build(deps): bump signal-hook from 0.3.18 to 0.4.4

[dependabot]

Bumps signal-hook from 0.3.18 to 0.4.4.

Changelog

Sourced from signal-hook's changelog.

0.4.4

• Documentation about SIGBUS (#204).

0.4.3

• Don't exclude .c files from release package.

0.4.2

• Fix double-close on pipe unregister (#200).
• Don't include development scripts in release package (195).

signal-hook-mio-0.3.0

signal-hook-tokio-0.4.0

signal-hook-async-std-0.4.0

• Release to bump dependency on signal-hook.

0.4.1

• Don't pin specific dependency versions accidentally.

0.4.0

• Changed the low_level::pipe to look OwnedFd instead of IntoRawFd, to enforce ownership of the file descriptor (#196).

signal-hook-registry-1.4.8

• Restore errno on signal handler exit (#194, #191).

signal-hook-registry-1.4.7

• Using earlier monopolization to reduce binary size (#190).

signal-hook-mio-0.2.5

• Allow mio 1.1

signal-hook-registry-1.4.6

• Reword/improve the safety requirements docs for register (#178).

signal-hook-1.3.18

• Release the special-case removal of AIX for top-level signal-hook too (#169, #176).

signal-hook-async-std-0.3.0

... (truncated)

Commits

• f37a7b5 Document SIGBUS
• b089b6b Update deps
• 7854fb6 Don't exclude .c files from release package
• c81b0e0 Release version 0.4.2
• 390dafb Fix double-close on pipe unregister
• 173107a Exclude development script from published package
• 2413101 Release async crates
• 85f8c75 Version 0.4.1 (don't pin dep versions)
• 6e44722 Version bump to 0.4.0
• 80cc0cf Update dependencies
• Additional commits viewable in compare view

[vyncint]

Reviewed and not merging this one — it costs a duplicate crate and buys nothing today.

What the lockfile in this diff actually says

signal-hook appears twice after the bump:

+[[package]]
+name = "signal-hook"
+version = "0.4.4"
...
-  "signal-hook",
+  "signal-hook 0.3.18",     # crossterm
+  "signal-hook 0.3.18",     # signal-hook-mio
+  "signal-hook 0.3.18",     # termwiz

Today there is one copy, shared:

$ cargo tree -i signal-hook --depth 3
signal-hook v0.3.18
├── crossterm v0.29.0
│   └── ratatui-crossterm v0.1.2
│       └── ratatui v0.30.2
├── mossaic v0.8.0
└── signal-hook-mio v0.2.5
    └── crossterm v0.29.0 (*)

crossterm 0.29 pins signal-hook 0.3, and ratatui 0.30 pins crossterm. So moving mossaic to 0.4 does not move the tree to 0.4 — it adds a second copy beside the first, and both get compiled into a release binary that this crate builds with lto = true.

Why that matters more than usual here

The comment immediately above the line this PR edits is the rationale for the version:

signal-hook … already in the tree at this version, since crossterm pulls it through ratatui for its event stream.

Being already in the tree is why 0.3 was chosen. Merging this would quietly falsify the comment explaining the choice, which is the kind of drift that survives for years because nothing checks it.

What would justify it

• A security advisory against 0.3.18. There is none — cargo deny check advisories is clean.
• An API mossaic needs. It uses three items, all unchanged across the major: consts::{SIGHUP, SIGINT, SIGTERM}, iterator::Signals::new, and low_level::emulate_default_handler (src/restore.rs).
• crossterm moving to 0.4, at which point the bump is free again and the tree goes back to one copy. That is the real trigger, and it is not in our hands.

deny.toml has multiple-versions = "warn", so CI stays green either way — this is a judgement the check deliberately leaves to a person, and the judgement is: not yet.

Nothing wrong with the PR itself; the bot is doing its job. Closing so it stops being re-proposed weekly, and telling Dependabot to hold this major until there is a reason.

@dependabot ignore this major version

[vyncint]

Closing per the review above — held until crossterm moves to signal-hook 0.4, at which point the bump costs nothing.

[dependabot]

OK, I won't notify you about version 0.x.x again, unless you re-open this PR.