Files
Akhil Velagapudi 2c071044db Bump dependencies (#757)
* deps: collapse duplicate major versions via workspace bumps

- inquire 0.7 -> 0.9 (drops crossterm 0.25)
- comfy-table 7.1 -> 7.2 (collapses crossterm on 0.29)
- insta 1.39 -> 1.47 (drops console 0.15)
- align ipc2581 crate on workspace quick-xml 0.38

* deps: disable unused default features on leaf crates

- image: only enable png/jpeg/webp (drops avif/rav1e/tiff/exr/... chain,
  ~35 transitive crates)
- arboard: default-features = false (we only call set_text, never image
  operations; drops image-data defaults)
- tar: default-features = false (xattr is unused)

* deps: remove unused dependency declarations

Prune ~60 `workspace = true` declarations and 11 `[workspace.dependencies]`
entries that no source file references. Verified by grepping each crate's
src/, tests/, and build.rs for any token matching the dep name.

Per-crate cleanup (crate: unused deps removed):
- ipc2581: walkdir
- pcb: ariadne
- pcb-diode-api: thiserror, minijinja, regex
- pcb-kicad: chrono, regress, typify
- pcb-layout: pathdiff
- pcb-mcp: signal-hook (direct version)
- pcb-sch: chrono
- pcb-sim: clap, pcb-layout, pcb-kicad, ariadne, log, env_logger,
  colored, open, inquire, pcb-ui
- pcb-zen-core: lru, chrono, pathdiff, lsp-types, debugserver-types,
  uuid, flate2 (removed from [features].native too)
- pcb-zen: display_container, derive_more, allocative, starlark_map,
  starlark_derive, thiserror, once_cell, clap, itertools, uuid, md5,
  sha2, base64, blake3, unicode-normalization, serde_yaml, pcb-kicad

Workspace [dependencies] entries removed (not referenced anywhere):
dir_diff, which, js-sys, lazy_static, web-sys, wasm-bindgen-futures,
lru, regress, display_container, flate2, typify

* deps: bump ruff 0.13.0 -> 0.15.11

Bumps the pinned `ruff_python_formatter` / `ruff_formatter` tag from
0.13.0 to 0.15.11. 0.15.11's internal `ruff_db` chain pulls
`ordermap 1.0 -> indexmap ^2.12`, which meant the old locked
`indexmap 2.10.0` had to be refreshed — so `cargo update indexmap@2.10.0`
is rolled into this commit.

Attempted `default-features = false` on both ruff_* crates, but
ruff_python_formatter 0.15 references `serde` unconditionally in a few
internal spots and fails to compile without the serde feature, so we
leave the defaults on.

* deps: refresh Cargo.lock

`cargo update` run on top of the ruff 0.15.11 bump. Most transitive
version refreshes are no-ops, but a few pull new duplicate versions
(`console 0.15.11` via an indicatif 0.17.12 -> 0.17.11 downgrade,
`nix 0.31.2` via ctrlc 3.5.1 -> 3.5.2, `windows-core 0.62.2` via
chrono 0.4.41 -> 0.4.44, `redox_syscall 0.7.4` / `winnow 1.0.2` via
ruff). Offset by a single dedup win: `itertools 0.12.1` drops out.

* deps: unify on md-5 crate (drop md5 crate)

ipc2581 was already using RustCrypto's `md-5` (`md5::Md5::digest`).
pcb-diode-api was using the separate simpler `md5` crate
(`md5::compute`). Switch pcb-diode-api to the RustCrypto API so we
only carry one md5 implementation.

Both APIs produce the same 16-byte digest with the same lowercase-hex
`LowerHex` formatting, so wire-format output is unchanged.

