chore(deps): bump diffy from 0.4.2 to 0.5.1 in /codex-rs

[dependabot]

Bumps diffy from 0.4.2 to 0.5.1.

Changelog

Sourced from diffy's changelog.

[0.5.1] - 2026-07-18

Fixed

• #85 Merge conflict markers are now always placed on their own lines. Previously, a conflicting hunk at the end of a file without a trailing newline glued the next marker onto its last content line, producing unparseable output. This matches git merge-file --diff3 behavior.

[0.5.0]- 2026-04-27

This is a major release introducing multi-file patch support, git binary diff handling, and no_std compatibility.

Breaking Changes

• #73 The crate is now no_std by default. Patch::to_bytes() and PatchFormatter::write_patch_into() now require the std feature. Add features = ["std"] to restore them.
• #46 Color support is now behind the color feature flag. Previously color was always available. Now PatchFormatter::with_color() requires enabling the color feature. The underlying implementation switched from nu-ansi-term to anstyle.

Added

• #55 #59 #61 #66 #74 #76 Multi-file patch support. Parse and apply unified diff and git diff output containing multiple files, including create, delete, modify, rename, and copy operations. Git binary patches (literal and delta) are supported behind the binary feature flag.
• #80 New apply example demonstrating multi-file patch application.

Fixed

• #51 #82 Patch::from_str / from_bytes no longer error on trailing non-patch content after a complete hunk, matching GNU patch and git apply behavior.

... (truncated)

Commits

• 51e8723 release 0.5.1
• 31de940 merge: keep conflict markers on their own lines (#85)
• 721fcb8 clippy: allow(question_mark)
• 6fa93d4 tests: update expected output for git v2.54
• 4197dca release 0.5.0
• e16c388 meta: exclude tests directory from package
• ea1d695 binary: mark BinaryPatchParseError::span pub(crate)
• 8591d7b docs: add changelog entry for v0.5.0
• 16d2380 chore: bump to 0.5.0
• 077a7c4 fix(patch): hunk range overflow panic
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #482 @ 9f78000 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Exact candidate read:

• git log --oneline origin/main..HEAD — exit 0; one commit, 9f78000.
• git diff origin/main...HEAD --stat — exit 0; Cargo.lock and Cargo.toml, 7 insertions / 4 deletions.
• Full diffs for codex-rs/Cargo.toml and codex-rs/Cargo.lock — exit 0 for each. I also read the surrounding workspace dependency block, lock entries, all diffy call sites, TUI rendering/counting paths, apply-patch conversion paths, MODULE.bazel lock wiring, the repo Bazel-lock script/docs, and diffy 0.5.0/0.5.1 breaking-change notes.
• git diff --check origin/main...HEAD — exit 0. This was a lane-chosen inspection command, not a declared repo gate.

Declared setup and gates:

• bun install — exit 0; setup only, 521 packages installed. It generated an unrelated untracked bun.lock during pnpm migration; I removed that setup artifact and left the candidate clean.
• package.json declares no typecheck script.
• package.json declares no test script, so this repo declares NO TEST GATE. I did not invent one.
• gh pr view 482 --repo hasna/codewith --json statusCheckRollup — exit 0. Snapshot: 42 checks = 26 SUCCESS, 1 FAILURE, 3 SKIPPED, 12 IN_PROGRESS.
• gh run view 30942505022 --repo hasna/codewith --job 92104178128 --log-failed — exit 1 because the overall workflow was still running and logs were unavailable.
• gh run view 30942505022 --repo hasna/codewith --job 92104178128 — exit 0; the failed step is Check MODULE.bazel.lock is up to date, process exit 1.

Forge checks read by name:

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — FAILURE
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• metadata — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — IN_PROGRESS
• Build release x86_64-unknown-linux-gnu — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-gnu — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Build release aarch64-unknown-linux-gnu — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-gnu — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Build release x86_64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox x86_64-apple-darwin — SUCCESS
• Build release aarch64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox aarch64-apple-darwin — SUCCESS
• Build release x86_64-unknown-linux-musl — IN_PROGRESS
• Build ptrcomp-sandbox x86_64-unknown-linux-musl — IN_PROGRESS
• Build release aarch64-unknown-linux-musl — IN_PROGRESS
• Build ptrcomp-sandbox aarch64-unknown-linux-musl — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Build ptrcomp-sandbox x86_64-pc-windows-msvc from source — SUCCESS
• Build ptrcomp-sandbox aarch64-pc-windows-msvc from source — SUCCESS
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS
• Argument comment lint package — SKIPPED
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — IN_PROGRESS
• Argument comment lint - Linux — IN_PROGRESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings:

• P1 required-build gate: codex-rs/Cargo.toml and Cargo.lock resolve diffy 0.5.1, but MODULE.bazel.lock still records diffy_0.4.2 with nu-ansi-term. The repo requires dependency changes to refresh and commit MODULE.bazel.lock; its authoritative Linux Bazel job fails exactly at the lock-alignment step. Remedy: run the repo-owned Bazel lock update lane, commit the resulting MODULE.bazel.lock change, push, and let the same forge gate rerun.

