chore: update dependencies and Rust tooling

[jan-kubica]

Summary

• update Bun, Cargo, and pinned GitHub Actions dependencies, including Changesets 3 and the latest Oxc tools; configure Changesets to format with Oxfmt
• add a checksum-verified Hawk 0.1.12 visibility gate on Rust 1.97.1, tighten three internal visibilities, and retain strict Clippy and Dylint checks
• add a patch Changeset so the fixed package group receives a synchronized release

Bon is intentionally not added: the meaningful multi-field construction surface is const/static ValidatorSpec data, which Bon builders cannot replace, while the remaining runtime APIs have no optional configuration that benefits from a builder.

Validation

Canonical Bun, Cargo, Clippy, Dylint, Hawk, generated-surface, version, oracle, performance, package, and smoke checks pass locally.

Summary by CodeRabbit

• Release

  • Prepared a patch release with refreshed package builds and updated publishing processes.

• Documentation

  • Simplified the README by removing outdated generated registry information.

• Quality and Maintenance

  • Strengthened automated checks and security verification across supported package builds.
  • Updated development tooling and package manager requirements to improve build reliability.
  • Refined internal visibility and formatting without changing validation behaviour.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 9 package(s) with unknown licenses.

View full job summary

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e1c727f-00d8-4d9e-9540-c9407e61de7c

📥 Commits

Reviewing files that changed from the base of the PR and between 4da0abc and e8a4b06.

⛔ Files ignored due to path filters (5)

• Cargo.lock is excluded by !**/*.lock
• bun.lock is excluded by !**/*.lock
• crates/stdnum-wasm-size-fixture/Cargo.lock is excluded by !**/*.lock
• fuzz/Cargo.lock is excluded by !**/*.lock
• scripts/rust-oracle/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (15)

• .changeset/calm-hawks-check.md
• .changeset/config.json
• .github/workflows/ci.yml
• .github/workflows/mutants.yml
• .github/workflows/release.yml
• .github/workflows/scorecard.yml
• README.md
• crates/stdnum-core/src/lib.rs
• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-wasm-size-fixture/Cargo.toml
• hawk.toml
• package.json
• packages/stdnum-wasm/package.json
• packages/stdnum/package.json
• scripts/oracle.ts

💤 Files with no reviewable changes (1)

• README.md

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Bindings and packages
• GitHub Check: Rust

🧰 Additional context used

📓 Path-based instructions (12)

**/*.{ts,tsx,py,json,md}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

After adding or changing a validator, use bun run codegen to generate npm entrypoints, TypeScript and Python registry types, package exports, and README tables; do not manually maintain generated outputs.

Files:

• packages/stdnum-wasm/package.json
• scripts/oracle.ts
• packages/stdnum/package.json
• package.json

**/*.{rs,ts,tsx,py}

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Keep Node.js, WASM, and Python bindings as thin adapters over the single Rust implementation; do not hand-write validator logic in bindings.

Files:

• scripts/oracle.ts
• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

**/*.{ts,tsx,js,jsx,rs}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{ts,tsx,js,jsx,rs}: Prefer explicit designs, fail fast at boundaries, return or throw early, and minimize brace nesting with early returns.
Use named constants instead of string literals for domain values.

Files:

• scripts/oracle.ts
• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{ts,tsx,js,jsx}: Do not assign directly to document.cookie.
Avoid spread syntax in loop accumulators; use .push().

Files:

