chore(deps): bump uuid from 1.24.1 to 1.25.0 - #1458
Conversation
dependabot
Bot
added
dependencies
![revuto-review[bot]](https://avatars.githubusercontent.com/u/55848801?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is an auto review done by revuto.
This PR's lockfile change doesn't match what the PR announces.
Finding: The title, branch name (dependabot/cargo/uuid-1.25.0), and body (release notes for 1.25.0) describe a bump to 1.25.0, but Cargo.lock actually resolves uuid to 1.26.0 (Cargo.lock:3412, checksum b5772d71…).
Verification performed:
- The crates.io index gives uuid 1.25.0's checksum as
f053576934f05a761a402421fbbe3d425d9366f75f978806a037b3ca481abecc— so the written entry is definitively not 1.25.0. - CI at the head SHA passed on all three OSes plus
Dependency CheckandSecurity Audit, so 1.26.0 exists upstream and the lock isn't corrupt — it just isn't the version this PR says it is.
Why it happened: the workspace requirement is loose (uuid = { version = "1", features = ["v4"] } in the root Cargo.toml), so dependabot's lockfile regeneration floated to the newest 1.x (1.26.0) rather than pinning to the announced 1.25.0.
Why it matters: everything between 1.25.0 and 1.26.0 ships unreviewed under a PR whose linked release notes (and eventual merge record) describe only 1.25.0 — a false review trail for a dependency change in a repo that audits dependencies on every PR.
Suggested fix (either is fine):
- Land the announced version:
cargo update uuid --precise 1.25.0(writes 1.25.0 + thef0535769…checksum), or - Let dependabot recreate the PR as a proper 1.26.0 bump so the title/release notes match the bits being merged.
No other concerns: uuid is used only for Uuid::new_v4() in agnix-cli telemetry, stable across 1.x, and no repo baselines/locale/rule surfaces are touched by a lockfile-only change.
| [[package]] | ||
| name = "uuid" | ||
| version = "1.24.1" | ||
| version = "1.26.0" |
There was a problem hiding this comment.
This is an auto review done by revuto.
This lockfile entry is 1.26.0, but the PR announces 1.25.0 (title, branch dependabot/cargo/uuid-1.25.0, and the 1.25.0 release notes in the body).
Verified: the crates.io index lists uuid 1.25.0's checksum as f053576934f05a761a402421fbbe3d425d9366f75f978806a037b3ca481abecc, while this entry writes b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812 — a different version's checksum. Since the workspace requirement is a loose uuid = { version = "1" } (root Cargo.toml), the lockfile regeneration floated to the newest 1.x instead of the announced target.
CI at this SHA passed on all platforms, so 1.26.0 builds — but the entire 1.25.0→1.26.0 delta is unreviewed and undocumented in this PR, and the merge record would say "1.25.0".
Suggested fix: run cargo update uuid --precise 1.25.0 to land exactly what this PR promises, or have dependabot recreate the PR as a 1.26.0 bump with its own release notes.
976b78e to
616a3df
Compare
There was a problem hiding this comment.
This is an auto review done by revuto.
This PR's lockfile change doesn't match what the PR announces. The title, branch (dependabot/cargo/uuid-1.25.0), and description document a bump to uuid 1.25.0, but Cargo.lock actually pins 1.26.0 — a different, unannounced upgrade. A precise bump (cargo update -p uuid --precise 1.25.0) also would not touch any other package, yet this diff additionally re-resolves tempfile's getrandom edge from 0.4.2 down to 0.3.4. Details inline. Either regenerate the lockfile against 1.25.0, or retitle/recreate the PR for 1.26.0 with its release notes included so reviewers can evaluate the version that actually ships.
| [[package]] | ||
| name = "uuid" | ||
| version = "1.24.1" | ||
| version = "1.26.0" |
There was a problem hiding this comment.
This is an auto review done by revuto.
This entry is 1.26.0, but the PR announces 1.25.0 everywhere (title, branch dependabot/cargo/uuid-1.25.0, and the release notes in the description, which only cover up to 1.25.0). Anyone approving based on the 1.25.0 release notes is approving a different, unreviewed upgrade.
The workspace requirement is a loose caret (uuid = { version = "1", features = ["v4"] } in the root Cargo.toml:65), so this lockfile was clearly re-resolved broadly (cargo update -p uuid) rather than pinned precisely — that's also why the unrelated getrandom hunk below rides along.
Suggested fix: regenerate with cargo update -p uuid --precise 1.25.0 so the lockfile matches the announcement, or retitle/recreate the PR as a 1.26.0 bump and include 1.26.0's release notes in the description.
| dependencies = [ | ||
| "fastrand", | ||
| "getrandom 0.4.2", | ||
| "getrandom 0.3.4", |
There was a problem hiding this comment.
This is an auto review done by revuto.
Out-of-scope churn: this hunk changes tempfile 3.27.0's resolved getrandom dependency from 0.4.2 (base) to 0.3.4, which has nothing to do with the announced uuid bump. A precise cargo update -p uuid --precise <ver> leaves this edge untouched. This corroborates that the lockfile was wholesale re-resolved; it should be reverted along with regenerating the uuid entry so the diff contains only the announced change.
Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.24.1 to 1.25.0. - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.1...1.25.0) --- updated-dependencies: - dependency-name: uuid dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
616a3df to
7101897
Compare
There was a problem hiding this comment.
This is an auto review done by revuto.
This PR's lockfile change doesn't match what the PR announces, in two ways — both still present at the head commit 7101897:
-
Version mismatch (HIGH): the title, branch name (
dependabot/cargo/uuid-1.25.0), body, and the commit message all say "bump uuid from 1.24.1 to 1.25.0", but the actual change pins 1.26.0 (Cargo.lock:3388).uuidis a direct workspace dependency (uuid = { version = "1", features = ["v4"] }in the rootCargo.toml), so this compiles, but merging records a commit whose message permanently misdescribes its content and jumps an extra minor release beyond what reviewers sign off on. Either retitle/amend to 1.26.0 or recreate the branch at the announced 1.25.0. -
Out-of-scope churn (MEDIUM): the second hunk downgrades tempfile 3.27.0's resolved
getrandomedge from0.4.2to0.3.4(Cargo.lock:2917). The base lock already contained bothgetrandom 0.3.4and0.4.2package entries, so this is a pure re-resolution change unrelated to the uuid bump — it silently swaps which entropy implementation tempfile uses on all platforms. If unintentional (e.g., acargo updatewith a different resolver), it should be reverted out of this PR; if intentional, it needs its own PR and explanation.
Neither issue was addressed by the two earlier reviews; the head commit still contains both.
| [[package]] | ||
| name = "uuid" | ||
| version = "1.24.1" | ||
| version = "1.26.0" |
There was a problem hiding this comment.
This is an auto review done by revuto.
This entry is 1.26.0, but the PR announces 1.25.0 everywhere — title, branch dependabot/cargo/uuid-1.25.0, description, and the commit message itself (chore(deps): bump uuid from 1.24.1 to 1.25.0, sha 7101897). The workspace requirement uuid = { version = "1", ... } accepts it so CI passes, but merging records a commit whose message misdescribes the change and ships a minor release beyond what the PR says was reviewed. Please either update the title/commit message to 1.26.0 or recreate the branch pinning the announced 1.25.0.
| dependencies = [ | ||
| "fastrand", | ||
| "getrandom 0.4.2", | ||
| "getrandom 0.3.4", |
There was a problem hiding this comment.
This is an auto review done by revuto.
Out-of-scope churn: this hunk changes tempfile 3.27.0's resolved getrandom dependency from 0.4.2 (base) to 0.3.4, which has nothing to do with the uuid bump. The base lockfile already contained both getrandom 0.3.4 (line 1008) and getrandom 0.4.2 (line 1022) as package entries — only tempfile's resolution edge moved, i.e. the lockfile was re-resolved rather than minimally bumped. This silently swaps the entropy implementation tempfile uses. It should be split out (or reverted) so this PR contains only the announced uuid change.
|
Superseded by #1469, which merged this update on current main after local tests, full CI, exact-head Revuto review, and zero unresolved threads. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps uuid from 1.24.1 to 1.25.0.
Release notes
Sourced from uuid's releases.
Commits
302e0bfMerge pull request #903 from uuid-rs/cargo/1.25.0b7ccde8prepare for 1.25.0 releasec62dffbMerge pull request #902 from ChrisJr404/serde-bytes-module8c198b2Add a serde::bytes module that encodes as a byte string