chore(deps): bump dtolnay/rust-toolchain from 1.95.0 to 1.100.0 in the actions group across 1 directory

[dependabot]

Bumps the actions group with 1 update in the / directory: dtolnay/rust-toolchain.

Updates dtolnay/rust-toolchain from 1.95.0 to 1.100.0

Commits

• 965947c toolchain: 1.100.0
• See full diff in compare view

---

Note

Low Risk
CI-only dependency pin for the Rust toolchain installer; no runtime or application code changes.

Overview
Bumps the dtolnay/rust-toolchain action from 1.95.0 to 1.100.0 in codeql.yml and verify-impl.yml, so CI CodeQL and the verify/test pipeline install Rust 1.100.0 instead of 1.95.0.

No application or snapchain source changes—only the workflow action pins.

^{Reviewed by Cursor Bugbot for commit 7382fcb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
snapchain-docs	Ready	Preview, Comment	Jul 29, 2026 9:15am

[cursor]

Invalid Rust toolchain version pin

High Severity

For dtolnay/rust-toolchain, the version tag selects the Rust toolchain to install, not an action semver. This Dependabot bump to @1.100.0 therefore requests Rust 1.100.0, which is not a released toolchain (latest stable is 1.97.1). Neither workflow passes an explicit toolchain input, so CI will fail at install time. The previous @1.95.0 pin also matched Dockerfile's rust:1.95 base image.

Additional Locations (1)

• .github/workflows/codeql.yml#L42-L43

 

^{Reviewed by Cursor Bugbot for commit 723c08a. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7382fcb. Configure here.}

[cursor]

Invalid Rust toolchain version bump

High Severity

Dependabot bumped dtolnay/rust-toolchain to @1.100.0, but Rust 1.100.0 is not a released toolchain (current stable is 1.97.x). That tag makes the action ask rustup for a nonexistent version, which 404s and fails CI in both codeql.yml and verify-impl.yml. Step names still say Install Rust 1.95.0, and Dockerfile remains on rust:1.95.

 

^{Reviewed by Cursor Bugbot for commit 7382fcb. Configure here.}