ci(rust): bump clap from 4.6.5 to 4.6.6

[dependabot]

Bumps clap from 4.6.5 to 4.6.6.

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

Commits

• 348cff3 chore: Release
• d478377 docs: Update changelog
• 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
• 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
• f90a966 fix(complete): Use spaces for indentation in fish
• dd4997b fix(complete): Don't glob-expand bash positionals
• 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
• 8141e11 chore(deps): Update compatible (dev) (#6398)
• 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
• 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[liramon2]

@strandly-the-agent Check if this is safe to merge.

[strandly-the-agent]

TL;DR — safe to merge. Verified at head df82106: the diff is 8 lockfile lines (clap + clap_builder 4.6.5 → 4.6.6), the archives match their checksums and the upstream v4.6.6 release commit, and the 4.6.5→4.6.6 source delta is behaviour-neutral. Nothing blocking. mergeStateStatus: BLOCKED is purely REVIEW_REQUIRED, so it just needs a human to approve — I'm deliberately not casting that approval myself.

What I actually checked (not just CI):

• Diff scope — git diff main pr88 = 8 lines, all clap/clap_builder version+checksum. Nothing else, no Cargo.toml change (root pins clap = { version = "4", features = ["derive"] }).
• Supply chain — sha256 of all four .crate archives matches the lockfile (and the sparse-index cksum); neither release yanked; the packaged source is byte-identical to clap-rs/clap at 4a622b43…, which is exactly what annotated tag v4.6.6 points to; no [patch]/[replace]/source replacement anywhere.
• Semantics — the whole delta is 34 source lines: internal Arg.blacklist → Arg.conflicts rename plus a new public Command::get_overridden_usage (identical body to the pub(crate) one it replaces). Built the binary against 4.6.5 and 4.6.6 and diffed the CLI surface (help, version, usage, bad flag, bad subcommand, missing value): byte-identical.
• Lock integrity — cargo metadata --locked accepts the head lock; clap 4.6.6 needs clap_builder =4.6.6 ✅ and clap_derive =4.6.4 ✅ (both present); features/deps unchanged; MSRV stays 1.85.
• Local suite — cargo test --workspace --all-targets --locked at df82106, cargo/rustc 1.97.1: exit 0, 1,749 passed / 0 failed across 10 test binaries (47+0+7+37+227+39+1296+96+0+0); dep-info confirms clap 4.6.6 / clap_builder 4.6.6 were the versions compiled. The known-flaky bind_direct_write_back passed.

One thing to know, not a blocker: reproducing the bump locally (cargo update -p clap --precise 4.6.6 on main, cargo 1.97.1) yields the same clap lines plus four re-pointed cfg(windows)-only edges — anstyle-query, anstyle-wincon, errno, socket2 move from windows-sys 0.61.2 to 0.60.2/0.52.0. That is not in this PR: main's lock and this branch's lock are byte-identical on every windows-sys line. Their requirements are wide (>=0.60.2,<0.62, >=0.52,<0.62, >=0.60,<0.62) so all three locked versions are valid and the resolver has freedom; it's pre-existing churn you'd see on main too.

Review shape, appendix (3 non-blocking), and what I could not verify

Passes run / skipped. Triage routed this as a 4-line lockfile bump with no source, test, doc, prompt or public-API change and no linked issue → ran supply-chain + lockfile verification, a local build & full test run, and an independent adversarial falsification pass (fresh context, separate sandbox reasoning, told to try to break the "safe" claim). Skipped API/DevX bar-raising, LLM-context, docs-accuracy, test-quality and issue-alignment — nothing in the diff for them to review; running them would have produced noise, not signal. The adversarial pass reached the same verdict independently and contributed the three items below.

Appendix — non-blocking (3), none attributable to this PR:

1. ⚪ The only observable behaviour change in 4.6.6 is Arg's Debug output (clap_builder/src/builder/arg.rs: field label "blacklist" → "conflicts"). Confirmed live that it differs; unreachable here — the sole clap consumer is src/cli.rs:11 (Parser/Subcommand derive) and nothing formats an Arg. Also confirmed no repo test asserts on clap-generated text: every Usage: string under tests/ is a hand-written HELP const for a lexopt-parsed builtin.
2. ⚪ ci.yml:46 runs cargo test --workspace --all-targets without --locked, and the cargo audit step is continue-on-error: true (ci.yml:130, deliberately, per its comment). So green CI proves less about the committed lock than it looks — which is why I ran --locked locally. Adding --locked to that step is a cheap follow-up (release.yml reuses the same gate); orthogonal to this bump. Separately: no RustSec/GitHub advisories for clap, clap_builder, clap_derive, clap_lex.
3. ⚪ .github/dependabot.yml defines a production-minor group (patterns: ['*'], update-types: [minor, patch]) that should have batched this patch bump, yet every cargo bump — including this one — arrives individually and no production-minor branch has ever existed, so the group appears never to have taken effect. Pre-existing config/behaviour gap, not a reason to hold this PR; happy to file an issue if you want one. The cooldown half was honoured: published 2026-08-06T14:03:25Z, PR opened 2026-08-10T12:57:03Z ≈ 3.95 days ≥ semver-patch-days: 3.

Also confirmed: branch is main + 1, 0 commits behind, merge-base == main HEAD — so the merge commit's lock is exactly what was tested. All 31 checks SUCCESS at df82106 (Rust ubuntu/macos/windows, Python 3.10–3.14, Node 20/22/24, Security audit, CI Gate); CodeQL NEUTRAL. PR title passes pr-title.yml's convention.

Could not verify: (a) whether anything besides the required review gates main — protection lives in a ruleset and the rulesets endpoint is outside my allow-list, so "review is the only blocker" is inferred from MERGEABLE + REVIEW_REQUIRED + all-green checks; (b) Windows/macOS behaviour and the wasm32 build locally — my runs were aarch64 Linux, CI covers Win/macOS for Rust, and no CI job builds wasm (scripts/build-wasm.sh is manual); risk is low since the delta contains no cfg/unsafe/target-specific line; (c) the commit signature on df82106 (gpg unavailable in my sandbox) — main's previous dependabot commit d65648f verifies via the API.

Automated review by strandly-the-agent — solid work for a human to approve, not a gate.