fix(deps): update all - #52
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/all
branch
from
March 3, 2026 10:04
7d02e38 to
4d3606c
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
3 times, most recently
from
March 12, 2026 13:10
42f00ff to
4437abd
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
2 times, most recently
from
March 31, 2026 21:06
6346374 to
1cbe1ee
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
2 times, most recently
from
April 3, 2026 17:29
78cbbe1 to
8455599
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
2 times, most recently
from
April 12, 2026 13:02
e2197e6 to
d02cc84
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
from
April 20, 2026 05:49
d02cc84 to
d305d58
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
2 times, most recently
from
May 15, 2026 20:54
e5ff503 to
8c3172e
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
from
June 29, 2026 23:39
8c3172e to
0a933fc
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
from
July 15, 2026 20:49
0a933fc to
31c5aa5
Compare
renovate
Bot
force-pushed
the
renovate/all
branch
from
August 15, 2026 01:48
31c5aa5 to
b16708e
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/all
branch
from
August 22, 2026 22:31
b16708e to
dc20219
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.1.89→0.1.921.11.1→1.12.10.1.3→0.1.51.8.1→1.11.00.27.7→0.27.96839151→93c56911.21.3→1.21.40.39.0→0.42.00.10.0→0.10.21.12.3→1.13.10.13.2→0.13.40.23.36→0.23.430.6.2→0.7.01.0.149→1.0.1513.4.0→3.5.03.26.0→3.27.01.49.0→1.53.10.7.18→0.7.191.21.0→1.25.0Release Notes
dtolnay/async-trait (async-trait)
v0.1.92Compare Source
v0.1.91Compare Source
v0.1.90Compare Source
tokio-rs/bytes (bytes)
v1.12.1Compare Source
Fixed
Box::newpanics (#837)v1.12.0Compare Source
Added
BytesMut::extend_from_within()(#818)BytesMut::try_unsplit()(#746)Fixed
get_intifnbytesis zero (#806)Changed
Documented
BytesMut::{reserve,try_reserve}doesn't preserve unused capacity (#808)hyperium/http-body (http-body-util)
v0.1.5Compare Source
v0.1.4Compare Source
What's Changed
Fusedbody combinator that always returnsNoneonce completed.BodyExt::into_stream()to convert a body into aStream.Full::into_inner()to get the fullBuf.InspectFrameandInspectErrcombinators.hyperium/hyper (hyper)
v1.11.0Compare Source
Bug Fixes
Upgradedwrites without send capacity (#4102) (aecf5abf)Features
ReadBufCursor::initialized_unfilled()method (#4115) (ccc1e850)v1.10.1 (2026-05-29)
Bug Fixes
v1.10.1Compare Source
Bug Fixes
v1.10.0Compare Source
Bug Fixes
NO_ERRORfrom early response (#3998) (e5ad96b1)Features
reset_stream_duration()client option (#4068) (156a6f6a, closes #2599)v1.9.0Compare Source
Bug Fixes
Features
max_local_error_reset_streamsoption (#4021) (57787459)v1.8.1 (2025-11-13)
Bug Fixes
matklad/once_cell (once_cell)
v1.21.4Compare Source
Fix unsoundness in
OnceCell::waitunder--features=parking_lot, #295.If thread A calls
wait, while thread B callsget_or_try_init(f), and, furthermore,fpanics,the
waitincorrectly returns and thread A observes uninitialized memory.Kudos to @meng-xu-cs for a nice find!
tafia/quick-xml (quick-xml)
v0.42.0Compare Source
This is a large release. The primary change is an ergonomic improvement across the entire API -
quick_xml now makes use of
&strandStringtypes where possible instead of&[u8]andVec<u8>. This requires significant refactoring of downstream code,but should result in a net simplification as well as potential performance improvements,
and opens up additional opportunities in future releases.
The MSRV has been raised to 1.86. We now use Rust 2024 Edition.
