Skip to content

fix(deps): bump ratatui 0.29→0.30 + ratatui-textarea to drop lru 0.12 (UB) - #5361

Closed
henrypark133 wants to merge 1 commit into
mainfrom
fix/lru-ratatui-0.30-tui-textarea
Closed

henrypark133 wants to merge 1 commit into
mainfrom
fix/lru-ratatui-0.30-tui-textarea

Conversation

@henrypark133

Copy link
Copy Markdown
Collaborator

Clears Dependabot #6 (lru IterMut Stacked Borrows UB, GHSA-rhfx-m35p-ff5j).

Why a code change, not just a lockfile bump

lru 0.12.5 was held transitively by ratatui 0.29 via tui-textarea 0.7. The grouped dep PR #5271 bumps ratatui→0.30 and lru→0.18 in the lockfile, but couldn't move lru because tui-textarea 0.7 caps ratatui at ^0.29, pinning the old lru through that path. The only way out is to move ironclaw_tui itself to the ratatui 0.30 ecosystem.

Changes

  • ratatui 0.29 → 0.30.2
  • tui-textarea 0.7 → ratatui-textarea 0.9.2 (the crate was renamed for the 0.30 ecosystem)
  • lru 0.12.5 eliminated → resolves to 0.16.4/0.18.0 (both UB-free)
  • input_box.rs: tui_textarea:: → ratatui_textarea::; cursor() destructures the new DataCursor(row, col) shape
  • widgets/mod.rs: dropped Sync from TuiWidget: Send + Sync — ratatui-textarea 0.9 holds a RefCell internally making TextArea !Sync. Verified non-load-bearing: widgets are created and used entirely within the single TUI thread (create_default_widgets runs inside the current_thread runtime spawned in app.rs), never shared by reference across threads.

Verification

  • cargo check -p ironclaw_tui: clean
  • cargo test -p ironclaw_tui: 178 passed, 0 failed
  • cargo clippy -p ironclaw_tui --all-features: no warnings
  • lru 0.12.x confirmed gone from Cargo.lock

🤖 Generated with Claude Code

…drop lru 0.12

Clears Dependabot #6 (lru Stacked Borrows UB in IterMut). lru 0.12.5
was pinned transitively by ratatui 0.29 via tui-textarea 0.7; the
grouped PR #5271 couldn't move it because tui-textarea capped ratatui
at ^0.29. Bumps both in ironclaw_tui's manifest so lru resolves
>=0.16.3, and ports the TUI widgets to ratatui 0.30's API.

Breaking changes addressed:
- tui-textarea 0.7 → ratatui-textarea 0.9 (crate rename for ratatui 0.30)
- cursor() now returns DataCursor(row, col) instead of (usize, usize)
- TextArea uses RefCell internally (now !Sync); dropped Sync from the
  TuiWidget trait bound since the TUI runs on a single dedicated thread
  and Sync was never required for correctness

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@gemini-code-assist

Copy link
Copy Markdown
Contributor

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@railway-app
railway-app Bot temporarily deployed to ironclaw-ci-preview / ironclaw-pr-5361 June 26, 2026 19:54 Destroyed
@github-actions github-actions Bot added scope: dependencies Dependency updates size: XL 500+ changed lines risk: low Changes to docs, tests, or low-risk modules labels Jun 26, 2026
@coderabbitai

coderabbitai Bot commented Jun 26, 2026 •

Copy link
Copy Markdown

Review Change Stack

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a14af74e-f509-41dd-bdf2-7b6fe95057fd

📥 Commits

Reviewing files that changed from the base of the PR and between 2fe061f and 989f2f3.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock, !**/Cargo.lock
📒 Files selected for processing (3)
  • crates/ironclaw_tui/Cargo.toml
  • crates/ironclaw_tui/src/widgets/input_box.rs
  • crates/ironclaw_tui/src/widgets/mod.rs
 ________________________________________________________
< PR looks good? I'll just summon three more edge cases. >
 --------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the contributor: core 20+ merged PRs label Jun 26, 2026
@coderabbitai

coderabbitai Bot commented Jun 26, 2026

Copy link
Copy Markdown

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details
{}

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 989f2f3b97

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


/// Trait implemented by all TUI widgets.
pub(crate) trait TuiWidget: Send + Sync {
pub(crate) trait TuiWidget: Send {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Drop Send from TuiWidget too

With the new ratatui-textarea 0.9.2 dependency, TextArea<'static> is !Send as well as !Sync, so InputBoxWidget can no longer satisfy this supertrait bound because it embeds a TextArea. Keeping TuiWidget: Send makes impl TuiWidget for InputBoxWidget fail to compile whenever ironclaw_tui is built; the commit only removed Sync, but the single-threaded TUI ownership described here means the remaining Send bound needs the same treatment or the input widget needs a Send wrapper.

Useful? React with 👍 / 👎.

@railway-app

railway-app Bot commented Jun 26, 2026

Copy link
Copy Markdown

🚅 Deployed to the ironclaw-pr-5361 environment in ironclaw-ci-preview

Service Status Web Updated (UTC)
ironclaw ✅ Success (View Logs) Web Jun 26, 2026 at 8:02 pm

@henrypark133

Copy link
Copy Markdown
Collaborator Author

Closing as stale — no activity in over three weeks. The branch is untouched; reopen if this is still needed.

This branch was successfully deployed

No deployments
ironclaw-ci-preview / ironclaw-pr-5361 — 989f2f3b Deployed Jun 26, 2026 by railway-app[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

contributor: core 20+ merged PRs risk: low Changes to docs, tests, or low-risk modules scope: dependencies Dependency updates size: XL 500+ changed lines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant