Repository navigation
Complete dependency batch with Leptos 0.8 and wgpu 30 migrations - #407
Draft
dependabot[bot] wants to merge 1 commit into
Draft
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
qqrm
added a commit
that referenced
this pull request
Oct 14, 2026
The committed lockfile contained three GitHub-reported vulnerable crates and two additional RustSec findings. Update only their compatible fixed versions; dependency requirements and application code stay unchanged: | Crate | Before | After | Advisory | | --- | --- | --- | --- | | bytes | 1.10.1 | 1.11.1 | GHSA-434x-w66g-qw3r | | rand | 0.8.5 | 0.8.6 | GHSA-cq8v-f236-94qc | | xxhash-rust | 0.8.15 | 0.8.16 | GHSA-6g2r-675j-hx59 | | crossbeam-epoch | 0.9.18 | 0.9.20 | RUSTSEC-2026-0204 | | anyhow | 1.0.98 | 1.0.103 | RUSTSEC-2026-0190 | Add a required dependency-audit job using the verified pinned installer and cargo-audit 0.22.2. ci-gate now requires all five jobs; vulnerabilities and unsoundness advisories fail the audit, and skipped/failed audit jobs block merge. Maintenance and yanked warnings remain visible. Document the existing missing-FPS reporting issue without changing the workload. Validation: fresh local cargo audit --deny unsound reports zero vulnerabilities and no unsound findings (RustSec database 6aed846, 2026-10-13). Locked metadata, formatting, actionlint, zizmor and diff checks passed. Full locked compilation and browser tests run in hosted CI; no local build, external browser, release dispatch or provider call was used. Remaining warnings: bincode, paste, proc-macro-error and proc-macro-error2 are unmaintained; spin 0.9.8 is yanked. These require separate dependency-maintenance decisions and are not suppressed. The unrelated broader Dependabot maintenance PR #407 remains separate. References: F:Cargo.lock, F:.github/workflows/ci.yml (dependency-audit and ci-gate), F:DOCS/PIPELINES.md (coverage and performance limitation).
qqrm
added a commit
that referenced
this pull request
Oct 15, 2026
…ce data (#409) The performance workflows passed with no FPS samples; timing ignored render errors and counted submission without waiting for GPU completion. This batch requires real completed-frame measurements and fails CI on absent/invalid data or a per-workload median regression over 30%. - Run deterministic 1k/50k/1m source-candle workloads with production LOD, 10 warmup frames and 5 x 30 measured frames per case. Await GPU readback completion and reject no-op renders, invalid inputs and GPU errors. - Measure a pinned reviewed reference and the candidate on the same hosted runner, using identical browser, compiler and SwiftShader settings. Keep separate logs/sample sets and record both code SHAs plus environment provenance. Cross-host absolute calibration remains historical evidence only. - Require the reusable read-only benchmark in ci-gate; remove the duplicate workflow, reject missing/invalid baselines, and refresh compatible cache/setup-node pins. Validation: formatting, locked all-feature checks, strict Clippy, actionlint and 10 Python regression tests passed. Hosted calibration and candidate runs executed both GPU tests and all 15 samples; paired final CI is pending. Local cargo test builds WASM but cannot execute it directly on native Windows, so runtime execution uses hosted browsers. Scope: cached LOD chart throughput with readback overhead on software SwiftShader. Physical GPU/display FPS, initial loading and live-update cost are not established. PR #407 contains additional major dependency migrations and is not superseded. Code: F:tests/performance_limit.rs; F:scripts/parse_perf_log.py; F:scripts/compare_fps.py; F:.github/workflows/benchmark.yml; F:.github/workflows/PIPELINES.md.
qqrm
marked this pull request as draft
October 15, 2026 06:07
qqrm
changed the title
Maintainer-authored completion of the existing dependency PR. Original bot history remains recorded in the PR and local receipt.
qqrm
force-pushed
the
dependabot/maintenance-1f1fccc2c6
branch
from
October 15, 2026 06:19
817f61f to
47ec79d
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The dependency batch now includes the real Leptos 0.8 / wgpu 30 / hecs 0.11 / derive_more 2 migrations and retains the gloo and strum updates. It incorporates current main, including the executed legacy tests and indicator-history alignment fixes, and patches the vulnerable crossbeam-epoch and unsound anyhow versions restored by the old lockfile.
Reactive roots and callbacks preserve disposal/cancellation behavior; GPU acquisition, presentation and validation use the new APIs. The performance workload, GPU readback/no-op checks and 30% limit are retained. A reviewed reference changes only its test lifetime adapter; both revisions use identical workload code and their own locked WASM runner.
This bot PR has been adopted by the repository owner. CI verifies the owner's GitHub-signed commit; the write controller still only auto-merges verified Dependabot-only batches. Final merge uses all protected exact-head checks, without administrative bypass or human approval.
Validation: locked all-feature build and strict Clippy passed; 10 performance-parser/comparator and 15 provenance tests passed. Full browser/Node/UI runtime and paired SwiftShader measurements are required before merge. Physical GPU performance is outside this CI result. The pre-existing native CPU <0.5ms case remains outside the browser-target build.