Non-blocking follow-ups:

• The diffy 0.5 release gates Patch::to_bytes / write_patch_into behind std and color formatting behind color. Codewith does not call those APIs; its Patch, Hunk, Line, and create_patch use sites remain available. No correctness or security blocker was found on those reachable paths.
• The absence of package.json test and typecheck scripts is recorded as a repository-gate finding. It is not being turned into an invented blocker.

Verdict remains NO_GO until the stale Bazel lock is refreshed and the applicable authoritative gate is green.

[andrei-hasna]

[REVIEW-FIX] #482 — refreshed stale Bazel dependency metadata

Pushed c631681 to the PR branch. The generated MODULE.bazel.lock entry now resolves diffy_0.5.1 instead of diffy_0.4.2.

Verification:

• bazel mod deps --lockfile_mode=update — exit 0
• bazel mod deps --lockfile_mode=error — exit 0
• git diff --cached --check — exit 0
• shield review — exit 0, 1 staged file checked, 0 security issues
• git push origin HEAD:dependabot/cargo/codex-rs/diffy-0.5.1 — exit 0

[andrei-hasna]

[REVIEW] GO — #482 @ c631681 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Focused re-review

• Read the exact two-commit candidate against freshly fetched origin/main 64d4a7b, including the full diff and surrounding diffy call sites.
• The prior P1 is fixed: MODULE.bazel.lock now resolves diffy_0.5.1, and no diffy_0.4.2 entry remains.
• Blocking P0/P1 findings: none.

Commands actually run

• git log --oneline origin/main..HEAD — exit 0.
• git diff origin/main...HEAD --stat — exit 0; final candidate is 3 files, 8 insertions, 5 deletions.
• Full git diff reads for codex-rs/Cargo.toml, codex-rs/Cargo.lock, and MODULE.bazel.lock — exit 0.
• bun install — exit 0; setup only, not a test gate; 521 packages installed.
• just bazel-lock-update — exit 127 because just is not installed in this lane; no file changed by this failed invocation.
• bazel mod deps --lockfile_mode=update — exit 0; exact underlying command declared by the just recipe.
• bazel mod deps --lockfile_mode=error — exit 0; focused remediation check, 1 lock consistency check passed, 0 failed.
• git diff --cached --check — exit 0; lane-chosen check, 1 staged file checked, 0 failures.
• shield review — exit 0; lane-chosen staged security scan, 1 file checked, 0 security issues.
• git push origin HEAD:dependabot/cargo/codex-rs/diffy-0.5.1 — exit 0; pre-push scan ran.
• gh pr checks 482 --repo hasna/codewith --required — exit 1 because GitHub reports no required branch-protection checks on this branch.
• gh pr view 482 --repo hasna/codewith --json headRefOid,statusCheckRollup — exit 0; authoritative rollup at c631681: 43 checks, 38 SUCCESS, 0 failed, 3 SKIPPED, 2 IN_PROGRESS.

Declared repository gates

• package.json declares no test script, so this repository declares no test gate. No test command was invented.
• package.json declares no typecheck script. No typecheck command was invented.

Authoritative forge checks read by name

• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Build Codewith Linux CLI — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• metadata — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• Format / etc — SUCCESS
• sdks — SUCCESS
• Build release x86_64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Build release aarch64-unknown-linux-gnu — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-gnu — SUCCESS
• Build release x86_64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox x86_64-apple-darwin — SUCCESS
• Build release aarch64-apple-darwin — SUCCESS
• Build ptrcomp-sandbox aarch64-apple-darwin — SUCCESS
• Build release x86_64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox x86_64-unknown-linux-musl — SUCCESS
• Build release aarch64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox aarch64-unknown-linux-musl — SUCCESS
• Build ptrcomp-sandbox x86_64-pc-windows-msvc from source — IN_PROGRESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SUCCESS
• Build ptrcomp-sandbox aarch64-pc-windows-msvc from source — IN_PROGRESS
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Gate disposition

• The authoritative required aggregator is green, every completed substantive Rust/Bazel check is green, and GitHub reports no protected required-check subset.
• The two still-running Windows ptrcomp source builds are optional full-matrix backstop jobs, not required merge gates under this repository's declared fast-gate policy. They are disclosed as IN_PROGRESS and not counted as passes.

Non-blocking follow-ups

• The absence of a declared package test gate is a repository-level gap.
• The absence of a declared typecheck script is recorded; no typecheck gate was invented.