chore(deps): lock file maintenance

[shunkakinoki]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[indent-zero]

PR Summary

Automated chore(deps): lock file maintenance PR from renovate-bot, force-pushed to rebase onto latest main and pick up an expanded set of transitive bumps. The PR remains Cargo.lock-only against main; other file changes visible in the force-push range diff are already-merged main commits (#2037–#2044), not new changes here.

• Bumps: bytemuck 1.25.0→1.25.1, bytemuck_derive 1.10.2→1.11.0, exr 1.74.1→1.74.2, ignore 0.4.27→0.4.28, lru 0.18.0→0.18.1, regex 1.12.4→1.13.0, regex-automata 0.4.14→0.4.15, ryu-js 1.0.2→1.0.3, sha1 0.10.6→0.10.7, thread_local 1.1.9→1.1.10, tinyvec 1.11.0→1.12.0, zlib-rs 0.6.5→0.6.6
• git-ai (branch=main): now 1.6.13 @ b10a7b9f… (was 1.6.12 @ 7f31bbc0…); source URL and branch pin unchanged
• No Cargo.toml changes; all bumps are semver-compatible with existing requirements

Issues

No issues found.

CI Checks

Waiting for CI checks...

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gemini-code-assist]

Code Review

This pull request updates several dependencies in Cargo.lock, including git-ai, ignore, lru, regex, regex-automata, and zlib-rs. There are no review comments to evaluate, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: deba90cb-2221-4a1e-aaf3-5d734a45fec7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/lock-file-maintenance-cargo

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mesa-dot-dev]

Performed full review of 14cc80d...1b0d159

Analysis

• git-ai dependency tracks mutable branch=main in manifest rather than pinned tag/revision, creating supply-chain brittleness where future lock updates silently pull new commits without explicit version signals or visibility into changelog

• No visibility into the commit range (7f31bbc...fcee8e1) for git-ai update—lacking changelog or commit summary to assess potential breaking changes before merge

• Builds using mutable branch references reduce reproducibility compared to immutable tags/revisions, creating determinism risk particularly for git-based dependencies outside crates.io's governance model

• Establish dependency policy requiring VCS dependencies to pin fixed revisions at manifest level with explicit changelog documentation, not just in lock files

Tip

Help

Slash Commands:

• /review - Request a full code review
• /review latest - Review only changes since the last review
• /describe - Generate PR description. This will update the PR body or issue comment depending on your configuration
• /help - Get help with Mesa commands and configuration options

^{0 files reviewed | 1 comments | Edit Agent Settings • Read Docs}

[mesa-dot-dev]

This git dependency update moves from commit 7f31bbc to fcee8e1 on the main branch. Since the lockfile doesn't provide visibility into what changed upstream, consider reviewing the commit range at git-ai-project/git-ai@7f31bbc...fcee8e1 to understand what functionality, bug fixes, or potential breaking changes are being introduced. For improved supply-chain security and build reproducibility, consider pinning git-ai to a specific tag or fixed rev in Cargo.toml rather than tracking a mutable branch=main.

 • 

Prompt for Agent

Task: Address review feedback left on GitHub.
Repository: shunkakinoki/dotfiles#2036
File: Cargo.lock#L1970
Action: Open this file location in your editor, inspect the highlighted code, and resolve the issue described below.

Feedback:
This git dependency update moves from commit `7f31bbc` to `fcee8e1` on the `main` branch. Since the lockfile doesn't provide visibility into what changed upstream, consider reviewing the commit range at https://github.com/git-ai-project/git-ai/compare/7f31bbc...fcee8e1 to understand what functionality, bug fixes, or potential breaking changes are being introduced. For improved supply-chain security and build reproducibility, consider pinning `git-ai` to a specific tag or fixed `rev` in Cargo.toml rather than tracking a mutable `branch=main`.

[mesa-dot-dev]

Mesa Description

TL;DR

Maintained Cargo lockfile by refreshing and updating Rust dependencies to their latest compatible versions.

What changed?

• Cargo.lock: Refreshed and updated Rust dependency lockfile.

^{Description generated by Mesa. Update settings}