From 5273fb2a38e6cc174c371fdea95325ef9792f5ee Mon Sep 17 00:00:00 2001 From: DoubleGate Date: Tue, 14 Jul 2026 19:40:47 -0400 Subject: [PATCH 1/2] chore(deps): consolidate 6 Dependabot bumps (pollster 1.0, wide 1.5, tungstenite 0.30, +patches) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Consolidate every open Dependabot version bump into one reviewed change, with the two major bumps (pollster, wide) and the coupled tungstenite pair verified against the actual code and gates rather than merged blind. Every bump landed with ZERO source changes required — each crate's public surface RustyNES uses is unchanged. Bumps (closes #298, #299, #300, #301, #302, #303): - pollster 0.4 -> 1.0 (#300): frontend, android, ios. Sole use is `pollster::block_on(...)` for the wgpu/Metal adapter+device init (3 call sites); the 1.0 API is unchanged there. Both 0.4 (transitive via wgpu) and 1.0 (our direct dep) coexist in the tree, which is fine. - wide 0.7 -> 1.5 (#301): the desktop `wide::u32x8` SIMD palette-index -> RGBA blitter (`gfx_blit.rs::blit_simd`; native-only, never in the wasm bundle). Pulls safe_arch 0.7 -> 1.0. The blitter's byte-identity gate (`gfx_blit::tests::simd_equals_scalar_byte_identical`) still passes, so the SIMD path stays bit-for-bit equal to scalar. - tungstenite 0.29 -> 0.30 + tokio-tungstenite 0.29 -> 0.30 (#302, #303): the netplay signaling WebSocket (blocking client + async server) and the mobile bridge's blocking server. Kept `default-features = false` + `handshake` + `rustls-tls-webpki-roots` (pure-rustls, no system OpenSSL, so aarch64-android cross-compile stays clean). The 0.30 API is unchanged for our usage, including the `MaybeTlsStream::Rustls(s).sock` internals access and `client_tls`/`IntoClientRequest`. New transitive TLS/nonce deps (chacha20 0.10, rand 0.10, const-oid 0.10) resolve cleanly; sha1 0.10.6 drops out. - bytemuck 1.25.0 -> 1.25.1, cc 1.2.66 -> 1.2.67 (#299 production group): patch bumps, lockfile only. - actions/setup-python v5 -> v6 (#298): the MkDocs step in web.yml. Verification (all green): - cargo check: frontend / netplay (netplay-client,signaling-server) / mobile. - cargo clippy -D warnings: frontend / netplay / mobile all clean. - cargo test: wide SIMD byte-identity (simd_equals_scalar_byte_identical) + the full netplay suite (81 + 16 + nat/relay loopbacks) all pass with 0.30. - cargo deny check: advisories / bans / licenses / sources all ok (new transitive deps included). - The `#![no_std]` core (cpu/ppu/apu/mappers) has none of these deps, so the deterministic engine and AccuracyCoin 141/141 are unaffected by construction. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/web.yml | 2 +- Cargo.lock | 91 +++++++++++++++++++---------- crates/rustynes-android/Cargo.toml | 2 +- crates/rustynes-frontend/Cargo.toml | 4 +- crates/rustynes-ios/Cargo.toml | 2 +- crates/rustynes-mobile/Cargo.toml | 2 +- crates/rustynes-netplay/Cargo.toml | 4 +- 7 files changed, 69 insertions(+), 38 deletions(-) diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml index 2796993c..6de9f30f 100644 --- a/.github/workflows/web.yml +++ b/.github/workflows/web.yml @@ -117,7 +117,7 @@ jobs: # than straight into `_site/docs`, because the assemble step below clears + # recreates `_site`. - name: Set up Python for MkDocs - uses: actions/setup-python@v5 + uses: actions/setup-python@v6 with: python-version: "3.12" diff --git a/Cargo.lock b/Cargo.lock index d1f9185e..6e44963c 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -490,9 +490,9 @@ checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06" [[package]] name = "bytemuck" -version = "1.25.0" +version = "1.25.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec" +checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424" dependencies = [ "bytemuck_derive", ] @@ -602,9 +602,9 @@ dependencies = [ [[package]] name = "cc" -version = "1.2.66" +version = "1.2.67" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996" +checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38" dependencies = [ "find-msvc-tools", "jobserver", @@ -633,6 +633,17 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" +[[package]] +name = "chacha20" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81" +dependencies = [ + "cfg-if", + "cpufeatures 0.3.0", + "rand_core 0.10.1", +] + [[package]] name = "ciborium" version = "0.2.2" @@ -830,6 +841,12 @@ dependencies = [ "wasm-bindgen", ] +[[package]] +name = "const-oid" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c" + [[package]] name = "const-str" version = "0.5.7" @@ -1203,6 +1220,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2" dependencies = [ "block-buffer 0.12.1", + "const-oid", "crypto-common 0.2.2", ] @@ -1735,6 +1753,7 @@ dependencies = [ "cfg-if", "libc", "r-efi 6.0.0", + "rand_core 0.10.1", ] [[package]] @@ -3549,6 +3568,12 @@ version = "0.