From 68ce20bddd96b7a36cd58f80379ce88ae4b19f60 Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Tue, 7 Oct 2025 15:26:50 -0700
Subject: [PATCH 1/9] chore(deps): Bump actions/setup-python from 4 to 6

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f082f30..f0c1b9e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -152,7 +152,7 @@ jobs:
           command: install
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
 
       - name: Install pre-commit
         run: pip install pre-commit
@@ -233,7 +233,7 @@ jobs:
           command: install
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
 
       - name: Install pre-commit
         run: pip install pre-commit

From bca50cbc1a0c57a3837de292e25157a0bb08a61b Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Tue, 7 Oct 2025 15:19:01 -0700
Subject: [PATCH 2/9] chore(deps): Bump dorny/paths-filter from 2 to 3

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f0c1b9e..aad6954 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v2
+      - uses: dorny/paths-filter@v3
         id: filter
         with:
           filters: |

From b2978a1a98aa0f7e65c90481c1459e3f898a7552 Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Tue, 7 Oct 2025 15:21:56 -0700
Subject: [PATCH 3/9] chore(deps): Bump arduino/setup-protoc from 2 to 3

---
 .github/workflows/build.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index aad6954..cf1eb88 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -194,7 +194,7 @@ jobs:
           - rust+wasm
     steps:
       - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -300,7 +300,7 @@ jobs:
       PROJECT_NAME: fission-codes-rust-template
     steps:
       - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -375,7 +375,7 @@ jobs:
       PROJECT_NAME: fission-codes-rust-template
     steps:
       - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -467,7 +467,7 @@ jobs:
           - rust+wasm
     steps:
       - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -672,7 +672,7 @@ jobs:
         working-directory: examples
     steps:
       - name: Install Protoc
-        uses: arduino/setup-protoc@v2
+        uses: arduino/setup-protoc@v3
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 

From 1d6532df8f90853fa0e3afba225e8f87bb352cb0 Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Tue, 7 Oct 2025 15:36:02 -0700
Subject: [PATCH 4/9] chore(deps): Bump cachix/install-nix-action from 23 to 31

---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cf1eb88..ee495b5 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -72,7 +72,7 @@ jobs:
           other: "--lib"
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v23
+        uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
@@ -161,7 +161,7 @@ jobs:
         run: pre-commit install
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v23
+        uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
@@ -242,7 +242,7 @@ jobs:
         run: pre-commit install
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v23
+        uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: |
             access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}

From bfbd13b7374e4ef7092fd8c6ca2e2fdbb4f391ff Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Tue, 14 Oct 2025 14:08:10 -0700
Subject: [PATCH 5/9] chore(deps): Bump actions/checkout from 4 to 5

---
 .github/workflows/build.yml | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ee495b5..04758cd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,7 +26,7 @@ jobs:
       nix: ${{ steps.filter.outputs.nix }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
       - uses: dorny/paths-filter@v3
         id: filter
         with:
@@ -59,7 +59,7 @@ jobs:
           - rust+wasm
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -118,7 +118,7 @@ jobs:
           - bin
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -199,7 +199,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
@@ -270,7 +270,7 @@ jobs:
           - bin
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -305,7 +305,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -340,7 +340,7 @@ jobs:
           - bin
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -380,7 +380,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -423,7 +423,7 @@ jobs:
           - bin
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -472,7 +472,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -520,7 +520,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -598,7 +598,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup cargo-generate
         uses: cargo-generate/cargo-generate-action@v0.18.3
@@ -677,7 +677,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Cache Project
         uses: Swatinem/rust-cache@v2

From 70d30ea4d8e3a40103a0ee51868d9a39aa312bd7 Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Wed, 8 Oct 2025 13:07:29 -0700
Subject: [PATCH 6/9] chore(deps): Update Unicode license exception

---
 examples/gen-axum/deny.toml | 4 ++--
 rust+wasm/deny.toml         | 4 ++--
 rust/deny.toml              | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/examples/gen-axum/deny.toml b/examples/gen-axum/deny.toml
index c749950..aa4e655 100644
--- a/examples/gen-axum/deny.toml
+++ b/examples/gen-axum/deny.toml
@@ -105,11 +105,11 @@ confidence-threshold = 0.8
 # Allow 1 or more licenses on a per-crate basis, so that particular licenses
 # aren't accepted for every possible crate as with the normal allow list
 exceptions = [
-    # The Unicode-DFS-2016 license is necessary for unicode-ident because they
+    # The Unicode-3.0 license is necessary for unicode-ident because they
     # use data from the unicode tables to generate the tables which are
     # included in the application. We do not distribute those data files so
     # this is not a problem for us. See https://github.com/dtolnay/unicode-ident/pull/9/files
-    { allow = ["Unicode-DFS-2016"], name = "unicode-ident", version = "*"},
+    { allow = ["Unicode-3.0"], name = "unicode-ident", version = "*"},
 ]
 
 # Some crates don't have (easily) machine readable licensing information,
diff --git a/rust+wasm/deny.toml b/rust+wasm/deny.toml
index c9aa6ec..9ef20c0 100644
--- a/rust+wasm/deny.toml
+++ b/rust+wasm/deny.toml
@@ -109,11 +109,11 @@ confidence-threshold = 0.8
 # Allow 1 or more licenses on a per-crate basis, so that particular licenses
 # aren't accepted for every possible crate as with the normal allow list
 exceptions = [
-    # The Unicode-DFS-2016 license is necessary for unicode-ident because they
+    # The Unicode-3.0 license is necessary for unicode-ident because they
     # use data from the unicode tables to generate the tables which are
     # included in the application. We do not distribute those data files so
     # this is not a problem for us. See https://github.com/dtolnay/unicode-ident/pull/9/files
-    { allow = ["Unicode-DFS-2016"], name = "unicode-ident", version = "*"},
+    { allow = ["Unicode-3.0"], name = "unicode-ident", version = "*"},
     { allow = ["OpenSSL"], name = "ring", version = "*" },
     { allow = ["OpenSSL"], name = "aws-lc-sys", version = "*" },
     { allow = ["MPL-2.0"], name = "webpki-roots", version = "*"},
diff --git a/rust/deny.toml b/rust/deny.toml
index c9aa6ec..9ef20c0 100644
--- a/rust/deny.toml
+++ b/rust/deny.toml
@@ -109,11 +109,11 @@ confidence-threshold = 0.8
 # Allow 1 or more licenses on a per-crate basis, so that particular licenses
 # aren't accepted for every possible crate as with the normal allow list
 exceptions = [
-    # The Unicode-DFS-2016 license is necessary for unicode-ident because they
+    # The Unicode-3.0 license is necessary for unicode-ident because they
     # use data from the unicode tables to generate the tables which are
     # included in the application. We do not distribute those data files so
     # this is not a problem for us. See https://github.com/dtolnay/unicode-ident/pull/9/files
-    { allow = ["Unicode-DFS-2016"], name = "unicode-ident", version = "*"},
+    { allow = ["Unicode-3.0"], name = "unicode-ident", version = "*"},
     { allow = ["OpenSSL"], name = "ring", version = "*" },
     { allow = ["OpenSSL"], name = "aws-lc-sys", version = "*" },
     { allow = ["MPL-2.0"], name = "webpki-roots", version = "*"},

From 912d60355ad33c2b2fd754caa41e87da28d95a74 Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Wed, 8 Oct 2025 14:28:05 -0700
Subject: [PATCH 7/9] chore(deps): Ignore atty advisory used by criterion in
 dev

---
 rust+wasm/deny.toml | 1 +
 rust/deny.toml      | 1 +
 2 files changed, 2 insertions(+)

diff --git a/rust+wasm/deny.toml b/rust+wasm/deny.toml
index 9ef20c0..78c8f1f 100644
--- a/rust+wasm/deny.toml
+++ b/rust+wasm/deny.toml
@@ -52,6 +52,7 @@ ignore = [
     "RUSTSEC-2023-0071", # Impacts rsa crate, which is only used in dev, see
                          # https://github.com/RustCrypto/RSA/pull/394 for remediation
     { id = "RUSTSEC-2024-0320", reason = "Not planning to force upgrade to rust-yaml2 yet" },
+    { id = "RUSTSEC-2024-0375", reason = "atty unmaintained, only used by criterion in dev. Can likely upgrade criterion to resolve" },
 ]
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score
 # lower than the range specified will be ignored. Note that ignored advisories
diff --git a/rust/deny.toml b/rust/deny.toml
index 9ef20c0..78c8f1f 100644
--- a/rust/deny.toml
+++ b/rust/deny.toml
@@ -52,6 +52,7 @@ ignore = [
     "RUSTSEC-2023-0071", # Impacts rsa crate, which is only used in dev, see
                          # https://github.com/RustCrypto/RSA/pull/394 for remediation
     { id = "RUSTSEC-2024-0320", reason = "Not planning to force upgrade to rust-yaml2 yet" },
+    { id = "RUSTSEC-2024-0375", reason = "atty unmaintained, only used by criterion in dev. Can likely upgrade criterion to resolve" },
 ]
 # Threshold for security vulnerabilities, any vulnerability with a CVSS score
 # lower than the range specified will be ignored. Note that ignored advisories

From 5f9eeb20fd0fdce09dd01801e8d115dfdabe1a47 Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Tue, 14 Oct 2025 12:03:39 -0700
Subject: [PATCH 8/9] docs: Convert log and alert comments to docstrings

---
 rust+wasm/{{project-name}}-wasm/src/lib.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust+wasm/{{project-name}}-wasm/src/lib.rs b/rust+wasm/{{project-name}}-wasm/src/lib.rs
index e4ffcca..4522383 100644
--- a/rust+wasm/{{project-name}}-wasm/src/lib.rs
+++ b/rust+wasm/{{project-name}}-wasm/src/lib.rs
@@ -31,9 +31,9 @@ pub fn set_panic_hook() {
 
 #[wasm_bindgen]
 extern "C" {
-    // For alerting
+    /// For alerting
     pub(crate) fn alert(s: &str);
-    // For logging in the console.
+    /// For logging in the console.
     #[wasm_bindgen(js_namespace = console)]
     pub fn log(s: &str);
 }

From 44683340b1a63fb89be744834e0412a8d0d5b0ee Mon Sep 17 00:00:00 2001
From: Brian Ginsburg <gins@brianginsburg.com>
Date: Wed, 15 Oct 2025 13:17:23 -0700
Subject: [PATCH 9/9] build(examples): Add pre-commit lockfile copy script

---
 .pre-commit-config.yaml           |  9 ++++++
 examples/README.md                | 15 +++++++++
 scripts/copy-example-lockfiles.sh | 53 +++++++++++++++++++++++++++++++
 3 files changed, 77 insertions(+)
 create mode 100755 scripts/copy-example-lockfiles.sh

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index d28edf7..6ce38d1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,3 +28,12 @@ repos:
       - id: check-executables-have-shebangs
       - id: check-toml
         exclude: ^(rust|rust+wasm)
+
+  - repo: local
+    hooks:
+      - id: copy-example-lockfiles
+        name: copy example cargo lockfiles
+        entry: scripts/copy-example-lockfiles.sh
+        language: script
+        files: ^examples/(Cargo\.(toml|lock)|.*/Cargo\.toml)$
+        pass_filenames: false
diff --git a/examples/README.md b/examples/README.md
index d4bab41..8dcd206 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -2,6 +2,21 @@ This workspace contains numerous examples demonstrating template-generated
 code and combinations. Each example is setup as its own crate, with its own
 dependencies.
 
+## Cargo.lock Synchronization
+
+The workspace automatically maintains synchronized `Cargo.lock` files for all
+example templates. When dependencies are updated at the workspace level, a
+pre-commit hook automatically copies the workspace `Cargo.lock` to each example
+directory that contains a `Cargo.toml` file. This ensures all templates have
+up-to-date dependency resolution for use with `cargo generate`.
+
+This synchronization happens automatically during commits when `Cargo.toml` or
+`Cargo.lock` files are modified. You can also run it manually:
+
+```console
+./scripts/copy-example-lockfiles.sh
+```
+
 ## Running Examples
 
 To run any example from this top-level:
diff --git a/scripts/copy-example-lockfiles.sh b/scripts/copy-example-lockfiles.sh
new file mode 100755
index 0000000..0e928c6
--- /dev/null
+++ b/scripts/copy-example-lockfiles.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# Script to copy workspace Cargo.lock to all example template directories
+# This ensures templates have up-to-date lock files for cargo generate
+
+set -e
+
+# Define paths
+WORKSPACE_LOCK="examples/Cargo.lock"
+EXAMPLES_DIR="examples"
+
+# Check if workspace lock file exists
+if [[ ! -f "$WORKSPACE_LOCK" ]]; then
+    echo "Error: Workspace Cargo.lock not found at $WORKSPACE_LOCK"
+    exit 1
+fi
+
+# Check if examples directory exists
+if [[ ! -d "$EXAMPLES_DIR" ]]; then
+    echo "Error: Examples directory not found at $EXAMPLES_DIR"
+    exit 1
+fi
+
+# Find all subdirectories in examples/ that contain a Cargo.toml (excluding target)
+example_dirs=()
+while IFS= read -r -d '' dir; do
+    # Skip the target directory
+    if [[ "$(basename "$dir")" == "target" ]]; then
+        continue
+    fi
+
+    # Check if the directory contains a Cargo.toml file
+    if [[ -f "$dir/Cargo.toml" ]]; then
+        example_dirs+=("$dir")
+    fi
+done < <(find "$EXAMPLES_DIR" -mindepth 1 -maxdepth 1 -type d -print0)
+
+# Check if we found any example directories
+if [[ ${#example_dirs[@]} -eq 0 ]]; then
+    echo "No example directories with Cargo.toml found in $EXAMPLES_DIR"
+    exit 0
+fi
+
+# Copy workspace lock to each example directory
+copied_count=0
+for example_dir in "${example_dirs[@]}"; do
+    target_lock="$example_dir/Cargo.lock"
+    cp "$WORKSPACE_LOCK" "$target_lock"
+    echo "Copied $WORKSPACE_LOCK to $target_lock"
+    ((copied_count++))
+done
+
+echo "Successfully copied Cargo.lock to $copied_count example template(s)"