Skip to content

chore: upgrade CVE'ed crates, remove unmaintaned crates#9032

Merged
ematipico merged 1 commit intomainfrom
chore/upgrade-crates
Feb 11, 2026
Merged

chore: upgrade CVE'ed crates, remove unmaintaned crates#9032
ematipico merged 1 commit intomainfrom
chore/upgrade-crates

Conversation

@ematipico
Copy link
Copy Markdown
Member

@ematipico ematipico commented Feb 11, 2026

Summary

We had some CVEs and some unmaintained crates in our tree. This PR updates bytes and time, which had CVEs, updates the codespeed crate, which contained unmaintained crates, uses owo-colors to replace ansi_rgb, which contained unmaintained crates

Important

We need this PR merged, or we can't do any release

Test Plan

CI should stay green

Docs

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Feb 11, 2026

⚠️ No Changeset found

Latest commit: a96e1a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions Bot added A-Project Area: project A-Linter Area: linter A-Parser Area: parser A-Formatter Area: formatter L-JavaScript Language: JavaScript and super languages L-CSS Language: CSS and super languages L-JSON Language: JSON and super languages L-HTML Language: HTML and super languages L-Tailwind Language: Tailwind CSS labels Feb 11, 2026
@ematipico ematipico requested review from a team February 11, 2026 09:24
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Feb 11, 2026

Merging this PR will not alter performance

✅ 58 untouched benchmarks
⏩ 95 skipped benchmarks1


Comparing chore/upgrade-crates (a96e1a3) with main (8ef9d1d)

Open in CodSpeed

Footnotes

  1. 95 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports.

@github-actions
Copy link
Copy Markdown
Contributor

Parser conformance results on

js/262

Test result main count This PR count Difference
Total 52902 52902 0
Passed 51682 51682 0
Failed 1178 1178 0
Panics 42 42 0
Coverage 97.69% 97.69% 0.00%

jsx/babel

Test result main count This PR count Difference
Total 38 38 0
Passed 37 37 0
Failed 1 1 0
Panics 0 0 0
Coverage 97.37% 97.37% 0.00%

symbols/microsoft

Test result main count This PR count Difference
Total 5464 5464 0
Passed 1915 1915 0
Failed 3549 3549 0
Panics 0 0 0
Coverage 35.05% 35.05% 0.00%

ts/babel

Test result main count This PR count Difference
Total 629 629 0
Passed 563 563 0
Failed 66 66 0
Panics 0 0 0
Coverage 89.51% 89.51% 0.00%

ts/microsoft

Test result main count This PR count Difference
Total 18870 18870 0
Passed 13011 13011 0
Failed 5858 5858 0
Panics 1 1 0
Coverage 68.95% 68.95% 0.00%

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Feb 11, 2026

Walkthrough

This PR relaxes version constraints for the codspeed-criterion-compat dev-dependency across 13 crate Cargo.toml files, changing from exact version =3.0.5 to wildcard *. Additionally, biome_test_utils replaces the ansi_rgb dependency with owo-colors and updates bench_case.rs to use type-based colour specifiers instead of runtime colour functions.

Possibly related PRs

Suggested labels

A-Tooling, A-Project

Suggested reviewers

  • siketyan
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately describes the main objective: upgrading CVE'd crates and removing unmaintained dependencies, which aligns with all changes across the Cargo.toml files and the colour library replacement.
Description check ✅ Passed The PR description clearly relates to the changeset, explaining the motivation (CVEs and unmaintained crates) and detailing specific updates to bytes, time, codespeed, and replacing ansi_rgb with owo-colors.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch chore/upgrade-crates

Comment @coderabbitai help to get the list of available commands and usage tips.

@ematipico ematipico merged commit 7106566 into main Feb 11, 2026
30 checks passed
@ematipico ematipico deleted the chore/upgrade-crates branch February 11, 2026 10:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-Formatter Area: formatter A-Linter Area: linter A-Parser Area: parser A-Project Area: project L-CSS Language: CSS and super languages L-HTML Language: HTML and super languages L-JavaScript Language: JavaScript and super languages L-JSON Language: JSON and super languages L-Tailwind Language: Tailwind CSS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants