chore(deps): harden dependency updates (#28)

.github/dependabot.yml

@@ -3,23 +3,44 @@ updates:
   - package-ecosystem: cargo
     directories:
       - "/"
-      - "/bench"
       - "/fuzz"
     schedule:
       interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Europe/Berlin
     labels:
       - dependencies
       - cargo
     open-pull-requests-limit: 10
     groups:
-      patch-and-minor:
+      cargo-non-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
         update-types:
           - patch
           - minor
+
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Europe/Berlin
     labels:
       - dependencies
       - github-actions
+    open-pull-requests-limit: 10
+    groups:
+      github-actions-non-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - patch
+          - minor
+    ignore:
+      # These refs select the Rust/MSRV version rather than an action release.
+      - dependency-name: dtolnay/rust-toolchain

.github/workflows/check.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo check
+      - run: cargo check --locked

.github/workflows/clippy.yml

@@ -19,4 +19,4 @@ jobs:
         with:
           components: clippy
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo clippy --locked --all-targets -- -D warnings

.github/workflows/coverage.yml

@@ -20,7 +20,7 @@ jobs:
           components: llvm-tools-preview
       - uses: Swatinem/rust-cache@v2.9.1
       - uses: taiki-e/install-action@cargo-llvm-cov
-      - run: cargo llvm-cov --workspace --all-targets --lcov --output-path lcov.info
+      - run: cargo llvm-cov --locked --workspace --all-targets --lcov --output-path lcov.info
       - name: Upload coverage reports to Codecov
         uses: codecov/codecov-action@v7
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'

.github/workflows/cross-platform.yml

@@ -23,5 +23,5 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo check
+      - run: cargo check --locked
-      - run: cargo test
+      - run: cargo test --locked

.github/workflows/release.yml

@@ -63,8 +63,8 @@ jobs:
       - name: Verify package
         if: steps.tag.outputs.exists == 'false'
         run: |
-          cargo package
+          cargo package --locked
-          cargo test
+          cargo test --locked
 
       - name: Authenticate with crates.io
         if: steps.tag.outputs.exists == 'false'

.github/workflows/test.yml

@@ -17,4 +17,4 @@ jobs:
       - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@1.88.0
       - uses: Swatinem/rust-cache@v2.9.1
-      - run: cargo test
+      - run: cargo test --locked

.gitignore

@@ -1,2 +1 @@
 /target
-/Cargo.lock

fuzz/Cargo.lock

@@ -725,7 +725,7 @@ checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "tui-textarea-2"
-version = "0.9.1"
+version = "0.12.1"
 dependencies = [
  "arbitrary",
  "crossterm",