chore(deps): bump pulseengine/rivet from 0.6.0 to 0.17.0

[dependabot]

Bumps pulseengine/rivet from 0.6.0 to 0.17.0.

Release notes

Sourced from pulseengine/rivet's releases.

Rivet v0.17.0

What's Changed

• fix(next-id): honor IDs claimed in git history, never reissue a burned ID (#479) by @​avrabe in pulseengine/rivet#531
• docs(npm): first-class npm/npx install path + sync stale package versions by @​avrabe in pulseengine/rivet#533
• feat(cli): minimal --no-default-features build (excludes serve+MCP+LSP stack) — REQ-202 / #456 by @​avrabe in pulseengine/rivet#534
• ci: move mutants-cli off lean-mem to rust-cpu (#523) by @​avrabe in pulseengine/rivet#526
• fix(schema): restore accepted to canonical status enum (#522) by @​avrabe in pulseengine/rivet#525
• feat(init): --vendor-schemas pins built-in schemas on-disk against upgrades (#431) by @​avrabe in pulseengine/rivet#537
• fix(deps): bump wasmtime 43 → 44.0.3 for RUSTSEC-2026-0182 (unblocks all PRs) by @​avrabe in pulseengine/rivet#542
• feat(check): add rivet check docs oracle with --format json + --strict (#540) by @​avrabe in pulseengine/rivet#541
• fix(variants): skip feature-model binding files in load_variant_configs_from_dir (#532) by @​avrabe in pulseengine/rivet#539
• ci: runner-liveness alert for the self-hosted pool (#509 slice 1) by @​avrabe in pulseengine/rivet#536
• fix(cli): JSON error envelope on parse failure under --format json (#500) by @​avrabe in pulseengine/rivet#535
• release(v0.17.0): bump version + CHANGELOG by @​avrabe in pulseengine/rivet#545

Full Changelog: pulseengine/rivet@v0.16.1...v0.17.0

Rivet v0.16.1

What's Changed

• ci: CI reliability — Miri timeout headroom + Verus on ubuntu-latest (v0.17.0, #509) by @​avrabe in pulseengine/rivet#520
• ci(miri): parallelize with cargo-nextest so Miri uses the cores (not 45 min on one) by @​avrabe in pulseengine/rivet#521
• fix(cli): next-id/add hard-fail on a parse-broken source (REQ-216, #518) by @​avrabe in pulseengine/rivet#527
• fix(variant): check --variant accepts the form init scaffolds (REQ-217, #514) by @​avrabe in pulseengine/rivet#528
• release(v0.16.1): #514 + #518 fixes (gale unblock) by @​avrabe in pulseengine/rivet#529

Full Changelog: pulseengine/rivet@v0.16.0...v0.16.1

Rivet v0.16.0

What's Changed

• fix(matrix): hint the correct --direction on an all-empty matrix (REQ-152) by @​avrabe in pulseengine/rivet#401
• fix(impact): load --since baseline via the canonical loader (REQ-153, #403) by @​avrabe in pulseengine/rivet#404
• fix(list,stats): loudly report sources skipped by parse errors (REQ-154, #353) by @​avrabe in pulseengine/rivet#405
• fix(validate): suppress prose-mention warning when no link type can connect the types (REQ-155, #353) by @​avrabe in pulseengine/rivet#407
• feat(validate): add coverage-rule-consistency schema check (REQ-148, #350) by @​avrabe in pulseengine/rivet#409
• refactor(validate): single chokepoint for schema-level consistency checks (REQ-156, #410) by @​avrabe in pulseengine/rivet#411
• fix(validate): emit the per-file parse-error skip WARN once, not twice (REQ-157, #406) by @​avrabe in pulseengine/rivet#412
• feat(validate,add): near-duplicate-intent detection (REQ-158, #397) by @​avrabe in pulseengine/rivet#413
• fix(add): deterministic near-duplicate note + correct REQ-158 self-count (#397) by @​avrabe in pulseengine/rivet#414
• feat(store): deterministic iter_sorted() + document iter() nondeterminism (REQ-159, #415) by @​avrabe in pulseengine/rivet#416
• fix(query,export,migrate): deterministic order over the HashMap-backed store (REQ-160, #415) by @​avrabe in pulseengine/rivet#417
• feat(validate): --structural gates on integrity only, via Diagnostic::is_structural() (REQ-161, #408) by @​avrabe in pulseengine/rivet#418
• ci(compliance): forward version-switcher + back-link inputs to the report action (REQ-163, #420) by @​avrabe in pulseengine/rivet#421
• chore(git): union-merge driver for CHANGELOG to cut parallel-PR conflicts (REQ-164, #422) by @​avrabe in pulseengine/rivet#423
• feat(schema): declare canonical status lifecycle in common.yaml (REQ-162, #352, #355) by @​avrabe in pulseengine/rivet#419
• fix(aspice): verification gates accept forward target status (REQ-165, #355 Finding 2) by @​avrabe in pulseengine/rivet#424
• feat(matrix): infer direction + link when --direction omitted (REQ-166, #402) by @​avrabe in pulseengine/rivet#425
• feat(cli): add rivet trace <id> + deterministic explain ordering (REQ-167, #426) by @​avrabe in pulseengine/rivet#427
• feat(bundle): --incoming follows backlinks so sinks bundle their realizers (REQ-168, #428) by @​avrabe in pulseengine/rivet#429

