-
Notifications
You must be signed in to change notification settings - Fork 0
chore(deps): bump wast from 257.0.1 to 258.0.0 - #1110
Conversation
🔒 HELD — not auto-mergeable (class: major). 257.0.1 -> 258.0.0 changes the major component
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
Codecov Report
✅ All modified and coverable lines are covered by tests.
📢 Thoughts on this report? Let us know!
avrabe
commented
Sep 5, 2026
[maintainer loop] Held-state audit — recording measured status so this hold is not silent.
wast 257.0.1 -> 258.0.0 · classifier: class=major
All 9 required contexts are GREEN on this PR. The only red is
Rivet Federated Graph (advisory), which was failing repo-wide from
2026年09月03日 04:00–21:25 because GitHub rate-limits anonymous clones from
datacenter IPs — nothing to do with this bump. Diagnosed and fixed in #1143/#1144.
So this is held by policy, not by evidence of breakage. The policy
(SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965) treats a 0.x minor as a de-facto
major, because for a 0.x crate it is one — earned from ordeal 0.9 -> 0.12,
which auto-merged as "minor" and hung Test/Z3 for 4–6 hours per run for
days.
Why you are being told this rather than left to rot. A held PR currently has
no defined exit: it cannot auto-merge, and nothing prompts a human. Four of
these accumulated since 2026年08月31日 — one (#1111, wasmparser) was genuinely
source-breaking and is closed with that evidence; the rest were reporting a CI
outage, not an incompatibility. A hold that is correct and silent is how they
became invisible, and I described their state wrongly in the org review as a
result. Raised for temper in #1132.
Staying held pending a deliberate decision, not forgotten. If you want it taken,
say so on this PR.
avrabe
commented
Sep 7, 2026
@dependabot rebase
Why now (RQ-64-DEPS, #965): this PR's base is 32 commits behind main, so its CI verdict is uninterpretable — the single failure it currently shows could be the bump or any of those 32 commits. Attribution needs a baseline. Rebasing is the prerequisite for judging the bump at all, not an endorsement of merging it.
This remains held under SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965: under semver a 0.x-minor bump is BREAKING, and that rule exists because ordeal 0.9 → 0.12 auto-merged as "minor" and hung Test and Z3 for hours across several days (#849).
RQ-64-DEPS is scoped to give that hold an exit condition — it currently says hold and never says how a held bump gets evaluated and released, which is why four have accumulated since 2026年08月31日.
Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!
If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.
avrabe
commented
Sep 7, 2026
|
Why recreate and not rebase (RQ-64-DEPS, #965): this branch carries a Measured, not assumed:
The single red is advisory and sits on a tree four days stale, so it cannot
|
avrabe
commented
Sep 7, 2026
@dependabot recreate
avrabe
commented
Sep 7, 2026
Measured, for the record (RQ-64-DEPS, #965): the earlier @dependabot recreate
on this PR was wrapped in backticks and dependabot did not act on it. The same
command posted as plain text on #1106 was picked up within minutes and the branch
was recreated on current main. So the command must be unformatted — a code-span
@dependabot ... is not parsed as a command.
Recorded here rather than only fixed, because the failure looked exactly like
"dependabot is slow" for half an hour, and that is a misdiagnosis worth not
repeating.
13aaf47 to
91d27fb
Compare
🔒 HELD — not auto-mergeable (class: major). 257.0.1 -> 258.0.0 changes the major component
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
...ng about the tree the suite ran on
The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.
What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:
1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
on trees whose merge-base was four days and one release stale. Neither that
red nor a green would have attributed anything to the bump.
2. The refresh mechanism can be permanently gone. Those three each carry a human
`Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
rebase a branch with foreign commits — it said so on all three at 06:05Z.
Merging main into a dependabot branch to freshen it is the move that destroys
the ability to freshen it. Now written down, because it is not obvious and it
is not reversible.
3. A bump nobody evaluates needs a disposition. These accumulated for a week
because nothing required an answer. "Still open" is not a disposition.
None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.
Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.
Refs #965
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...pendabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026年09月07日: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...ng about the tree the suite ran on
The artifact's original premise ("the hold has no exit") was too strong. The
workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never
a block: merge a held bump BY HAND once the FULL suite is green ... the
discriminator is CI, not a maintainer's read of the diff." That criterion is
correct. The premise is corrected in the artifact rather than edited away, the
third premise correction this release and the same discipline RQ-64-FLOORPROSE
got.
What the exit omitted is everything about the TREE THE SUITE RAN ON, which is
what made it unusable in practice:
1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one
red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured
on trees whose merge-base was four days and one release stale. Neither that
red nor a green would have attributed anything to the bump.
2. The refresh mechanism can be permanently gone. Those three each carry a human
`Merge branch 'main' into dependabot/...` commit, and dependabot refuses to
rebase a branch with foreign commits — it said so on all three at 06:05Z.
Merging main into a dependabot branch to freshen it is the move that destroys
the ability to freshen it. Now written down, because it is not obvious and it
is not reversible.
3. A bump nobody evaluates needs a disposition. These accumulated for a week
because nothing required an answer. "Still open" is not a disposition.
None of this loosens the hold — 0.x-minor is breaking under semver and the
ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which
is what keeps a hold a delay rather than an accumulator.
Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched —
the added text deliberately avoids them), workflow parses, rivet validate at
main's 40-error baseline with 0 broken cross-refs.
Refs #965
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...pendabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026年09月07日: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L
...the suite ran on (#1186) * fix(ci): RQ-64-DEPS (#965) — the MINORHOLD exit exists but says nothing about the tree the suite ran on The artifact's original premise ("the hold has no exit") was too strong. The workflow states one at dependabot-auto-merge.yml:20 — "a hold is a delay, never a block: merge a held bump BY HAND once the FULL suite is green ... the discriminator is CI, not a maintainer's read of the diff." That criterion is correct. The premise is corrected in the artifact rather than edited away, the third premise correction this release and the same discipline RQ-64-FLOORPROSE got. What the exit omitted is everything about the TREE THE SUITE RAN ON, which is what made it unusable in practice: 1. Base freshness is part of "green". #1106/#1107/#1110 each showed exactly one red — `Rivet Federated Graph (advisory)` — which is GREEN on main, measured on trees whose merge-base was four days and one release stale. Neither that red nor a green would have attributed anything to the bump. 2. The refresh mechanism can be permanently gone. Those three each carry a human `Merge branch 'main' into dependabot/...` commit, and dependabot refuses to rebase a branch with foreign commits — it said so on all three at 06:05Z. Merging main into a dependabot branch to freshen it is the move that destroys the ability to freshen it. Now written down, because it is not obvious and it is not reversible. 3. A bump nobody evaluates needs a disposition. These accumulated for a week because nothing required an answer. "Still open" is not a disposition. None of this loosens the hold — 0.x-minor is breaking under semver and the ordeal 0.9->0.12 hang cost days. It makes the exit precise enough to use, which is what keeps a hold a delay rather than an accumulator. Verified: claim_check 59/59 (the MINORHOLD count-eq patterns are untouched — the added text deliberately avoids them), workflow parses, rivet validate at main's 40-error baseline with 0 broken cross-refs. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(rivet): correct the v0.64 plan's VG-009 claim — a grep for `1.6` matched `41.6 %` The plan comment asserted that VG-009 and VCR-REACH-002 both still state aarch64 accepts 1.6 %. Only the second is true. VG-009's only "1.6" is the tail of "41.6 %", a line-coverage figure for synth-backend-riscv/src/backend.rs, framed "measured at v0.54.0" — correctly dated history, and untouched since #918. Flagging it would have been a false red on a properly dated citation. Measured and reported by the RQ-64-SCOPEGAP lane, which was briefed with explicit permission to return a negative result and used it. The claim was mine: it came from a grep for `1.6`, which returns OCCURRENCES and cannot return FRAMING. Same failure that produced v0.62's devirtualization claim, and the correction is left visible beside the original rather than edited away — the scoping error is the same shape the artifact is about. The real population the artifact should have named is larger and of a different kind: eight artifacts restating the repo's own proof counts as undated present-tense fact ("188 Qed / 52 Admitted", six months stale against a number CLAUDE.md itself count-eq-pins). `chore` deliberately, not `fix`: naming RQ-64-SCOPEGAP in a delivery-shaped subject would oblige R4 to find that artifact's status flip in THIS PR, and it belongs to #1182. Verified: rivet validate at main's 40-error baseline, 0 broken cross-refs; status_evidence_check exit 0. Refs #1085 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * fix(ci): RQ-64-DEPS (#965) — record the plain-text requirement for dependabot commands, measured by probe `@dependabot recreate` inside BACKTICKS is silently ignored. Measured 2026年09月07日: three held PRs sat unchanged for over half an hour after a backticked command; the identical command posted UNFORMATTED on #1106 was acted on within minutes, and #1107/#1110 followed once reposted plain. Worth writing down for two reasons. The failure is indistinguishable from "the bot is slow", which is how it was misdiagnosed here. And the only reason it became a measurement rather than a guess is that the plain form was probed on ONE PR before being repeated on all of them — the difference between a controlled test and three identical shots in the dark. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L * chore(release): RQ-64-DEPS (#965) — record PR #1186 in landed:, status stays proposed (half the done-when) R4 is satisfied by fields.landed rather than a status flip, deliberately: the exit condition landed but the four held PRs have no disposition yet, and claiming `implemented` on half a criterion is the shape this release keeps finding in other people's gates. Refs #965 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YJK5LZZEkV5smCY1jKn18L --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
avrabe
commented
Sep 7, 2026
@dependabot rebase
91d27fb to
d2f77f6
Compare
🔒 HELD — not auto-mergeable (class: major). 257.0.1 -> 258.0.0 changes the major component
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
avrabe
commented
Sep 7, 2026
@dependabot rebase
d2f77f6 to
c2a4322
Compare
🔒 HELD — not auto-mergeable (class: major). 257.0.1 -> 258.0.0 changes the major component
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
avrabe
commented
Sep 7, 2026
Kani Verification red here is ENVIRONMENTAL, not attributable to this bump —
and it still blocks the merge, correctly.
Diagnosis, measured rather than assumed:
- The failing step is
Install Kani— the toolchain installer, not a
verification result. Awastversion bump cannot affect Kani's installer. Kani Verificationis success onmainHEAD (44987ba8).- This PR was terminal green on all 65 checks before its rebase; only the
base moved.
So the failure names a fetch/install problem, not a proof problem. Reading the
failing STEP rather than the job name is what distinguishes the two — "Kani
failed" and "installing Kani failed" are categorically different findings.
It is nonetheless a non-advisory red, so the merge ritual's CHECK3 refuses
this PR until it is green. That is the correct behaviour: only codecov and
codecov/patch are advisory here, and "I believe this one is a flake" is not a
merge criterion. Re-running the failed job once the workflow finishes; if it
reddens again at the same step, that is a repo-level infrastructure issue worth
its own issue rather than a reason to wave this through.
avrabe
commented
Sep 7, 2026
@dependabot rebase
Bumps [wast](https://github.com/bytecodealliance/wasm-tools) from 257.0.1 to 258.0.0. - [Release notes](https://github.com/bytecodealliance/wasm-tools/releases) - [Commits](https://github.com/bytecodealliance/wasm-tools/commits) --- updated-dependencies: - dependency-name: wast dependency-version: 258.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
c2a4322 to
9ba57a8
Compare
🔒 HELD — not auto-mergeable (class: major). 257.0.1 -> 258.0.0 changes the major component
Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.
Uh oh!
There was an error while loading. Please reload this page.
Bumps wast from 257.0.1 to 258.0.0.
Commits