chore(deps): update github-actions

[cachekit-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/create-github-app-token	action	minor	v3.0.0 → v3.2.0	v3.3.0
codecov/codecov-action	action	minor	v7.0.0 → v7.1.1
rust (source, changelog)	uses-with	minor	1.97.1 → 1.99.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

v3.1.1

Compare Source

Bug Fixes

• improve error message when app identifier is empty (#​362) (07e2b76), closes #​249

v3.1.0

Compare Source

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#​357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#​353) (e6bd4e6)
• update permission inputs (#​358) (076e948)

codecov/codecov-action (codecov/codecov-action)

v7.1.1

Compare Source

What's Changed

• chore(release): 7.1.1 by @​thomasrockhu-codecov in #​1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

Compare Source

What's Changed

• chore(release): 7.1.0 by @​thomasrockhu-codecov in #​1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

rust-lang/rust (rust)

v1.99.0

Compare Source

==========================

Language

• Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows
• Extend unconditional_panic lint to function calls that panic when the chunks/windows size is zero
• Stabilize C-variadic function definitions
• Stabilize the ability to use #[unsafe(naked)] functions to define C-variadic functions (#![feature(c_variadic_naked_functions)]).
• Trait methods are now resolved on an adjusted never type (producing a FCW)
• Coerce from inference variables to trait objects if the inference variable is related via subtyping to a type that is known to be Sized
• Stabilize #[my_macro] mod foo;. This allows outlined modules (mod foo;) anywhere in the body of a custom attribute or derive macro.
• Fix the overflowing_literals lint with repeated negation. For instance, it will now no longer lint on --128_i8, which is already detected by the arithmetic_overflow lint.
• Add POSIX symbols to the invalid_runtime_symbol_definitions and suspicious_runtime_symbol_definitions lints
• Lint unused #[path] attributes on inline modules
• Enable unreachable_cfg_select_predicates lint as part of unused lint group
• Stabilize passing 128-bit integers via vector registers with asm! on x86
• Explicitly document that some allocations are allowed to grow in-place (but none are allowed to shrink)
• We now guarantee that the contents of an UnsafeCell can be accessed without going through get
  • The invalid_reference_casting lint was adjusted accordingly
• Account for globally enabled target features in global_asm!
• Warn if an invalid doc attribute is used on a macro invocation

Compiler

• Convert -Ctarget-cpu into a target-modifier for AVR, AMDGCN and NVPTX
• Enable static_position_independent_executables on all gnu targets
• When providing a suggestion about a missing method, rustc now prefers an exactly matching name from a doc alias attribute over a similarity search from other method names. If your new users sometimes expect a method under a different name, adding a doc alias will now help them find it via rustc suggestions, in addition to helping them find it via rustdoc search: When suggesting method names, prefer exact doc aliases over similar names

Platform Support

• Promote riscv64-unknown-linux-musl to Tier 2 with host tools

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Iteration on RangeInclusive (a..=b ranges) is now optimized better in some circumstances. As a side effect of this, the behavior of RangeInclusive values that has already been exhausted (as an iterator) has changed. For example, the return values of start() and end() on such ranges may return different values, and using such ranges as slice indexes may have different behavior. These behaviors were not guaranteed to be stable, so these changes are considered to not be breaking changes.
• Relax transmute_copy to accept ?Sized types
• Update transmute_copy to use a non-unwinding panic
• Don't escape U+FF9E and U+FF9F in escape_debug_ext
• Re-export core::fmt::NumBuffer in alloc (and std)

Stabilized APIs

• IntoIterator for Box<[T; N]>
• IntoIterator for &Box<[T; N]>
• IntoIterator for &mut Box<[T; N]>
• VecDeque::retain_back
• core::ffi::VaList
• Box::into_non_null
• Box::from_non_null
• Vec::into_parts
• Vec::from_parts
• core::mem::size_of_val_raw
• core::mem::align_of_val_raw
• core::alloc::Layout::for_value_raw
• String::from_utf8_lossy_owned
• string::FromUtf8Error::into_utf8_lossy
• FusedIterator for StepBy<I>
• std::fs::set_times
• std::fs::set_times_nofollow

Cargo

• Add a new built-in profile debug. This is a preparation for transitioning the dev profile away from debugging to give a saner default for faster development iterations. Currently there is no difference between dev and debug profiles. docs #​17214
• Workspace members on edition 2024 or later can now override an inherited workspace dependency's default-features field. For example, serde = { workspace = true, default-features = false } now turns off default features even when the workspace definition enables them. On earlier editions, default-features = false is ignored with a warning. (RFC 3945) #​17126

See also the full Cargo changelog

Rustdoc

• Add new unused_footnote_definition rustdoc lint
• Smarter filtering of trait impls yields performance improvements of 20% on average and up to 40% on some real-world crates. (1, 2, 3, 4, 5)

Compatibility Notes

• Fully deprecate the legacy integral modules. For example, std::i32::MAX should be accessed via i32::MAX instead.
• Upgrade no_mangle_generic_items into hard error
• The Pin::new_unchecked has had its safety invariants changed slightly
• Do not promote references to extern statics
• Ensure that the inferred types of let patterns typecheck
• hermit/fs: Return unsupported() instead of from_raw_os_error(22)
• Fixed a bug where #[repr(simd)] was accidentally allowed on macro invocations on stable Rust
• Abort const-eval when there are generics in the type of the value being produced
• Attributes not applying to anything are now an error in code blocks in doc comments
• Box::leak: tell people to avoid unleaking
• PowerPC inline ASM: Fix scalar floats being in the wrong vector lane on little endian
• Do not take doc(cfg()) into account when filtering doctests
• Infer anonymous lifetimes in the types of associated consts as 'static
• Macros that expand to a semicolon now produce a warning lint (semicolon_in_expressions_from_non_local_macros) even when the macro comes from another crate. Previously, such warnings only appeared for macros from the same crate, to avoid showing warnings that can't be fixed locally; however, this masked problems, as integration tests from the crate providing the macro get compiled as a separate crate, so tests often wouldn't reveal this issue. If you encounter a lint like this, please make sure to report it to the crate providing the macro so they can fix it; don't just silence it in your own crate.
  • semicolon_in_expressions_from_macros: Lint on non-local macros too
  • Split non-local semicolon_in_expressions_from_macros into a separate lint
• In Cargo, incremental compilation is now disabled by default when running in CI. CI is detected via the CI environment variable. #​17220
• The Rust Reference no longer recommends using a single pattern to match a union alongside another value, such as in a manually-written tagged union. This was because it was found that such code would, in some circumstances, result in the compiler reading the contents of the union before checking if the rest of the scrutinee matches the rest of the pattern. This can cause undefined behavior in code similar to what the reference previously recommended.

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

• Update to LLVM 23

v1.98.1

Compare Source

===========================

• rustc: fix miscompilation in generating vtables

v1.98.0

Compare Source

==========================

Language

• Allow shortening lifetime of &mut when unsize-coercing, even in an invariant position. For example, you can now coerce a Cell<&'long mut i32> to a Cell<&'short mut dyn Send>. Such shortenings were already previously allowed when coercing a &mut to a &, or coercing a & to a &.
• Add deny-by-default invalid_runtime_symbol_definitions lint and warn-by-default suspicious_runtime_symbol_definitions lint
  • The lints currently specifically targets core runtime symbols like memcmp, memset, strlen, ... and is planned to be expanded in the next few releases.
• Add warn-by-default c_void_returns lint to check core::ffi::c_void as a return type

Platform Support

• Add powerpc64-unknown-linux-gnuelfv2 as Tier 3
• Add aarch64-unknown-linux-pauthtest as Tier 3 target
• Promote thumbv7a-none-eabi to Tier 2
• Promote thumbv7a-none-eabihf to Tier 2
• Promote thumbv7r-none-eabi to Tier 2
• Promote thumbv7r-none-eabihf to Tier 2
• Promote thumbv8r-none-eabihf to Tier 2

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Change Location<'_> lifetime to 'static in Panic[Hook]Info
• Document panic in RangeInclusive::from(legacy::RangeInclusive)
• Document that ManuallyDrop's Box interaction has been fixed
• Stabilize LoongArch CRC Intrinsics
• The derive macro is available at {core,std}::derive. This was previously unintentionally stabilized in 1.96, but is now explicitly accepted as a stabilized API.
  • Please note that the MSRV for {core,std}::derive will be 1.96, and not 1.98.

Stabilized APIs

• str::substr_range
• [T]::subslice_range
• core::fmt::NumBuffer
• <{integer}>::format_into
• Send/Sync for std::process::CommandArgs
• {fN}::algebraic_add
• {fN}::algebraic_sub
• {fN}::algebraic_mul
• {fN}::algebraic_div
• {fN}::algebraic_rem
• NonZero<{integer}>::from_str_radix
• String::from_utf16le
• String::from_utf16le_lossy
• String::from_utf16be
• String::from_utf16be_lossy
• [T]::strip_circumfix
• str::strip_circumfix
• Atomic<T>::from_mut
• Atomic<T>::get_mut_slice
• Atomic<T>::from_mut_slice
• std::range::legacy
• bool::ok_or
• bool::ok_or_else

Compatibility Notes

• If fully elided, lifetime bounds of trait object types may now resolve differently or even get rejected in very specific niche scenarios
• Error in more cases of ambiguous imports
• Switch the destructors implementation for thread locals on Windows to use Fiber Local Storage (FLS)
• Convert some cases of the ambiguous_glob_imports lint into a hard error
• Where-bounds of the form Type = Type and Type == Type are no longer syntactically allowed
• Ensure Send/Sync is not implemented for std::env::Vars{,Os}
• Fix that in some attributes, arguments were not properly rejected
• repr(transparent) is now more strict about which fields have "trivial" layout and hence can be ignored: repr(C) types, types with private fields, and #[non_exhaustive] types are no longer considered "trivial"
• Correctly check whether types have equal size in transmute() when some repr attributes are involved.
• More characters are escaped when printing strings and chars
• Implement fast path for derive(PartialOrd) when deriving Ord
  This can break crates in practice where a type's PartialOrd and Ord impls were inconsistent with each other.
• Add temporary scope to assert_eq and assert_ne
• Closed a hole in the pattern matching structural equality check, preventing cases where a match of a constant would be allowed, despite disagreeing with a manually written PartialEq implementation, when a derive(PartialEq) implementation for that type also exists.
• On Emscripten the WASM exception handling ABI is now unconditionally used The -Zemscripten-wasm-eh=false flag to switch back to JS exceptions has been removed.
• The UNSAFE_CODE lint is now consistently emitted for all unsafe attributes
• Solaris: remove File::lock implementation, it has the wrong semantics (return "unsupported" instead)
• Windows-gnu targets now specify baseline tools versions
• rustfmt now discovers module files that are defined in cfg_select!
  This may cause more code to be formatted which was previously ignored.

---

Configuration

📅 Schedule: (in timezone Australia/Sydney)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: cachekit-io/cachekit-ts/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5f4a5c00-aaf9-48c8-a242-06a508c7a87a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.