Skip to content

chore(deps): update rust crate reqwest to v0.13.4#907

Closed
renovate[bot] wants to merge 1621 commits into
mainfrom
renovate/reqwest-0.x-lockfile
Closed

chore(deps): update rust crate reqwest to v0.13.4#907
renovate[bot] wants to merge 1621 commits into
mainfrom
renovate/reqwest-0.x-lockfile

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 25, 2026

This PR contains the following updates:

Package Type Update Change
reqwest build-dependencies patch 0.13.30.13.4
reqwest dependencies patch 0.13.30.13.4
reqwest workspace.dependencies patch 0.13.30.13.4

Release Notes

seanmonstar/reqwest (reqwest)

v0.13.4

Compare Source

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

loonghao and others added 30 commits April 5, 2026 11:28
…ction

Add version_info() to provider.star DSL. Rust provider now stores by rustc version (O(1) check). lock.rs uses version_info() first.
When stdout is not a TTY (e.g., test runner, CI), OutputRenderer
auto-upgrades to JSON format. The where command outputs JSON with
'source: not_found' instead of human-readable 'not found' text.

Updated 4 failing tests to also match 'not_found' (JSON source field):
- test_where_unknown_tool
- test_where_system_installed_tool
- test_where_multiple_tools
- test_imagemagick_where_detects_system
- Add cancelled state as acceptable in check_job function
- Introduce check_optional_job for conditional jobs (test-full, cross-build, coverage, docs)
- Only core jobs (build, test-targeted, code-quality, etc.) are strictly required
- Conditional jobs that are legitimately skipped no longer cause CI failure
- Add .windsurfrules, .kiro/steering/, .trae/rules/ for Windsurf/Kiro/Trae AI IDEs
- Add .cursor/rules/vx-mcp.mdc for MCP integration rules
- Update AGENTS.md with AI Agent Ecosystem section and MCP guide
- Update CLAUDE.md with MCP integration section
- Update version references: v0.8.16/v0.8.18 → v0.8.19
- Enhance vx-usage skill with real-world MCP examples
- Sync updated skills to all 9 agent directories
- indexmap: 2.0 -> 2.13
- winreg: 0.55 -> 0.56
- sha2: 0.10 -> 0.11 (workspace, vx-installer, vx-config)
- terminal_size: 0.4 -> 0.4.4
- toml_edit: 0.24 -> 0.25

Closes #751, #693, #691, #686, #683, #682, #681, #676, #588
sha2 0.11's finalize() returns GenericArray<u8, ...> which does not
implement LowerHex, so format!({:x}, ...) fails to compile.

Replace with byte-by-byte hex encoding using std::fmt::Write, which
works correctly without any additional dependencies.

Fixes release build error in aarch64-unknown-linux-gnu target.
Fix sha2 GenericArray LowerHex compile errors in two crates:
- crates/vx-cli/src/commands/self_update.rs: replace format!({:x}, hasher.finalize()) with byte-by-byte hex encoding
- crates/vx-installer/src/downloader.rs: same fix

chore(deps): upgrade GitHub Actions versions
- actions/checkout: v5 -> v6 (11 workflow files)
- actions/deploy-pages: v4 -> v5 (docs.yml)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…and AI agent support to 17+ (#762)

- Update version v0.8.19 → v0.8.20 across 10+ agent config files

- Add .github/instructions/ directory with file-scoped Copilot instructions (3 files)

- Enhance AGENTS.md with ETH Zurich research insights and 'How AI Agents Should Use vx' section

- Add OpenCode, Augment Code to supported agents list (17+ agents total)

- Sync .codebuddy/skills/ with canonical skills/ directory

- Update agent count references (13+/15+ → 17+)
…dency (#766)

* feat: propagate explicit version from bundled runtime to parent dependency

When running vx npx@20, the version 20 now propagates to the parent runtime (node). Bundled runtimes share the parent version space.

- Add get_bundled_parent_name() helper for bundled runtime detection

- Extend build_plan() and build_dependency_runtimes() for version propagation

- Add 6 unit tests, update CLI help text, update docs (EN/ZH)

* test(vx-installer): add unit tests for calculate_sha256 and parse_content_disposition

Cover the 5 lines flagged by Codecov as missing in PR #766:
- test_calculate_sha256_known_hash: verifies correct hex output
- test_calculate_sha256_empty_file: verifies SHA256 of empty input
- test_calculate_sha256_large_file: exercises multi-buffer read loop (>8192 bytes)
- test_calculate_sha256_nonexistent_file: verifies error on missing path
- test_parse_content_disposition_*: 6 tests covering simple, quoted, RFC5987
  encoded, URL-encoded, no-filename, and empty-filename variants

---------

Co-authored-by: hallong <hallong@tencent.com>
- docker/setup-qemu-action v3 -> v4
- docker/setup-buildx-action v3 -> v4
- docker/login-action v3 -> v4
- actions/attest-build-provenance v3 -> v4
- zip v8.5.0 -> v8.5.1 (Cargo.lock)
* chore(deps): update dorny/paths-filter action to v4

* chore(deps): update github artifact actions

* chore: regenerate workspace-hack (cargo-hakari)

* style: fix rustfmt formatting in downloader tests

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* feat(providers): add tokei code statistics provider

Implements tokei provider (#663) with full platform support:
- Windows x64/x86: direct .exe binary download
- macOS x64/arm64: .tar.gz archive
- Linux x64/arm64: .tar.gz archive (musl/gnu triples)

Asset format uses Rust target triple without version number in filename,
which differs from most providers and requires a custom download_url.
Includes starlark logic tests (10) and runtime tests (7).