Breaking Changes
Non-UTF-8 input passed to
Reader::from_reader()withoutDecodingReaderwill nowproduce
Error::Encodinginstead of silently passing through invalid bytes.Use
DecodingReaderto transcode non-UTF-8 sources.QName,LocalName,Prefix,Namespace,PrefixDeclaration)now wrap
&strinstead of&[u8].into_inner()returns&str, andAsRef<str>is implemented (
AsRef<[u8]>has been removed).ResolveResult::Unknownnow containsStringinstead of
Vec<u8>, andNamespaceErrorvariants containStringinstead ofVec<u8>.decoder: Decoderfield from event types (BytesStart,BytesText,BytesCData,BytesRef) andAttributes. Thedecoder()method is no longer availableon these types. Decode methods on events now always assume UTF-8 input.
Error::missed_end()no longer takes aDecoderparameter.BytesStart,BytesEnd,BytesText,BytesCData,BytesPI,BytesRef) now storeCow<str>internally instead ofCow<[u8]>.into_inner()onBytesText,BytesCData,BytesPI, andBytesRefnow returnsCow<str>.BytesStart::set_name()now takes&strinstead of&[u8].Eventenum now implementDeref<Target = str>instead of
Deref<Target = [u8]>. ExplicitAsRef<str>impls are provided toavoid ambiguity.
decode()methods fromBytesText,BytesCData, andBytesRef.Content is already available as
&strviaDeref. Thexml10_content(),xml11_content(),xml_content(), andhtml_content()methods now returnCow<str>directly instead ofResult<Cow<str>, EncodingError>.Attribute::valueis nowCow<'a, str>instead ofCow<'a, [u8]>.The
From<(&[u8], &[u8])>impl has been removed.BytesDecl::version(),encoding(), andstandalone()now returnCow<'_, str>instead ofCow<'_, [u8]>.Reader::decoder()method. UseReader::encoding()instead(available with the
encodingfeature). Removeddecoder()from theXmlReadserde trait. Removed all methods from
Decoder(the struct is kept only forbackward compatibility with deprecated
Attributemethods).NamespaceError::TooManyDeclarationshas been renamed toTooManyBindings,and
NamespaceResolver::set_max_declarations_per_elementhas been renamed toNamespaceResolver::set_max_namespace_bindings, and the semantic behavior haschanged slightly. The default maximum has also been reduced from 256 to 128.
DeError::UnexpectedStartrenamed toDeError::MixedContent. That erroris emitted when you try to deserialize boolean, number or string
fieldfromsomething like
<field>text <tag/> another text</field>.Bug Fixes
\r,\n, and\tin attribute valuesas
&#​13;,&#​10;, and&#​9;respectively, preventing silent data loss fromXML attribute-value normalization on round-trip. Likewise
Attribute::fromperforms the same transformation.
Deserializernow correctly handles namespaces. Previouslythe namespace bindings might be applied or removed before the event actually
was consumed which lead to a couple of bugs.
Attributes::newandAttributes::htmlnow return empty iterators whentheir starting position is past the end of the input instead of panicking.
NamespaceResolver::push(and hence everyNsReaderStart/Emptyevent) now returns the new
NamespaceError::TooDeeplyNestedwhen a documentnests elements deeper than
u16::MAX, instead of overflowing the internalu16depth counter. Previously the unguardednesting_level += 1panickedunder
overflow-checksbuilds and silently wrapped in release, corruptingnamespace-scope bookkeeping on deeply nested untrusted input.
NamespaceResolvernow caps the total number of in-scope namespacebindings (default 128, configurable via
set_max_namespace_bindings),replacing the previous per-element
max_declarations_per_elementlimit.Deserializernow enforces a configurable recursion-depthlimit (default 128, matching
serde_json). Deeply nested XML returnsDeError::TooDeeplyNestedinstead of overflowing the native call stack.Use
Deserializer::recursion_limit()to adjust.\rin text content is now escaped as&#​13;by the serde serializer,BytesText::new(),escape(),partial_escape(), andminimal_escape(),preventing silent conversion to
\nfrom XML end-of-line normalization onround-trip. Note that
\rcannot be preserved through CDATA serializationbecause character references are not permitted inside CDATA sections.
Misc Changes
getting_started,writer,serde_roundtrip,reader_patterns,visitor) and anexamples/README.mdguide on choosing between the serde and pull-reader/writer APIs.
Attributemethods that take aDecoderparameter, sinceattribute values are now always valid UTF-8:
decoded_and_normalized_value(),decoded_and_normalized_value_with(),decode_and_unescape_value(), anddecode_and_unescape_value_with(). Usenormalized_value()andnormalized_value_with()instead.NamespaceResolver::withthat allows temporary applying namespacebindings from the start tag for the scope of a provided closure F, without making any
persistent change to the resolver. It is useful to check a peeked event which is
not yet consumed in custom implementations of peekable reader.
Deserializer::resolverandDeserializer::resolver_mutmethodsto get a namespace resolver used by this deserializer, because it no longer uses
an
NsReaderinternally.Hash,PartialOrd, andOrdforBytesTextandBytesCDatatypes.v0.41.0Compare Source
New Features
NsReader::resolver_mut()andNamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.Bug Fixes
Attributes(and anything that iteratesBytesStart::attributes()with the default
with_checks(true)) no longer takes O(N²) time on a starttag with a large number of attributes. Small tags keep the previous linear
scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is
O(N). The exact
AttrError::Duplicated(new, prev)positions are unchanged.NamespaceResolver::push(and hence everyNsReaderStart/Emptyevent) now rejects a start tag that declares more than
DEFAULT_MAX_DECLARATIONS_PER_ELEMENT(256)xmlns/xmlns:*namespacebindings, returning the new
NamespaceError::TooManyDeclarations. Previouslypushallocated oneNamespaceBindingper declaration with no upper bound,before the event was returned to the caller, so an
NsReaderconsumer couldnot bound its memory exposure on untrusted input. The limit is configurable
via
NamespaceResolver::set_max_declarations_per_element(useusize::MAXto disable).
v0.40.1Compare Source
Bug Fixes
unreachable!()panic in the serde deserializer when a DOCTYPEdeclaration appears between two text runs inside an element (e.g.
<a>x<!DOCTYPE y>z</a>). The DOCTYPE used to breakdrain_text'sconsecutive-text merge, so two
DeEvent::Textevents reachedread_textand tripped its "Cannot be two consequent Text events"invariant. DOCTYPE is now treated as transparent during text drain —
it still goes through the entity resolver, but the surrounding text
is merged into one run. Discovered via libFuzzer on a real-world
SAML deserializer harness.
v0.40.0Compare Source
MSRV bumped to 1.79.
Now
quick-xmlsupports UTF-16 encoded documents. See the newDecodingReadertype.New Features
#956: Add
DecodingReader, aBufReadadapter that auto-detects encodingfrom BOM or XML declaration and transcodes to UTF-8. Enabled by the
encodingfeature.#938: Add new enumeration
XmlVersionand typified getterBytesDecl::xml_version().#938: Add new error variant
IllFormedError::UnknownVersion.#371: Add new error variant
EscapeError::TooManyNestedEntities.#371: Improved compliance with the XML attribute value normalization process by adding
Attribute::normalized_value()Attribute::normalized_value_with()Attribute::decoded_and_normalized_value()Attribute::decoded_and_normalized_value_with()which ought to be used in place of deprecated
Attribute::unescape_value()Attribute::unescape_value_with()Attribute::decode_and_unescape_value()Attribute::decode_and_unescape_value_with()Deprecated functions now behaves the same as newly added.
Bug Fixes
Deserializerwhen parse XML 1.0 documents.Previously XML 1.1. rules was applied.
Misc Changes
.prefixes(),.resolve(),.resolve_attribute(), and.resolve_element()of
NsReader. Use.resolver().<...>methods instead.BytesText::xml_content,BytesCData::xml_contentandBytesRef::xml_contentaccepts
XmlVersionparameter to apply correct EOL normalization rules.read_text()now returnsBytesTextwhich allows you to get the content withproperly normalized EOLs. To get the previous behavior use
.read_text().decode()?.v0.39.4Compare Source
Bug Fixes
is split across
BufReaderchunks. As with #950, the returnedEvent::DocTypemay contain the malformed DTD; this fix only ensures thatthe parser does not panic.
<followedby 9+ bytes of unknown markup inside a DTD internal subset. Same disposition
as #957 / #950: parser must not panic; DTD validity reporting is a future
improvement.
v0.39.3Compare Source
Bug Fixes
Note, that currently we do not check the validity of DTD, so the returned
Event::DocTypemay contain the malformed DTD.
rust-random/rand (rand)
v0.10.2Compare Source
Fixes
UniformCharfrom bad source (#1790)Changes
partial_shuffleand apply#[must_use](#1769)unsafein contexts where non-local memory corruption could invalidate contract (#1791)v0.10.1Compare Source
This release includes a fix for a soundness bug; see #1763.
Changes
make_rngand add#[track_caller](#1761)log(#1763)rust-lang/regex (regex)
v1.13.1Compare Source
===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#1364 for (many) more details.
Bug fixes:
Fixes previously unsound reverse suffix and inner optimizations.
v1.13.0Compare Source
===================
This release includes a new API, a
regex!macro, for lazy compilation ofa regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:
Improvements:
Add a new
regex!macro for efficient and automatic reuse of a compiled regex.v1.12.4Compare Source
===================
This release includes a performance optimization for compilation of regexes
with very large character classes.
Improvements:
Avoid re-canonicalizing the entire interval set when pushing new class ranges.
seanmonstar/reqwest (reqwest)
v0.13.4Compare Source
ClientBuilder::tls_sslkeylogfile(bool)option to allow using the related environment variable.ClientBuilder::http2_keep_alive_*options for theblockingclient.native-tlsbackend.v0.13.3Compare Source
/etc/resolv.conffails.STOP_SENDINGas not an error.serde-rs/json (serde_json)
v1.0.151Compare Source
v1.0.150Compare Source
palfrey/serial_test (serial_test)
v3.5.0Compare Source
What's Changed
New Contributors
Full Changelog: palfrey/serial_test@v3.4.0...v3.5.0
Stebalien/tempfile (tempfile)
v3.27.0Compare Source
This release adds
TempPath::try_from_pathand deprecatesTempPath::from_path.Prior to this release,
TempPath::from_pathmade no attempts to convert relative paths into absolute paths. The following code would have deleted the wrong file:Now:
TempPath::from_pathwill attempt to convert relative paths into absolute paths. However, this isn't always possible as we need to callstd::env::current_dir, which can fail. If we fail to convert the relative path to an absolute path, we simply keep the relative path.TempPath::try_from_pathbehaves exactly likeTempPath::from_path, except that it returns an error if we fail to convert a relative path into an absolute path (or if the passed path is empty).Neither function attempt to verify the existence of the file in question.
Thanks to @meng-xu-cs for reporting this issue.
tokio-rs/tokio (tokio)
v1.53.1: Tokio v1.53.1Compare Source
1.53.1 (July 20th, 2026)
Fixed
OnceLock::waitfrom the Windows handler (#8300)Fixed (unstable)
Documented
v1.53.0: Tokio v1.53.0Compare Source
1.53.0 (July 17th, 2026)
Added
From<OwnedFd>andFrom<OwnedHandle>forFile(#8266)SocketAddrmethods to Unix sockets (#8144)Changed
#[inline]to IO trait impls for in-memory types (#8242)mpsc::{Receiver,UnboundedReceiver}now drops waker on drop, even if there are still senders (#8095)#[track_caller]totimeout_at()(#8077)Sleep(#8132)Fixed
Chain(#8251)FastRand(#8078)reserve[_many]returns permits (#8260)Trace::capture/Trace::trace_with(#8043).reset()(#8169)IO uring (unstable)
fs::try_exists(#8080)Documented
create_dir_allsucceeds if path exists (#8149)try_read*/try_write*readiness behavior (#8032)yield_nowdefers its waker (#8254)timeout_at()(#8077)v1.52.4: Tokio v1.52.4Compare Source
1.52.4 (July 16th, 2026)
Fixed
before_parkschedules work (#8222)Fixed (unstable)
v1.52.3: Tokio v1.52.3Compare Source
1.52.3 (May 8th, 2026)
Fixed
len()(#8062)OwnedPermit::release()method (#8075)RwLockhasmax_readers != 0(#8076)Emptyfromtry_recv()when mpsc is closed with outstanding permits (#8074)v1.52.2: Tokio v1.52.2Compare Source
1.52.2 (May 4th, 2026)
This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to its performance impact. (#8100)
v1.52.1: Tokio v1.52.1Compare Source
1.52.1 (April 16th, 2026)
Fixed
spawn_blockingto hang (#8057)v1.52.0: Tokio v1.52.0Compare Source
1.52.0 (April 14th, 2026)
Added
AioSource::register_borrowedfor I/O safety support (#7992)try_iofunction tounix::pipesender and receiver types (#8030)Added (unstable)
Builder::enable_eager_driver_handoffsetting enable eager hand off of the I/O and time drivers before polling tasks (#8010)trace_with()for customized task dumps (#8025)impl FnMut()intrace_withinstead of justfn()(#8040)io_uringinAsyncReadforFile(#7907)Changed
spawn_blockingscalability with sharded queue (#7757)compare_exchange_weak()in worker queue (#8028)Fixed
Documented
oneshot::Sender::senddocs (#8026)sync::watch(#8035)ConnectionRefusederrors with UDP sockets (#7870)v1.51.4: Tokio v1.51.4Compare Source
1.51.4 (July 16th, 2026)
Fixed
before_parkschedules work (#8222)v1.51.3: Tokio v1.51.3Compare Source
1.51.3 (May 8th, 2026)
Fixed
len()(#8062)OwnedPermit::release()method (#8075)RwLockhasmax_readers != 0(#8076)Emptyfromtry_recv()when mpsc is closed with outstanding permits (#8074)v1.51.2: Tokio v1.51.1Compare Source
1.51.2 (May 4th, 2026)
This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to its performance impact. (#8100)
v1.51.1: Tokio v1.51.1Compare Source
1.51.1 (April 8th, 2026)
Fixed
SO_ERRORonrecvfor UDP sockets on Linux (#8001)Fixed (unstable)
worker_local_schedule_counttest (#8008)v1.51.0: Tokio v1.51.0Compare Source
1.51.0 (April 3rd, 2026)
Added
get_peer_credon Hurd (#7989)tokio::runtime::worker_index()(#7921)LocalRuntime(#7557)Changed
Fixed
notify_waiterspriority inNotify(#7996)Chan::recv_manywhen called with non-empty vector on closed channel (#7991)v1.50.0: Tokio v1.50.0Compare Source
1.50.0 (Mar 3rd, 2026)
Added
TcpStream::set_zero_linger(#7837)is_rt_shutdown_err(#7771)Changed
memchrreturns in-bounds pointer (#7792)write_buf(#7871)event_intervalis set to 0 (#7838)SetConsoleCtrlHandler(#7833)Registry(#7885)Fixed
AsyncFdregistration list on deregister (#7773)usedeclarations intokio::select!([#7929])GET_BUF_SIZEconstant fortarget_os = "android"(#7889)current_threadifbefore_parkdefers waker (#7835)block_in_place(#7879)num_idle_threadson shutdown ([#7910], [#7918], [#7922])Unstable
Documented
AsyncWriteExt::shutdown()([#7908])AsyncWritedocumentation (#7875)Runtime::spawn(#7803)event_intervaldoc ([#7932])recvreturnsNoneonce closed and no more messages ([#7920])spawn_blockingvs dedicated threads ([#7923])JoinHandlecompletion (#7825)None(#7869)Builder::spawn_local(#7828)Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.