* deps: bump itertools 0.13 -> 0.14

* deps: bump quick-xml 0.38 -> 0.39

* deps: bump fixedbitset 0.4 -> 0.5

* deps: bump similar 2 -> 3

* deps: bump termtree 0.5 -> 1.0

* deps: bump colored 2 -> 3

* deps: bump glam 0.31 -> 0.32

* deps: bump indicatif 0.17 -> 0.18

* deps: bump json-patch 3 -> 4

* deps: bump petgraph 0.6 -> 0.8

* deps: bump termimad 0.31 -> 0.34

* deps: bump toml 0.8 -> 1

* deps: bump zip 4 -> 8

* deps: bump rusqlite 0.37 -> 0.39, r2d2_sqlite 0.31 -> 0.33

* deps: bump thiserror 1 -> 2

* deps: bump textwrap 0.11 -> 0.16

* deps: bump rquickjs 0.9 -> 0.11

* deps: bump rpc-router 0.1 -> 0.2

* deps: bump reqwest 0.12 -> 0.13 + axoupdater 0.9 -> 0.10

reqwest 0.13 removed the flavor-specific rustls features. The new
`rustls` feature uses `rustls-platform-verifier` (OS trust store) as
the default CA source. That's the upstream-recommended path and keeps
the two crates aligned so we don't end up with two reqwest/TLS stacks
in the lock.

axoupdater 0.10 is bumped in the same commit because it depends on
axoasset 2.0 which itself requires reqwest 0.13 — separating them
would force a second reqwest version into the lock.

* deps: bump sha2 0.10 -> 0.11 and md-5 0.10 -> 0.11

RustCrypto 0.11 switched from `generic-array` to `hybrid-array`, whose
`Array<u8, N>` no longer implements `LowerHex`. Migrate the 7
`format!("{:x}", ...digest(...))` call sites to `hex::encode(...)`
(we already had hex as a dep in pcb-diode-api; promoted to workspace).

Updated call sites:
- crates/ipc2581/src/checksum.rs (x2)
- crates/pcb-diode-api/src/registry/embeddings.rs
- crates/pcb-diode-api/src/release.rs
- crates/pcb-diode-api/src/scan.rs
- crates/pcb-kicad/src/footprint.rs
- crates/pcb-layout/src/model_embed_discovery.rs
- crates/pcb-test-utils/src/snapdir.rs

Wire-format output (hex-encoded digest) is unchanged.

* deps: remove ~40 unused dependency declarations

Verified via regex that none of the following crate deps are imported
or used via macros/derives in the source files of the declaring crate.
Removing them cleans up the manifests and shrinks the lock where they
were the sole consumer.

Per-crate cleanup (crate: deps removed):
- pcb: path-slash, dir-diff, terminal_size, unicode-width, indicatif
  (regular); assert_cmd, assert_fs, duct, itertools (dev)
- pcb-diode-api: zerocopy
- pcb-docs: once_cell
- pcb-eda: insta (dev)
- pcb-ipc2581-tools: starlark_syntax
- pcb-layout: minijinja (regular); assert_cmd (dev)
- pcb-mcp: url, rpc-router (all JSON-RPC is hand-rolled with serde_json)
- pcb-sch: dirs, pcb-sexpr, starlark_syntax
- pcb-sim: tempfile (regular); assert_fs, assert_cmd, insta, serial_test,
  paste, walkdir, zip, tempfile, serde_json, pcb-zen (dev)
- pcb-test-utils: dir-diff
- pcb-ui: crossterm
- pcb-zen-core: dupe, derive_more, starlark_derive, clap; also dropped
  unused `reqwest` activation from the `native` feature and unused
  `getrandom` + its `wasm` feature activation (neither is actually
  imported in this crate)
- pcb-zen-wasm: wasm-bindgen-test (dev)

Also:
- pcb-zen: moved `regex` from [dependencies] to [dev-dependencies]
  (only used by the spice_model integration test)

Workspace-level orphans dropped (no remaining references anywhere):
starlark_derive, getrandom, wasm-bindgen-test, dir-diff.

* ipc2581: report checksum mismatch digests correctly

* deps: replace once_cell with stdlib equivalents

`std::sync::LazyLock` (stable 1.80) and `std::sync::OnceLock` (stable
1.70) cover all our `once_cell::sync::Lazy` and `once_cell::sync::OnceCell`
usage. `std::cell::OnceCell` replaces the single-threaded
`once_cell::unsync::OnceCell`.

Two notes on the migration:
- stdlib `OnceCell::get_or_try_init` is still unstable (`once_cell_try`),
  so one call site in interface.rs uses an equivalent `get().is_none() +
  set()` fallback pattern.
- API shapes otherwise match 1:1 (same `Deref`, `get`, `set`, `get_or_init`).

Drops the `once_cell` crate entirely from the lock.
2026-04-22 21:53:49 -04:00
..
2026-02-28 14:38:25 -05:00
2026-04-22 21:53:49 -04:00