Skip to content

fix(deps): bump time to 0.3.47 in Cargo.lock#589

Merged
ErikBjare merged 2 commits intoActivityWatch:masterfrom
TimeToBuildBob:bob/fix-time-security-update
Apr 30, 2026
Merged

fix(deps): bump time to 0.3.47 in Cargo.lock#589
ErikBjare merged 2 commits intoActivityWatch:masterfrom
TimeToBuildBob:bob/fix-time-security-update

Conversation

@TimeToBuildBob
Copy link
Copy Markdown
Contributor

Dependabot security updates on master are currently failing because the workspace lockfile resolves time to 0.3.41, while the fixed version starts at 0.3.47 (see failing run 24800631566).

This updates Cargo.lock with a targeted cargo update -p time --precise 0.3.47, which also refreshes the related transitive entries (time-core, time-macros, deranged, num-conv, and the serde split package metadata).

Verification:

  • cargo metadata --locked --format-version 1 --no-deps
  • cargo tree -i time --locked shows time v0.3.47

…nstall

tarpaulin 0.22.0 was released in 2022 and does not support Rust edition 2024,
causing 'unknown variant `2024`' errors in cargo metadata parsing.

Switch from the pinned FreeMasen/tarpaulin-action (v0.22.0) to direct
cargo install so we always get the latest tarpaulin. Also removes the
now-unnecessary OpenSSL 1.1 install step — modern tarpaulin uses rustls.
@TimeToBuildBob
Copy link
Copy Markdown
Contributor Author

Pushed a CI fix on top of the Cargo.lock bump (40cdf23).

Root cause of the Code coverage failure: cargo-tarpaulin 0.22.0 (released 2022) parses cargo metadata JSON and doesn't recognize edition = "2024", producing:

unknown variant `2024`, expected one of `2015`, `2018`, `2021`

This started failing when Rust edition 2024 was introduced into the workspace (via the aw-client-rust API key crate in #587).

Fix: Replace FreeMasen/tarpaulin-action@0.22.0 with cargo install cargo-tarpaulin (always gets the latest release, which supports edition 2024). Also removes the now-unnecessary OpenSSL 1.1 install step — modern tarpaulin uses rustls.

All other CI jobs (android, clippy, format, ubuntu, macOS, windows) were already passing on the original commit. This commit only touches the coverage workflow.

@codecov
Copy link
Copy Markdown

codecov Bot commented Apr 23, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.11%. Comparing base (656f3c9) to head (40cdf23).
⚠️ Report is 47 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master     #589      +/-   ##
==========================================
+ Coverage   70.81%   76.11%   +5.29%     
==========================================
  Files          51       60       +9     
  Lines        2916     4685    +1769     
==========================================
+ Hits         2065     3566    +1501     
- Misses        851     1119     +268     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@TimeToBuildBob
Copy link
Copy Markdown
Contributor Author

CI is now all green (7/7 checks passing). The tarpaulin upgrade fixed the Code coverage job — the previous 0.22.0 pin didn't support Rust edition 2024 (introduced by the aw-client-rust PR #587 that merged yesterday). Ready to merge when convenient.

@ErikBjare ErikBjare merged commit 1e9c358 into ActivityWatch:master Apr 30, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants