Skip to content

ci: fix cargo deny advisories and drawer focus e2e race - #1

Merged
rickye26 merged 3 commits into
mainfrom
cursor/fix-deny-and-drawer-focus-8e69
Nov 3, 2026
Merged

rickye26 merged 3 commits into
mainfrom
cursor/fix-deny-and-drawer-focus-8e69

Conversation

@neopot

@neopot neopot commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

Cherry-picked onto current main from neopot/catchlight cursor/fix-deny-and-drawer-focus-1663 (402a8e1).

  • clipboard-win lockfile bump 5.4.1 -> 5.4.3. 5.4.1 is yanked. arboard 3.6.1 accepts ^5.3.1, so the lockfile pins 5.4.3.
  • async-executor lockfile bump 1.14.0 -> 1.14.1. 1.14.0 is yanked. 1.14.1 is the compatible release, and Cargo.lock is the only file changed.
  • deny.toml ignores for RUSTSEC-2026-0370, RUSTSEC-2026-0371, and RUSTSEC-2026-0372. zvariant, zbus_names, and zvariant_derive arrive only via accesskit_unix -> atspi -> zbus 5, and the newest accesskit_unix still needs zbus 5. Remove the ignores once AccessKit moves to zbus 6.
  • Drawer focus e2e. The test clicked the face row of a session that openFile was about to replace. It now waits for the opened copy to be the current session and for the face row to exist before clicking. Product code is unchanged.

Checks that passed on the fork: cargo deny, e2e on both backends, cargo fmt --check, clippy -D warnings.

Fresh checks on this branch:

  • nix develop -c bun run --filter catchlight-demo e2e passed on the previous head, including the drawer-focus step on in-tab WebGPU, connected WebGPU, and in-tab WebGL2. This follow-up only changes Cargo.lock.
  • nix develop -c cargo deny check now fully passes (advisories ok, bans ok, licenses ok, sources ok) after the async-executor bump.
Open in Web Open in Cursor 

cursoragent and others added 3 commits November 3, 2026 01:18
clipboard-win 5.4.1 is yanked. arboard 3.6.1 accepts ^5.3.1, so the
lockfile now pins 5.4.3.

zvariant, zvariant_derive, and zbus_names were folded into zbus 6 and
have no patched release. They only arrive through accesskit's AT-SPI
stack, via bevy_winit and egui-winit. accesskit_unix 0.24.1 still
depends on zbus 5, and Bevy 0.20 has not moved off it, so the
advisories stay ignored until that migration exists.

Co-authored-by: Pot <pot@hyperlogue.tech>
The drawer-focus step opens sample.clm while the previous step still
has that model on screen. The face row is already there, so the click
selects the session openFile is about to replace. On the connected
backend that replacement lands during the focus checks, clears the
selection, and disables Delete, so Shift+Tab no longer lands on it.
In-tab wasm usually finishes first, which is why only the connected
pass failed.

Co-authored-by: Pot <pot@hyperlogue.tech>
1.14.0 is yanked. 1.14.1 is the compatible release, so the
lockfile moves to it and nothing else changes.

Co-authored-by: Pot <pot@hyperlogue.tech>
@rickye26
rickye26 merged commit d06720a into main Nov 3, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants