chore: Update depcheck toolchain and dependencies - #24289
Merged
Conversation
dev/depcheck is scanned by Dependabot but is not eligible to receive dependabot PRs, so it has several dependencies with known security issues. This PR updates those dependencies; it also updates the Rust toolchain and cargo versions while we're at it.
github-actions
Bot
added
the
development-process
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #24289 +/- ##
==========================================
- Coverage 81.29% 81.29% -0.01%
==========================================
Files 1110 1110
Lines 385336 385336
Branches 385336 385336
==========================================
- Hits 313261 313252 -9
- Misses 53594 53596 +2
- Partials 18481 18488 +7 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
sandeshkr419
pushed a commit
to sandeshkr419/datafusion
that referenced
this pull request
Aug 12, 2026
## Which issue does this PR close? - N/A ## Rationale for this change This PR tweaks the dependabot config to send dependency updates for a few parts of the repo that were previously missed: - `dev/depcheck` is excluded from the Cargo workspace and has its own `Cargo.lock` (apache#24289 updates the dependencies manually as an interim fix) - `datafusion/wasmtest/datafusion-wasm-app` has its own npm `package-lock.json` - Composite actions under `.github/actions/` - The Python dependencies are a uv workspace rooted at the top-level `pyproject.toml` with a shared `uv.lock`, but only `docs/` was covered — `dev/` and `benchmarks/` got no version updates. ## What changes are included in this PR? - Add a `cargo` entry for `/dev/depcheck` - Add an `npm` entry for `/datafusion/wasmtest/datafusion-wasm-app` - Change the `github-actions` entry from `directory: "/"` to `directories: ["/", "/.github/actions/*"]` so composite actions are covered - Replace the `pip` `/docs` entry with a `uv` entry at the repository root, covering the whole uv workspace and `uv.lock` ## Are these changes tested? Some manual testing, hard to really test exhaustively without letting dependabot run. ## Are there any user-facing changes? No.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue does this PR close?
Rationale for this change
dev/depcheck is scanned by Dependabot but is not eligible to receive dependabot PRs, so it has several dependencies with known security issues. This PR updates those dependencies; it also updates the Rust toolchain version used by depcheck while we're at it.
What changes are included in this PR?
See above.
Are these changes tested?
Yes. Manually tested by adding a cycle and verifying that depcheck still catches it.
Are there any user-facing changes?
No.