• scripts/oracle.ts

**/*.{ts,tsx}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{ts,tsx}: Prefer TypeScript features that make invalid states structurally impossible, including branded types, discriminated unions, exhaustive checks, and named discriminators instead of growing boolean state flags.
Do not use TypeScript enums; use as const objects or union types.
Model mutually exclusive states as discriminated unions with a stable discriminator such as type or status; avoid boolean flag sets with optional payloads.
Avoid unnecessary as casts; narrow with type guards or in checks, and if a cast is unavoidable obtain approval and add a // SAFETY: explanation.
Trace type mismatches to their source instead of casting at the consumer.
Do not annotate values whose types are already inferred or pass explicit type arguments to inference-driven hooks and API calls.
Validate large-union object literals with as const satisfies T rather than a : T annotation.
Use .at(0) when an element may be absent; use [0] only after existence is established or with a // SAFETY: comment.
Prefer arrow functions, parameter destructuring when the intermediate value is not reused, and discriminated-union narrowing over Use options or args objects for three or more function arguments, or for interchangeable same-type arguments; reservePropsfor React component props. Reuse library utility types, keep helper-local types near their helper, and hoist only noisy return types into nearby aliases. Prefer type narrowing over annotations in hot generic paths to control type-instantiation cost. Shared modules must not perform module-level side effects; split reusable utilities from side-effecting singletons. Never import test-only types into production code; use structural constraints when production generics must accept test instances. Defer eager initialization such asbetterAuth()ordrizzle()behind lazy getters when initialization depends on another module's export. Use oxlint with the ultracite preset and oxfmt; suppress a rule only with// ...

Files:

• scripts/oracle.ts

**/*.{rs,ts,py}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{rs,ts,py}: Binding layers should remain thin: business logic belongs in the Rust core, while TypeScript, Python, WASM, and NAPI layers translate types and call shared core logic.
Generated artifacts must be versioned and validated at load time, rejecting stale, mismatched, or oversized artifacts with typed errors.
Test only behavior that can actually fail beyond guarantees from the type system, framework, or linter; prefer invariants over examples for large input spaces.
Do not snapshot sensitive raw text unless fixtures are intentionally public and minimal; prefer normalized summaries, counts, spans, labels, and redacted output.

Files:

• scripts/oracle.ts
• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

**/*.{rs,ts}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{rs,ts}: Use property and mutation testing for checksum behavior and differential testing of specialized canonical validators against the full validator.
Canonical ASCII validation must be zero-allocation, byte-oriented, single-pass, and return NotCanonical when normalization would change input; keep Unicode normalization as the compatibility fallback.
Separate validation status from presentation: kernels return compact statuses and typed error codes, while bindings create strings, objects, exceptions, and diagnostics only when required.
Keep binding calls coarse through indexed dispatch and batch operations, and treat performance as a tested contract with deterministic allocation assertions and controlled normalized benchmarks.

Files:

• scripts/oracle.ts
• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

**/*.{ts,tsx,rs}

📄 CodeRabbit inference engine (AGENTS.md)

Preserve per-country module boundaries and public export paths; package exports are public API.

Files:

• scripts/oracle.ts
• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

**/{Cargo.toml,rust-toolchain.toml}

📄 CodeRabbit inference engine (AGENTS.md)

Put shared workspace lint policy in [workspace.lints]; members should opt in with [lints] workspace = true.

Files:

• crates/stdnum-wasm-size-fixture/Cargo.toml

crates/stdnum-core/src/validators/**/*.rs

📄 CodeRabbit inference engine (CONTRIBUTING.md)

Implement new identifier validators under crates/stdnum-core/src/validators/.

Files:

• crates/stdnum-core/src/validators/common.rs

crates/**/*.rs

📄 CodeRabbit inference engine (CONTRIBUTING.md)

crates/**/*.rs: Register every new validator in the Rust catalog.
Add Rust unit-test, property-test, and shared-fixture coverage for every new validator.

Files:

• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

**/*.rs

📄 CodeRabbit inference engine (AGENTS.md)

**/*.rs: Use Rust 2024 for new crates, pin the toolchain in rust-toolchain.toml, and keep rustfmt and clippy installed.
Forbid unsafe code by default; if required, isolate it in a small module and document the invariant with a SAFETY: comment.
Production Rust must not use unwrap(), expect(), panic!(), todo!(), or unimplemented!(); use typed errors or make impossible states unrepresentable.
Avoid unchecked indexing, string slicing, and unchecked as casts; use safe accessors, UTF-8-safe APIs, TryFrom, checked conversions, and domain newtypes.
Prefer narrow domain types over primitive strings or numbers, keep struct fields private unless public construction is contractual, and use smart constructors for invariants.
Use enums for closed domain states; use options structs or bon builders for named arguments and APIs with many optional parameters.
Prefer Result<T, E> with concrete error enums for library code, using thiserror; use miette only for human-facing diagnostics.
Add #[must_use] to builders, configuration transforms, computed results, and APIs whose ignored result is likely a bug.
Keep comments concise and document invariants, non-obvious algorithms, generated contracts, and safety boundaries rather than narrating obvious code.
Keep domain dictionaries, language rules, fixtures, and generated artifacts out of code and in reproducible data files or build outputs.
Public Rust docs, logs, diagnostics, and comments must write stella in lowercase.
Extensible analyzers, detectors, linters, and validators should use module-owned declarative rule specifications; central registries should remain thin and preserve ordering and iteration only.
Avoid expensive module initialization and library-import side effects such as filesystem, network, environment, or global logger setup; applications and CLIs own process-level effects.
Use cargo nextest run --workspace --all-features when available, otherwise the repository's documented test command; ...