* fix(providers/tokei): remove unsupported macos/arm64 platform

tokei has never released a native aarch64-apple-darwin binary.
Remove macos/arm64 from the platform map so download_url returns None
on Apple Silicon, letting vx report the platform as unsupported rather
than attempting a 404 download.

Update the starlark test to assert None is returned for macos/arm64.

* fix(providers/tokei): fix install layout and macos arm64 support

- Rewrite install_layout using explicit __type dicts (like dust/rcedit)
  instead of binary_layout/archive_layout helpers, ensuring vx correctly
  handles both the Windows .exe binary_install and Unix .tar.gz archive
- Restore macos/arm64 with x86_64-apple-darwin fallback (Rosetta 2),
  matching the pattern used by the dust provider
- Windows: binary_install into bin/, get_execute_path → install_dir/bin/tokei.exe
- Unix: archive at root, get_execute_path → install_dir/tokei
- Update tests: 13 passing, including arm64 Rosetta 2 and layout type checks

* fix(providers/tokei): use brew fallback for macOS arm64

tokei v12.1.2 x86_64 binary fails to run via Rosetta 2 on macOS arm64
due to TLS (thread-local storage) compatibility issues in the old binary.

Replace the Rosetta 2 fallback with Homebrew as the system_install strategy
for macOS. This provides a native arm64 binary on Apple Silicon via brew,
while macOS x64 still uses the direct GitHub release download.

On macOS arm64: download_url returns None, vx falls back to brew install.
On macOS x64: direct download of x86_64-apple-darwin.tar.gz.

* fix(providers/tokei): use variable form for system_install

vx parses system_install as a static variable (dict), not a function.
Change from `def system_install(ctx, version):` to the correct
`system_install = system_install_strategies([...])` variable form,
matching the pattern used by cmake, bash, and other providers.
* fix(providers/git): fix Windows download URL for .windows.N versions

The download_url function hardcoded tag suffix as ".windows.1" and used
the raw version string in the asset filename, causing HTTP 404 for
releases with a windows patch number > 1 (e.g. v2.53.0.windows.2).

Fix:
- Parse the ".windows.{N}" suffix from the version string
- Construct the correct tag: "v{base}.windows.{N}"
- Asset filename: "{base}" when N=1, "{base}.{N}" when N>1
- Add arm64 Windows support (was missing, only x64 and x86 existed)

Adds regression tests for .windows.1, .windows.2 and arm64 cases.

Fixes: vx install git@latest failing with HTTP 404 on Windows

* fix(providers): fix download URL bugs in xmake and ollama

xmake (Windows arm64):
  The windows/arm64 platform was mapped to "win64" producing
  "xmake-bundle-v{version}.win64.exe", but the actual GitHub asset
  is "xmake-bundle-v{version}.arm64.exe".
  Fixed mapping: windows/arm64 → ("arm64", ".exe", "")
  Also added windows/arm64 to the platform map (was missing).

ollama (Linux):
  Linux assets changed from .tgz to .tar.zst compression format.
  Updated both linux/x64 and linux/arm64 entries from "tgz" to "tar.zst".
  Updated tests to assert .tar.zst instead of .tgz.

* chore: regenerate workspace-hack (cargo-hakari)

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Remove vx switch (never implemented, only TODO stubs) and vx plugin (hidden legacy alias for vx provider). Also adds duckdb and flux providers from auto-improve branch.
renovate Bot and others added 24 commits May 23, 2026 00:09
Add Trunk and wasm-pack providers for Rust WebAssembly workflows.

Update provider counts and build-tool docs to include both runtimes, and sync Cargo.lock workspace package versions with v0.9.1.
- add legacy Python 3.7.9 support via python-build-standalone 20200822 assets
- add Wasmtime and Wasmer providers
- use Wasmer archive assets to avoid the Windows installer
* fix: prepend node_modules/.bin to PATH for npm/npx execution

When `vx npm run <script>` is called on Windows, npm's internal PATH
prepend (adding node_modules/.bin for script execution) can fail when
the environment is explicitly set via Command::env(). This causes
locally-installed binaries like tsc, vite, etc. to not be found.

As a defensive safety net, vx now prepends the local
node_modules/.bin directory to PATH when executing npm or npx
commands, mirroring what npm does internally. The directory is only
added if it actually exists on disk.

Fixes the "'tsc' is not recognized" error in dcc-mcp-core's build.rs
when running `vx npm run build` from the admin-ui/ directory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: regenerate workspace-hack (cargo-hakari) [skip ci]

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented May 25, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@loonghao loonghao force-pushed the main branch 2 times, most recently from 71bc865 to f639b2a Compare May 26, 2026 00:22
@loonghao
Copy link
Copy Markdown
Owner

Superseded: reqwest updated to 0.13.4 directly on main

@loonghao loonghao closed this May 26, 2026
@loonghao loonghao deleted the renovate/reqwest-0.x-lockfile branch May 26, 2026 00:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant