Skip to content

Conversation

@phylum-bot
Copy link
Contributor

Bump dependencies for all SemVer-compatible updates.

@phylum-bot phylum-bot requested a review from a team as a code owner September 1, 2025 05:33
@phylum-bot phylum-bot requested a review from cd-work September 1, 2025 05:33
@phylum-io
Copy link

phylum-io bot commented Sep 1, 2025

Phylum OSS Supply Chain Risk Analysis - INCOMPLETE

The analysis contains 7 package(s) Phylum has not yet processed,
preventing a complete risk analysis. Phylum is processing these
packages currently and should complete soon.
Please wait for up to 30 minutes, then re-run the analysis.

View this project in the Phylum UI

@maxrake
Copy link
Contributor

maxrake commented Sep 1, 2025

Something is wrong with the macos builds and help is requested to fix it.

@maxrake
Copy link
Contributor

maxrake commented Sep 2, 2025

It turns out the dependency updates in this weekly bump PR were not the source of the build errors for macos-latest runners. This same issue started within the last week, first appearing in the weekly scheduled test run. It turns out the macos-latest runners were updated such that they are now susceptible to a known build issue for the libffi-sys crate. It has since been fixed and a new version published with the change...but our use of this crate derives from deno and specifically deno_ffi:

❯ cargo tree --target all -i libffi-sys
libffi-sys v2.3.0
├── deno_ffi v0.155.0
│   └── deno_runtime v0.177.0
│       └── phylum-cli v7.5.0 (/Users/ccoggins/dev/phylum-dev/cli/cli)
│           └── xtask v0.1.0 (/Users/ccoggins/dev/phylum-dev/cli/xtask)
│   [build-dependencies]
│   └── deno_runtime v0.177.0 (*)
└── libffi v3.2.0
    └── deno_ffi v0.155.0 (*)

Since we haven't updated deno in so long...and doing so requires accounting for a number of breaking changes...a patch was applied to the Cargo.toml manifest to use the commit from the fix instead.

@maxrake
Copy link
Contributor

maxrake commented Sep 2, 2025

Since I made the last commit, a different reviewer should take a look.
It looks like @cd-work was originally assigned to this PR.

@maxrake maxrake merged commit 83eaa92 into main Sep 3, 2025
30 of 32 checks passed
@maxrake maxrake deleted the auto-cargo-update branch September 3, 2025 18:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants