chore(deps): bump smallvec from 1.15.1 to 1.15.2 - #13324
Conversation
Bumps [smallvec](https://github.com/servo/rust-smallvec) from 1.15.1 to 1.15.2. - [Release notes](https://github.com/servo/rust-smallvec/releases) - [Commits](servo/rust-smallvec@v1.15.1...v1.15.2) --- updated-dependencies: - dependency-name: smallvec dependency-version: 1.15.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #13324 +/- ##
=======================================
Coverage 83.2% 83.2%
=======================================
Files 856 856
Lines 342379 342379
=======================================
+ Hits 285148 285161 +13
+ Misses 57231 57218 -13 🚀 New features to boost your workflow:
|
|
@claude review |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM, straightforward dependabot patch bump (smallvec 1.15.1 → 1.15.2) — includes an upstream use-after-free fix in DrainFilter::keep_rest and a rustc perf workaround.
Extended reasoning...
Overview
This is a Dependabot-generated patch version bump for the smallvec crate from 1.15.1 to 1.15.2. Changes are limited to Cargo.toml (one workspace dependency line) and four Cargo.lock files (root, ci/xtask, dev-bins, programs/sbf). The non-root lockfiles also reflect transitive churn (windows-sys version updates and itertools 0.10 → 0.14 in prost-build/prost-derive) that comes from re-resolution rather than any direct change in this PR.
Security risks
The upstream release contains a security-relevant fix: a use-after-free in DrainFilter::keep_rest for zero-capacity SmallVecs (servo/rust-smallvec#407). This is a strict improvement over 1.15.1. No new APIs, no behavioral changes to the union/serde features used here, and no patched-fork or git sources introduced.
Level of scrutiny
Low. This is a single-patch-version bump of a widely-used crate, generated by Dependabot, with no source code changes in the repo. The workspace dep uses default-features = false, features = ["union"] — unchanged. CI (codecov) is green and coverage is unaffected.
Other factors
The transitive lockfile churn in non-root workspaces is benign — those lockfiles belong to excluded workspaces (ci/xtask, dev-bins, programs/sbf) and the version drift on windows-sys/itertools does not affect Linux build/runtime semantics. The PR author yihau explicitly requested this review.
|
Tick the box to add this pull request to the merge queue (same as
|
3 participants
Bumps smallvec from 1.15.1 to 1.15.2.
Release notes
Sourced from smallvec's releases.
Commits
c469051Bump version.9fe422bFix Windows CI.51b965fWork around rustc 1.93 perf regression with MaybeUninit9da26a5Fix use-after-free in DrainFilter::keep_rest for zero-capacity SmallVecs79184f1Add Miri test for use-after-free in DrainFilter::keep_restf59fb36Merge pull request #397 from GiGainfosystems/exclude_scripts28b6ed7Exclude development scriptDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)