... (truncated)

Changelog

Sourced from pulseengine/rivet's changelog.

[0.17.0] - 2026-06-19

Security

• RUSTSEC-2026-0182 / #542 — bump wasmtime 43 → 44.0.3. A new advisory flags a WASIp1 fd_renumber resource leak in wasmtime-wasi, fixed in 44.0.3. The Security Audit gate had gone red repo-wide; rivet's only wasmtime consumer is the compose-witness component runner (wasm_runtime.rs), which compiles unchanged against the new API. cargo audit is clean afterward.

Added

• #540 / #541 — rivet check docs oracle. Enumerates every candidate path the doc scanner considered and tags each loaded / skipped (<reason>) / excluded (<glob>). --format json emits the canonical {oracle, entries, total, by_status} envelope; --strict exits non-zero when any candidate is skipped (allowlist exclusions do not trip strict).
• REQ-202 / #456 — minimal --no-default-features build. rivet-cli gates the serve + MCP + LSP stack behind cargo features (all kept in default, so the published binary is byte-for-byte unchanged). cargo build -p rivet-cli --no-default-features yields the validate/list/add/commit-check core with none of axum/rmcp/lsp-server compiled in; --format html export, snapshot, and embed (which share the dashboard renderer) are serve-gated and refuse with a clear message in the minimal build.
• REQ-220 / #431 — rivet init --vendor-schemas. Writes the resolved built-in schemas (plus auto-discovered bridges) on-disk into schemas/, so a project pins its validation against rivet upgrades (the loader prefers on-disk over the embedded copy). Never overwrites an existing schema file.
• #509 — runner-liveness alert. A GitHub-hosted scheduled workflow (runner-liveness.yml) probes the self-hosted runner pool and queued-run age every 15 minutes and raises a durable runner-down tracking issue when the pool stalls, instead of every gate queueing forever with no signal.

Fixed

• REQ-218 / #479 — next-id honors IDs claimed in git history. Allocation scanned only the working tree, so a reverted commit or an in-flight branch could reissue an ID already claimed elsewhere (the reverted-but-burned-ID trap). next-id and add now also consider IDs claimed in commit trailers / subject tags across all refs; overridable with RIVET_NEXTID_NO_GIT=1.
• REQ-219 / #500 — JSON error envelope on a parse failure. A misplaced top-level --project/--schemas (they are deliberately not clap global) left stdout empty under --format json, giving consumers a cryptic "EOF while parsing". Such invocations now emit a one-line {error, hint} envelope on stdout; non-JSON parse errors keep the stderr-only behavior.
• #532 / #539 — variant loader skips feature-model binding files. load_variant_configs_from_dir no longer trips over variant:-wrapped binding files.
• #522 / #525 — restore accepted to the canonical status enum.

... (truncated)

Commits

• d648ce4 release(v0.17.0): bump version + CHANGELOG [0.17.0] (#545)
• ee352ce fix(cli): emit a JSON error envelope on parse failure under --format json (RE...
• a32a02b ci: add runner-liveness alert for the self-hosted pool (#509 slice 1) (#536)
• b16bb9c fix(variants): skip feature-model binding files in load_variant_configs_from_...
• 01f2976 feat(check): add rivet check docs oracle with --format json + --strict (#54...
• 55339e1 fix(deps): bump wasmtime 43 -> 44.0.3 for RUSTSEC-2026-0182 (#542)
• 8dae100 feat(init): --vendor-schemas pins built-in schemas on-disk against upgrades (...
• fa1b8ed fix(schema): restore accepted to canonical status enum (#522) (#525)
• 6f2df49 ci: move mutants-cli off lean-mem to rust-cpu (#523) (#526)
• 18db3e9 feat(cli): minimal --no-default-features build excludes serve+MCP+LSP stack (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)