Update dependencies

[workers-devprod]

This is an automated pull request for updating the dependencies of workerd.

[github-actions]

The generated output of @cloudflare/workers-types has been changed by this PR. If this is intentional, run just generate-types to update the snapshot. Alternatively, you can download the full generated types:

Full Type Diff

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This is an automated dependency update covering Rust crates, Bazel build deps, workflow version bumps, and a few build configuration changes.

Issues found (ranked by severity):

1. Hardcoded LLVM-19 paths in .bazelrc break builds without exact LLVM-19 install location — The new build:linux lines hardcode /usr/lib/llvm-19/bin/ paths. This overrides the existing generic CC=clang (line 259) and will break builds for anyone whose LLVM-19 is installed elsewhere (e.g., via Homebrew paths on WSL, or a different package layout). Additionally, --ld-path on lines 502-503 potentially conflicts with the existing --linkopt="-fuse-ld=lld" on line 327.

2. llvm.sh is added but never referenced — A 259-line vendored copy of the LLVM installer script is added to the repo root, but no CI workflow, Dockerfile, or action in this PR is updated to use it. The existing Dockerfile.release, .github/actions/setup-runner/action.yml, and .devcontainer/Dockerfile all still wget/curl the remote version. This looks like an incomplete change — either the consumers should be updated to use the local copy, or the file shouldn't be added yet.

[ask-bonk]

These lines hardcode /usr/lib/llvm-19/bin/ paths, which overrides the generic CC=clang on line 259 for all Linux builds. This will break builds for anyone who doesn't have LLVM-19 installed at this exact system path.

Also, --ld-path=/usr/lib/llvm-19/bin/ld.lld on line 502 may conflict with the existing --linkopt="-fuse-ld=lld" on line 327 — both attempt to control the linker but via different mechanisms.

Is this intentional? If this is only needed for CI, it should probably go in a .bazelrc.ci or be scoped to a specific config (e.g., build:ci-linux) rather than the global build:linux config.

[ask-bonk]

This 259-line script is added to the repo root but nothing in this PR references it. The existing consumers (.github/actions/setup-runner/action.yml, Dockerfile.release, .devcontainer/Dockerfile) all still download llvm.sh from https://apt.llvm.org/llvm.sh. Is this an incomplete change, or is it used elsewhere outside this repo?

[ask-bonk]

I'm Bonk, and I've done a quick review of your PR.

This is an automated dependency update covering Rust crates, Bazel build deps, workflow version bumps, and a few build configuration changes. The version bumps themselves all look like routine patch/minor updates and are consistent across Cargo.lock, defs.bzl, and the individual Bazel BUILD files.

I posted a review with 2 issues:

1. Hardcoded LLVM-19 paths in .bazelrc (.bazelrc:501-504) -- These new build:linux lines hardcode /usr/lib/llvm-19/bin/ paths for CC, ld, and AR, overriding the existing generic CC=clang on line 259. This will break builds for developers without LLVM-19 at that exact path, and the --ld-path flag may conflict with the existing --linkopt="-fuse-ld=lld" on line 327.

2. llvm.sh added but never referenced -- A 259-line vendored copy of the LLVM installer script is added to repo root, but no consumer in this PR (CI workflows, Dockerfiles, actions) is updated to use it instead of downloading from https://apt.llvm.org/llvm.sh.

github run

[npaun]

Contains junk changes