deps: fix cargo-deny bans failure from duplicate crate versions#288
Merged
Conversation
Task: TASK-0010 The CI deny job (cargo deny check bans) failed with exit code 2 because two crates resolved to two versions each, which the bans config denies. itertools resolved to both 0.13 (via ratatui 0.29) and 0.14 (a direct hub-tui dependency). Only with_position()/Position are used here, an API identical in both versions, so the direct dependency is pinned down to 0.13 to unify on a single version. unicode-width resolved to both 0.1.14 (via unicode-truncate) and 0.2.0 (via ratatui and tui-textarea). This split lives entirely inside ratatui's transitive tree and is not controllable without an upstream change, so it joins the documented skip list. The crossterm skip is removed: it now resolves to a single version, so the skip was unnecessary and cargo-deny warned about it.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR restores a green cargo deny check bans CI run by unifying duplicate crate versions where possible (notably itertools) and adjusting the cargo-deny skip list for a transitive-only split (unicode-width) that can’t be resolved locally.
Changes:
- Pin
hub-tui’s directitertoolsdependency to0.13to matchratatui 0.29and eliminate the duplicate-version ban. - Update
deny.tomlbans skip list: removecrossterm(no longer duplicated) and addunicode-width(0.1/0.2 split inratatui’s transitive tree). - Regenerate
Cargo.lockto reflect the unifieditertoolsversion (and removeditertools 0.14.0entry).
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| ui/tui/Cargo.toml | Pins itertools to 0.13 with rationale to avoid cargo-deny duplicate-version bans. |
| deny.toml | Adjusts the bans skip list to match actual unavoidable duplicate-version splits. |
| Cargo.lock | Removes the extra itertools 0.14.0 lock entry and normalizes dependencies to a single itertools version. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The completion steps injected into every dispatched agent session told the agent to run `hub task link <ID> <path>`, but the CLI requires the path to be passed via `--value`. A bare positional path is rejected with "unexpected argument", so every agent hit the error and had to discover the correct flag before it could register its session log. The injected command now matches the CLI signature, and the completion-steps test asserts the `--value` form so the instruction can no longer drift from the actual interface.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✅ What
check / denyCI job by removing two duplicate crate versions thatcargo deny check bansrejecteditertoolsnow resolves to a single version (0.13): the directhub-tuidependency is pinned down to match whatratatuialready pulls in — onlywith_position()/Positionare used, an API identical across both versionsunicode-widthjoins the documented skip list: its 0.1.14/0.2.0 split lives entirely insideratatui's transitive tree and can't be unified without an upstream changecrosstermskip, which had collapsed to a single version and was triggering a cargo-deny warninghub task link <ID> <path>, but the CLI requires the path via--value. Corrected the injected command and added a test so it can't drift from the CLI again🤔 Why
👩🔬 How to validate
cargo deny check bans advisories sourcesadvisories ok, bans ok, sources okand a clean exit (no duplicate-entry errors, no unnecessary-skip warning)cargo clippy -- -D warningsandcargo nextest runbuild_task_prompt_includes_task_id_in_completion_stepsnow asserts thehub task link ... --value ...form🔖 Related links