chore(deps): update cranelift-isle requirement from 0.132 to 0.134 in /fuzz - #318
Merged
temper-pulseengine[bot] merged 1 commit intoAug 11, 2026
Merged
Conversation
Updates the requirements on [cranelift-isle](https://github.com/bytecodealliance/wasmtime) to permit the latest version. - [Release notes](https://github.com/bytecodealliance/wasmtime/releases) - [Changelog](https://github.com/bytecodealliance/wasmtime/blob/main/RELEASES.md) - [Commits](https://github.com/bytecodealliance/wasmtime/commits) --- updated-dependencies: - dependency-name: cranelift-isle dependency-version: 0.134.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
temper-pulseengine
Bot
deleted the
dependabot/cargo/fuzz/cranelift-isle-0.134
branch
August 11, 2026 20:42
avrabe
added a commit
that referenced
this pull request
Aug 12, 2026
…just root (#319) Third re-float of the cranelift-isle pin (#298, #310, now #318). The previous fix added a dependabot `ignore` for cranelift-isle, but scoped it to the root cargo ecosystem only. #318 was titled "update cranelift-isle requirement in /fuzz" and widened the ROOT workspace constraint to 0.134 anyway — the bot came in through one of the four doors that were still open: / ignore=[cranelift-isle] /fuzz ignore=NONE <- used this one /loom-cli ignore=NONE /loom-core ignore=NONE /loom-isle ignore=NONE A partial mechanical guard is a guard that has not been tested against the thing it guards. Adding the entry to every cargo ecosystem, and re-pinning the root constraint that #318 widened. This is the same lesson the release gate in v1.3.0 carries, applied to my own previous fix: the invariant has to be enforced everywhere it can be violated, not everywhere I happened to look. Refs #142, #304, #311
This was referenced Aug 12, 2026
avrabe
added a commit
that referenced
this pull request
Aug 13, 2026
#321) loom ships binaries, so the lock belongs in the repository: the build becomes reproducible and dependency changes arrive as reviewable diffs instead of as ambient resolution at CI time. Four red-main incidents this cycle were caused by resolution rather than by any code change — rand 0.9->0.10, nightly fuzz deps, an auto-merged ordeal bump that flipped a pin test, and cranelift-isle re-floated THREE times (#298, #310, #318) past a comment in Cargo.toml explaining exactly why not to. The third one came through a different dependabot ecosystem than the ignore meant to stop it. Per-pin ignores are whack-a-mole against an automated player; the lock is the mechanism. This does not freeze upgrades, it gates them: the same bumps now arrive as PRs whose CI must be green before they land. Also corrects a mis-citation of mine. Comments in Cargo.toml and dependabot.yml pointed at "#142" as the lockfile issue. #142 is "Restore release-binary uploads + adopt unified release artifact standard", it is closed, and it does not mention the lockfile at all — so those pointers read as "already handled" when no such work existed. They now point at #320. Verified: lock resolves cranelift-isle 0.132.3 (inside the pin) and `cargo check --locked` builds. Closes #320
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on cranelift-isle to permit the latest version.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)