chore(deps): bump the cargo-dependencies group across 1 directory with 5 updates

Bumps the cargo-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [log](https://github.com/rust-lang/log) | `0.4.34` | `0.4.35` | | [zip](https://github.com/zip-rs/zip2) | `9.1.3` | `9.5.0` | | [rfd](https://github.com/PolyMeilex/rfd) | `0.17.2` | `0.18.0` | | [zbus](https://github.com/z-galaxy/zbus) | `5.19.0` | `6.2.1` | | [toml](https://github.com/toml-rs/toml) | `1.1.8+spec-1.1.0` | `1.2.0+spec-1.1.0` | Updates `log` from 0.4.34 to 0.4.35 - [Release notes](https://github.com/rust-lang/log/releases) - [Changelog](https://github.com/rust-lang/log/blob/main/CHANGELOG.md) - [Commits](https://github.com/rust-lang/log/compare/0.4.34...v0.4.35) Updates `zip` from 9.1.3 to 9.5.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v9.1.3...v9.5.0) Updates `rfd` from 0.17.2 to 0.18.0 - [Release notes](https://github.com/PolyMeilex/rfd/releases) - [Changelog](https://github.com/PolyMeilex/rfd/blob/master/CHANGELOG.md) - [Commits](https://github.com/PolyMeilex/rfd/compare/0.17.2...0.18.0) Updates `zbus` from 5.19.0 to 6.2.1 - [Release notes](https://github.com/z-galaxy/zbus/releases) - [Changelog](https://github.com/z-galaxy/zbus/blob/main/release-plz.toml) - [Commits](https://github.com/z-galaxy/zbus/compare/zbus-5.19.0...zbus-6.2.1) Updates `toml` from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0 - [Commits](https://github.com/toml-rs/toml/compare/toml-v1.1.8...toml-v1.2.0) --- updated-dependencies: - dependency-name: log dependency-version: 0.4.35 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-dependencies - dependency-name: zip dependency-version: 9.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: rfd dependency-version: 0.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies - dependency-name: zbus dependency-version: 6.2.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo-dependencies - dependency-name: toml dependency-version: 1.2.0+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
2026-11-13 01:17:30 -06:00 · 2026-11-12 11:08:18 +00:00
8 changed files with 159 additions and 106 deletions
@@ -1,32 +0,0 @@
-# This file is machine-generated by `gh actions-lock`.
-# Do not edit by hand; run `gh actions-lock` to update.
-# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.3'
-workflows:
-    '.github/workflows/ast-grep.yml': []
-    '.github/workflows/ci.yml': []
-    '.github/workflows/freebsd.yml': []
-    '.github/workflows/house-rules.yml': []
-    '.github/workflows/lockfile.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/nix.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/packaging-lint.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'step-security/harden-runner@v2.22.4'
-    '.github/workflows/release.yml': []
-    '.github/workflows/sonarcloud.yml': []
-    '.github/workflows/windows-arm64.yml': []
-dependencies:
-    'actions/checkout@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
-        owner_id: 44036562
-        repo_id: 197814629
-    'step-security/harden-runner@v2.22.4':
-        ref: 'v2.22.4'
-        commit: 'sha1-1d88384fd173af6ecb012dfd0264a306b711241a'
-        owner_id: 88700172
-        repo_id: 422287306
@@ -1,34 +0,0 @@
-name: Lockfile
-
-# Fails when .github/workflows/actions.lock is out of sync with the workflows, or when a locked pin
-# no longer verifies upstream, so a moved tag cannot slip a different commit into a run.
-# Docs: https://gh.io/actions-lockfile
-on:
-  pull_request:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  lockfile:
-    name: Lockfile is in sync
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-actions-lock
-        run: gh extension install github/gh-actions-lock --pin v0.4.1
-      - name: Verify the lockfile
-        run: gh actions-lock --verify
@@ -28,10 +28,10 @@ jobs:
    timeout-minutes: 5
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Git dependencies come from storytold
        run: |
          set -euo pipefail
@@ -28,10 +28,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.4
+        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install the pinned packaging toolchain
@@ -78,7 +78,7 @@ dependencies = [
 "futures-lite",
 "futures-util",
 "serde",
- "zbus",
+ "zbus 5.19.0",
 ]

