Repository navigation
fix(deps): move clipboard-win off a yanked release - #259
Merged
Merged
Conversation
clipboard-win 5.4.1 is yanked, so `cargo audit` warns on every run. `cargo update -p clipboard-win` moves it to 5.4.3, a patch release. Only Cargo.lock changes. The crate is Windows-only and reaches the build through the opt-in `gui` feature (eframe -> egui-winit -> arboard). `cargo check --features gui --target x86_64-pc-windows-gnu` passes. `cargo audit` now reports only the four upstream-blocked unmaintained warnings (W1 and W2 in the standards upstream dependency watch). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.
Contributor
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters: 1
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including
 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
hyperpolymath
added a commit
to metadatastician/standards
that referenced
this pull request
Nov 4, 2026
Updates the *Blocked on*, *Unblocking release* and *Action when cleared* rows of the two open entries in `docs/UPSTREAM-DEPENDENCY-WATCH.adoc`, which was added in #1311. The page's last check was 2026-10-19, and upstream has moved since then. ## W1: zbus 5 sub-crates (RUSTSEC-2026-0370/0371/0372) - `zbus_xml` 6.0.0 has shipped on `zbus ^6`. - Nothing above it has moved yet: - `zbus-lockstep` and `zbus-lockstep-macros` 0.7.0 still require `zbus_xml ^5.2` and `zvariant ^5.13`. - `atspi` / `atspi-common` still require `zbus ^5.5`. - `accesskit_atspi_common` 0.21.1 requires `zvariant ^5.15` directly, so it is now named as a gate in its own right. - The unblock chain now starts with a `zbus-lockstep` release. ## W2: `ttf-parser` (RUSTSEC-2026-0192) - `sctk-adwaita` 0.11.1 and later have an optional `skrifa` backend. `ab_glyph` is still the default. - Stable `winit` 0.30.13 still pins `sctk-adwaita ^0.10.1`, which has no `skrifa` backend. - `winit` 0.31.0-beta.4 exposes the new backend as `wayland-csd-adwaita-skrifa`. - The unblock path is now: 1. A stable `winit` 0.31. 2. An egui release on it. 3. Each repository selects the `skrifa` feature, unless upstream makes it the default first. ## Verification - Every gate's newest release was queried on crates.io on 2026-11-04, with the loop from the page's *How to re-check* section. - The W2 path was tested in a scratch crate with `winit = "=0.31.0-beta.4"` and default features off: - With `wayland-csd-adwaita`, the lockfile holds `ttf-parser` and `ab_glyph`. - With `wayland-csd-adwaita-skrifa`, it holds neither and holds `skrifa` instead. `cargo check` passes. - The page renders with Asciidoctor 2.0.26 at `--failure-level WARN` with no warnings, and `scripts/check-canonical-names.sh` passes. ## Related hyperpolymath/panic-attack#259 clears the remaining non-upstream `cargo audit` warning there, a yanked `clipboard-win`. After that, panic-attack's audit reports only W1 and W2. --- _Generated by [Claude Code](https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
clipboard-win5.4.1 is yanked, socargo auditonmainwarns on every run. This runscargo update -p clipboard-win, which moves it to 5.4.3, a patch release. OnlyCargo.lockchanges.Path in
eframe→egui-winit→arboard→clipboard-win. The crate is Windows-only and is reached only through the opt-inguifeature.Verification
cargo check --features gui --target x86_64-pc-windows-gnupasses, using the mingw-w64 toolchain. This is the only build that compiles the crate.cargo check --all-featurespasses on Linux.cargo auditexits 0. Its warnings drop from 5 to 4, and the remaining four are the upstream-blocked unmaintained advisories:Both entries are tracked in
docs/UPSTREAM-DEPENDENCY-WATCH.adocin hyperpolymath/standards.Generated by Claude Code