* build(deps): update all Rust dependencies to latest versions
Bulk-update all Cargo.lock files across the workspace and bindings
to their latest compatible versions. This supersedes the individual
per-directory dependabot PRs (#678-#682) that fail CI due to version
skew when only one lockfile is updated.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* ci: refresh ALL Cargo lockfiles on dependabot PRs
Dependabot security updates bypass the grouped-updates config and
create per-directory PRs (one per Cargo.lock). This causes version
skew — e.g. rand gets bumped in bindings/ruby but stays old elsewhere,
breaking the build.
Fix by unconditionally refreshing all lockfiles whenever any Cargo
manifest or lockfile changes, rather than only the affected directory.
Also harden the workflow against expression injection:
- Move head.ref and base_ref to env vars (not inline ${{ }})
- Validate refs via git check-ref-format --branch
- Validate SHA format (hex, 40 chars) before use
- Fetch base branch by ref (not bare SHA) for reliable diffing
- Add security boundary comment on untrusted code checkout
- Add version comment on pinned checkout action SHA
Ref: https://github.com/dependabot/dependabot-core/issues/7547
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
dependabot[bot]