chore(deps): update dependencies and fix CI for Renovate

[panbanda]

Summary

• Update gix 0.77->0.78, reqwest 0.12->0.13, minify-html 0.16->0.18, criterion 0.5->0.8
• Update all semver-compatible deps (anyhow, chrono, clap, flate2, insta, minijinja, proptest, regex, thiserror, toml, assert_cmd)
• Fix gix 0.78 breaking change: diff::Action::Continue replaced with ControlFlow::Continue(())
• Fix criterion 0.8 deprecation: criterion::black_box -> std::hint::black_box
• Fix reqwest 0.13 feature rename: rustls-tls -> rustls
• Add explicit toolchain input to all dtolnay/rust-toolchain CI steps so future Renovate SHA updates don't break builds

Not updated

• tree-sitter ecosystem (0.24->0.26): blocked because 5 grammar crates (typescript, java, cpp, c-sharp, ruby) have no releases beyond 0.23 on crates.io

Why Renovate PRs were failing

• PR fix(deps): update rust crate reqwest to 0.13 - autoclosed #283 (reqwest): Renovate bumped the version but didn't rename the rustls-tls feature to rustls (breaking change in 0.13)
• PR fix(deps): update tree-sitter packages #272 (tree-sitter): tree-sitter 0.26 is incompatible with grammar crates stuck at 0.23, and the core API changed (Language -> LanguageFn)
• PR chore(deps): update github-actions #390 (github-actions): dtolnay/rust-toolchain uses branch-based defaults for the toolchain version. When Renovate updates the SHA to a commit from a different branch, the toolchain input becomes empty and the action fails with "'toolchain' is a required input". Fixed by adding explicit toolchain input to all steps.

Test plan

• cargo build succeeds
• cargo clippy --all-targets --all-features -- -D warnings passes
• cargo fmt --check passes
• 1666 unit tests pass
• 29/32 integration tests pass (3 score tests are slow full-repo analyses, not a regression)

[github-actions]

Omen Analysis

Diff Risk

Risk Score	46%
Risk Level	MEDIUM
Files Modified	6
Lines Added	+979
Lines Deleted	-470
Commits	2

Risk Factors

Factor	Score
lines_added	0.16
file_churn	0.1
lines_deleted	0.08
num_files	0.032
file_complexity	0.0156
commits	0.0140
entropy	0.0073
ownership_diffusion	0.0036

Recommendations

• Large PR with 979 lines added - consider splitting into smaller changes
• Large deletion of 470 lines - ensure no accidental removals
• Touches historically volatile files - changes here often introduce bugs

Repository Health

Health Score	77.26902837047508 / 100
Grade	C
Files Analyzed	93
Critical Issues	1

Score Components

Component	Score	Weight
complexity	92	1
duplication	41.7	0.8
cohesion	94.2	0.6
tdg	84	0.6
coupling	50.6	0.4
satd	91.4	0.4
smells	100	0.2

Tips for AI agents

Use these commands to investigate and improve low-scoring areas.

Run full analysis:

omen -f json score    # health score with component breakdown
omen -f json diff     # PR risk analysis
omen hotspot          # high-churn + high-complexity files

Coupling (score: 50.56559139784946) -- needs attention

omen graph && omen smells

Break cyclic dependencies by introducing interfaces or extracting shared types. Reduce fan-out from hub modules by splitting responsibilities.

---

Duplication (score: 41.70640486208509) -- needs attention

omen clones

Look for Type-1 (exact) and Type-2 (renamed) clones. Extract shared logic into reusable functions or modules. Prioritize clones in high-churn files.

---

General workflow for improving scores:

1. Run the relevant analyzer command to identify specific files
2. Focus on the highest-weight components first (complexity 25%, duplication 20%, cohesion 15%, TDG 15%)
3. Make targeted improvements -- small refactors that reduce complexity or eliminate duplication
4. Re-run omen score to verify improvement

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🚫 Review skipped — only excluded labels are configured. (1)

• autorelease: pending

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/update-dependencies

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}