Skip to content

chore(deps): update the dependency graph; hold egui at 0.35 (upstream wasm break) #397

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
doublegate merged 3 commits into from
Aug 18, 2026
+441 −307
Merged

chore(deps): update the dependency graph; hold egui at 0.35 (upstream wasm break) #397

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
badf5d5
chore(deps): update the dependency graph; hold egui at 0.35 (upstream…
doublegate Aug 18, 2026
c0ac139
docs(deps): record the egui 0.35 hold where the pin lives
doublegate Aug 18, 2026
f7f882e
chore(deps): hold the egui tier in dependabot.yml, not only in a comment
doublegate Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,32 @@ updates:
- "doublegate"
assignees:
- "doublegate"
# HOLD the egui tier. A comment in `Cargo.toml` explains WHY the pin exists,
# but a comment does not reach Dependabot -- it would keep re-opening the
# same three PRs every Monday, and the risk is not the noise, it is that the
# twentieth identical PR gets merged on the assumption it is routine.
#
# `egui-winit` 0.36.1 does not compile for `wasm32-unknown-unknown`, and
# RustyNES ships a wasm demo:
#
# error[E0407]: method `bytes` is not a member of trait `egui::DroppedFile`
#
# egui 0.36 split `DroppedFile` by target (`bytes_async` on wasm, `bytes` on
# native) while egui-winit's `NativeFile` impl has no cfg gate, so on wasm it
# implements a method the trait does not declare and omits the one it does.
# `wgpu` is held with them only because `egui-wgpu` 0.35 pins it.
#
# REMOVE ALL FOUR ENTRIES once upstream ships the fix -- this is a hold, not
# a policy. Re-check by bumping and running both wasm clippy invocations.
ignore:
- dependency-name: "egui"
versions: [">=0.36"]
- dependency-name: "egui-wgpu"
versions: [">=0.36"]
- dependency-name: "egui-winit"
versions: [">=0.36"]
- dependency-name: "wgpu"
versions: [">=30"]
# Group minor and patch updates together
groups:
development-dependencies:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:
# cargo-audit release needs >= 1.88 to COMPILE. The prebuilt binary RUNS
# fine under any toolchain — it only parses Cargo.lock, it never compiles
# the project — so the toolchain pin is irrelevant to it.
- uses: taiki-e/install-action@v2.85.10
- uses: taiki-e/install-action@v2.85.13
with:
tool: cargo-audit
- run: cargo audit
Expand All @@ -75,7 +75,7 @@ jobs:
# Prebuilt binary for the same reason as the audit job: the latest
# cargo-deny needs rustc >= 1.88 to build from source, while the repo is
# pinned to 1.96. Policy lives in `deny.toml`.
- uses: taiki-e/install-action@v2.85.10
- uses: taiki-e/install-action@v2.85.13
with:
tool: cargo-deny
- run: cargo deny check
Expand Down
Loading