fix: unbreak tag releases after the dependabot batch, correct MSRV, drop unused indicatif

.github/dependabot.yml

@@ -32,6 +32,15 @@ updates:
         update-types: ["version-update:semver-major"]
 
   # GitHub Actions pinned in the CI / release / npm-publish / mirror workflows.
+  #
+  # REVIEWER TRAP: `.github/workflows/release.yml` is GENERATED by cargo-dist and
+  # is verified against the generator by the `plan` job. Dependabot cannot be
+  # told to skip a single file, so it will keep proposing action bumps inside
+  # that file — and `plan` will keep failing them. Do NOT merge such a PR: `plan`
+  # is also the FIRST job of the real release workflow, so a mismatched
+  # release.yml breaks the next `vX.Y.Z` tag push, not just the PR. Drop the
+  # release.yml hunks and keep the rest; the file only changes when
+  # `cargo-dist-version` is bumped and `dist generate` is re-run.
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/workflows/release.yml

@@ -56,7 +56,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
           submodules: recursive
@@ -116,7 +116,7 @@ jobs:
       - name: enable windows longpaths
         run: |
           git config --global core.longpaths true
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
           submodules: recursive
@@ -175,7 +175,7 @@ jobs:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
           submodules: recursive
@@ -225,7 +225,7 @@ jobs:
     outputs:
       val: ${{ steps.host.outputs.manifest }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
           submodules: recursive
@@ -290,7 +290,7 @@ jobs:
       GITHUB_EMAIL: "admin+bot@axo.dev"
     if: ${{ !fromJson(needs.plan.outputs.val).announcement_is_prerelease || fromJson(needs.plan.outputs.val).publish_prereleases }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: true
           repository: "bugsee/homebrew-tap"
@@ -337,7 +337,7 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
         with:
           persist-credentials: false
           submodules: recursive

CLAUDE.md

@@ -14,8 +14,11 @@ per-build-system orchestrators shell to it instead of each re-implementing the
 HTTP / compression / retry / presigned-handshake logic — the Android Gradle
 plugin (Kotlin), and the iOS SDK + fastlane `BugseeAgent`s (Python).
 
-Binary crate, no library target. Edition 2021, MSRV 1.79 (pinned via
-`rust-toolchain.toml`).
+Binary crate, no library target. Edition 2021, MSRV 1.88 (declared in
+`Cargo.toml`'s `rust-version`). `rust-toolchain.toml` selects `stable`, NOT the
+MSRV — and CI builds `stable` too, so nothing in CI catches MSRV drift. A
+dependency bump can silently raise the real floor; check with `cargo +<ver>
+check --all-targets` and update `rust-version` in the same change.
 
 ## Commands
 

Cargo.toml

@@ -2,7 +2,10 @@
 name = "bugsee-cli"
 version = "0.7.4"
 edition = "2021"
-rust-version = "1.79"
+# Real floor, not an aspiration: the locked tree requires 1.88 (`gimli`,
+# `globset`, `plist`, `time`). Verify a bump with `cargo +<ver> check
+# --all-targets` — CI builds `stable`, so it will NOT catch MSRV drift.
+rust-version = "1.88"
 authors = ["Bugsee"]
 description = "Bugsee CLI — cross-platform symbol collection, conversion, and upload."
 readme = "README.md"
@@ -116,7 +119,6 @@ anyhow = "1"
 thiserror = "2"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
-indicatif = "0.18"
 tempfile = "3"
 
 # In-place self-replacement of the running executable for `bugsee-cli update`.