chore(deps): bump async-trait from 0.1.89 to 0.1.91 in /codex-rs

[dependabot]

Bumps async-trait from 0.1.89 to 0.1.91.

Release notes

Sourced from async-trait's releases.

0.1.91

• Update to syn 3 (#299)
• Fix mutability for by-reference receivers (#301)

0.1.90

(yanked)

Commits

• d049ee0 Release 0.1.91
• 7a0961f Merge pull request #301 from dtolnay/mutability
• 740f86f Ignore mut_mut pedantic clippy lint in test
• 4699cd3 Fix mutability for by-reference receivers
• 6dd3573 Add regression test for issue 300
• 2371797 Release 0.1.90
• d03f075 Merge pull request #299 from dtolnay/syn3
• 6cf42c1 Update to syn 3
• b9daaba Ignore match_same_arms pedantic clippy lint
• aa706d1 Update actions/upload-artifact@v6 -> v7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #479 @ 8774cef — lens: correctness+security+gates, reviewer unresolved-account003 (1 of 1)

Acceptance scope: pr479-lock-sync-v1 — review the exact origin/main...HEAD lockfile-only update, require Cargo/Bazel dependency-lock consistency and authoritative forge checks, and block only concrete reachable in-scope P0/P1 defects or required-gate failures.

What I read:

• git log --oneline origin/main..HEAD: one commit, 8774cef63 chore(deps): bump async-trait from 0.1.89 to 0.1.91 in /codex-rs.
• git diff origin/main...HEAD --stat: codex-rs/Cargo.lock | 17 ++++++++++++++---.
• Full diff and surrounding codex-rs/Cargo.lock package records, the workspace dependency declaration in codex-rs/Cargo.toml, the Bazel lock entry in MODULE.bazel.lock, the lock-check recipe/script references, and root package.json.
• The repo declares no typecheck script.
• The repo declares no test gate in package.json; no test script exists. I did not invent one.

Commands and results:

• bun install — exit 0; setup only, not a gate; 521 packages installed; pass/fail count N/A.
• gh pr view 479 --repo hasna/codewith --json statusCheckRollup — exit 0; 28 checks read: 19 success, 5 failure, 1 cancelled, 3 skipped.

Authoritative forge checks read, by name:

• FAILURE — Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — cla
• SUCCESS — Check for spelling errors
• SUCCESS — Blob size policy
• SUCCESS — cargo-deny
• SUCCESS — build-test
• SUCCESS — Build Codewith Linux CLI
• SUCCESS — Detect changed areas
• SUCCESS — python-sdk
• FAILURE — Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4
• SUCCESS — Format / etc
• SUCCESS — sdks
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4
• SKIPPED — Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main)
• SUCCESS — cargo shear
• FAILURE — Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SKIPPED — Argument comment lint package
• SUCCESS — Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm
• FAILURE — Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu
• CANCELLED — Argument comment lint - Linux
• SUCCESS — Verify release build on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — Argument comment lint - Windows
• FAILURE — CI results (required)
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm
• SKIPPED — [code]smith

Blocking P0/P1 findings:

• P1 required-build-gate failure: codex-rs/Cargo.lock resolves async-trait 0.1.91 with syn 3.0.3, while MODULE.bazel.lock still records async-trait_0.1.89. The Linux Bazel job's declared lock check printed MODULE.bazel.lock is out of date. and exited 1. This is a current, reachable dependency-lock inconsistency introduced by this PR. Remedy: run the repo-prescribed just bazel-lock-update, commit the regenerated MODULE.bazel.lock, then re-run the affected Bazel lock/build lanes.

Security/correctness:

• No additional concrete reachable P0/P1 correctness or security defect found in the dependency-only diff. cargo-deny is green.

Non-blocking follow-ups:

• None.

[andrei-hasna]

[FIX] Updated the PR head to defc1d8748 with the generated Bazel dependency metadata required by the Cargo lockfile change.

• Added async-trait_0.1.91 and syn_3.0.3 metadata to MODULE.bazel.lock.
• just bazel-lock-update could not run because just is not installed on this machine (exit 127), so I ran its exact declared recipe, bazel mod deps --lockfile_mode=update (exit 0).
• Focused failed lane: ./scripts/check-module-bazel-lock.sh — exit 0.
• Staged security scan: shield review — exit 0, No security issues found in staged changes.
• Commit: defc1d8 (fix(deps): refresh Bazel lock metadata).
• Push: exit 0; the pre-push hook scanned 1 commit.

[andrei-hasna]

[REVIEW] GO — #479 @ defc1d8 — lens: correctness+security+gates, reviewer unresolved-account003 (1 of 1)

Acceptance scope: pr479-lock-sync-v1 — focused re-review of the named MODULE.bazel.lock defect, its generated fix, and direct build/security regressions. Unchanged evidence and unrelated theoretical issues were not relitigated.

Focused verification:

• The prior P1 is fixed: MODULE.bazel.lock now carries async-trait_0.1.91 and syn_3.0.3 metadata generated by the repo-declared Bazel recipe.
• just bazel-lock-update — exit 127 because just is not installed; this wrapper failure is an environment fact, not a repo gate.
• bazel mod deps --lockfile_mode=update — exit 0; the lane's chosen remediation command, not package.json's gate.
• ./scripts/check-module-bazel-lock.sh — exit 0; 1 pass, 0 fail; this is the exact affected CI sub-lane that previously printed MODULE.bazel.lock is out of date.
• shield review — exit 0; 1 staged file checked, 0 security findings.
• bun install — exit 0; setup only, not a gate; 521 packages installed.
• gh pr view 479 --repo hasna/codewith --json statusCheckRollup — exit 0; 38 SUCCESS, 0 FAILURE, 2 IN_PROGRESS, 3 SKIPPED.
• The repo declares no typecheck script.
• The repo declares no test gate in package.json; no test script exists. No gate was invented.

Authoritative forge checks read, by name:

• SUCCESS — Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — cla
• SUCCESS — Check for spelling errors
• SUCCESS — Blob size policy
• SUCCESS — cargo-deny
• SUCCESS — build-test
• SUCCESS — Build Codewith Linux CLI
• SUCCESS — Detect changed areas
• SUCCESS — python-sdk
• SUCCESS — metadata
• SUCCESS — Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4
• SUCCESS — Format / etc
• SUCCESS — sdks
• SUCCESS — Build release x86_64-unknown-linux-gnu
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4
• SUCCESS — Build ptrcomp-sandbox x86_64-unknown-linux-gnu
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4
• SUCCESS — Build release aarch64-unknown-linux-gnu
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4
• SUCCESS — Build ptrcomp-sandbox aarch64-unknown-linux-gnu
• SUCCESS — Build release x86_64-apple-darwin
• SUCCESS — Build ptrcomp-sandbox x86_64-apple-darwin
• SUCCESS — Build release aarch64-apple-darwin
• SUCCESS — Build ptrcomp-sandbox aarch64-apple-darwin
• SUCCESS — Build release x86_64-unknown-linux-musl
• SUCCESS — Build ptrcomp-sandbox x86_64-unknown-linux-musl
• SUCCESS — Build release aarch64-unknown-linux-musl
• SUCCESS — Build ptrcomp-sandbox aarch64-unknown-linux-musl
• IN_PROGRESS — Build ptrcomp-sandbox x86_64-pc-windows-msvc from source
• SKIPPED — Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main)
• SUCCESS — cargo shear
• IN_PROGRESS — Build ptrcomp-sandbox aarch64-pc-windows-msvc from source
• SKIPPED — Argument comment lint package
• SUCCESS — Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu
• SUCCESS — Argument comment lint - Linux
• SUCCESS — Verify release build on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — Argument comment lint - Windows
• SUCCESS — Bazel test on windows-latest for x86_64-pc-windows-gnullvm
• SUCCESS — CI results (required)
• SKIPPED — [code]smith

Blocking P0/P1 findings:

• None. The named required-build-gate defect is fixed, its affected Linux Bazel lanes and CI results (required) are green, and no direct regression was found.

Non-blocking follow-ups:

• Two v8-canary Windows source-build confidence-backstop jobs remain in progress on live runners. They are not protected/required checks, are outside the generated lock-fix lane, and this repo explicitly does not make the full upstream-style matrix the immediate gate for a small release fix. Their pending state is recorded, not promoted into a false blocker.