chore: drop stale windows-sys 0.48 transitive deps from Cargo.lock - #98
Merged
Conversation
Bump winapi-util 0.1.9 -> 0.1.11, which resolves windows-sys to the 0.59 line already in the lock. Removes 9 dead duplicate entries (windows-sys 0.48.0, windows-targets 0.48.5, and the seven windows_* 0.48.5 platform crates) that were reachable only through a Windows-only, build-time-only chain (winapi-util -> walkdir -> lalrpop [build-dependencies] -> cedar-policy-core). None of these link into the shipped cdylib; removing them slims cargo audit / SBOM output. Lock-only change, no source edits. Closes #85. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dannypsnl
pushed a commit
to dannypsnl/cedar-py
that referenced
this pull request
Jul 3, 2026
…ityio#85 note - Remove the now-done GH k9securityio#85 follow-on bullet (landed as PR k9securityio#98). - Add reusable guidance on collapsing a stale duplicate transitive version by re-resolving the consuming crate's edge (cargo update <consumer>), with the winapi-util/windows-sys case as the example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
swenger
pushed a commit
to swenger/cedar-py
that referenced
this pull request
Jul 10, 2026
…ityio#85 note - Remove the now-done GH k9securityio#85 follow-on bullet (landed as PR k9securityio#98). - Add reusable guidance on collapsing a stale duplicate transitive version by re-resolving the consuming crate's edge (cargo update <consumer>), with the winapi-util/windows-sys case as the example. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the 9 stale
windows-sys 0.48family entries fromCargo.lock, resolving #85.Bumps
winapi-util 0.1.9 -> 0.1.11, which resolveswindows-systo the0.59line already present in the lock. This drops the dead duplicate entries:windows-sys 0.48.0windows-targets 0.48.5windows_aarch64_gnullvm 0.48.5,windows_aarch64_msvc 0.48.5windows_i686_gnu 0.48.5,windows_i686_msvc 0.48.5windows_x86_64_gnu 0.48.5,windows_x86_64_gnullvm 0.48.5,windows_x86_64_msvc 0.48.5These were reachable only through a Windows-only, build-time-only chain:
None of it links into the shipped cdylib (build-deps do not enter the wheel;
winapi-utilreferenceswindows-sysonly under#[cfg(windows)]). Removing the duplicates slimscargo audit/ SBOM output and removes a source of false-positive advisories.Approach
Targeted
cargo update winapi-utilrather than a blanketcargo update, for a minimal, auditable diff —winapi-util 0.1.11reuses the existingwindows-sys 0.59.0, adding nothing new.Scope
Verification
git diff main --stat->Cargo.lockonly (22 ins / 88 del)windows*0.48entries remain; onlywindows-sys 0.59.0leftmaturin develop --releaserebuilds cleanlypytest-> 198 passed (+ 2 subtests)Closes #85.
🤖 Generated with Claude Code