[dependabot]

Bumps the cargo-compatible group with 2 updates in the / directory: uuid and jsonschema.

Updates uuid from 1.28.0 to 1.29.0

Release notes

Sourced from uuid's releases.

v1.29.0

What's Changed

• Add versioned constructors to NonNilUuid by @​RanaPriyansh in uuid-rs/uuid#919
• Prepare for 1.29.0 release by @​KodrAus in uuid-rs/uuid#920

Full Changelog: uuid-rs/uuid@v1.28.0...v1.29.0

Commits

• 4643e60 Merge pull request #920 from uuid-rs/cargo/v1.29.0
• a3631fd prepare for 1.29.0 release
• 304913e Merge pull request #919 from RanaPriyansh/fix/non-nil-versioned-constructors-901
• d49f963 Reuse existing version tests for NonNilUuid constructors
• 2f02404 Add versioned constructors to NonNilUuid
• See full diff in compare view

Updates jsonschema from 0.60.0 to 0.60.1

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.60.1

Fixed

• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

[Rust] Release 0.60.1

• Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
• #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
• const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
• #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

[Ruby] Release 0.60.1

Fixed

• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, taking time linear in their written length instead of quadratic in their digit count.

Changelog

Sourced from jsonschema's changelog.

[0.60.1] - 2026-10-23

Fixed

• Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #1790
• #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #1790
• const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #1791
• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
• #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

Commits

• e9af61d chore(ruby): Release 0.60.1
• 8aa123d chore(python): Release 0.60.1
• 4eb7a64 chore(rust): Release 0.60.1
• 4e90b95 perf: Single scan for the exponent in the digit budget check
• f990b96 fix: Wrong results for numbers past the exponent cap with arbitrary-precision
• c221db8 perf: Super-quadratic conversion of large numbers to fractions with arbitrary...
• 9f3b332 fix: Object equality depending on key order when serde_json preserve_order is...
• a5eb859 fix: Panic on numbers past f64 when serde_json arbitrary_precision is enabled...
• dd3169e chore(python): Release 0.60.0
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: d745bae7-c47b-42d0-8d2c-a1fcff1541b9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[HackingGate]

@dependabot rebase

[uphold-review]

uphold-review

Lock files only: Every file this pull request changes is one a package manager writes, so only uphold's rules ran. Use Full review on the uphold review check for a full review.

❌ uphold rules: uphold's rules refuse this · this repository's policy at bef7f83

Rule output

$ uphold scan
policy check failed: no-running-os-identity-metadata (hostname)
Do not commit identity metadata from the running OS. The scan reads the current
username, home path, hostname and default route at runtime, then searches the
tracked files for what it read. Use neutral placeholders instead --
example-user, example-host, example.test, /srv/example.
.github/workflows/test.yml:127:          components: llvm-tools-preview
.github/workflows/test.yml:138:          tool: cargo-llvm-cov,nextest
docs/COVERAGE.md:73:| [Abstract syntax tree](https://en.wikipedia.org/wiki/Abstract_syntax_tree) | the program's structure without layout, so a rule matches a construct however it is spelled | [Clang AST](https://clang.llvm.org/docs/IntroductionToTheClangAST.html), [ast-grep](https://ast-grep.github.io/) |
docs/COVERAGE.md:79:| [High-level intermediate representation](https://en.wikipedia.org/wiki/Intermediate_representation) | names resolved and types assigned, so a check sees what an identifier refers to | [rustc HIR](https://rustc-dev-guide.rust-lang.org/hir.html), [MLIR](https://mlir.llvm.org/), [LLVM IR](https://llvm.org/docs/LangRef.html) |
docs/COVERAGE.md:80:| [Control-flow graph](https://en.wikipedia.org/wiki/Control-flow_graph) | every path a function can take, so a check can ask whether one statement is reached before another | [LLVM](https://llvm.org/), [Soot](https://soot-oss.github.io/soot/) |
docs/COVERAGE.md:81:| [Data-flow graph](https://en.wikipedia.org/wiki/Data_dependency) | which value flows into which operation | [Joern](https://joern.io/), [LLVM](https://llvm.org/) |
docs/COVERAGE.md:83:| [Static single-assignment form](https://en.wikipedia.org/wiki/Static_single-assignment_form) | each variable assigned once, so a value's definition is its name | [LLVM](https://llvm.org/), [GCC](https://gcc.gnu.org/) |
docs/COVERAGE.md:85:| [Def-use chains](https://en.wikipedia.org/wiki/Use-define_chain) | each definition linked to every use it reaches, and back | [LLVM](https://llvm.org/), [GCC](https://gcc.gnu.org/) |
docs/COVERAGE.md:86:| [Dominator tree](https://en.wikipedia.org/wiki/Dominator_(graph_theory)) | which statement runs before another on every path, so "checked before used" is decidable | [LLVM](https://llvm.org/), [GCC](https://gcc.gnu.org/) |
docs/COVERAGE.md:95:| [Dependency analysis](https://en.wikipedia.org/wiki/Dependence_analysis) | which statements must stay in order, the ground of loop transformation and slicing | [Polly](https://polly.llvm.org/), [isl](https://libisl.sourceforge.io/) |
docs/COVERAGE.md:96:| [Precision](https://en.wikipedia.org/wiki/Data-flow_analysis#Sensitivities): interprocedural, flow-, context- and path-sensitive | how much of the program an answer accounts for: across calls, in statement order, per call site, per branch; each costs time and removes false positives | [Infer](https://fbinfer.com/), [Clang Static Analyzer](https://clang-analyzer.llvm.org/), [SVF](https://github.com/SVF-tools/SVF) |
docs/COVERAGE.md:98:| [Interval](https://en.wikipedia.org/wiki/Interval_arithmetic), [octagon](https://doi.org/10.1007/s10990-006-8609-1) and [polyhedral](https://doi.org/10.1145/512760.512770) domains | bounds per variable; bounds on sums and differences of pairs; any linear relation: each more precise and more costly than the last | [APRON](https://github.com/antoinemine/apron), [Astree](https://www.absint.com/astree/), [Polly](https://polly.llvm.org/)/[isl](https://libisl.sourceforge.io/) |
docs/COVERAGE.md:149:| [Coverage-guided fuzzing](https://en.wikipedia.org/wiki/Fuzzing) | inputs mutated toward new code coverage until one fails | [AFL++](https://aflplus.plus/), [libFuzzer](https://llvm.org/docs/LibFuzzer.html), [honggfuzz](https://github.com/google/honggfuzz) |
docs/COVERAGE.md:158:| [Coverage analysis](https://en.wikipedia.org/wiki/Code_coverage) | which lines, branches or conditions a suite ran; a measure that stops measuring once it is a target, as [goodharts-law](../principles/goodharts-law.toml) says | [llvm-cov](https://llvm.org/docs/CommandGuide/llvm-cov.html), [gcov](https://gcc.gnu.org/onlinedocs/gcc/Gcov.html) |
docs/COVERAGE.md:166:| [Memory instrumentation](https://en.wikipedia.org/wiki/Instrumentation_(computer_programming)) | every access checked against allocation bounds and lifetimes | [AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html), [Valgrind](https://valgrind.org/) |
docs/COVERAGE.md:167:| [Race detection](https://en.wikipedia.org/wiki/Race_condition) | unsynchronized conflicting accesses found from the happens-before order of a run | [ThreadSanitizer](https://clang.llvm.org/docs/ThreadSanitizer.html), [Helgrind](https://valgrind.org/docs/manual/hg-manual.html) |
docs/COVERAGE.md:169:| [Deadlock analysis](https://en.wikipedia.org/wiki/Deadlock_(computer_science)) | lock-order cycles seen in one run, which can deadlock in another | [Helgrind](https://valgrind.org/docs/manual/hg-manual.html), [ThreadSanitizer](https://clang.llvm.org/docs/ThreadSanitizer.html) |
scripts/coverage.sh:49:for tool in llvm-cov nextest; do
scripts/coverage.sh:58:# this crate has no lib target -- and llvm-cov instruments that binary and
scripts/coverage.sh:73:echo "==> cargo llvm-cov ${args[*]}"
scripts/coverage.sh:74:cargo llvm-cov "${args[@]}"
toolchain.toml:87:# declared anyway because "cargo llvm-cov: no such subcommand" is not a message
toolchain.toml:90:name = "cargo-llvm-cov"
toolchain.toml:91:check = "cargo llvm-cov --version"
toolchain.toml:93:hint = "coverage-only; install: cargo install cargo-llvm-cov (or run: scripts/deps.sh install)"
toolchain.toml:186:check = "cargo llvm-cov --version >/dev/null 2>&1 && cargo nextest --version >/dev/null 2>&1"
toolchain.toml:188:cargo install --locked cargo-llvm-cov


$ uphold check
reconciled 19 enforcement claims:
  explicit-unknown <- catalog-tests  enforced by a hook installed here
  single-authoritative-source <- catalog-reference-current  enforced by a hook installed here
  make-illegal-states-unrepresentable <- catalog-validate  enforced by a hook installed here
  single-authoritative-source <- catalog-tests  enforced by a hook installed here
  explicit-unknown <- no-stale-hook-pins  enforced by uphold guard at manual
  single-authoritative-source <- no-stale-hook-pins  enforced by uphold guard at manual
  complete-mediation <- prevent-ai-author  enforced by uphold guard at commit-msg
  fail-safe-defaults <- prevent-public-push  enforced by uphold guard at pre-push
  observability <- removed-function-named  enforced by uphold guard at commit-msg
  least-privilege <- workflow-declares-permissions  enforced by uphold scan
  minimize-attack-surface <- workflow-declares-permissions  enforced by uphold scan
  compromise-recording <- no-local-merge  enforced by uphold guard at pre-merge-commit
  compromise-recording <- no-merge-commit  enforced by uphold guard at pre-commit
  data-minimization <- no-private-repo-names  enforced by uphold guard at commit-msg
  data-minimization <- no-running-os-identity-metadata  enforced by uphold scan
  chestertons-fence <- removed-function-named  enforced by uphold guard at commit-msg
  deprecation-discipline <- no-stale-hook-pins  enforced by uphold guard at manual
  reproducible-derived-state <- catalog-reference-current  enforced by a hook installed here
  reproducible-derived-state <- review-current  enforced by a hook installed here
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-validate: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-tests: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-ai-author: unmeasured [not_requested] — no behavioral probe requested
  behavior  prevent-public-push: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  workflow-declares-permissions: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-local-merge: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-merge-commit: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-private-repo-names: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-running-os-identity-metadata: unmeasured [not_requested] — no behavioral probe requested
  behavior  removed-function-named: unmeasured [not_requested] — no behavioral probe requested
  behavior  no-stale-hook-pins: unmeasured [not_requested] — no behavioral probe requested
  behavior  catalog-reference-current: unmeasured [not_requested] — no behavioral probe requested
  behavior  review-current: unmeasured [not_requested] — no behavioral probe requested
  note  lefthook.yml runs the binary
  note  lefthook.yml defines 20 command(s)
  note  .claude/settings.json runs `uphold hook`
adopted 10 record(s) for design rulings ([decide]):
  explicit-unknown
  parameterize-do-not-enumerate
  enforcement-needs-a-trigger
  psychological-acceptability
  single-authoritative-source
  mechanism-policy-separation
  least-power
  complete-mediation
  fail-safe-defaults
  economy-of-mechanism
  order  fail-safe-defaults over psychological-acceptability: A scope the shim cannot evaluate refuses by default, and `unresolved = "run"` is the named way out.
  order  explicit-unknown over psychological-acceptability: A seam that stands down says so on stderr; it never reports what it did not read as a pass.
  order  psychological-acceptability over complete-mediation: A hook that refuses routine work has its matcher deleted, and then it mediates nothing.
  order  least-power over parameterize-do-not-enumerate: `[stop] run` takes argv and no shell; a command that needs a pipeline names a script.

---

Reviewed with uphold 1.38.0 by uphold-review 0.4.1 · 4f04b44 · claude-opus-5-5 · 16 s · $0.00 list