From 9c90044c05f2031285897f6cb6e615b7b610be0c Mon Sep 17 00:00:00 2001 From: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> Date: Thu, 23 Jul 2026 16:26:21 +0800 Subject: [PATCH 1/2] chore(deps): resync Cargo.lock with Cargo.toml and lock it in CI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two lockfile-only dependabot bumps (#139, #140) raised resvg to 0.47.0 and sha2 to 0.11.0 in Cargo.lock without touching Cargo.toml, which asks for `resvg = "0.45"` and `sha2 = "0.10"`. Under cargo's 0.x rules the minor version is the major, so neither requirement accepts the locked version and the lockfile has been self-contradictory ever since: $ cargo metadata --locked error: cannot update the lock file ... because --locked was passed Nothing failed loudly — CI never passed `--locked` — so the cost landed on contributors instead: every local cargo invocation rewrote the lock, leaving a permanently dirty working tree to discard before each commit. Resyncing drops the duplicates too. gpui-component already pulls resvg 0.45.1, so the tree no longer builds two copies each of resvg, usvg, tiny-skia, tiny-skia-path, kurbo, svgtypes, roxmltree, imagesize and polycool. CI now builds and tests with `--locked` so the next such drift fails in the PR rather than in a working tree. The release and nightly workflows keep their unlocked builds on purpose: both stamp Cargo.toml's version and depend on cargo refreshing the lock's root entry. --- .github/workflows/ci.yml | 11 ++- Cargo.lock | 140 +++++---------------------------------- 2 files changed, 25 insertions(+), 126 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5b233d0d..30471f36 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -62,8 +62,15 @@ jobs: - uses: Swatinem/rust-cache@v2 + # `--locked` on the build so a Cargo.lock that disagrees with Cargo.toml + # fails here instead of being silently rewritten. Without it the drift is + # invisible to CI and lands on contributors instead: every local `cargo` + # run rewrites the lock, leaving a permanently dirty working tree that has + # to be re-discarded before every commit. Deliberately not applied to the + # release/nightly workflows — those stamp Cargo.toml's version and rely on + # cargo refreshing the lock's own root entry. - name: Build - run: cargo build --target ${{ matrix.target }} + run: cargo build --locked --target ${{ matrix.target }} - name: Test - run: cargo test --target ${{ matrix.target }} + run: cargo test --locked --target ${{ matrix.target }} diff --git a/Cargo.lock b/Cargo.lock index df99a38b..69c3f731 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2500,7 +2500,7 @@ version = "0.5.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bbc773e24e02d4ddd8395fd30dc147524273a83e54e0f312d986ea30de5f5646" dependencies = [ - "roxmltree 0.20.0", + "roxmltree", ] [[package]] @@ -3151,7 +3151,7 @@ dependencies = [ "raw-window-handle", "refineable", "regex", - "resvg 0.45.1", + "resvg", "scheduler", "schemars", "seahash", @@ -3167,7 +3167,7 @@ dependencies = [ "thiserror 2.0.18", "ttf-parser", "url", - "usvg 0.45.1", + "usvg", "util_macros", "uuid", "waker-fn", @@ -3209,7 +3209,7 @@ dependencies = [ "paste", "raw-window-handle", "regex", - "resvg 0.45.1", + "resvg", "ropey", "rust-i18n", "schemars", @@ -4056,12 +4056,6 @@ version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "edcd27d72f2f071c64249075f42e205ff93c9a4c5f6c6da53e79ed9f9832c285" -[[package]] -name = "imagesize" -version = "0.14.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09e54e57b4c48b40f7aec75635392b12b3421fa26fe8b4332e63138ed278459c" - [[package]] name = "imgref" version = "1.12.2" @@ -4494,18 +4488,6 @@ dependencies = [ "smallvec", ] -[[package]] -name = "kurbo" -version = "0.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b60dfc32f652b926df6192e55525b16d186c69d47876c3ead4da5cc9f8450e2" -dependencies = [ - "arrayvec", - "euclid", - "polycool", - "smallvec", -] - [[package]] name = "kv-log-macro" version = "1.0.7" @@ -6307,15 +6289,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "polycool" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "50596ddc09eb5ad5f75cacd40209568e66df71baf86e1499a0e99c4cff12a5a6" -dependencies = [ - "arrayvec", -] - [[package]] name = "polyval" version = "0.7.2" @@ -7084,26 +7057,12 @@ dependencies = [ "log", "pico-args", "rgb", - "svgtypes 0.15.3", - "tiny-skia 0.11.4", - "usvg 0.45.1", + "svgtypes", + "tiny-skia", + "usvg", "zune-jpeg 0.4.21", ] -[[package]] -name = "resvg" -version = "0.47.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9be183ad6a216aa96f33e4c8033b0988b8b3ea6fd2359d19af5bac4643fd8e81" -dependencies = [ - "log", - "pico-args", - "rgb", - "svgtypes 0.16.1", - "tiny-skia 0.12.0", - "usvg 0.47.0", -] - [[package]] name = "rfc6979" version = "0.6.0" @@ -7158,15 +7117,6 @@ version = "0.20.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97" -[[package]] -name = "roxmltree" -version = "0.21.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1964b10c76125c36f8afe190065a4bf9a87bf324842c05701330bba9f1cacbb" -dependencies = [ - "memchr", -] - [[package]] name = "rsa" version = "0.10.0-rc.18" @@ -8512,17 +8462,7 @@ version = "0.15.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "68c7541fff44b35860c1a7a47a7cadf3e4a304c457b58f9870d9706ece028afc" dependencies = [ - "kurbo 0.11.3", - "siphasher", -] - -[[package]] -name = "svgtypes" -version = "0.16.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "695b5790b3131dafa99b3bbfd25a216edb3d216dad9ca208d4657bfb8f2abc3d" -dependencies = [ - "kurbo 0.13.1", + "kurbo", "siphasher", ] @@ -8859,22 +8799,7 @@ dependencies = [ "cfg-if", "log", "png 0.17.16", - "tiny-skia-path 0.11.4", -] - -[[package]] -name = "tiny-skia" -version = "0.12.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47ffee5eaaf5527f630fb0e356b90ebdec84d5d18d937c5e440350f88c5a91ea" -dependencies = [ - "arrayref", - "arrayvec", - "bytemuck", - "cfg-if", - "log", - "png 0.18.1", - "tiny-skia-path 0.12.0", + "tiny-skia-path", ] [[package]] @@ -8888,17 +8813,6 @@ dependencies = [ "strict-num", ] -[[package]] -name = "tiny-skia-path" -version = "0.12.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "edca365c3faccca67d06593c5980fa6c57687de727a03131735bb85f01fdeeb9" -dependencies = [ - "arrayref", - "bytemuck", - "strict-num", -] - [[package]] name = "tinystr" version = "0.8.3" @@ -9292,13 +9206,13 @@ dependencies = [ "portable-pty", "regex", "reqwest_client", - "resvg 0.47.0", + "resvg", "russh", "russh-sftp", "serde", "serde_json", "serde_yaml", - "sha2 0.11.0", + "sha2 0.10.9", "smallvec", "smol", "tokio", @@ -9465,45 +9379,23 @@ dependencies = [ "data-url", "flate2", "fontdb", - "imagesize 0.13.0", - "kurbo 0.11.3", + "imagesize", + "kurbo", "log", "pico-args", - "roxmltree 0.20.0", + "roxmltree", "rustybuzz", "simplecss", "siphasher", "strict-num", - "svgtypes 0.15.3", - "tiny-skia-path 0.11.4", + "svgtypes", + "tiny-skia-path", "unicode-bidi", "unicode-script", "unicode-vo", "xmlwriter", ] -[[package]] -name = "usvg" -version = "0.47.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d46cf96c5f498d36b7a9693bc6a7075c0bb9303189d61b2249b0dc3d309c07de" -dependencies = [ - "base64", - "data-url", - "flate2", - "imagesize 0.14.0", - "kurbo 0.13.1", - "log", - "pico-args", - "roxmltree 0.21.1", - "simplecss", - "siphasher", - "strict-num", - "svgtypes 0.16.1", - "tiny-skia-path 0.12.0", - "xmlwriter", -] - [[package]] name = "utf-8" version = "0.7.6" From a42ed82a140b00029a1d1b3a3d209e260b67a9c1 Mon Sep 17 00:00:00 2001 From: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com> Date: Thu, 23 Jul 2026 17:03:44 +0800 Subject: [PATCH 2/2] ci(release): build the tagged commit with --locked too MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release workflow is a plain checkout of the tag — nothing rewrites Cargo.toml there, so the lockfile guard the CI build just gained applies just as well, and a release is the build you least want silently re-resolving dependencies. Only nightly stays unlocked: it stamps Cargo.toml's version, which makes the lock's own root entry stale by design. --- .github/workflows/ci.yml | 6 +++--- .github/workflows/release.yml | 6 +++++- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 30471f36..282b59c0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -66,9 +66,9 @@ jobs: # fails here instead of being silently rewritten. Without it the drift is # invisible to CI and lands on contributors instead: every local `cargo` # run rewrites the lock, leaving a permanently dirty working tree that has - # to be re-discarded before every commit. Deliberately not applied to the - # release/nightly workflows — those stamp Cargo.toml's version and rely on - # cargo refreshing the lock's own root entry. + # to be re-discarded before every commit. The release workflow locks its + # build too; only nightly stays unlocked, because it stamps Cargo.toml's + # version and relies on cargo refreshing the lock's own root entry. - name: Build run: cargo build --locked --target ${{ matrix.target }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eaf1657e..82c1a8bc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,9 +62,13 @@ jobs: with: workspaces: tty7 + # `--locked` because a release must ship the dependency set the tag + # recorded, not whatever cargo would re-resolve at build time. Safe here + # (unlike nightly) precisely because nothing rewrites Cargo.toml: this is + # a plain checkout of the tagged commit. - name: Build working-directory: tty7 - run: cargo build --release --target ${{ matrix.target }} + run: cargo build --release --locked --target ${{ matrix.target }} # ---- Packaging: one step per OS ---------------------------------------- # macOS gets a signed + notarized drag-to-Applications DMG. Windows gets