[TheHypnoo]

Summary

Phase 2 of the dependency cleanup: move every locked package to its newest semver-compatible version that satisfies the 7-day publish-age window. Lockfile only; no manifest requirement changes.

Changes

• Cargo.lock: 174 packages updated, 9 added and 2 removed as a consequence of the new versions (for example borsh, pulp, raw-cpuid).
• 61 of the 235 candidates stay at the newest version the soak window allows; their latest releases are under 7 days old.
• Done with cargo update -p <pkg>@<version> per package, because a full cargo update currently fails: perry-perex requires perex ^0.1.14, which is still inside the window (the lock already pins it, so builds are unaffected).
• Duplicated package names: 116 → 117 (system-deps gains a second version). Compatible updates do not unify major versions; that is the next phases (RustCrypto, windows, swc_*, LLVM, GTK4).

Related issue

n/a

Conflict-resolution validation (2026-10-25)

• Synchronized with pinned main667a8fc4 in commit835f233f through a normal history-preserving push; GitHub reports MERGEABLE.
• Preserved main's GTK migration and webpki-roots1.0.10 rather than reintroducing the older PR pin; no manifest requirement was changed.
• Independent static verification covers1010 package identities,3262 uniquely resolved/reachable references and483 direct consumer requirements; the downgrade gate passed3022 comparisons.
• Full offline Cargo metadata remains UNAVAILABLE because gdk-pixbuf0.22.0 is uncached. No fresh build, platform or CI success is claimed for this integration.
• The original test plan below is historical evidence, not a rerun on835f233f. Current native review and hosted CI remain separate.

Test plan

• Rebased on main after chore: repository cleanup, lean AGENTS.md and single version source #13193 and chore(deps): remove unused dependencies #13194 landed; the update set is identical to the one verified below.
• cargo metadata --locked and cargo check --locked --workspace --all-targets (cross-host UI crates excluded on macOS)
• cargo build --locked --release -p perry -p perry-runtime-static -p perry-stdlib-static
• RUST_TEST_THREADS=1 cargo test --release -p perry-runtime on the rebased branch: 5881 passed, 0 failed
• Workspace tests excluding perry-runtime were run locally; the perry integration suites fail when all run concurrently on one machine, and the sampled failures (addr_class_handle_bands, array_birth_layout_in_closure, array_record_released_after_exit) pass in isolation with both lockfiles. CI's full tier is the authoritative run.

Checklist

• I have NOT bumped the workspace version or edited CHANGELOG.md (maintainer handles these at merge)

Summary by CodeRabbit

• Chores
  • Updated 174 locked dependencies to newer compatible versions that meet the 7-day publish-age window. Dependency requirements remain unchanged.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b2eb6d1e-0ef9-4e0e-adf7-bb78606089f9

Commits

Reviewing files that changed from the base of the PR and between 315f8d8 and 835f233.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9a6402be-fd92-414e-a45c-92bbbaa40f98

Commits

Reviewing files that changed from the base of the PR and between ed36b4a and 315f8d8.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 1

• changelog.d/13198-compatible-dependency-updates.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.

Walkthrough

The changelog records updates to 174 locked dependencies that meet the stated semver-compatibility and publish-age constraints. Manifest requirements remain unchanged.

Changes: Compatible dependency update

Layer / File(s)	Summary
Dependency update record changelog.d/13198-compatible-dependency-updates.md	The changelog records updates to 174 locked dependencies within the stated constraints. Manifest requirements remain unchanged.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: Minimal · up to 315f8

No actionable merge-blocking risk is identified in this dependency update record.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: applying semver-compatible dependency updates.
Description check		The description includes the required Summary, Changes, Related issue, Test plan, and Checklist sections. It gives specific scope, constraints, validation commands, test results, and known test limita…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required Summary, Changes, Related issue, Test plan, and Checklist sections. It gives specific scope, constraints, validation commands, test results, and known test limitations. The optional Screenshots section is not needed for this lockfile-only change.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches: 💡 2

⚔️ Resolve merge conflicts: 💡

• Resolve merge conflict in branch chore/deps-compatible-updates

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}