 [[package]]
@@ -473,7 +473,7 @@ dependencies = [
 "enumflags2",
 "serde",
 "static_assertions",
- "zbus",
+ "zbus 5.19.0",
 "zbus-lockstep",
 "zbus-lockstep-macros",
 "zbus_names",
@@ -488,7 +488,7 @@ checksum = "2230e48787ed3eb4088996eab66a32ca20c0b67bbd4fd6cdfe79f04f1f04c9fc"
 dependencies = [
 "atspi-common",
 "serde",
- "zbus",
+ "zbus 5.19.0",
 ]

 [[package]]
@@ -938,6 +938,15 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "constant_time_eq"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eb6feb175df65d0a3ccd3e73484e940d0ac664e8034f0519fd49a93db3071d9"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -1368,7 +1377,7 @@ dependencies = [
 "objc2-foundation 0.3.2",
 "parking_lot",
 "percent-encoding",
- "pollster 1.0.1",
+ "pollster",
 "profiling",
 "raw-window-handle",
 "send_wrapper",
@@ -1484,7 +1493,7 @@ dependencies = [
 "kittest",
 "log",
 "open",
- "pollster 1.0.1",
+ "pollster",
 "serde",
 "tempfile",
 "toml",
@@ -2620,9 +2629,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.34"
+version = "0.4.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+checksum = "5d15f86d12da44cd8d4ec3c73984537eb7f4cadcb9776a575a0a8a05ca11005c"

 [[package]]
 name = "mach2"
@@ -2680,6 +2689,17 @@ dependencies = [
 "simd-adler32",
 ]

+[[package]]
+name = "mio"
+version = "1.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "moxcms"
 version = "0.8.1"
@@ -2933,6 +2953,7 @@ dependencies = [
 "objc2-core-foundation",
 "objc2-core-graphics",
 "objc2-foundation 0.3.2",
+ "objc2-uniform-type-identifiers 0.3.2",
 ]

 [[package]]
@@ -3203,7 +3224,7 @@ dependencies = [
 "objc2-link-presentation",
 "objc2-quartz-core 0.2.2",
 "objc2-symbols",
- "objc2-uniform-type-identifiers",
+ "objc2-uniform-type-identifiers 0.2.2",
 "objc2-user-notifications",
 ]

@@ -3230,6 +3251,16 @@ dependencies = [
 "objc2-foundation 0.2.2",
 ]

+[[package]]
+name = "objc2-uniform-type-identifiers"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7902ac02859fc1f7045f8b598c63f1ae0cc7efeaa06a9bc9f3d9a3c955974fa4"
+dependencies = [
+ "objc2 0.6.5",
+ "objc2-foundation 0.3.2",
+]
+
 [[package]]
 name = "objc2-user-notifications"
 version = "0.2.2"
@@ -3501,12 +3532,6 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

-[[package]]
-name = "pollster"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
-
 [[package]]
 name = "pollster"
 version = "1.0.1"
@@ -3840,9 +3865,9 @@ checksum = "19b30a45b0cd0bcca8037f3d0dc3421eaf95327a17cad11964fb8179b4fc4832"

 [[package]]
 name = "rfd"
-version = "0.17.2"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20dafead71c16a34e1ff357ddefc8afc11e7d51d6d2b9fbd07eaa48e3e540220"
+checksum = "c4b9d4857b10297ffb0f64cae711e983a7aeaee561848d56d429d3858bd8ed93"
 dependencies = [
 "block2 0.6.2",
 "dispatch2",
@@ -3853,8 +3878,9 @@ dependencies = [
 "objc2-app-kit 0.3.2",
 "objc2-core-foundation",
 "objc2-foundation 0.3.2",
+ "objc2-uniform-type-identifiers 0.3.2",
 "percent-encoding",
- "pollster 0.4.0",
+ "pollster",
 "raw-window-handle",
 "wasm-bindgen",
 "wasm-bindgen-futures",
@@ -4351,6 +4377,16 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "soundcraft"
 version = "0.20.1"
@@ -4553,7 +4589,7 @@ dependencies = [
 "soundcraft-vst3-host",
 "toml",
 "web-time",
- "zbus",
+ "zbus 6.2.1",
 ]

 [[package]]
@@ -5049,14 +5085,21 @@ version = "1.54.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
 dependencies = [
+ "bytes",
+ "libc",
+ "mio",
 "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
 ]

 [[package]]
 name = "toml"
-version = "1.1.8+spec-1.1.0"
+version = "1.2.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
+checksum = "c5ffcdf8f50436dbbfd675c1fe1b8e0854f42b7defea8584bdebe1aee900e561"
 dependencies = [
 "indexmap",
 "serde_core",
@@ -5099,9 +5142,9 @@ dependencies = [

 [[package]]
 name = "toml_writer"
-version = "1.1.3+spec-1.1.0"
+version = "1.2.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
+checksum = "009dbb7700f11c55ef83aebbe4c0e9cf1f1ac0844bd8d6f00dc38f302026e13a"

 [[package]]
 name = "tracing"
@@ -6292,11 +6335,40 @@ dependencies = [
 "uuid",
 "windows-sys 0.61.2",
 "winnow",
- "zbus_macros",
+ "zbus_macros 5.19.0",
 "zbus_names",
 "zvariant",
 ]

+[[package]]
+name = "zbus"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ddb2961d9587ef9f24ad14cde1c3bc4c5edc9f1525932a8cffdd5bd98886eb9"
+dependencies = [
+ "async-trait",
+ "bitflags 2.13.2",
+ "endi",
+ "futures-core",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix 1.1.5",
+ "serde",
+ "serde_repr",
+ "socket2",
+ "tokio",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow",
+ "zbus_macros 6.2.1",
+ "zbus_utils",
+ "zcheapstr",
+ "zruntime",
+]
+
 [[package]]
 name = "zbus-lockstep"
 version = "0.5.2"
@@ -6336,6 +6408,18 @@ dependencies = [
 "zvariant_utils",
 ]

+[[package]]
+name = "zbus_macros"
+version = "6.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "083b38add47c340fc12ec560124fb1d9c23acb584f7021099f85ec6587a03c54"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.9",
+ "zbus_utils",
+]
+
 [[package]]
 name = "zbus_names"
 version = "4.3.5"
@@ -6347,6 +6431,19 @@ dependencies = [
 "zvariant",
 ]

+[[package]]
+name = "zbus_utils"
+version = "6.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af55e52da295311b368c45bcae221f020e28e97a2420360170ce389218e76ec7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 3.0.9",
+ "winnow",
+]
+
 [[package]]
 name = "zbus_xml"
 version = "5.2.1"
@@ -6414,6 +6511,20 @@ name = "zeroize"
 version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]

 [[package]]
 name = "zerotrie"
@@ -6454,18 +6565,21 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "9.1.3"
+version = "9.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
+checksum = "e3476fd497ac8af5b1ec7b51acab7bef380f7e8dd8e0487595bafd839417a302"
 dependencies = [
+ "constant_time_eq",
 "crc32fast",
 "flate2",
 "getrandom 0.4.3",
 "indexmap",
+ "libc",
 "memchr",
 "nix",
 "typed-path",
 "windows-sys 0.61.2",
+ "zeroize",
 ]

 [[package]]
@@ -6480,6 +6594,20 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

+[[package]]
+name = "zruntime"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ef5ed7d628cdf0af82f93dfe03330a8e37383bf7422a1d3d6eb72326680be5"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "rustix 1.1.5",
+ "socket2",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.5.3"
@@ -69,7 +69,7 @@ eframe = { version = "0.37", default-features = false }
 # Monotonic clock on native and the browser (the `web_time::Instant` panics-free equivalent).
 web-time = "1.1"
 egui_kittest = "0.37"
-rfd = "0.17"
+rfd = "0.18"
 image = { version = "0.25", default-features = false, features = ["png"] }

 [workspace.lints.rust]
@@ -32,7 +32,7 @@ log.workspace = true
 image.workspace = true

 [target.'cfg(target_os = "linux")'.dependencies]
-zbus = "5"
+zbus = "6"

 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 craft-update = { workspace = true }
@@ -1,11 +1,2 @@
 sonar.projectKey=storytold_soundcraft
 sonar.organization=storytold
-
-# githubactions:S7637 asks for every action to be pinned to a commit SHA. A workflow covered by
-# .github/workflows/actions.lock runs the commit the lockfile records, so its tag refs are pinned
-# and the lockfile covers the actions those actions use too. Sonar does not read lockfiles yet, so
-# the rule flags the tag refs anyway:
-# https://community.sonarsource.com/t/githubactions-s7637-false-positives-for-actions-pinned-through-native-actions-lock/190814
-sonar.issue.ignore.multicriteria=gha-lockfile
-sonar.issue.ignore.multicriteria.gha-lockfile.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.gha-lockfile.resourceKey=.github/workflows/**