Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependencies and bump MSRV to v1.70 #912

Merged
merged 6 commits into from
Feb 26, 2024

Conversation

jschwe
Copy link
Contributor

@jschwe jschwe commented Dec 27, 2023

Rust 1.70 was released on 2023-06-01, so it is half a year old by now. It is also the minimum version I got the updated dependencies to compile on.

Based on #870.

Closes #880
Closes #899

@jschwe
Copy link
Contributor Author

jschwe commented Jan 9, 2024

@emilio What do you think - would bumping the MSRV to 1.70 be acceptable now, given that it is half a year old?

boxdot and others added 6 commits February 24, 2024 12:16
This also removes the dependency on the unmaintained crate atty.

Closes mozilla#828
Disable default features (logging, async), since we don't need
them right now.
@jschwe
Copy link
Contributor Author

jschwe commented Feb 24, 2024

@emilio I picked up #870 and CI is passing. In this scope I bumped the MSRV to 1.70, which was released on 2023-06-01. This was required for the further dependency bump.

It would close issue #880

@emilio emilio merged commit ef086cb into mozilla:master Feb 26, 2024
2 checks passed
@jschwe jschwe deleted the jschwender/clap-up2 branch February 26, 2024 16:36
@ivoanjo
Copy link

ivoanjo commented Mar 4, 2024

Thanks for picking this up, especially the upgrade from clap 3 to 4. Would be awesome to have a release with this :)

@lgarron
Copy link

lgarron commented Apr 5, 2024

Thanks for picking this up, especially the upgrade from clap 3 to 4. Would be awesome to have a release with this :)

Indeed, this would be super appreciated!

For those of us who try to resolve vulnerability alerts on all our GitHub repositories, we're unfortunately stuck until cbindgen releases a new version. Even a pre-release would be nice for this.

@lgarron
Copy link

lgarron commented May 28, 2024

Thanks for picking this up, especially the upgrade from clap 3 to 4. Would be awesome to have a release with this :)

Indeed, this would be super appreciated!

For those of us who try to resolve vulnerability alerts on all our GitHub repositories, we're unfortunately stuck until cbindgen releases a new version. Even a pre-release would be nice for this.

@emilio Is there anything blocking a release with this in it? At this point, my use of cbindgen for a Rust project causes me to receive a weekly Depednabot email from GitHub highlighting the atty vulnerability. I don't want to lose track of the vuln alert, so I don't want to dismiss it. But it's just sitting there with a fix nearly available. 😢

If there's something I can do to help, I'd be glad to.

@emilio
Copy link
Collaborator

emilio commented May 28, 2024

Nothing particularly blocking other than the fact that I need to go through all the changes and prepare a changelog, which takes time I don't have right now... Any help with that is really appreciated, it should be a matter of making a PR to the CHANGES file and bumping the version :)

zshipko pushed a commit to extism/extism that referenced this pull request Aug 22, 2024
Updates the requirements on
[cbindgen](https://github.com/mozilla/cbindgen) to permit the latest
version.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/mozilla/cbindgen/blob/master/CHANGES">cbindgen's
changelog</a>.</em></p>
<blockquote>
<h1>0.27.0</h1>
<pre><code>  * Revert: The `Config` struct now has a private member.
* Allow users to specify a crate version for bindings generation
([#901](mozilla/cbindgen#901)).
* Update MSRV to 1.74
([#912](mozilla/cbindgen#912),
[#987](mozilla/cbindgen#987)).
* Support #[deprecated] on enum variants
([#933](mozilla/cbindgen#933)).
* Support integrating the package_version information in a header file
comment ([#939](mozilla/cbindgen#939)).
* Add a language backend
([#942](mozilla/cbindgen#942)).
* Support generics with defaulted args
([#959](mozilla/cbindgen#959)).
* Add `VaList` compatibility
([#970](mozilla/cbindgen#970)).
</code></pre>
<h1>0.26.0</h1>
<pre><code>  * Fix swapping of `&gt;&gt;=` and `&lt;&lt;=` in constants.
* Add support for #[deprecated]
([#860](mozilla/cbindgen#860)).
  * Built-in support for bitflags 2.0.
  * Support for &quot;C-unwind&quot; ABI.
* Generate bindings for non-public extern items if they are
#[no_mangle].
</code></pre>
<h2>0.25.0</h2>
<pre><code>  * Re-release of yanked 0.24.6 as a major release
  * Update MSRV to 1.57
* Support variadic arguments (`...`)
([#805](mozilla/cbindgen#805))
* Add --depfile option
([#820](mozilla/cbindgen#820))
  * Breaking changes: The `Config` struct now has a private member.
</code></pre>
<h2>0.24.6 (YANKED: depfile option was breaking, see <a
href="https://redirect.github.com/mozilla/cbindgen/issues/841">#841</a>)</h2>
<pre><code>  * Update MSRV to 1.57
* Support variadic arguments (`...`)
([#805](mozilla/cbindgen#805))
* Add --depfile option
([#820](mozilla/cbindgen#820))
</code></pre>
<h2>0.24.5</h2>
<pre><code>  * Don't enforce tempfile version.
</code></pre>
<h2>0.24.4</h2>
<pre><code> * Move expand infinite recursion fix
([#799](mozilla/cbindgen#799))
* Add with_cpp_compat to the builder
([#796](mozilla/cbindgen#796))
* Handle never type in return position consistently
([#780](mozilla/cbindgen#780))
* Fix warnings ([#816](mozilla/cbindgen#816),
[#819](mozilla/cbindgen#819))
* Updated documentation
([#788](mozilla/cbindgen#788),
[#791](mozilla/cbindgen#791),
[#792](mozilla/cbindgen#792),
[#810](mozilla/cbindgen#810),
[#823](mozilla/cbindgen#823))
</code></pre>
<h2>0.24.3</h2>
<pre><code> * Make struct expressions correctly generated through
typedefs ([#768](mozilla/cbindgen#768)).
</code></pre>
<h2>0.24.2</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mozilla/cbindgen/commit/58c6156b0d91e82abb03c26187b8d18fa4345ce0"><code>58c6156</code></a>
Bump MSRV again for clap.</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/103a8de0ac1ac311d54843acdfc10ee8c203a3ba"><code>103a8de</code></a>
Cargo update and version bump.</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/67cb560430cf91fecdd402cd1239d0a51baff634"><code>67cb560</code></a>
Update CHANGES since v0.26.0</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/316298182ebf508240c95ddf9943556b2fb546e1"><code>3162981</code></a>
Output condition for globals.</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/e469e44c0027f4ca039a4556f6062c0ba343a5b4"><code>e469e44</code></a>
Add missing parens to log message</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/3cbb637bbf16c7378ce4d6cb4b73e5d2d2bd33fa"><code>3cbb637</code></a>
Update cython expectations from the previous patch.</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/785e066e03b0e22a32c31e9adab78a18f6ce195b"><code>785e066</code></a>
Fix variadic arguments when used in function pointer</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/aa8ea654e156fd1b8e5b1b755c7b43fe4ea81331"><code>aa8ea65</code></a>
deps: Update syn to 2.0</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/9f632843b8b9dacbdc7a153868a4a9546e196e2e"><code>9f63284</code></a>
Generalize Item to expose documentation and generic params</li>
<li><a
href="https://github.com/mozilla/cbindgen/commit/1dda6162e53df57cb1769e9a6f942f6de839f50b"><code>1dda616</code></a>
Used documented method of specifying variadic arguments</li>
<li>Additional commits viewable in <a
href="https://github.com/mozilla/cbindgen/compare/0.26.0...v0.27.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
5 participants