[27Bslash6]

Replaces the proptest MSRV hold with a cargo-vet hold: proptest joins the existing xxhash-rust rule, and the two proptest rules from #136 (the minor/major hold and its separateMinorPatch split) go.

The MSRV reason is gone. proptest 1.12.0 declares rust-version = "1.88". #137 raised the crate's rust-version and the CI floor job to 1.91, and the full suite passes on 1.91 with proptest 1.12.0 (cargo +1.91 test --all-features: 250 passed, 0 failed).

A second reason was hiding behind it. supply-chain/config.toml exempts only proptest 1.11.0 (safe-to-run), no imported feed audits it, and audits.toml does not trust its publisher. So every new proptest version fails cargo vet, the same as xxhash-rust. 1.12.0 also brings in seven crates that supply-chain/ does not cover yet. With cargo update -p proptest --precise 1.12.0, plain cargo vet (as CI runs it) on main's store:

Vetting Failed!
8 unvetted dependencies:
  borsh:1.8.1, borsh-derive:1.8.1, bytes:1.12.1, proc-macro-crate:3.5.0,
  proptest:1.12.0, rand_xorshift:0.5.0, toml_datetime:1.1.2+spec-1.1.0,
  toml_edit:0.25.13+spec-1.1.0  (all missing safe-to-run)
estimated audit backlog: 23590 lines

main itself passes. Dropping the hold outright would regenerate a rust-dev-deps group that fails Cargo Vet (Supply Chain). Recording those entries is a supply-chain trust decision for whoever approves the update, so proptest now waits under Pending Approval on the Dependency Dashboard, and the approver adds the entries on that branch, as with xxhash-rust. Vulnerability updates are still not held. The rule now holds proptest patches too, because a patch also falls outside the version-pinned exemption.

What Renovate proposes (Renovate 43.288.0 lookup dry-run against main's tree, org preset inlined): proptest 1.11.0 → 1.12.0 stays on its own branch renovate/proptest-1.x-lockfile, as before. No other cargo update changes branch.

renovate-config-validator --strict passes. No code change. Docs: none needed; the reason lives in the rule's description, and no doc mentions these rules.

[kodus-27b]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the `@kody start-review` command at the root of your PR.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Providing Context (Files & MCPs)

Add these hints in your PR description (or a comment) to unlock deeper checks:

• Ticket / Acceptance Criteria: `Refs: ABC-123` (Linear/Jira/Asana/ClickUp/Trello) or a direct ticket link.
• Bugfix Validation: a Sentry/Datadog/Bugsnag event link (or paste the stack trace/error message).
• Endpoint Risk: mention the route (e.g., `POST /api/payments`) or controller/action name.
• Attach a repo file as context: use an explicit marker like `@file:docs/guide.mdx#L10-L50` (replace with your real path).
• API Contract Docs: include `@file:openapi.yaml` or `@file:swagger.json` when changing routes/schemas.
• Definition of Done / Standards: include `@file:DOD.md` or `@file:CONTRIBUTING.md` if your repo has them.
• Design System Source of Truth: include `@file:ui/index.ts` (replace with your DS entrypoint path).
• Feature Flags: include the flag key/name and `@file:flags.ts` / `@file:config.json` (and optionally the PostHog flag name).
• Edge/CDN Rules: link the Cloudflare rule/zone or describe the intended redirect/header behavior.
• Attach an MCP tool output: use `@mcp<provider|tool>` (replace with an installed MCP provider + tool, e.g., `@mcp<sentry|events.search>`).

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: cachekit-io/cachekit-core
• Branch: lab-11225-drop-proptest-msrv-hold
• File: .coderabbit.yaml
• Commit: ea63b48
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 165cc681-2694-4330-88fc-aa98f9c9539d

Commits

Reviewing files that changed from the base of the PR and between b4e7b57 and ea63b48.

Files selected for processing: 1

• renovate.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Summary by CodeRabbit

• Chores
  • Updated internal dependency review settings to apply approval requirements consistently across selected Rust development dependencies. The settings also clarify audit coverage and when a dependency can be removed from the approval rule. There are no changes to app features, functionality, or user workflows. This update affects release maintenance rather than the experience of using the product.

Walkthrough

The Renovate configuration removes separate update rules for proptest and adds proptest to the existing cargo-vet approval rule with xxhash-rust.

Changes

Renovate approval rules

Layer / File(s)	Summary
Update and approval rules renovate.json	The separate proptest patch-separation and approval-hold rules were removed. The cargo-vet approval rule now covers proptest and xxhash-rust, and its description records proptest audit details and removal conditions.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related PRs

• cachekit-io/cachekit-core#136: Added the proptest Renovate hold and separateMinorPatch rule that this change removes.
• cachekit-io/cachekit-core#137: Raised the crate and CI Rust floor; this change refers to the updated MSRV when removing the old proptest hold.

Suggested reviewers: kodus-27b

Merge Risk: Minimal · up to ea63b

No actionable merge-blocking risk was identified in the Renovate configuration changes.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description clearly explains the change from an MSRV hold to a cargo-vet hold for proptest and relates directly to the changeset.
Title check		The title clearly identifies the main change: proptest is held for cargo-vet approval instead of the previous MSRV reason.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}