[wu-sheng]

Bumps dependencies in Cargo.lock to close open Dependabot alerts.

Changes

Package	Old	New	Advisory
bytes	1.10.1	1.11.1	GHSA-434x-w66g-qw3r / CVE-2026-25541 (integer overflow in BytesMut::reserve)
rand	0.8.5	0.8.6	GHSA-cq8v-f236-94qc
atty	0.2.14	removed	GHSA-g98v-hv3f-hcfr (no patched release)

• bytes and rand are lockfile-only bumps (cargo update -p <crate> --precise <ver>).
• atty came only from the test-only e2e crate: e2e -> structopt 0.3.26 -> clap 2.34.0 (default "color" feature) -> atty. e2e/Cargo.toml now uses structopt = { version = "0.3", default-features = false }, which turns off clap 2's color, suggestions and vec_map features. This removes atty, ansi_term, strsim 0.8, vec_map and hermit-abi 0.1 from Cargo.lock. The e2e binary only parses one flag, so the only effect is uncolored help output and no "did you mean" suggestions.
• dist-material/LICENSE regenerated with license-eye dependency resolve --summary (same commit as CI).

Supersedes #74 (rand 0.8.6; that PR also fails license-check because LICENSE was not updated).

Not changed

• time stays at 0.3.41 (GHSA-r6v5-fh4h-64xc / CVE-2026-25727). The only fixed version, 0.3.47 (with time-core 0.1.8), requires Rust 1.88, while rust-version and rust-toolchain.toml are 1.85. time is pulled only through systemstat (optional management feature). Fixing it needs an MSRV/toolchain bump to 1.88, left for a separate decision.

Verified locally (rustc/cargo 1.85.1 from rust-toolchain.toml, RUSTFLAGS="-D warnings")

All passed:

• cargo check --workspace --release --all-features and cargo check --workspace --release
• cargo clippy --workspace --release --all-features -- -D warnings and the same without features
• cargo test --workspace --release --all-features and cargo test --workspace --release
• cargo fmt --all -- --check
• e2e --help / --mode parsing still works with structopt default features off
• license-eye header check, license-eye dependency check and license-eye dependency resolve --summary ./dist-material/LICENSE.tpl with both the old pin (d299844e) and v0.9.0; both produce the same dist-material/LICENSE

Not run locally: the fmt job's nightly-2025-03-24 toolchain (stable rustfmt was used; no Rust source changed), doc, codecov/tarpaulin, and the docker-compose e2e. CI covers these.

GitHub Actions

Updated to versions allowed by the ASF Actions policy (GitHub-owned and apache/* actions are allowed org-wide; codecov/codecov-action@* is on the ASF allow list):

Action	Old	New	Notes
actions/checkout	v2	v7	node24 runtime; submodules input unchanged. The v7 fork-PR block only affects pull_request_target/workflow_run, which are not used here.
apache/skywalking-eyes/header, apache/skywalking-eyes/dependency	d299844e (2023-03)	a196742f (v0.9.0)	Same inputs (config). The go install license-eye@... in the LICENSE summary step moves to the same commit so the action and summary check use one version.
codecov/codecov-action	v2.1.0	v7.1.1	Uploads with Codecov OIDC: use_oidc: true plus job permissions: contents: read, id-token: write. Without it, v7 rejected the upload from this in-repo branch ("Token required because branch is protected", run 41410827092). With OIDC, the upload for PR head f7cc816 (run 41414700660) and for the master merge commit baa7e41 (push run 41418320645) both succeeded and are processed on Codecov. Fork PRs skip OIDC and use Codecov's tokenless fork upload. fail_ci_if_error stays at its default (false).

E2E

The e2e workflow uses docker compose (v2) directly on ubuntu-24.04 and does not use apache/skywalking-infra-e2e, so no infra-e2e re-pin is needed. No docker-compose v1 calls, top-level compose version: keys or removed runner images were found.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.45%. Comparing base (45d9198) to head (f7cc816).
⚠️ Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #75      +/-   ##
==========================================
+ Coverage   13.29%   15.45%   +2.16%     
==========================================
  Files          21       18       -3     
  Lines         790      686     -104     
==========================================
+ Hits          105      106       +1     
+ Misses        685      580     -105     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.