build(deps): update project dependencies, Git sources and CI tooling

Merged
JL
5d ago
+9013-1716

Refresh the 21 Cargo manifests across six workspaces and the icon-generation tooling against current stable registry releases and upstream refs checked on 2026-10-29. This includes GPUI 0.3.10, usage-rs 7.1.3, Wasmi 2.0.0, tray-icon 0.26.1 and core-foundation 0.10.1. Refresh external lockfiles and CI action SHAs/tool pins, including wasm-bindgen CLI 0.2.129, cargo-nextest 0.9.150, Trunk 0.22.1 and shared-WASM nightly 2026-10-29. Pin optional icon-generation tools to Pillow 13.0.0 and oxipng 10.2.1; the generator passed in a temporary copy without changing the checked-in icons. The project's own release version is unchanged.

Git lockfile pins resolve whatsapp-rust/main to 1fcb58a272334604261eb23f5e2a3f1b54059a33 and GPUI Kit/main to 944803984cf0ba3111861d6e1aa9d6265c109ff9. Keep the whatsapp-rust family on one branch source. Integrate main e6e3020, preserving the animated WebP decoder and subsequent sticker/media fixes. No animation scheduler is added.

Adapt extensible upstream fixtures, shutdown reports, GPUI scroll callbacks and OS-dependent shortcut loading. Enable Wasmi's bytecode validation and auto-dispatch explicitly: without auto-dispatch, a plugin loop overflows the host stack in an unoptimized build. Existing sandbox tests verify fuel and resource limits.

Exceptions are deliberate: retain sqlite-wasm-rs 0.5.5 and sqlite-wasm-vfs 0.2.0 because VFS 0.3 removes the IndexedDB backend holding existing browser databases. Upgrading that pair requires a data migration. Keep the additive getrandom 0.2.17 compatibility backend alongside 0.4.3. Upstream pins four RTC crates to 0.21.0-beta.2, crypto-common pins generic-array 0.14.7, and wasm-bindgen's optional coverage path pins minicov 0.3.8.

The published gpui-pre-web 0.3.10 uses floating-point arguments for get_image_data, which web-sys 0.3.106 changed to integers. Its licensed, checksum-identified vendored copy changes only that call; vendor/gpui-pre-web/README.md records provenance and removal criteria. There is no local font-cache patch.

Qualification at head e95deb7: the Rust changes pass 2,354 workspace tests with 25 ignored, workspace Clippy, MSRV 1.95 and the shared-memory web type check. Real Chromium runs passed 44 daemon/session tests plus 25 WebCodecs, 6 playout and 1 audio-lifecycle test; the latter three suites also passed with production shared-memory flags and rebuilt std. The complete Trunk web bundle and relocatable asset validation passed. The real SDK/host example smoke test passed. CLI release is 1,485,224 bytes, below 2 MiB. Pinned icon tools passed temporary regeneration/pixel-preservation checks. Codex reviewed c19e5f6 without findings; later commits update fixtures, icon-tool pins and explicitly enable macOS notification sounds. Remote macOS CI caught that missing feature on the prior head; e95deb7 fixes it. The new head's remote checks and release builds remain pending, so this PR remains draft.

Compatibility probe: tested heads #273 3ca1300, #274 4a13dfb, #275 39e67c0, #277 8d61230 and #278 a5c7c3e merge cleanly with this branch and pass all-target Clippy. The combined run passed 2,364 tests with 27 ignored after excluding two known incompatible #274 assertions. Those compare legacy JSON envelope text and fail when GPUI unifies serde_json/preserve_order; their JSON values remain equivalent. These failures belong to the combined probe, not the standalone #281 branch. #276 was withdrawn and is not included.

Summary by cubic

Refreshes dependencies across six Cargo workspaces, Git sources, and CI tooling against current stable registry releases. Updates include GPUI 0.3.10, usage-rs 7.1.3 (renamed from usage), Wasmi 2.0.0, tray-icon 0.26.1, wasm-bindgen 0.2.129, and cargo-nextest 0.9.150; icon generation now runs through a pinned venv in packaging/requirements.txt. The project's own release version is unchanged.

Breaking dependency changes

  • The usage crate is now usage-rs; all imports and shell completion call sites updated.
  • Wasmi 2.0.0 requires explicit validate and auto-dispatch features; without auto-dispatch a plugin loop overflows the host stack in unoptimized builds.
  • GPUI's scroll-wheel handler is now on_scroll instead of on_scroll_wheel, application shortcuts load through KeyBinding::load since the static constructor no longer resolves the OS-dependent alias, and the sticker test observes the decoder's cache during the drawing phase since assets now belong to the view currently drawing.
  • The macOS notification sound feature is declared in the GUI manifest so it builds on macOS.
  • whatsapp-rust's shutdown now returns a ShutdownReport; call sites log observations through a new report_shutdown helper, the outgoing-call fixture adapts to early answers being authenticated before device selection, and group notices are constructed through upstream builders since Promote/Demote gained fields.

Deliberate exceptions

  • Retains sqlite-wasm-rs 0.5.5 and sqlite-wasm-vfs 0.2.0 because VFS 0.3 drops the IndexedDB backend holding existing browser databases; upgrading would require a data migration.
  • Vendors gpui-pre-web 0.3.10 with one patch: web-sys 0.3.106 changed get_image_data coordinates and sizes to integers while the published crate passes floats. Provenance and removal criteria are documented in vendor/gpui-pre-web/README.md.