chore(deps): combined Dependabot updates (Cargo + npm + actions) by barakb · Pull Request #236 · FalkorDB/benchmark

barakb · 2026-07-23T11:51:17Z

Combines the open Dependabot PRs into one green PR (verified locally: just build / just clippy / just test, and just ui-lint / just ui-build).

Cargo (#223, #224, #226, #227, #228)

serde 1.0.215 → 1.0.229
thiserror 2.0.6 → 2.0.19
tokio 1.52.3 → 1.53.1
tokio-stream 0.1.17 → 0.1.19
toml 0.8 → 1.1.3 (major) — toml::from_str now requires the serde feature alongside parse; added to the feature set. Parsing verified via the thresholds/config unit tests.

npm — `ui/` (#229, #230, #232, #233)

next 15.5.18 → 16.2.11 (major)
tailwind-merge 2.6.0 → 3.6.0 (major)
@radix-ui/react-tooltip 1.1.6 → 1.2.14
npm-minor-patch group (chore(deps): bump the npm-minor-patch group in /ui with 14 updates #229): @radix-ui/react-{checkbox,collapsible,dialog,hover-card,separator,slot,toast,toggle,toggle-group}, react + react-dom 19.2.8, eslint-config-next 16.2.11, postcss 8.5.22

GitHub Actions (#225)

taiki-e/install-action 2.83.4 → 2.84.1 (SHA-pinned c44f6b04… across ci/coverage/docs/playwright)

Held back

chore(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /ui #231 typescript 5 → 7 — TS 7.0 is the new native compiler; typescript-eslint does not support it yet (typescript-eslint does not support TS 7.0), which breaks just ui-lint. Excluded until the eslint toolchain supports TS 7 (tracking: Enhancement: Use TS 7 (tsgo / typescript-go) for type information typescript-eslint/typescript-eslint#10940).

Closes #223, #224, #226, #227, #228, #229, #230, #232, #233, #225.

Combined Dependabot Cargo updates: - serde 1.0.215 → 1.0.229 (#228) - thiserror 2.0.6 → 2.0.19 (#227) - tokio 1.52.3 → 1.53.1 (#223) - tokio-stream 0.1.17 → 0.1.19 (#224) - toml 0.8 → 1.1.3 (#226) — major; from_str now needs the `serde` feature alongside `parse`, added to the toml feature set. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…react) Combined Dependabot npm updates (ui/): - next 15.5.18 → 16.2.11 (#232, major) - tailwind-merge 2.6.0 → 3.6.0 (#233, major) - @radix-ui/react-tooltip 1.1.6 → 1.2.14 (#230) - npm-minor-patch group (#229): @radix-ui/react-{checkbox,collapsible, dialog,hover-card,separator,slot,toast,toggle,toggle-group}, react + react-dom 19.2.8, eslint-config-next 16.2.11, postcss 8.5.22. Excludes #231 (typescript 5 → 7): TS 7.0 is the new native compiler and typescript-eslint doesn't support it yet ("typescript-eslint does not support TS 7.0"), which breaks `just ui-lint`. Held back until the eslint toolchain supports TS 7. ui-lint + ui-build verified green locally. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

SHA-pinned (c44f6b04… # v2.84.1) across ci.yml, coverage.yml, docs.yml, and playwright.yml, matching the CodeQL "pin third-party actions to a SHA" requirement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vercel · 2026-07-23T11:51:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
benchmark	Ready	Preview, Comment	Jul 23, 2026 11:51am

coderabbitai · 2026-07-23T11:51:24Z

Warning

Review limit reached

@barakb, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 31 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ef67fe1a-9361-4cc1-8554-290e61091b26

📥 Commits

Reviewing files that changed from the base of the PR and between 470942f and 70ecdf5.

⛔ Files ignored due to path filters (2)

Cargo.lock is excluded by !**/*.lock, !Cargo.lock
ui/package-lock.json is excluded by !**/package-lock.json, !ui/package-lock.json

📒 Files selected for processing (6)

.github/workflows/ci.yml
.github/workflows/coverage.yml
.github/workflows/docs.yml
.github/workflows/playwright.yml
Cargo.toml
ui/package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch barakb/combined-dependabot-2026-07-23

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Pull request overview

Consolidates multiple Dependabot updates into a single PR, covering Rust dependencies, UI (Next.js) dependencies, and GitHub Actions pin updates.

Changes:

Bumped Rust crates (notably tokio, serde, thiserror, and toml with a feature adjustment for serde).
Bumped UI dependencies, including a major next upgrade to ^16.2.11 and tailwind-merge to ^3.6.0, plus Radix package updates.
Updated taiki-e/install-action to a newer SHA-pinned commit across workflows.

Reviewed changes

Copilot reviewed 6 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ui/package.json	Updates UI dependency versions (Next.js major bump, Radix, React patch, tailwind-merge major).
ui/package-lock.json	Regenerates lockfile to reflect updated UI dependency graph after upgrades.
Cargo.toml	Updates Rust dependency versions; `toml` major bump and feature set updated.
Cargo.lock	Updates locked Rust dependency graph to match Cargo.toml bumps (incl. syn/thiserror/tokio/toml transitive changes).
.github/workflows/playwright.yml	Updates `taiki-e/install-action` pinned SHA used in Playwright job.
.github/workflows/docs.yml	Updates `taiki-e/install-action` pinned SHA used in docs validation job.
.github/workflows/coverage.yml	Updates `taiki-e/install-action` pinned SHA used in coverage job.
.github/workflows/ci.yml	Updates `taiki-e/install-action` pinned SHA used in Rust CI + synthetic verify jobs.

codecov · 2026-07-23T11:54:32Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 47.32%. Comparing base (470942f) to head (70ecdf5).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #236   +/-   ##
=======================================
  Coverage   47.32%   47.32%           
=======================================
  Files          35       35           
  Lines       13406    13406           
  Branches    13406    13406           
=======================================
  Hits         6345     6345           
  Misses       6843     6843           
  Partials      218      218

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-07-23T11:57:31Z

🔁 Synthetic non-divergence — same-machine A/B. The recorded workload (every read op) ran twice against the same FalkorDB, back-to-back on one machine, across concurrency 1,2,4,8,16,32 × cached/uncached. The gate fails only if a per-op result digest or the workload_hash differs — so the latency deltas below are same-machine noise, not a regression.

Synthetic benchmark diff — A → B

field	A (baseline)	B (candidate)
FalkorDB module	4.20.1	4.20.1
server image	falkordb/falkordb@sha256:9042fdc4e53f5390ca5a3993aa71506523970efb40ffb9a98e6a4b1a9a4f8862	falkordb/falkordb@sha256:9042fdc4e53f5390ca5a3993aa71506523970efb40ffb9a98e6a4b1a9a4f8862
endpoint / graph	`falkor://127.0.0.1:6381` / `verify`	`falkor://127.0.0.1:6381` / `verify`
workload_hash	`sha256:3b2f76388752d7b45d4deca697857e92b59a7817606ff18664a509e4528be306`	`sha256:3b2f76388752d7b45d4deca697857e92b59a7817606ff18664a509e4528be306`
samples / warmup	200 / 50	200 / 50

Δ is 100·(candidate−baseline)/baseline. Latency: lower is better (a positive Δ = slower / regressed); throughput: higher is better. — = not measured in that run.

⚠ baseline and candidate ran the same FalkorDB module version (4.20.1) — there is no version delta to measure

Per-op A/B — latency (p50/p90/p95/p99) & throughput, every read op × concurrency × cached/uncached