[konflux-internal-p02]

This PR contains the following updates:

Package	Update	Change	Pending
nextest-rs/nextest	patch	0.9.143 → 0.9.150	0.9.151

Before merging, refresh the amd64/arm64 checksums with deploy/konflux/e2e-odh/sync-generic-fetcher.py --update <uv|helm|nextest|oc> and commit the result; the hermetic build fails until they match.

---

Release Notes

nextest-rs/nextest (nextest-rs/nextest)

v0.9.150: cargo-nextest 0.9.150

Compare Source

Security

• Fixed GHSA-vc25-qg58-w57c: with the experimental run recording feature enabled, cargo nextest run --rerun with a malicious portable recording could run arbitrary code during the build.

  Reruns inherit the original run's build scope (defined as the combination of package, target, and feature selection options). Nextest versions 0.9.125 through 0.9.149 recorded the build scope as raw Cargo arguments, and passed them to Cargo unchanged. A crafted recording could therefore add any Cargo option, such as a --config that sets build.rustc-wrapper. That code ran as the invoking user during the build, before any tests started, even with a warm build cache.

  Nextest now records the build scope as structured data, and passes each value to Cargo joined to its flag (for example, --package=<value>), so a recording can no longer add other Cargo options.

  To ensure that everyone working on your repository uses a fixed version, set the minimum required version in .config/nextest.toml:

  nextest-version = "0.9.150"

Added

• cargo nextest archive has a new --zstd-long option, which enables Zstandard long-distance matching with a 128 MiB window. For large archives, this can significantly improve the compression ratio at lower compression levels. Extracting these archives needs no extra options. (#​3664)

  Thanks nsextonTT for your first contribution!

Changed

• Run recording now uses store format 3.0. As part of the security fix above:

  • Recordings made by nextest 0.9.149 and earlier, including portable recordings, can no longer be replayed or rerun. Nextest still lists and prunes them, and recommends discarding them.
  • Once this version of nextest writes to a record store, nextest 0.9.149 and earlier can still read the store but can no longer write to it. These versions disable recording with a warning, and pruning fails.

  For more details, see recorded run versioning.

• If cargo nextest run --rerun can't read the parent run, the error now names the run (and the portable recording, if any), and suggests starting a new rerun chain.

Fixed

• Nextest now passes Cargo options to Cargo as single --flag=value arguments. Previously, an option value that started with -, such as --target-dir=-build, was passed as a separate argument and could be misinterpreted by Cargo as a flag.

v0.9.149: cargo-nextest 0.9.149

Compare Source

Security

• cargo nextest self update no longer trusts the eMudhra intermediate certificate authorities whose private keys were disclosed on 2026-10-20. Previously, an attacker able to intercept network traffic could have used these keys to make cargo nextest self update download and install a malicious binary.

  Nextest's self-updater uses a bundled set of root certificates, so operating system and browser updates do not protect it. This release updates webpki-roots to 1.0.10 and rustls-webpki to 0.103.16, both of which distrust the compromised certificates.

  Running tests does not involve network access and is not affected. Builds without the self-update feature, including most distribution packages, are also not affected.

  Updating from an earlier version with cargo nextest self update would go through the affected code one last time. If you're concerned about your network being compromised, use one of the other installation methods instead.

Fixed

• On riscv64 Linux, cargo nextest self update no longer panics. (#​3649)

v0.9.148: cargo-nextest 0.9.148

Compare Source

Changed

• For setup scripts, slow-timeout no longer accepts on-timeout = "pass", and nextest now reports a configuration error if it is specified. A setup script that times out always fails the run. Previously, this setting was accepted but handled inconsistently: the timed-out script was counted as a failure, but the run was not cancelled. (#​3640)
• Internal dependency updates: guppy updated to 0.19.1, and target-spec updated to 3.7.0, updating built-in targets to Rust 1.98.

Fixed

• Stress runs now exit with a non-zero code if any iteration failed. Previously, with fail-fast disabled, the exit code reflected only the last iteration, so a stress run with failures in earlier iterations exited with code 0 if the last iteration passed. (#​3624)

• Stress runs now always run at least one iteration. Previously, --stress-duration with a very short duration (such as 1ns) could finish without running any tests. (#​3633)

• Runs stopped by immediate fail-fast (--max-fail N:immediate) are now treated as failed rather than cancelled. Previously, in stress runs, the summary read 0 passed; cancelled due to test failure and the failing iteration was not counted as failed. (#​3639)

• When the global timeout fires with immediate fail-fast enabled, nextest now reports the global timeout as the reason the run was cancelled. Previously, the tests terminated by the timeout counted as failures, so nextest printed a second Cancelling due to test failure line and reported a test failure as the reason. (#​3637)

• After the global timeout fires, nextest no longer keeps a CPU core busy while it waits for running tests to shut down. (#​3647)

• The leak timeout is no longer restarted each time a leaked handle produces output, or each time nextest handles a signal or an info request while waiting. Previously, a test that exited while leaving behind a process that kept writing to standard output or standard error could delay leak detection indefinitely. (#​3646)

• If waiting on a test or setup script process fails, nextest now reports the test or script as an execution failure, with the underlying error shown. Previously, nextest panicked. (#​3643)

• The Cancelling and Killing status lines no longer contain stray colons. Previously, nextest printed lines like Killing due to second signal: : 1 test still running, and a trailing colon when nothing was still running. (#​3641)

Internal improvements

• Source builds of nextest no longer compile two versions of zstd. (#​3620)

  Thanks Jake-Shadle for your contribution!

v0.9.146: cargo-nextest 0.9.146

Compare Source

Fixed

• Updated chacha20 and der to non-yanked versions.

v0.9.145: cargo-nextest 0.9.145

Compare Source

Changed

• Configuration diagnostics now name the file each setting came from. For example, cargo nextest show-config version shows which file specified the nextest-version requirement, and cargo nextest show-config test-groups shows which file each override was defined in.

  For now, this is most useful when tool-specific config files are in play, but upcoming work to support local configuration files also benefits from this. (#​3580, #​3584)

• Config file paths in errors and warnings are now displayed relative to the directory nextest is invoked from, following typical CLI conventions. Previously, parse errors showed absolute paths and warnings showed paths relative to the workspace root. In stylized output, config file paths are now colored as well. (#​3568, #​3570, #​3577)

Fixed

• Per-test overrides and setup and wrapper scripts defined in a profile's inheritance chain are now applied. Previously, only the selected profile's own overrides and those in profile.default were consulted, so overrides in intermediate profiles were silently skipped. As part of this change, a profile that does not set default-filter now inherits it from the nearest ancestor that does, rather than always from profile.default. (#​3585)

• A default-filter set by a tool config file is now respected when the repository config does not set one. Previously, the tool's filter was ignored and all() was used. (#​3592)

• Profile inheritance cycles that span multiple config files, such as a tool config file redefining a profile that the repository config inherits from, are now detected and reported as errors. Previously, cycles were only detected within a single file. (#​3588)

• Passing --tool-config-file more than once for the same tool name now produces an error. Previously, nextest panicked internally. (#​3589)

• The hint shown when a command requires an experimental feature that isn't enabled now points at the correct config file path when nextest is run from a subdirectory of the workspace, from outside the workspace, or with an explicit --config-file. (#​3565)

• On Unix platforms where the Rust standard library cannot create pipes with FD_CLOEXEC set atomically (most notably Apple platforms), a test could inherit a sibling test's capture pipe if the two were spawned concurrently. The sibling was then reported as having leaked handles after it exited. Nextest now creates capture pipes itself and coordinates pipe creation with process spawning, so that spawns no longer inherit stray pipes. (#​3553)

  An upcoming design document will go over how nextest spawns processes in detail, including more information about this workaround.

  Thanks gaborbernat for your first contribution!

v0.9.144: cargo-nextest 0.9.144

Compare Source

Changed

• Failures while setting up run recording (for example, a store directory that cannot be created) are now always reported as warnings, and the test run continues without recording. Previously, only a store format version mismatch was treated as a warning, and other setup failures aborted the run. This makes setup consistent with recording finalization, which already never fails a run. (#​3547)
• The "continue rerunning" hint printed when a rerun has outstanding tests is now only shown when the rerun was itself recorded, since cargo nextest run -R latest can only continue the chain in that case. (#​3548)

Fixed

• Fixed the elapsed time shown in per-test running lines for tests that had been running for more than an hour. The minutes field was displayed as the total number of minutes rather than the minutes within the hour, producing output like [05:313:30]. (#​3535)
• When a cargo metadata or cargo build invocation fails, the error message now shows the full list of arguments that were passed to Cargo, including --color and --manifest-path. Previously, some arguments were omitted from the message. (#​3557)

Thanks chirizxc, latent-9, and k-cross for your first contributions!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 430bfb92-0a27-4fa0-a45d-6f603732bdcb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}