chore(deps): update patch crates by renovate[bot] · Pull Request #14509 · web-infra-dev/rspack

renovate · 2026-06-19T19:03:59Z

This PR contains the following updates:

Package	Type	Update	Change
aho-corasick	workspace.dependencies	patch	`1.1.4` → `1.1.5`
anyhow	workspace.dependencies	patch	`1.0.102` → `1.0.104`
arc-swap	workspace.dependencies	patch	`1.9.1` → `1.9.2`
async-trait	workspace.dependencies	patch	`0.1.89` → `0.1.92`
bytes	workspace.dependencies	patch	`1.12.0` → `1.12.1`
camino	workspace.dependencies	patch	`1.2.3` → `1.2.5`
clap	workspace.dependencies	patch	`4.6.1` → `4.6.6`
fast-glob	workspace.dependencies	patch	`1.1.0` → `1.1.1`
futures (source)	workspace.dependencies	patch	`0.3.32` → `0.3.34`
glob	dev-dependencies	patch	`0.3.3` → `0.3.4`
html-escape (source)	workspace.dependencies	patch	`0.2.13` → `0.2.15`
indexmap	workspace.dependencies	patch	`2.14.0` → `2.14.1`
indicatif	workspace.dependencies	patch	`0.18.4` → `0.18.6`
json-strip-comments	workspace.dependencies	patch	`3.1.1` → `3.1.2`
lightningcss	workspace.dependencies	patch	`1.0.0-alpha.71` → `1.0.0-alpha.72`
memchr	workspace.dependencies	patch	`2.8.2` → `2.8.3`
pnp (source)	workspace.dependencies	patch	`0.12.11` → `0.12.12`
proc-macro2	workspace.dependencies	patch	`1.0.106` → `1.0.107`
quote	workspace.dependencies	patch	`1.0.45` → `1.0.47`
rustc-hash	workspace.dependencies	patch	`2.1.2` → `2.1.3`
ryu-js	workspace.dependencies	patch	`1.0.2` → `1.0.3`
serde (source)	workspace.dependencies	patch	`1.0.228` → `1.0.229`
serde_json	workspace.dependencies	patch	`1.0.150` → `1.0.151`
similar-asserts	workspace.dependencies	patch	`1.5.0` → `1.7.0`
stacker	workspace.dependencies	patch	`0.1.24` → `0.1.25`
syn	workspace.dependencies	patch	`2.0.117` → `2.0.119`
thiserror	workspace.dependencies	patch	`2.0.18` → `2.0.20`
thread_local	workspace.dependencies	patch	`1.1.9` → `1.1.10`
triomphe	workspace.dependencies	patch	`0.1.14` → `0.1.16`
trybuild	workspace.dependencies	patch	`1.0.116` → `1.0.120`
twox-hash	workspace.dependencies	patch	`2.1.2` → `2.1.4`
wasi-common	workspace.dependencies	patch	`36.0.13` → `36.0.14`
wasmtime	workspace.dependencies	patch	`36.0.13` → `36.0.14`
xxhash-rust	workspace.dependencies	patch	`0.8.15` → `0.8.18`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

BurntSushi/aho-corasick (aho-corasick)

`v1.1.5`

Compare Source

dtolnay/anyhow (anyhow)

`v1.0.104`

Compare Source

Update syn dev-dependency to version 3

`v1.0.103`

Compare Source

Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

vorner/arc-swap (arc-swap)

`v1.9.2`

Document RefCnt must not panic (#208).

dtolnay/async-trait (async-trait)

`v0.1.92`

Compare Source

Resolve double_must_use clippy lint in generated code (#303)

`v0.1.91`

Compare Source

`v0.1.90`

Compare Source

Update to syn 3

tokio-rs/bytes (bytes)

`v1.12.1`

Compare Source

Fixed

Properly handle when Box::new panics (#837)

camino-rs/camino (camino)

`v1.2.5`

Compare Source

Fixed

Removed unnecessary files from the package.

`v1.2.4`

Compare Source

Added

Methods to convert between Box<Utf8Path> and Box<Path>:

From<Box<Utf8Path>> for Box<Path> (as of release, not documented due to rust-lang/rust#158466).
Utf8Path::into_std_boxed_path(self: Box<Self>)
Utf8Path::from_boxed_path(path: Box<Path>)
TryFrom<Box<Path>> for Box<Utf8Path>

Thanks nicopap for your first contribution!

clap-rs/clap (clap)

`v4.6.6`

Compare Source

Features

Add Command::get_overridden_usage

`v4.6.5`

Compare Source

`v4.6.4`

Compare Source

Internal

Update to syn v3

`v4.6.3`

Compare Source

Fixes

(derive) Allow "literal".function() as attribute values

`v4.6.2`

Compare Source

Fixes

(help) Say alias when there is only one

oxc-project/fast-glob (fast-glob)

`v1.1.1`

Compare Source

Fixed

apply the negation offset to the globstar segment check (#171)

Other

reduce Rust dev debug info (#162)

rust-lang/futures-rs (futures)

`v0.3.34`

Compare Source

Preserve cloned waker identity. (#3032)
Updato syn to 3. (#3028)

`v0.3.33`

Compare Source

Fix ReadLine's soundness issue regarding to exception safety. (#3020)
Fix unsound Send impl for IterPinRef and Iter. (#3003)
Fix stacked borrows violation in compat01as03 implementation. (#3012)
Fix memory leak in FuturesUnordered::IntoIter. (#3005)
Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
Re-export alloc::task::Wake. (#3010)
Update spin to 0.12. (#3014)

rust-lang/glob (glob)

`v0.3.4`

Compare Source

Cache filename for sorting in fill_todo (#181)
Replace into_error method with impl Into (#179)
Replace tempdir with tempfile (#176)
Set the edition to 2021 (#188)

magiclen/html-escape (html-escape)

`v0.2.15`

Compare Source

`v0.2.14`

Compare Source

indexmap-rs/indexmap (indexmap)

`v2.14.1`

Compare Source

Simplify comparisons where Equivalent isn't needed (Q = K).
Unify index assertions for bounds checks.
Fix (or expect) clippy lints.

console-rs/indicatif (indicatif)

`v0.18.6`

Compare Source

What's Changed

fix: correctly detect dumb terminal on Windows by @ugur-eren in #818

`v0.18.5`

Compare Source

What's Changed

Upgrade to rand 0.10 by @djc in #768
multi: document common MultiProgress bugs + behavior (#595) by @chris-laplante in #786
Use div_duration_f64 by @ChrisDenton in #792
Clear the rest of line after drawing to the terminal by @ChrisDenton in #790
Fix ProgressDrawTarget.is_stderr() for MultiProgress by @kojiishi in #803
Fix height and filler when wrapped at the middle of wide characters by @kojiishi in #799
fix: respect NO_COLOR and TERM=dumb environment variable by @ValentinLeTallec in #808
Fix stray comma after minus sign in HumanFloatCount by @sueun-dev in #815
Fix HumanFloatCount dropping the fractional part by @greymoth-jp in #816
style module cleanup by @djc in #813
Drop screenshots from MultiProgress documentation by @djc in #817

oxc-project/json-strip-comments (json-strip-comments)

`v3.1.2`

Compare Source

Other

(json-strip-comments) exclude extraneous files from published package (#209)
(deps) update rust crates (#210)
(deps) update semgrep/semgrep docker tag to v1.171.0 (#211)
(semgrep) add scan workflow (#208)
(deps) update actions/setup-node action to v7 (#207)
(deps) update actions/setup-node action to v6.5.0 (#206)
(deps) update dependency rust to v1.97.1 (#205)
update sponsor section
(deps) update rust crates (#203)
(deps) update codspeedhq/action action to v4.18.5 (#202)
(deps) update dependency rust to v1.97.0 (#201)
restore original Apache-2.0 license (#200)
(deps) update rust to v1.96.1 (#199)
standardize rustfmt config
normalize README sponsor section
configure clippy exported api lint (#196)
add crates environment to release workflow
(deps) update github actions (#193)
use codspeed simulation mode (#192)
use codspeed mode input (#191)
enable codspeed simulation (#190)
(deps) update rust crates (#189)
(deps) update github actions (#188)
(deps) update rust crates (#187)
(deps) update github actions to v4.17.5 (#186)
(deps) update github actions to v4.17.0 (#185)
(deps) update rust crates (#183)
(deps) update github actions (#182)
(deps) update dependency rust to v1.96.0 (#181)
(deps) update rust crates (#180)
(deps) update github actions (#179)
switch security workflow to ubuntu-latest (#178)
update packageManager to pnpm 11.0.4 (#177)
(deps) update github actions (#176)
(deps) update pnpm/action-setup action to v6.0.4 (#175)
(deps) update github actions (#174)
(deps) update github-actions (#172)

BurntSushi/memchr (memchr)

`v2.8.3`

Compare Source

yarnpkg/pnp-rs (pnp)

`v0.12.12`

Compare Source

Other

(deps) bump regress to 0.12.0 (#113)

dtolnay/proc-macro2 (proc-macro2)

`v1.0.107`

Compare Source

Documentation improvements

dtolnay/quote (quote)

`v1.0.47`

Compare Source

Documentation improvements

`v1.0.46`

Compare Source

Avoid repeated get_span in quote_spanned (#329, thanks @Noratrieb)

rust-lang/rustc-hash (rustc-hash)

`v2.1.3`

Compare Source

boa-dev/ryu-js (ryu-js)

`v1.0.3`

Compare Source

Breaking Changes

Minimum rust version has been bumped from 1.64.0 to 1.71.0.

Bug Fixes

BUG #56: Fix panic in format64_to_fixed when rounding carries past all integer digits. (@Ansh-699)

Internal Improvements

INTERNAL #57: Sync upstream/main. (@jedel1043)
INTERNAL #63: Make Cursor store unsigned integer len and index. (@HalidOdat)

serde-rs/serde (serde)

`v1.0.229`

Compare Source

Update to syn 3

serde-rs/json (serde_json)

`v1.0.151`

Compare Source

Add RawValue::from_string_unchecked (#1331, thanks @WonderLawrence)

rust-lang/stacker (stacker)

`v0.1.25`

Compare Source

dtolnay/syn (syn)

`v2.0.119`

Compare Source

Preserve attributes on tail-call expressions in statement position (#1994)
Parse field-representing types builtin in type position (#1996)

`v2.0.118`

Compare Source

Documentation improvements

dtolnay/thiserror (thiserror)

`v2.0.20`

Compare Source

Suppress redundant_field_names clippy lint in generated code (#454)

`v2.0.19`

Compare Source

Update to syn 3

Amanieu/thread_local-rs (thread_local)

`v1.1.10`

Compare Source

Fixed

Fix undefined behavior when get_or or get_or_try reentrantly initializes the same ThreadLocal (#97).
Fix an integer underflow in iterator size_hint implementations (#89).
Fix compilation with the nightly feature enabled (#96).

Changed

ThreadLocal::get no longer allocates a thread ID or registers a thread-local destructor when no value exists for the current thread (#84).

Manishearth/triomphe (triomphe)

`v0.1.16`

Compare Source

`v0.1.15`

Compare Source

dtolnay/trybuild (trybuild)

`v1.0.120`

Compare Source

Collect more path dependencies from dev deps and target deps (#340)
Prefer longest match in path dependency search (#341, #342)

`v1.0.119`

Compare Source

Fix detection of crate features in new Cargo build-dir layout (#338, thanks @ranger-ross)

`v1.0.118`

Compare Source

Normalize cargo registry paths for any registry source (#331, thanks @devjgm)
Limit custom registry to new normalization level (#334)

`v1.0.117`

Compare Source

Better error message when TRYBUILD env var is wrong (#332, thanks @tisonkun)

shepmaster/twox-hash (twox-hash)

`v2.1.4`

Compare Source

Changed

Documentation added about the stability of the hashing algorithms.

`v2.1.3`

Compare Source

Fixed

Removed a panic that could occur when using XxHash32 or XxHash64
in debug mode. Release mode is unaffected.

Changed

The version range for the optional rand dependency now allows 0.10
in addtion to 0.9.

bytecodealliance/wasmtime (wasi-common)

`v36.0.14`

Compare Source

36.0.14

Released 2026-08-20

Fixed

Filesystem sandbox escape when paths or symlinks contain trailing slashes.
GHSA-vqjp-4c8c-hfgg

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 8am on saturday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-06-19T19:13:48Z

📦 Binary Size-limit

Comparing c0bab86 to fix: include output path in chunk render cache keys (#14877) by Gengkun

❌ Size increased by 536.00KB from 66.64MB to 67.17MB (⬆️0.79%)

codspeed-hq · 2026-06-19T19:22:35Z

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 47 skipped benchmarks¹

_{Comparing renovate/patch-crates (c0bab86) with main (439df0f)}

47 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

stormslowly · 2026-06-20T11:08:19Z

@codspeedbot Why is this bench case so flaky? How can I make it more stable

codspeed-hq · 2026-06-20T11:08:24Z

@codspeedbot Why is this bench case so flaky? How can I make it more stable

Good question — and the short answer is that the +2.62% here is almost certainly noise, not a real effect of this dependency bump (pnp/syn/wasi-common/wasmtime aren't on the hashing path).

Why `rust@create_full_hash` looks flaky

It's the shortest benchmark in the suite (~3 ms). Simulation mode counts simulated CPU cycles, which is very stable for purely single-threaded code. But a fixed amount of run-to-run jitter is a much larger fraction of a 3 ms benchmark than of a 30 ms one, so the same absolute wobble reads as a bigger percentage. The fastest benchmarks are always the noisiest in relative terms.
Residual multi-threading. The harness is already well-tuned for determinism (NeverGrowInPlaceAllocator to remove allocator non-determinism, rayon pinned to 1 thread, and a current-thread tokio runtime under CodSpeed). However, the blocking thread pool is still 8 (SIMULATION_BENCHMARK_BLOCKING_THREADS in xtask/benchmark/src/lib.rs). Any spawn_blocking work executed during run_create_hash_pass gets scheduled across those 8 threads non-deterministically, which perturbs the cycle count from run to run.

How to make it more stable

Treat small changes as noise. For this particular benchmark, I'd treat anything under ~5% in simulation as within the noise floor unless the diff actually touches the hashing/codegen path. CodSpeed flags it because it's a real measured delta, but at this duration the signal-to-noise ratio is low.
Lengthen the workload for this stage. It shares GENERAL_STAGE_NUM_MODULES with the other stage benchmarks, so the cleanest fix is a dedicated, larger input for create_full_hash so the fixed jitter becomes a smaller fraction of the total. This is the single most effective lever.
Reduce blocking-thread non-determinism. If run_create_hash_pass doesn't deadlock with fewer threads, pinning SIMULATION_BENCHMARK_BLOCKING_THREADS to 1 (or making the pass run inline) would make the executed path fully deterministic. This needs validation against the other stage benchmarks before adopting it.
Ensure deterministic iteration order. Confirm any maps iterated while building hashes use a deterministic hasher (FxHashMap) or are sorted before iteration, so iteration order doesn't shift the instruction count.

I held off on committing a change here since the most impactful options (bigger dedicated input, or dropping the blocking-thread count) need a few benchmark runs to confirm they actually lower the variance without regressing the other stages or deadlocking. If you'd like, I can open a follow-up PR that adds a larger dedicated input for this stage and we can validate the reduced variance on CodSpeed — just let me know.

Summary

Warming up the performance wizard...
Analyzing benchmark stability — Explained why rust@create_full_hash is noise-prone and how to stabilize it
Handling comment — Comment handling finished successfully

_{Was this response helpful? React with 👍 or 👎 to help us improve CodSpeedBot.}

chenjiahan · 2026-06-22T05:38:55Z

The size regression is mainly from pnp 0.12.10.

pnp replaced fancy-regex with regress 0.11.1, while Rspack already depends on regress 0.10.5. This pulls two regress versions into the binary, which also causes the cargo deny duplicate failure.

github-actions · 2026-06-23T05:41:17Z

Rsdoctor Bundle Diff Analysis

Found 5 projects in monorepo, 0 projects with changes.

📊 Quick Summary

Project	Total Size	Gzip Size
popular-libs	1.7 MB	552.1 KB
react-10k	5.6 MB	1.3 MB
react-1k	823.1 KB	217.0 KB
react-5k	2.7 MB	663.8 KB
ui-components	4.9 MB	1.4 MB

Generated by Rsdoctor GitHub Action

cloudflare-workers-and-pages · 2026-07-11T03:24:29Z

Deploying rspack with Cloudflare Pages

Latest commit:	`b677b51`
Status:	✅ Deploy successful!
Preview URL:	https://ac809c3d.rspack-v2.pages.dev
Branch Preview URL:	https://renovate-patch-crates.rspack-v2.pages.dev

View logs

renovate Bot added the dependencies Pull requests that update a dependency file label Jun 19, 2026

renovate Bot force-pushed the renovate/patch-crates branch from eebd9f8 to 929efea Compare June 20, 2026 09:57

chenjiahan assigned stormslowly Jun 22, 2026

renovate Bot force-pushed the renovate/patch-crates branch 3 times, most recently from 0176c85 to 9488bff Compare June 23, 2026 05:29

renovate Bot force-pushed the renovate/patch-crates branch 6 times, most recently from 8551a20 to e29cafa Compare July 2, 2026 13:54

renovate Bot force-pushed the renovate/patch-crates branch 11 times, most recently from 0ae816b to f96a1ad Compare July 10, 2026 18:55

renovate Bot force-pushed the renovate/patch-crates branch 10 times, most recently from d756a4e to 77970a5 Compare August 9, 2026 09:03

renovate Bot force-pushed the renovate/patch-crates branch 15 times, most recently from cefd61a to c7a219d Compare August 17, 2026 07:03

renovate Bot force-pushed the renovate/patch-crates branch 4 times, most recently from bc24904 to 3024fec Compare August 22, 2026 03:54

chore(deps): update patch crates

44c4a18

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update patch crates - #14509

chore(deps): update patch crates#14509
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/patch-crates

renovate Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

stormslowly commented Jun 20, 2026

Uh oh!

codspeed-hq Bot commented Jun 20, 2026 •

edited

Loading

Uh oh!

chenjiahan commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Fixed

Fixed

Added

Features

Internal

Fixes

Fixes

Fixed

Other

What's Changed

What's Changed

Other

Other

Breaking Changes

Bug Fixes

Internal Improvements

Fixed

Changed

Changed

Fixed

Changed

36.0.14

Fixed

Configuration

Uh oh!

github-actions Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Binary Size-limit

Uh oh!

codspeed-hq Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

stormslowly commented Jun 20, 2026

Uh oh!

codspeed-hq Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why rust@create_full_hash looks flaky

How to make it more stable

Uh oh!

chenjiahan commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rsdoctor Bundle Diff Analysis

Uh oh!

cloudflare-workers-and-pages Bot commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying rspack with Cloudflare Pages

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Jun 19, 2026 •

edited

Loading

github-actions Bot commented Jun 19, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 19, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 20, 2026 •

edited

Loading

Why `rust@create_full_hash` looks flaky

github-actions Bot commented Jun 23, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jul 11, 2026 •

edited

Loading