Files:

• crates/stdnum-core/src/validators/common.rs
• crates/stdnum-core/src/lib.rs

🧠 Learnings (9)

📓 Common learnings

Learnt from: CR
Repo: stella/stdnum PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-07-24T12:19:40.886Z
Learning: Run `bun run rust:check`, `bun run codegen:check`, `bun run typecheck`, `bun test`, `bun run lint`, and `bun run format` before submitting a pull request.

Learnt from: CR
Repo: stella/stdnum PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-07-28T11:17:04.632Z
Learning: Applies to **/*.rs : Use Rust 2024 for new crates, pin the toolchain in `rust-toolchain.toml`, and keep rustfmt and clippy installed.

Learnt from: CR
Repo: stella/stdnum PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-07-24T12:19:40.886Z
Learning: Keep pull requests to one logical change.

📚 Learning: 2026-07-28T11:17:04.632Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-07-28T11:17:04.632Z
Learning: Applies to **/*.rs : Use Rust 2024 for new crates, pin the toolchain in `rust-toolchain.toml`, and keep rustfmt and clippy installed.

Applied to files:

• .changeset/calm-hawks-check.md
• .github/workflows/ci.yml

📚 Learning: 2026-07-24T12:19:40.886Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-07-24T12:19:40.886Z
Learning: Applies to **/*.{rs,ts,tsx,py} : Keep Node.js, WASM, and Python bindings as thin adapters over the single Rust implementation; do not hand-write validator logic in bindings.

Applied to files:

• hawk.toml

📚 Learning: 2026-07-28T11:17:04.632Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-07-28T11:17:04.632Z
Learning: Applies to **/*.rs : Public Rust docs, logs, diagnostics, and comments must write `stella` in lowercase.

Applied to files:

• hawk.toml

📚 Learning: 2026-07-24T12:19:40.886Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-07-24T12:19:40.886Z
Learning: Applies to **/*.{ts,tsx,py,json,md} : After adding or changing a validator, use `bun run codegen` to generate npm entrypoints, TypeScript and Python registry types, package exports, and README tables; do not manually maintain generated outputs.

Applied to files:

• packages/stdnum/package.json

📚 Learning: 2026-07-24T12:19:40.886Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-07-24T12:19:40.886Z
Learning: Applies to crates/stdnum-core/src/validators/**/*.rs : Implement new identifier validators under `crates/stdnum-core/src/validators/`.

Applied to files:

• crates/stdnum-wasm-size-fixture/Cargo.toml
• crates/stdnum-core/src/lib.rs

📚 Learning: 2026-07-28T11:17:04.632Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-07-28T11:17:04.632Z
Learning: Applies to **/*.rs : Use `cargo nextest run --workspace --all-features` when available, otherwise the repository's documented test command; use property tests, fuzz targets, fixture parity tests, and snapshots where appropriate.

Applied to files:

• .github/workflows/ci.yml

📚 Learning: 2026-07-24T12:19:40.886Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: CONTRIBUTING.md:0-0
Timestamp: 2026-07-24T12:19:40.886Z
Learning: Run `bun run rust:check`, `bun run codegen:check`, `bun run typecheck`, `bun test`, `bun run lint`, and `bun run format` before submitting a pull request.

Applied to files:

• .github/workflows/ci.yml

📚 Learning: 2026-07-28T11:17:04.632Z

Learnt from: CR
Repo: stella/stdnum PR: 0
File: AGENTS.md:0-0
Timestamp: 2026-07-28T11:17:04.632Z
Learning: Applies to **/{Cargo.toml,rust-toolchain.toml} : Put shared workspace lint policy in `[workspace.lints]`; members should opt in with `[lints] workspace = true`.

Applied to files:

• .github/workflows/ci.yml

🔇 Additional comments (15)

.changeset/calm-hawks-check.md (1)

1-5: LGTM!

.changeset/config.json (1)

2-8: LGTM!

.github/workflows/mutants.yml (1)

37-37: LGTM!

.github/workflows/release.yml (1)

425-425: LGTM!

.github/workflows/scorecard.yml (1)

26-33: LGTM!

crates/stdnum-wasm-size-fixture/Cargo.toml (1)

20-20: LGTM!

packages/stdnum-wasm/package.json (1)

34-34: LGTM!

packages/stdnum/package.json (1)

955-955: LGTM!

scripts/oracle.ts (1)

1276-1279: LGTM!

hawk.toml (1)

1-22: LGTM!

crates/stdnum-core/src/lib.rs (1)

1626-1649: LGTM!

Also applies to: 2309-2311

crates/stdnum-core/src/validators/common.rs (1)

3-5: LGTM!

package.json (2)

31-31: LGTM!

Also applies to: 78-78

---

55-59: 🗄️ Data Integrity & Integration

No lockfile change is required.

bun.lock already contains the updated manifest ranges and matching resolutions.

			> Likely an incorrect or invalid review comment.

.github/workflows/ci.yml (1)

3-7: LGTM!

Also applies to: 175-177, 195-212, 219-219, 238-240

---

📝 Walkthrough

Walkthrough

The pull request adds Hawk visibility auditing for Rust libraries, reduces internal helper visibility, and updates CI, release actions, package tooling, formatting configuration, and Changesets metadata.

Changes

Hawk visibility audit and CI

Layer / File(s)	Summary
Visibility audit configuration hawk.toml, package.json, crates/stdnum-core/src/lib.rs, crates/stdnum-core/src/validators/common.rs	Hawk production targets and the rust:hawk script are added. Three Rust helpers become module-private.
Hawk CI installation and linting .github/workflows/ci.yml	CI pins Hawk settings, disables persisted checkout credentials, verifies and installs Hawk, installs the Rust toolchain, updates the Rust tools action, and runs rust:hawk.

Tooling and release maintenance

Layer / File(s)	Summary
Tooling and workflow updates package.json, packages/stdnum/package.json, packages/stdnum-wasm/package.json, crates/stdnum-wasm-size-fixture/Cargo.toml, .github/workflows/mutants.yml, .github/workflows/release.yml, .github/workflows/scorecard.yml, scripts/oracle.ts	Development dependencies, wasm-bindgen, workflow actions, and the package manager requirement are updated. tierFor is reformatted without behaviour changes.
Changeset and generated content updates .changeset/calm-hawks-check.md, .changeset/config.json, README.md	A patch Changeset is added. The Changesets schema and formatter are updated. Generated registry summary content is removed from the README.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions as GitHub Actions Rust job
  participant HawkArchive as Hawk release archive
  participant CargoHawk as Cargo Hawk
  participant RustToolchain as Rust toolchain
  GitHubActions->>HawkArchive: Download pinned archive
  GitHubActions->>GitHubActions: Verify checksum and install Hawk
  GitHubActions->>RustToolchain: Install pinned toolchain
  GitHubActions->>CargoHawk: Run rust:hawk
  CargoHawk->>RustToolchain: Analyse Rust libraries

Loading

Possibly related PRs

• stella/stdnum#130: Introduced the Rust functions whose visibility changes in this pull request.
• stella/stdnum#157: Introduced related stdnum-core validator visibility changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarises the main dependency and Rust tooling updates in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/deps-rust-tooling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8a4b06e05

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the wasm-bindgen CLI with the crate version

The locked wasm-bindgen crate is now 0.2.127, but the WebAssembly toolchain steps in ci.yml and release.yml still install wasm-bindgen-cli 0.2.126. Both workflows pass the resulting module to that CLI through scripts/build-wasm.mjs; wasm-bindgen's crate and CLI schema versions must match, so bun run build:wasm will stop with a version mismatch before the smoke tests or portable package publication. Update both workflow pins to 0.2.127.

Useful? React with 👍 / 👎.