Skip to content

chore(deps): bump the rust-security group across 1 directory with 11 updates - #22

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-security-7369d2e174
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-security-7369d2e174

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-security group with 11 updates in the / directory:

Package From To
thiserror 2.0.20 2.0.21
clap 4.6.6 4.6.7
clap_complete 4.6.9 4.6.11
quick-xml 0.41.0 0.42.0
dirs 6.0.0 7.0.0
toml 1.1.4+spec-1.1.0 1.1.6+spec-1.1.0
yrs 0.20.0 0.28.0
rand 0.8.7 0.10.2
rand_chacha 0.3.1 0.10.0
automerge 0.5.12 0.12.0
axum 0.7.9 0.8.9

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

  • Fix parsing of generic unit variants in display expressions (#459)
Commits
  • b1827ee Release 2.0.21
  • 58037b5 Merge pull request #459 from dtolnay/turbofish
  • f82a0cf Keep track of nested turbofish depth
  • 72ea492 Raise required compiler to Rust 1.77
  • 72eea0d Resolve io_other_error clippy lint in tests
  • 07f09a2 Raise required compiler to Rust 1.74
  • 2715388 Update ui test suite to nightly-2026-09-22
  • 5a306c7 Update ui test suite to nightly-2026-09-05
  • ef9383b Update ui test suite to nightly-2026-08-22
  • 8336b84 Update ui tests for version 2.0.20
  • See full diff in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Commits
  • d3e59a9 chore: Release
  • d997f87 docs: Update changelog
  • fb6058c Merge pull request #6409 from heaths/pwsh-support
  • 2310870 test(complete): Add tests for completer_for_path
  • 5967c17 refactor(complete): Move shell detection to Shells
  • 594602b fix(complete): Detect pwsh for PowerShell
  • 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
  • 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
  • c968b13 chore(deps): Update Rust crate shlex to v2
  • 8f247cb chore(deps): Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates clap_complete from 4.6.9 to 4.6.11

Commits
  • 2cb76fd chore: Release
  • 0b00b8d docs: Update changelog
  • 3443000 Merge pull request #6526 from bonnefoa/fix-completion-escape
  • a1b6be7 fix(clap_complete): Fix value escape in zsh completion
  • face9e8 test(complete): Add completion test without arg's help
  • 88053ab test(complete): Re-enable complete tests
  • e6adcc2 chore(release): Simplify replacements
  • 13f2db5 chore: Release
  • 3304fea docs: Update changelog
  • 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
  • Additional commits viewable in compare view

Updates quick-xml from 0.41.0 to 0.42.0

Release notes

Sourced from quick-xml's releases.

v0.42.0 - String Ergonomics

What's Changed

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

  • #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
  • #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
  • #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
  • #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
  • #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
  • #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
  • #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
  • #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
  • #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
  • #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

  • #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
  • #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
  • #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
  • #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
  • #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
  • #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
  • #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
  • #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
  • #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
  • #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.
  • #1000: DeError::UnexpectedStart renamed to DeError::MixedContent. That error is emitted when you try to deserialize boolean, number or string field from something like <field>text <tag/> another text</field>.

... (truncated)

Commits
  • 36a2c52 Release 0.42.0
  • a4b9fca cargo fmt
  • 22c99f5 Update Rust Edition to 2024
  • 83351fb Add rename = $value to a table in serde example comments
  • f4db767 Clarify documentation about lifetimes of the events and attributes
  • 9f4c66a Fix formatting for correct assertions in read_nodes_serde
  • 6950ef7 Add GHA job to execute examples
  • dbf9e3f Show XML Decl tracking in examples
  • aab9452 Add writing a Decl event to the writer example
  • 1573e05 Avoid trim_text(true) in the in-depth examples
  • Additional commits viewable in compare view

Updates dirs from 6.0.0 to 7.0.0

Updates toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits
  • 572c005 chore: Release
  • 66d0c53 docs: Update changelog
  • 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
  • 0ff90db perf(display): Write encoded strings directly
  • efb2536 perf(display): Move generated representation strings
  • 075c444 refactor(display): Consolidate key-path encoding
  • b48f338 perf(display): Borrow table keys during document output
  • c6c1de3 perf(parser): Move completed table header keys
  • ec90463 perf(parser): Borrow input when creating editable documents
  • d76a48a test: Benchmark rendering generated keys and values
  • Additional commits viewable in compare view

Updates yrs from 0.20.0 to 0.28.0

Commits
  • 23b7f56 release v0.28
  • 8c0a825 Merge pull request #662 from Horusiath/remove-subscription
  • aaa1f50 fix dealock in fuzzy tests
  • 22890d6 Merge pull request #659 from kavinsood/fix/ywasm-utf16-offset-docs
  • ba8f2d3 Merge pull request #658 from Horusiath/fix/branch-by-val-eq
  • a576b98 docs(ywasm): describe text offsets as UTF-16 code units
  • 9d2d390 Branch::eq should only compare by reference
  • cf11965 ai-gen: yffi - make use of new subscription API:
  • 85043ee make doc subscribe/unsubscribe from transaction
  • 64f3ede use unsubscribe abased on ArcSwap Option
  • Additional commits viewable in compare view

Updates rand from 0.8.7 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates rand_chacha from 0.3.1 to 0.10.0

Release notes

Sourced from rand_chacha's releases.

0.10.0

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

#1632: rust-random/rand#1632 #1642: rust-random/rand#1642 #1649: rust-random/rand#1649 #1652: rust-random/rand#1652 #1653: rust-random/rand#1653 #1659: rust-random/rand#1659 #1665: rust-random/rand#1665 #1669: rust-random/rand#1669 #1674: rust-random/rand#1674 #1677: rust-random/rand#1677 #1693: rust-random/rand#1693 #1695: rust-random/rand#1695 #1697: rust-random/rand#1697 #1717: rust-random/rand#1717 #1722: rust-random/rand#1722 #1732: rust-random/rand#1732 #1734: rust-random/rand#1734

New Contributors

... (truncated)

Changelog

Sourced from rand_chacha's changelog.

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

#1632: rust-random/rand#1632 #1642: rust-random/rand#1642 #1649: rust-random/rand#1649 #1652: rust-random/rand#1652 #1653: rust-random/rand#1653 #1659: rust-random/rand#1659 #1665: rust-random/rand#1665 #1669: rust-random/rand#1669 #1674: rust-random/rand#1674 #1677: rust-random/rand#1677 #1693: rust-random/rand#1693 #1695: rust-random/rand#1695 #1697: rust-random/rand#1697 #1717: rust-random/rand#1717 #1722: rust-random/rand#1722 #1732: rust-random/rand#1732 #1734: rust-random/rand#1734

[0.9.2] - 2025-07-20

Deprecated

  • Deprecate rand::rngs::mock module and StepRng generator (#1634)

... (truncated)

Commits

Updates automerge from 0.5.12 to 0.12.0

Commits
  • 1755d0d rust/automerge@0.12.0
  • f45718f rust/automerge/change_graph: Fix test flake
  • efef0e1 rust/automerge: Fix InsertQuery::resolve
  • 9d5cbd8 Apply rich text block patches in JavaScript
  • 4e7bccf Emit rich text patches for exposed text objects
  • 1ae4d18 rust: Exclude fragment head from checkpoints
  • 7f96e1b javascript/implementation: Fix documentation mention fork
  • 62ea6a1 javascript/proxies: Guard on __proto__
  • fa20bd8 build(deps-dev): bump browserslist
  • 9f3cef7 build(deps-dev): bump fast-uri
  • Additional commits viewable in compare view

Updates axum from 0.7.9 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

axum v0.8.8

  • Clarify documentation for Router::route_layer (#3567)

#3567: tokio-rs/axum#3567

axum v0.8.7

  • Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#3555)
  • Make it easier to visually scan for default features (#3550)
  • Fix some documentation typos

