build: bump melior from 0.26.4 to 0.26.7

[dependabot]

Bumps melior from 0.26.4 to 0.26.7.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	melior@​0.26.4 ⏵ 0.26.7

View full report

[nebasuke]

@hedgar2017 This one is more for you to review as it seems high impact. Not sure if we should do this bump, as it seems quite high impact. (It's still blocked on cooldown at the moment regardless, so no rush.)

[hedgar2017]

@hedgar2017 This one is more for you to review as it seems high impact. Not sure if we should do this bump, as it seems quite high impact. (It's still blocked on cooldown at the moment regardless, so no rush.)

Thanks! We should be targeting the latest melior, as it is apparently missing a couple of minor features and I'll probably contribute there or fork it eventually.

MLIR crates are gated with a feature and not present in non-MLIR builds that we ship in releases.

@nebasuke what happens if I merge it now and override the cooldown?

[nebasuke]

I'd say we should not do normal exceptions for cooldown, unless it's a security risk and you've spent some time vetting the upgrade (which is not really the scope of this upgrade).

Regardless, might be worth waiting a bit as melior is having quite a few releases at the moment including even newer ones, see https://crates.io/crates/melior/versions.

[hedgar2017]

@nebasuke in fact, we have to switch to main (or some kind of dev or forked branch) of melior and slang-solidity, so the solx integration can move along with its MLIR and Slang counterparts. It's the same process we have had with inkwell and llvm-sys.rs crates.
If you have another process in mind, please elaborate. Otherwise I'll start vetting melior, and AFAIU you're doing this for slang-solidity now so it must be fine too.

[dependabot]

Superseded by #306.