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3" +[[package]] +name = "pollster" +version = "1.0.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "bc6355899e1c9462875b6757c79f3caa011a1fdae12bbb1a2e72dd1f234f8336" + [[package]] name = "polycool" version = "0.4.0" @@ -3734,6 +3759,17 @@ dependencies = [ "rand_core 0.9.5", ] +[[package]] +name = "rand" +version = "0.10.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" +dependencies = [ + "chacha20", + "getrandom 0.4.3", + "rand_core 0.10.1", +] + [[package]] name = "rand_chacha" version = "0.3.1" @@ -3772,6 +3808,12 @@ dependencies = [ "getrandom 0.3.4", ] +[[package]] +name = "rand_core" +version = "0.10.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" + [[package]] name = "rand_xorshift" version = "0.4.0" @@ -4034,7 +4076,7 @@ dependencies = [ "objc2-core-foundation", "objc2-foundation 0.3.2", "percent-encoding", - "pollster", + "pollster 0.4.0", "raw-window-handle", "wasm-bindgen", "wasm-bindgen-futures", @@ -4257,7 +4299,7 @@ dependencies = [ "log", "ndk", "ndk-context", - "pollster", + "pollster 1.0.1", "raw-window-handle", "rustynes-gfx-shaders", "rustynes-mobile", @@ -4339,7 +4381,7 @@ dependencies = [ "md-5", "naga", "png", - "pollster", + "pollster 1.0.1", "ratatui", "rfd", "rustynes-cheevos", @@ -4351,7 +4393,7 @@ dependencies = [ "rustynes-script", "serde", "serde_json", - "sha1 0.11.0", + "sha1", "sha2 0.11.0", "tempfile", "thiserror 2.0.18", @@ -4389,7 +4431,7 @@ dependencies = [ "bytemuck", "cpal", "log", - "pollster", + "pollster 1.0.1", "raw-window-handle", "rustynes-gfx-shaders", "rustynes-mobile", @@ -4506,9 +4548,9 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f" [[package]] name = "safe_arch" -version = "0.7.4" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "96b02de82ddbe1b636e6170c21be622223aea188ef2e139be0a5b219ec215323" +checksum = "1f7caad094bd561859bcd467734a720c3c1f5d1f338995351fefe2190c45efed" dependencies = [ "bytemuck", ] @@ -4635,17 +4677,6 @@ dependencies = [ "serde_core", ] -[[package]] -name = "sha1" -version = "0.10.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" -dependencies = [ - "cfg-if", - "cpufeatures 0.2.17", - "digest 0.10.7", -] - [[package]] name = "sha1" version = "0.11.0" @@ -5224,9 +5255,9 @@ dependencies = [ [[package]] name = "tokio-tungstenite" -version = "0.29.0" +version = "0.30.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c" +checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71" dependencies = [ "futures-util", "log", @@ -5319,19 +5350,19 @@ checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31" [[package]] name = "tungstenite" -version = "0.29.0" +version = "0.30.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8" +checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22" dependencies = [ "bytes", "data-encoding", "http", "httparse", "log", - "rand 0.9.4", + "rand 0.10.2", "rustls", "rustls-pki-types", - "sha1 0.10.6", + "sha1", "thiserror 2.0.18", "webpki-roots 0.26.11", ] @@ -6196,9 +6227,9 @@ dependencies = [ [[package]] name = "wide" -version = "0.7.33" +version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0ce5da8ecb62bcd8ec8b7ea19f69a51275e91299be594ea5cc6ef7819e16cd03" +checksum = "dfdfe6a32973f2d1b268b8895845a8a96cac2f0191e72c27cc929036060dbf89" dependencies = [ "bytemuck", "safe_arch", diff --git a/crates/rustynes-android/Cargo.toml b/crates/rustynes-android/Cargo.toml index bfe187f4..e2cb6a79 100644 --- a/crates/rustynes-android/Cargo.toml +++ b/crates/rustynes-android/Cargo.toml @@ -45,7 +45,7 @@ android_logger = "0.15" # `AndroidNdk` window handle wgpu needs. wgpu = "29" raw-window-handle = "0.6" -pollster = "0.4" +pollster = "1.0" bytemuck = { version = "1", features = ["derive"] } # Shared CRT/scanline WGSL (single source of truth with the desktop frontend). rustynes-gfx-shaders.workspace = true diff --git a/crates/rustynes-frontend/Cargo.toml b/crates/rustynes-frontend/Cargo.toml index 221f131b..e73a5fea 100644 --- a/crates/rustynes-frontend/Cargo.toml +++ b/crates/rustynes-frontend/Cargo.toml @@ -232,7 +232,7 @@ sha2.workspace = true # Frontend-only utilities. Both already in the dependency tree as # transitive deps of wgpu; adding them as direct deps is free. -pollster = "0.4" +pollster = "1.0" bytemuck = "1" web-time.workspace = true @@ -250,7 +250,7 @@ rustynes-netplay.workspace = true # dependency-light. Native-only on purpose — the wasm blitter uses # `core::arch::wasm32` v128 intrinsics under `+simd128` (with a scalar fallback), # so `wide` never enters the wasm bundle and the 5 MiB size budget is untouched. -wide = "0.7" +wide = "1.5" # v1.7.0 "Forge" G4 — movie-export hash hardening (native export path only, so # the wasm size budget is untouched). `.fm2` wants an MD5 `romChecksum`, `.bk2` diff --git a/crates/rustynes-ios/Cargo.toml b/crates/rustynes-ios/Cargo.toml index 0ef26fe4..b8058433 100644 --- a/crates/rustynes-ios/Cargo.toml +++ b/crates/rustynes-ios/Cargo.toml @@ -44,7 +44,7 @@ log = "0.4" [target.'cfg(target_os = "ios")'.dependencies] wgpu = "29" raw-window-handle = "0.6" -pollster = "0.4" +pollster = "1.0" bytemuck = { version = "1", features = ["derive"] } cpal = "0.18" # Shared CRT/scanline/NTSC WGSL (single source of truth with the desktop diff --git a/crates/rustynes-mobile/Cargo.toml b/crates/rustynes-mobile/Cargo.toml index 6c893833..4cc47a50 100644 --- a/crates/rustynes-mobile/Cargo.toml +++ b/crates/rustynes-mobile/Cargo.toml @@ -75,7 +75,7 @@ zip = { version = "8", default-features = false, features = ["deflate"] } # STUN responder, exactly like `rustynes-netplay`'s `tests/nat_loopback.rs`. The # blocking `tungstenite` server side mirrors the client the bridge uses; same # version + pure-rustls features (no OpenSSL) so the dev build stays consistent. -tungstenite = { version = "0.29", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"] } +tungstenite = { version = "0.30", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"] } [[bin]] # The binding generator the platform builds invoke: diff --git a/crates/rustynes-netplay/Cargo.toml b/crates/rustynes-netplay/Cargo.toml index d4dd6efa..1726d434 100644 --- a/crates/rustynes-netplay/Cargo.toml +++ b/crates/rustynes-netplay/Cargo.toml @@ -37,7 +37,7 @@ thiserror = { workspace = true, features = ["std"] } # only the async WebSocket plumbing in `examples/signaling_server.rs`. [target.'cfg(not(target_arch = "wasm32"))'.dependencies] tokio = { version = "1", features = ["rt-multi-thread", "net", "macros", "sync", "time", "io-util"], optional = true } -tokio-tungstenite = { version = "0.29", optional = true } +tokio-tungstenite = { version = "0.30", optional = true } futures-util = { version = "0.3", optional = true } serde_json = { version = "1.0", optional = true } @@ -45,7 +45,7 @@ serde_json = { version = "1.0", optional = true } # worker. `rustls-tls-webpki-roots` keeps it pure-Rust TLS (no system OpenSSL), # which is what lets it cross-compile cleanly to aarch64-linux-android. No async # runtime: this is the blocking `tungstenite::connect` + `read`/`send` API. -tungstenite = { version = "0.29", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"], optional = true } +tungstenite = { version = "0.30", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"], optional = true } # v2.5.0 Phase C — WebRTC transport scaffold for the browser (wasm32 only). # The native build (UDP/std::net) needs none of these; on wasm they back the From 904d10e052109cf6da4d9e31b166e98225587c41 Mon Sep 17 00:00:00 2001 From: DoubleGate Date: Tue, 14 Jul 2026 19:59:09 -0400 Subject: [PATCH 2/2] docs(deps): correct the pollster/bytemuck comment (review #305) Adopt the copilot review note: the "both are free transitive deps of wgpu" comment was inaccurate after the pollster 0.4 -> 1.0 bump. `bytemuck` is still a free direct dep (matches the wgpu-resolved version), but `pollster 1.0` is a NEW major distinct from the `pollster 0.4` that `rfd 0.17.2` still pulls transitively, so the two coexist as a temporary duplicate until rfd bumps to pollster 1.x. The comment now states the intentional 1.0 pin and the duplicate explicitly. No dependency or code change (comment only). Co-Authored-By: Claude Opus 4.8 --- crates/rustynes-frontend/Cargo.toml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/crates/rustynes-frontend/Cargo.toml b/crates/rustynes-frontend/Cargo.toml index e73a5fea..92c9ccc7 100644 --- a/crates/rustynes-frontend/Cargo.toml +++ b/crates/rustynes-frontend/Cargo.toml @@ -230,8 +230,11 @@ toml.workspace = true serde_json.workspace = true sha2.workspace = true -# Frontend-only utilities. Both already in the dependency tree as -# transitive deps of wgpu; adding them as direct deps is free. +# Frontend-only utilities. `bytemuck` matches the version already resolved +# transitively (via wgpu), so declaring it direct is free. `pollster` is pinned +# to 1.0 as an intentional direct dep for `block_on`; note this is a NEW major +# distinct from the `pollster 0.4` that `rfd` still pulls transitively, so the two +# coexist as a temporary duplicate until rfd bumps to pollster 1.x. pollster = "1.0" bytemuck = "1" web-time.workspace = true