#3550: tokio-rs/axum#3550 #3555: tokio-rs/axum#3555

axum v0.8.5

  • fixed: Reject JSON request bodies with trailing characters after the JSON document (#3453)
  • added: Implement OptionalFromRequest for Multipart (#3220)
  • added: Getter methods Location::{status_code, location}
  • added: Support for writing arbitrary binary data into server-sent events (#3425)]
  • added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#3469)
  • added: impl FusedStream for WebSocket (#3443)
  • changed: The sse module and Sse type no longer depend on the tokio feature (#3154)
  • changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#3377)
  • changed: Update minimum rust version to 1.78 (#3412)

#3154: tokio-rs/axum#3154 #3220: tokio-rs/axum#3220 #3377: tokio-rs/axum#3377 #3412: tokio-rs/axum#3412 #3425: tokio-rs/axum#3425 #3443: tokio-rs/axum#3443 #3453: tokio-rs/axum#3453 #3469: tokio-rs/axum#3469

axum v0.8.4

  • added: Router::reset_fallback (#3320)
  • added: WebSocketUpgrade::selected_protocol (#3248)
  • fixed: Panic location for overlapping method routes (#3319)
  • fixed: Don't leak a tokio task when using serve without graceful shutdown (#3129)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates

Bumps the rust-security group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.20` | `2.0.21` |
| [clap](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.6.9` | `4.6.11` |
| [quick-xml](https://github.com/tafia/quick-xml) | `0.41.0` | `0.42.0` |
| dirs | `6.0.0` | `7.0.0` |
| [toml](https://github.com/toml-rs/toml) | `1.1.4+spec-1.1.0` | `1.1.6+spec-1.1.0` |
| [yrs](https://github.com/y-crdt/y-crdt) | `0.20.0` | `0.28.0` |
| [rand](https://github.com/rust-random/rand) | `0.8.7` | `0.10.2` |
| [rand_chacha](https://github.com/rust-random/rand) | `0.3.1` | `0.10.0` |
| [automerge](https://github.com/automerge/automerge) | `0.5.12` | `0.12.0` |
| [axum](https://github.com/tokio-rs/axum) | `0.7.9` | `0.8.9` |



Updates `thiserror` from 2.0.20 to 2.0.21
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.20...2.0.21)

Updates `clap` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.6...clap_complete-v4.6.7)

Updates `clap_complete` from 4.6.9 to 4.6.11
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.9...clap_complete-v4.6.11)

Updates `quick-xml` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/tafia/quick-xml/releases)
- [Changelog](https://github.com/tafia/quick-xml/blob/master/Changelog.md)
- [Commits](tafia/quick-xml@v0.41.0...v0.42.0)

Updates `dirs` from 6.0.0 to 7.0.0

Updates `toml` from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.4...toml-v1.1.6)

Updates `yrs` from 0.20.0 to 0.28.0
- [Release notes](https://github.com/y-crdt/y-crdt/releases)
- [Commits](y-crdt/y-crdt@v0.20.0...v0.28.0)

Updates `rand` from 0.8.7 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.7...0.10.2)

Updates `rand_chacha` from 0.3.1 to 0.10.0
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@rand_chacha-0.3.1...0.10.0)

Updates `automerge` from 0.5.12 to 0.12.0
- [Release notes](https://github.com/automerge/automerge/releases)
- [Commits](https://github.com/automerge/automerge/compare/rust/automerge@0.5.12...rust/automerge-0.12.0)

Updates `axum` from 0.7.9 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.9)

---
updated-dependencies:
- dependency-name: thiserror
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-security
- dependency-name: clap
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-security
- dependency-name: clap_complete
  dependency-version: 4.6.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-security
- dependency-name: quick-xml
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-security
- dependency-name: dirs
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-security
- dependency-name: toml
  dependency-version: 1.1.6+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-security
- dependency-name: yrs
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-security
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-security
- dependency-name: rand_chacha
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-security
- dependency-name: automerge
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-security
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area:core Touches `linkmarks-core` (model, traits, canonical, dedupe). chore Build, tooling, dependency, or housekeeping change. labels Sep 28, 2026
@coderabbitai

coderabbitai Bot commented Sep 28, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 9072adf5-8467-4046-ab8f-36a1ed5070df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:core Touches `linkmarks-core` (model, traits, canonical, dedupe). chore Build, tooling, dependency, or housekeeping change.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants