chore(deps): bump wasmparser from 0.256.0 to 0.257.1

[dependabot]

Bumps wasmparser from 0.256.0 to 0.257.1.

Commits

• See full diff in compare view

[github-actions]

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.256.0 -> 0.257.1: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

[github-actions]

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.256.0 -> 0.257.1: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

[avrabe]

Held — and this is the hold working as designed.

wasmparser 0.256.0 → 0.257.1 is a 0.x-minor, which semver treats as non-breaking (major = 0). The full suite disagrees: 54 failing checks.

Its four siblings from the same batch — #1032 wit-parser, #1033 ordeal, #1035 wast, #1037 rivet — all went green on all 9 required contexts and have been merged. This one did not, and it is the reason the hold gates on CI rather than on a maintainer's read of the diff: from the outside these five bumps were indistinguishable.

Prior specimens of the same class: object 0.39 → 0.40 broke 16 call sites across three unrelated newtype surfaces (#1008); ordeal 0.9 → 0.12 auto-merged as "minor" and hung Test + Z3 for hours across days.

Staying held until the 54 failures are diagnosed. Enforcement is #965 / RQ-59-MINORHOLD (#1022), which is why auto-merge is off and major-bump-hold is applied rather than this sitting green-and-unnoticed.

[github-actions]

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.256.0 -> 0.257.1: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

[github-actions]

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.256.0 -> 0.257.1: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

[avrabe]

Closing — held by policy, and now the policy is a mechanism rather than a maintainer's read.

The machine verdict

RQ-59-MINORHOLD shipped in v0.59.0, which turned #965's documented-but-unenforced hold into an enforced, tested classifier. Running the shipped tool on this bump:

$ python3 scripts/dependabot_minor_hold.py --prev 0.256.0 --new 0.257.1
decision=hold
class=zerox-minor
reason=0.256.0 -> 0.257.1: for a 0.x crate the MINOR is the de-facto major
       (ordeal 0.9->0.12; object 0.39->0.40 / #938)

This PR was held by hand when it opened. It is now held by the gate, with a machine-readable reason — which is the outcome #965 asked for.

Why closing rather than leaving it open

• 11 commits behind main, with 5 required checks red (Clippy, Test, Z3, Bazel, Kani). Those failures were measured against a main that has since taken v0.59.0 and six v0.60 increments; the "54 failures" figure this was held on is long stale and no longer means anything.
• Not a security bump — no advisory in the PR body, and the workspace pins wasmparser = "0.256" with nothing requiring 0.257.
• Dependabot runs weekly, so if this bump still matters it returns against a fresh main without a fortnight of drift. A stale red PR held open is noise that makes the board harder to read, not a placeholder.

What taking it would require

The hold is not "never" — it is "not automatically". A 0.x-minor bump of a parser this deep needs the full suite green on a fresh base, deliberately, not an auto-merge. The precedents are why: ordeal 0.9→0.12 hung Test and Z3 for hours on a perf regression, and object 0.39→0.40 broke 16 call sites across three unrelated newtype surfaces — including RelocationFlags::Elf { r_type } struct-destructuring sites that no .r_type( search finds.

That last one is the standing method note from #938 and worth repeating here: the sweep was asserted complete from a grep and was wrong twice (2 sites → 6 → 16). A grep is a hypothesis; the compiler is the oracle. Whoever takes this next should build every CI feature set, not search for call sites.

Refs #965

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.