[plx]

Pull request

Problem

Ten Dependabot proposals were open. Each one was blocked:

• Bump clap from 4.6.4 to 4.6.6 #138 (clap) and Bump log from 0.4.33 to 0.4.34 #139 (log) never regenerated THIRD_PARTY_LICENSES.md, so Third-Party Licenses failed.
• chore(deps): bump syn from 2.0.119 to 3.0.3 #115 (syn 3), chore(deps): bump thiserror from 1.0.69 to 2.0.19 #116 (thiserror 2) and chore(deps): bump windows-sys from 0.60.2 to 0.61.2 #117 (windows-sys 0.61) are major bumps that changed only Cargo.lock. The Cargo.toml requirements (2.0 / 1.0 / 0.60) reject those lockfiles, so every build lane failed.
• Bump actions/checkout from 5.0.1 to 7.0.1 #130 (checkout v7) broke the issue Pin GitHub Actions and enforce least-privilege bounded workflow execution #61 workflow policy test, which pins the reviewed checkout SHA. It also left the README and .github/examples/readme-verify.yml CI example on v5.0.1.
• Bump actions/upload-artifact from 4.6.2 to 7.0.1 #129, Bump actions/deploy-pages from 4.0.5 to 5.0.0 #111, Bump actions/setup-node from 5.0.0 to 7.0.0 #112 and Bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #113 were otherwise fine, but main requires strict up-to-date checks. Merging them one at a time would mean a fresh CI cycle per PR, plus lockfile and license-file conflicts between them.

This PR combines all ten into one reviewed change. The Dependabot PRs will be closed as superseded once this merges.

Before behavior

main at 17c7727 has:

• clap 4.6.4 / clap_builder 4.6.2
• log 0.4.33
• thiserror 1.0.69, with a duplicate 2.0.19 pulled in transitively
• windows-sys 0.60.2 alongside 0.61.2, plus windows-targets 0.53.5 and eight windows_* 0.53.1 crates
• syn 2.0.119 as the dev-dependency
• checkout v5.0.1, upload-artifact v4.6.2, setup-node v5.0.0, upload-pages-artifact v4.0.0, deploy-pages v4.0.5

After behavior

Cargo:

• clap 4.6.6 / clap_builder 4.6.6 and log 0.4.34. Lockfile-only, same versions Dependabot proposed.
• thiserror = "2.0". The 1.0.69 pair leaves the graph. All #[error] attributes compile unchanged.
• windows-sys = "0.61". Every dependent is unified on 0.61.2, which removes windows-sys 0.60.2, windows-targets and the eight windows_* target crates.
• syn = { version = "3.0", ... } (dev-dependency). The syn-based contract tests compile and pass unchanged.
• The resulting package set is exactly the five Dependabot lockfile proposals combined. No other crate moved.

GitHub Actions:

Action	From	To	SHA
actions/checkout	v5.0.1	v7.0.1	3d3c42e5aac5ba805825da76410c181273ba90b1
actions/upload-artifact	v4.6.2	v7.0.1	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
actions/setup-node	v5.0.0	v7.0.0	820762786026740c76f36085b0efc47a31fe5020
actions/upload-pages-artifact	v4.0.0	v5.0.0	fc324d3547104276b827a68afc52ff2a11cc49c9
actions/deploy-pages	v4.0.5	v5.0.0	cd2ce8fcbc39b97be8ca5fce6e763baed58fa128

• I checked each SHA against the upstream tag with git ls-remote.
• Release-note review:
  • checkout v6/v7 changes only affect persisted credentials (we use persist-credentials: false) and pull_request_target/workflow_run fork checkouts (no workflow here uses those triggers).
  • upload-artifact v7 adds an opt-in archive: false.
  • The Pages actions move to Node 24 and upload-artifact v7.
• The issue Pin GitHub Actions and enforce least-privilege bounded workflow execution #61 checkout pin assertion, README.md and .github/examples/readme-verify.yml now name checkout v7.0.1.
• audits/2026-07-26-issue-61-workflow-hardening.md is a dated evidence record, so its pin table is left as-is.

Licenses:

• THIRD_PARTY_LICENSES.md is regenerated with cargo-about 0.9.0.
• After the graph change, about.toml held clarify blocks for four crates that are no longer present (windows-targets, windows_aarch64_msvc, windows_x86_64_gnu, windows_x86_64_msvc). cargo-about warned about them, so they are removed. The windows-sys clarification and its checksums still apply to 0.61.2.

Red-before-fix evidence

The failures are on the Dependabot PRs' own hosted runs:

• Bump log from 0.4.33 to 0.4.34 #139: Third-Party Licenses failed.
• chore(deps): bump syn from 2.0.119 to 3.0.3 #115: every build and Rust lane failed.
• Bump actions/checkout from 5.0.1 to 7.0.1 #130: the build and Rust lanes failed on the checkout pin test.

Validation

Local, Linux x86_64:

• cargo +1.85.0 clippy --locked --all-targets --all-features -- -D warnings and cargo +1.85.0 test --locked --all-targets --all-features: pass.
• cargo clippy --locked --all-targets --all-features -- -D warnings and cargo test --locked --all-targets --all-features on stable 1.97.0: pass.
• cargo check and cargo clippy -- -D warnings with --target x86_64-pc-windows-msvc: pass, which exercises the windows-sys 0.61 API surface.
• cargo fmt --check: pass.
• cargo test --locked --test issue_62_package_boundary -- --include-ignored, --test issue_64_release_identity, cargo package --locked and cargo publish --dry-run --locked: pass.
• python3 scripts/check_release_identity.py --tag v0.2.0: pass.
• cargo about generate about.hbs --output-file THIRD_PARTY_LICENSES.md: clean, no warnings, committed.
• agentic-navigation-guide verify --deny-ignored: pass.

Hosted CI covers macOS, Windows, Rust 1.96.1/1.97.1, coverage, mutation sentinels, performance and workflow lint.

site-publish.yml runs only on pushes to main, so the Pages actions are first exercised after merge.

Documentation and compatibility

• README.md: the CI example's checkout pin is updated to match the actionlint-checked example.
• No change to the CLI, guide format, exit statuses or the packaged file list.
• The Rust 1.85 floor is unchanged and verified.

Security and sensitive data

• Every action stays pinned to a full SHA with a version comment.
• No new permissions, triggers or secrets.
• The checkout v7 fork-checkout block for pull_request_target/workflow_run only tightens behavior.
• No tokens, secrets or private details are added.

Dependencies and issue graph

Supersedes the Dependabot PRs:

• Bump actions/deploy-pages from 4.0.5 to 5.0.0 #111, Bump actions/setup-node from 5.0.0 to 7.0.0 #112, Bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #113
• chore(deps): bump syn from 2.0.119 to 3.0.3 #115, chore(deps): bump thiserror from 1.0.69 to 2.0.19 #116, chore(deps): bump windows-sys from 0.60.2 to 0.61.2 #117
• Bump actions/upload-artifact from 4.6.2 to 7.0.1 #129, Bump actions/checkout from 5.0.1 to 7.0.1 #130
• Bump clap from 4.6.4 to 4.6.6 #138, Bump log from 0.4.33 to 0.4.34 #139

These are PRs, not issues, so there is no issue-scoped closing directive. They will be closed by hand after merge.

site/src/content/docs/docs/ci.mdx still shows a checkout v4.3.1 example. Dependabot doesn't manage that file and it is out of scope here.

Checklist

• This pull request addresses one concern (outstanding Dependabot updates) and contains no unrelated cleanup.
• The regression is deterministic, hermetic, bounded, and placed at the narrowest useful layer. The existing checkout pin assertion is updated rather than relaxed.
• Focused and full validation results are recorded above.
• User-facing and normative documentation are aligned where applicable.
• Dependency, license, package, release, and security impacts are explicit.
• Every review conversation is resolved before merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WUWzFoG6QJYfSytZacWniT

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T12:05:13.412576Z	2697961	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Review

Overall this is a well-scoped, mechanical dependency-consolidation PR, and the rationale for bundling all ten Dependabot proposals (avoiding repeated strict-required-check cycles and manifest/lockfile conflicts between them) is sound given this repo's branch protection.

