deps: arrow/parquet 59.3.0 and six minor bumps, with the SBOM regenerated - #82
Merged
Conversation
Supersedes the Dependabot PRs #49 (arrow-parquet group) and #51 (rust-minor-and-patch group), which have been red for a week for a reason Dependabot cannot fix: `sbom.cdx.json` and `THIRD_PARTY_LICENSES.md` are tracked and pin exact dependency versions, and CI runs `gen_sbom.py --check` and `gen_third_party_licenses.py --check`. Any lock bump therefore fails that job until both are regenerated, which is a step Dependabot does not take. Landing the bumps by hand with the regeneration included is what actually goes green. Lock only; no manifest constraint changed, so every one of these is semver-compatible with what `Cargo.toml` already asks for: arrow, parquet 59.0.0 -> 59.3.0 (and the fifteen arrow-* crates) anyhow 1.0.103 -> 1.0.104 blake3 1.8.5 -> 1.8.7 clap 4.6.1 -> 4.6.6 serde_json 1.0.150 -> 1.0.151 thiserror 2.0.18 -> 2.0.20 base64 0.22.1 -> 0.23.1 (transitive, pulled by the arrow update) serde stayed at 1.0.228: 1.0.229 does not resolve under the current graph, so Dependabot's proposed bump for it is not applied here. mzdata is deliberately untouched. #52 moves it 0.65.5 -> 0.66.6, which is a BREAKING change for a 0.x crate and a manifest edit, in the library that parses mzML. It gets its own branch and a conversion-output comparison rather than riding along with a lock refresh. Validated: `cargo fmt --check`, `clippy --all-targets --locked -D warnings`, `cargo test --workspace --locked` (284), `cargo audit` clean, and both generators `--check` clean after regeneration. The SBOM goes from 175 to 174 components (arrayref dropped by the blake3 update). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
# Conflicts: # THIRD_PARTY_LICENSES.md # sbom.cdx.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #49 (arrow-parquet group) and #51 (rust-minor-and-patch group).
Why those two have been red for a week
Not a conflict — both still report
MERGEABLE.sbom.cdx.jsonandTHIRD_PARTY_LICENSES.mdare tracked and pin exact dependency versions, and CI runsgen_sbom.py --checkandgen_third_party_licenses.py --checkin the "python sidecars + configs" job. Any lock bump fails that job until both are regenerated, and regenerating them is a step Dependabot does not take. So those PRs could never go green on their own.What is in this one
Lock only. No manifest constraint changed, so every bump is semver-compatible with what
Cargo.tomlalready asks for:arrow-*)serde stays at 1.0.228. Dependabot proposed 1.0.229; it does not resolve under the current graph, so it is not applied here.
mzdata is deliberately not in this PR. #52 moves it 0.65.5 → 0.66.6, which is a breaking change for a 0.x crate, a manifest edit, and in the library that parses mzML. It gets its own PR with a conversion-output comparison.
Validation
cargo fmt --check,clippy --all-targets --locked -D warnings,cargo test --workspace --locked(284),cargo auditclean, and both generators--checkclean after regeneration. SBOM 175 → 174 components (arrayrefdropped by the blake3 update).Suggested follow-up
This will recur on every Dependabot run. Worth deciding whether CI should regenerate these two files rather than only check them, or whether Dependabot should be pointed at a job that does. Happy to implement whichever you prefer.
🤖 Generated with Claude Code