From 077984cd062c7031df2deea200e8d1e0cb1f590a Mon Sep 17 00:00:00 2001 From: "laurigates-renovate[bot]" <293328251+laurigates-renovate[bot]@users.noreply.github.com> Date: Sat, 26 Sep 2026 08:00:51 +0000 Subject: [PATCH] chore(deps): pin dependencies --- .github/workflows/ci.yml | 12 ++++++------ .github/workflows/docs-drift.yml | 2 +- .github/workflows/gpu.yml | 18 +++++++++--------- .github/workflows/release-please.yml | 6 +++--- .github/workflows/security-audit.yml | 2 +- Cargo.toml | 16 ++++++++-------- crates/loractl-api/Cargo.toml | 10 +++++----- crates/loractl-cli/Cargo.toml | 14 +++++++------- crates/loractl-core/Cargo.toml | 28 ++++++++++++++-------------- 9 files changed, 54 insertions(+), 54 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d1fc1e3..02630da 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,11 +20,11 @@ jobs: name: fmt + clippy + test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - uses: dtolnay/rust-toolchain@stable with: components: clippy, rustfmt - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@v2.9.2 - name: cargo fmt --check run: cargo fmt --all -- --check - name: cargo clippy @@ -47,11 +47,11 @@ jobs: name: clippy (opt-in feature paths) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - uses: dtolnay/rust-toolchain@stable with: components: clippy - - uses: Swatinem/rust-cache@v2 + - uses: Swatinem/rust-cache@v2.9.2 - name: clippy (mnist) run: cargo clippy -p loractl-core --all-targets --features mnist -- -D warnings - name: clippy (gpt2-real) @@ -80,8 +80,8 @@ jobs: name: cargo-deny (licenses/bans/sources) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - uses: EmbarkStudios/cargo-deny-action@v2 + - uses: actions/checkout@v6.1.0 + - uses: EmbarkStudios/cargo-deny-action@v2.1.1 with: arguments: "" command: check diff --git a/.github/workflows/docs-drift.yml b/.github/workflows/docs-drift.yml index 4991ac4..09754a4 100644 --- a/.github/workflows/docs-drift.yml +++ b/.github/workflows/docs-drift.yml @@ -31,7 +31,7 @@ jobs: name: surf lint + check runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - name: surf lint (every anchor resolves) uses: Connorrmcd6/surface@091b937ae34ac81a02386604fed977dd24f1f0cf # v0.8.0 with: diff --git a/.github/workflows/gpu.yml b/.github/workflows/gpu.yml index f6a7caa..2aeaf18 100644 --- a/.github/workflows/gpu.yml +++ b/.github/workflows/gpu.yml @@ -115,13 +115,13 @@ jobs: runs-on: [self-hosted, gpu, cuda] timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Install Rust uses: dtolnay/rust-toolchain@stable - name: Cache cargo - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@v2.9.2 with: # Persistent self-hosted runner: caching ~/.cargo/bin snapshots the # host's rustup/cargo proxies and clobbers them on restore (the CAEF @@ -146,13 +146,13 @@ jobs: runs-on: [self-hosted, gpu, wgpu] timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Install Rust uses: dtolnay/rust-toolchain@stable - name: Cache cargo - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@v2.9.2 with: # Persistent self-hosted runner — see the cuda job's cache-bin note. cache-bin: "false" @@ -173,13 +173,13 @@ jobs: runs-on: [self-hosted, gpu, cuda] timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Install Rust uses: dtolnay/rust-toolchain@stable - name: Cache cargo - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@v2.9.2 with: # Persistent self-hosted runner — see the cuda job's cache-bin note. cache-bin: "false" @@ -206,13 +206,13 @@ jobs: runs-on: [self-hosted, gpu, cuda] timeout-minutes: 120 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v4.4.0 - name: Install Rust uses: dtolnay/rust-toolchain@stable - name: Cache cargo - uses: Swatinem/rust-cache@v2 + uses: Swatinem/rust-cache@v2.9.2 with: # Persistent self-hosted runner — see the cuda job's cache-bin note. cache-bin: "false" @@ -301,7 +301,7 @@ jobs: # lines it managed, and those are exactly what diagnosis needs. - name: Upload bench log if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v4.6.2 with: name: bench-log path: bench.log diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index d9e4f91..109c7f9 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -24,11 +24,11 @@ jobs: # flagged release_please = true). - name: Generate GitHub App token id: app-token - uses: actions/create-github-app-token@v3 + uses: actions/create-github-app-token@v3.2.0 with: app-id: ${{ vars.RELEASE_PLEASE_APP_ID }} private-key: ${{ secrets.RELEASE_PLEASE_PRIVATE_KEY }} - - uses: googleapis/release-please-action@v4 + - uses: googleapis/release-please-action@v4.4.1 id: release with: token: ${{ steps.app-token.outputs.token }} @@ -42,7 +42,7 @@ jobs: # (not the release branch), so pushing the lock here does not self-trigger. - name: Check out the release PR branch if: ${{ steps.release.outputs.prs_created == 'true' }} - uses: actions/checkout@v6 + uses: actions/checkout@v6.1.0 with: ref: ${{ fromJSON(steps.release.outputs.pr).headBranchName }} token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml index 0bda3d7..3fa638e 100644 --- a/.github/workflows/security-audit.yml +++ b/.github/workflows/security-audit.yml @@ -24,6 +24,6 @@ jobs: audit: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v6.1.0 - uses: taiki-e/install-action@cargo-audit - run: cargo audit diff --git a/Cargo.toml b/Cargo.toml index 14e763e..9c49340 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -17,30 +17,30 @@ repository = "https://github.com/laurigates/loractl" rust-version = "1.92" [workspace.dependencies] -anyhow = "1" -serde = { version = "1", features = ["derive"] } -serde_json = "1" -tracing = "0.1" +anyhow = "=1.0.103" +serde = { version = "=1.0.228", features = ["derive"] } +serde_json = "=1.0.150" +tracing = "=0.1.44" # HTTP/SSE surface for loractl-api. Default features off: routing/SSE are # always available; `http1` + `tokio` enable the hyper server and # `axum::serve`, `json` enables the `Json` extractor. -axum = { version = "0.8", default-features = false, features = [ +axum = { version = "=0.8.9", default-features = false, features = [ "http1", "json", "tokio", ] } # `time` is deliberate: axum's SSE keep-alive timer and the test timeout # guards both need it. -tokio = { version = "1", features = [ +tokio = { version = "=1.52.3", features = [ "rt-multi-thread", "macros", "sync", "net", "time", ] } -async-stream = "0.3" +async-stream = "=0.3.6" # Data-parallel iterators. Used by loractl-core's dataset pipeline (#178) to # decode/resize training images across cores while the GPU-bound encode stays # serial. Already in the resolved tree via `tokenizers`, so this adds no new # external surface; MIT OR Apache-2.0, both on cargo-deny's allow list. -rayon = "1" +rayon = "=1.12.0" diff --git a/crates/loractl-api/Cargo.toml b/crates/loractl-api/Cargo.toml index 6322c03..9246878 100644 --- a/crates/loractl-api/Cargo.toml +++ b/crates/loractl-api/Cargo.toml @@ -32,12 +32,12 @@ tokio.workspace = true async-stream.workspace = true # Names the `Stream` trait for `state::subscribe`'s axum-free return type # (async-stream produces a futures-core `Stream`). -futures-core = "0.3" +futures-core = "=0.3.32" # Constant-time token compare for the bearer-auth gate (#62) — already in the # resolved tree (and in deny.toml's license allow-list) via burn's deps. -subtle = "2" -tracing-subscriber = { version = "0.3", features = ["env-filter"] } +subtle = "=2.6.1" +tracing-subscriber = { version = "=0.3.23", features = ["env-filter"] } [dev-dependencies] -tower = { version = "0.5", features = ["util"] } -http-body-util = "0.1" +tower = { version = "=0.5.3", features = ["util"] } +http-body-util = "=0.1.3" diff --git a/crates/loractl-cli/Cargo.toml b/crates/loractl-cli/Cargo.toml index 102c40a..ef44ee7 100644 --- a/crates/loractl-cli/Cargo.toml +++ b/crates/loractl-cli/Cargo.toml @@ -35,14 +35,14 @@ anyhow.workspace = true # formatting lives here, not in core. serde_json.workspace = true tracing.workspace = true -clap = { version = "4", features = ["derive"] } -clap_complete = "4" -figment = { version = "0.10", features = ["yaml", "env"] } -indicatif = "0.18" -tracing-subscriber = { version = "0.3", features = ["env-filter"] } +clap = { version = "=4.6.1", features = ["derive"] } +clap_complete = "=4.6.7" +figment = { version = "=0.10.19", features = ["yaml", "env"] } +indicatif = "=0.18.6" +tracing-subscriber = { version = "=0.3.23", features = ["env-filter"] } # Error/panic reporting to GlitchTip (Sentry-API compatible). DSN comes from # the SENTRY_DSN env var; rustls transport avoids a system OpenSSL dependency. -sentry = { version = "0.46", default-features = false, features = [ +sentry = { version = "=0.46.2", default-features = false, features = [ "backtrace", "contexts", "panic", @@ -55,4 +55,4 @@ sentry = { version = "0.46", default-features = false, features = [ [dev-dependencies] # `figment::Jail` (env + cwd isolation for the config-precedence tests) is # gated behind figment's `test` feature. -figment = { version = "0.10", features = ["yaml", "env", "test"] } +figment = { version = "=0.10.19", features = ["yaml", "env", "test"] } diff --git a/crates/loractl-core/Cargo.toml b/crates/loractl-core/Cargo.toml index a6b25b1..e900e1c 100644 --- a/crates/loractl-core/Cargo.toml +++ b/crates/loractl-core/Cargo.toml @@ -21,7 +21,7 @@ loractl-bench = { path = "../loractl-bench" } # ML backend. `ndarray` is the portable CPU backend (no GPU/CUDA needed for the # MNIST correctness harness); `autodiff` wraps a backend for training. Backends # stay generic so a GPU backend (wgpu/cuda) can be swapped in later. -burn = { version = "0.21", default-features = false, features = [ +burn = { version = "=0.21.0", default-features = false, features = [ "std", "ndarray", "autodiff", @@ -78,7 +78,7 @@ burn = { version = "0.21", default-features = false, features = [ # is one matmul), and a re-run of `tests/grad_checkpointing.rs` bit-identity # against a flex-backed trainer, since flex's SIMD is the same class of lever # that already fails it here. -burn-ndarray = { version = "0.21", default-features = false, features = [ +burn-ndarray = { version = "=0.21.0", default-features = false, features = [ "std", "multi-threads", ] } @@ -86,10 +86,10 @@ burn-ndarray = { version = "0.21", default-features = false, features = [ # and absent from `default`, so it costs the normal build nothing. The `[features]` # block below documents why it is declared directly (same reason as burn-ndarray # above: `rayon` has no passthrough on the umbrella) and what the probe answers. -burn-flex = { version = "0.21", default-features = false, features = [ +burn-flex = { version = "=0.21.0", default-features = false, features = [ "std", ], optional = true } -burn-store = { version = "0.21.0", default-features = false, features = [ +burn-store = { version = "=0.21.0", default-features = false, features = [ "safetensors", "std", ] } @@ -103,22 +103,22 @@ serde_json.workspace = true # burn-store's snapshot-save can't express). Both already ride in transitively # via burn-store at these exact versions, so depending on them directly adds no # new external surface. -regex = "1" -safetensors = "0.7" +regex = "=1.12.4" +safetensors = "=0.7.0" # Qwen3-VL caption conditioning (M10, #21): loads the HF `tokenizer.json` # shipped with Krea-2-Raw so `Qwen3VlConditioner` can tokenize captions # through the krea-2 chat template. Pure offline — file-based loading only, # no hub/HTTP features. -tokenizers = { version = "0.22", default-features = false, features = ["onig"] } +tokenizers = { version = "=0.22.2", default-features = false, features = ["onig"] } # Scaled-fp8 checkpoint loading (M15, #82): `fp8.rs` mmaps the safetensors # file once and shares it across its lazy dequant closures — the same crate # (and pattern) burn-store's own lazy file path uses, so this already rides # in transitively at this exact version via burn-store's `std` feature. -memmap2 = "0.9" +memmap2 = "=0.9.11" # Image dataset pipeline (M12, #23): decode + resize the training images. # Default features off — only the two formats the kohya-style folder # convention actually uses; no HDR/EXR/AVIF subtree. -image = { version = "0.25", default-features = false, features = ["png", "jpeg"] } +image = { version = "=0.25.10", default-features = false, features = ["png", "jpeg"] } # Parallel image decode/resize in the encode phase (#178). The decoder is # already SIMD-capable (image 0.25 decodes JPEG through zune-jpeg), so the cost # is resize + pixel shuffling, and the only lever left is doing several images @@ -134,8 +134,8 @@ rayon.workspace = true # tree; `sha2` (already transitive via burn-store) does the integrity check. # The fetch is lazy — a run with a local tokenizer never touches the network, # so offline CI is unaffected. -ureq = { version = "3", default-features = false, features = ["rustls"] } -sha2 = "0.10" +ureq = { version = "=3.3.0", default-features = false, features = ["rustls"] } +sha2 = "=0.10.9" [features] # GPU compute backends (M7, #18). None are in `default`, so `cargo build`/ @@ -221,7 +221,7 @@ flex-simd = ["flex", "burn-flex/simd"] # `sshs_model_hash` from the finished file — an INDEPENDENT check of the # consumer's algorithm, so it must hash for itself rather than trust the # exporter. Same version the library already pins. -sha2 = "0.10" +sha2 = "=0.10.9" # int4 (Q4S) frozen-base quantization goldens (#96). burn-ndarray gates its Q4 # `quantize` behind the empty `export_tests` feature (Q8/int8 is always on; Q4 is # not) — so the offline int4 quant tests need it enabled. As a dev-dependency it @@ -231,7 +231,7 @@ sha2 = "0.10" # `default-features = false` so it adds only export_tests to whatever features # burn already turns on; unification is additive, so std/simd/etc. are unaffected # and the int8 goldens are untouched (export_tests only ADDS the Q4/Q2 arms). -burn-ndarray = { version = "0.21", default-features = false, features = [ +burn-ndarray = { version = "=0.21.0", default-features = false, features = [ "export_tests", ] } # ADR-0005 step-VRAM probe (`examples/step_probe.rs`): loads a TrainConfig @@ -239,4 +239,4 @@ burn-ndarray = { version = "0.21", default-features = false, features = [ # itself as env-free). Examples build against dev-dependencies, so the # library surface is untouched; same version + feature the CLI already pins, # so no new external surface rides into Cargo.lock. -figment = { version = "0.10", features = ["yaml"] } +figment = { version = "=0.10.19", features = ["yaml"] }