Verified

• about.toml cleanup is correct. The four removed clarify blocks (windows-targets, windows_aarch64_msvc, windows_x86_64_gnu, windows_x86_64_msvc) are exactly the crates dropped from the graph now that every windows-sys dependent unifies on 0.61.2. The [windows-sys.clarify] block (with its license-file checksums) is correctly left in place, still needed for the surviving 0.61.2 entry.
• Cargo.lock dedup checks out. Post-change, dependency lists show bare "windows-sys" / "thiserror" (no version suffix) rather than "windows-sys 0.61.2" — that's only how Cargo renders a dep array when a single version remains, confirming the old 0.60.2/1.0.69 copies are really gone rather than just hidden in the diff.
• tests/issue_61_workflow_security_policy.rs was updated in lockstep with the new checkout pin/comment, so the regression test still enforces the reviewed SHA rather than being weakened.
• thiserror usage in src/errors.rs and src/cli/output.rs is plain #[derive(Error)]/#[error(...)]/#[from] — nothing that touches the areas that changed between thiserror 1.x and 2.x, so that bump looks low-risk.

Minor notes (non-blocking)

1. Action SHA pins aren't independently verifiable from this review environment (no outbound network access here), so I could only confirm the lockfile-internal consistency, not that each pinned SHA actually matches the claimed upstream tag (e.g. checkout@3d3c42e... ↔ v7.0.1). The PR body says these were checked with git ls-remote — since an incorrect commit pin is a real supply-chain risk, it'd be good for another reviewer with network access (or a CI step) to re-confirm those five SHA↔tag mappings before merge.
2. site/src/content/docs/docs/ci.mdx still shows actions/checkout@...v4.3.1 in its example. I confirmed via git log this predates this PR (introduced in Add contributor workflow and templates #137) and isn't Dependabot-managed, so it's reasonable to leave out of scope as the description says — but it's now a third, more-stale checkout reference alongside the freshly-bumped ones in the workflows/README, worth a follow-up issue so the doc examples don't drift further.
3. The syn 2.0 → 3.0 dev-dependency bump is a major version jump feeding the contract/robustness tests (parser_robustness_tests.rs, v0_2_contract_tests.rs, etc.). The PR claims these compile/pass unchanged across both the MSRV (1.85.0) and stable toolchains, which is the right evidence bar for a major bump — just flagging it as the highest-risk single change in this diff since it's the one most likely to silently change AST-shape assumptions in the test helpers.

Test coverage

No new tests, which is appropriate here — this is a pure dependency/version bump with one existing regression test updated to match (issue_61_workflow_security_policy.rs). No functional/CLI behavior changes, consistent with "No change to the CLI, guide format, exit statuses or the packaged file list" in the description.

Security

Nothing concerning: all actions remain full-SHA pinned with a version comment, persist-credentials: false is preserved everywhere, no permission/trigger/secret changes. The one thing worth double-checking (SHA↔tag mapping, note #1 above) is a verification gap on my end rather than a finding of an actual problem.

Nice attention to detail regenerating THIRD_PARTY_LICENSES.md and pruning the now-unused about.toml clarifications rather than leaving stale entries behind.

[plx]

Rust beta (informational) is red, but the cause is a beta toolchain change, not this PR. The lane is continue-on-error and isn't part of Required CI.

What fails: 11 binary unit tests, all panicking at src/test_support.rs:55 with error: profile 'out' is not defined.

Why:

• Cargo 1.100.0-beta.7 moves unit-test executables to its build-dir layout, target/debug/build/agentic-navigation-guide/<hash>/out/agentic_navigation_guide-<hash>. Stable uses target/debug/deps/….
• cli_binary() only strips a trailing deps, so with the new layout it treats out as the profile name and runs cargo build --profile out.

Not this PR's:

• I reproduced the identical 11 failures locally with beta on main at 17c7727.
• This PR doesn't touch src/test_support.rs.
• The failure is deterministic, so a re-run wouldn't tell us anything.

Proposed fix (separate follow-up, not added here to keep this PR scoped to the dependency updates). Verified locally: 228 passed on both 1.100.0-beta.7 and stable.

             binary.pop();
             if binary.ends_with("deps") {
                 binary.pop();
+            } else if binary.ends_with("out") {
+                // Cargo's build-dir layout places unit tests at
+                // <profile>/build/<package>/<hash>/out/<test executable>.
+                binary.pop();
+                binary.pop();
+                binary.pop();
+                if binary.ends_with("build") {
+                    binary.pop();
+                }
             }

---

Generated by Claude Code