chore(deps): bump wit-parser from 0.257.1 to 0.258.0

[dependabot]

Bumps wit-parser from 0.257.1 to 0.258.0.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🔒 HELD — not auto-mergeable (class: zerox-minor). 0.257.1 -> 0.258.0: for a 0.x crate the MINOR is the de-facto major (ordeal 0.9->0.12; object 0.39->0.40 / #938)

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[avrabe]

[maintainer loop] Held-state audit — recording measured status so this hold is not silent.

wit-parser 0.257.1 -> 0.258.0 · classifier: class=zerox-minor

All 9 required contexts are GREEN on this PR. The only red is
Rivet Federated Graph (advisory), which was failing repo-wide from
2026-09-03 04:00–21:25 because GitHub rate-limits anonymous clones from
datacenter IPs — nothing to do with this bump. Diagnosed and fixed in #1143/#1144.

So this is held by policy, not by evidence of breakage. The policy
(SYNTH-DEPENDABOT-MINORHOLD-ENFORCED-965) treats a 0.x minor as a de-facto
major, because for a 0.x crate it is one — earned from ordeal 0.9 -> 0.12,
which auto-merged as "minor" and hung Test/Z3 for 4–6 hours per run for
days.

Why you are being told this rather than left to rot. A held PR currently has
no defined exit: it cannot auto-merge, and nothing prompts a human. Four of
these accumulated since 2026-08-31 — one (#1111, wasmparser) was genuinely
source-breaking and is closed with that evidence; the rest were reporting a CI
outage, not an incompatibility. A hold that is correct and silent is how they
became invisible, and I described their state wrongly in the org review as a
result. Raised for temper in #1132.

Staying held pending a deliberate decision, not forgotten. If you want it taken,
say so on this PR.