[dependabot]

Bumps the rust-dependencies group with 9 updates:

Package	From	To
rustyline	18.0.1	19.0.0
bincode	1.3.3	3.0.0
libc	0.2.190	0.2.191
ureq	2.12.1	3.5.0
rand	0.8.8	0.10.3
zip	9.0.3	9.0.5
calamine	0.36.1	0.37.0
tokio	1.53.3	1.54.1
log	0.4.33	0.4.34

Updates rustyline from 18.0.1 to 19.0.0

Release notes

Sourced from rustyline's releases.

19.0.0

What's Changed

• Fix some clippy #936
• Bump to actions/checkout@v6 #937
• Ignore clippy::collapsible_match #925
• Replace cfg_if by cfg_select #935
• Replace some cfg(not by cfg_select #939
• Bump rusqlite version #940
• Fix clippy warnings #942
• Fix clippy errors #945
• Use std::assert_matches #941
• Fix page_completions #948 (#949)
• Simplify creation of an editor with a default helper #950
• Coverage #891
• Edition 2024 #952
• Test --no-default-features #953
• Rustfmt group_imports & imports_granularity #956
• Update syn requirement from 2.0.116 to 3.0.2 #958
• Fix clippy warnings #962
• Simplify test code #965
• Simplify tests #967
• Accept Tab as confirmation at the completion list prompt #955 (#968)
• Read VEOF before writing VTIME #970 (#971)
• Fix FTS queries #966, #972 (#973, #989)
• Fix clippy warnings #975
• Check input buffer before polling #976 (#977)
• Fix page completions #980 (#981)
• Rustfmt #982

Full Changelog: kkawakam/rustyline@v18.0.0...v19.0.0

Commits

• 44c7025 Merge pull request #990 from gwenn/19
• 7a5033d Prepare release
• 98beff8 Merge pull request #989 from gwenn/fts
• badf865 Improve FTS queries
• 05eb920 Merge pull request #982 from gwenn/fmt
• 58b38c6 Rustfmt
• 705f9cd Merge pull request #981 from kkawakam/page_completions
• 3053c59 Fix page completions
• b5d88b9 Merge pull request #977 from gwenn/buffer_vs_printer
• f2bbcc5 Check input buffer before polling
• Additional commits viewable in compare view

Updates bincode from 1.3.3 to 3.0.0

Commits

• See full diff in compare view

Updates libc from 0.2.190 to 0.2.191

Release notes

Sourced from libc's releases.

0.2.191

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Changelog

Sourced from libc's changelog.

0.2.191 - 2026-10-16

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Commits

• ccc2ff4 libc: Release 0.2.191
• bce6efb apple: Add mach_task_self and mach_task_self_ to semver checks
• ecf4fd4 apple: Re-restrict mach_vm_map to MacOS-only
• b0e0423 Revert "apple: Disable mach.h API on Apple mobile OSs"
• 9c7f568 apple: add ifaliasreq and in6_aliasreq
• 018c7e9 wasi: Add pthread_condattr_{get,set}clock
• 2c77185 openbsd: add sensordev structure
• e10813c hurd: Add missing POSIX_SPAWN_* flags
• 2ea4bc1 Fix FreeBSD/aarch64
• 6d666fd dragonfly: Parse version from headers rather than CLI
• Additional commits viewable in compare view

Updates ureq from 2.12.1 to 3.5.0

Changelog

Sourced from ureq's changelog.

3.5.0

• Prepare 3.5.0 and fix dependency advisories and warnings - #1217
• Add Agent::shutdown() to interrupt requests in flight and close all connections #1211
• Preserve validated request header casing with RequestBuilder::header_raw #1214
• Decode proxy URL credentials once; literal percent signs must be escaped as %25 #1215
• Encode ProxyBuilder credentials and preserve colons in proxy passwords #1215
• Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #1209
• Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #1209
• Clarify timeout budgets, phase boundaries, and proxy DNS #1213
• Bound TLS handshake I/O by the remaining connect/global timeout #1208
• Retry socket reads interrupted by EINTR when timeout (technically breaking) #1205
• Fix native-tls-no-default enabling dependencies without enabling the TLS connector
• Add timeout_per_read and timeout_per_write independently of total phase budgets

3.4.3

• Update TLS dependencies for security fixes #1218

3.4.2

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
• Bypass pooling for request connection settings incompatible with the Agent #1201
• Try the next resolved address on unreachable/unavailable connect errors #1195

3.4.1

• Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199
• Do not pool connections with unconsumed buffered input #1198
• Fix timeout budgets restarting and applying to later phases #1194
• Complete TLS handshake during connect so timeout_connect covers it #1193
• Speed up read_json for responses with a known, small body size #1191

3.4.0

• Seal RequestExt (technically breaking) #1189
• Send canonical Basic authentication scheme to CONNECT proxies #1185
• Establish target TLS through HTTPS CONNECT proxies #1183
• Update rustls-platform-verifier to 0.7.0 #1174
• Fix pooled connections never aging out according to max_idle_age #1172
• Strip brackets from IPv6-literal hosts before TLS SNI/ServerName #1171
• RequestExt::middleware_config for conf inside middleware #1169

3.3.0

• Bump MSRV 1.71 -> 1.85, edition 2024 #1167

3.2.1

• Switch archived utf-8 crate for utf8-zero #1163

... (truncated)

Commits

• 1bd534e Fix changelog
• fee0ad2 Prepare 3.5.0 and fix dependency advisories and warnings
• 7de0ab7 Remove realtime dependencies from tests
• 3f18f90 Add Agent::shutdown() for active and pooled connections
• 04572f2 Expose validated request header casing
• 6b1c275 Fix proxy credential encoding and decoding
• 6a609b4 Apply the connect timeout to the SOCKS handshake and check NO_PROXY first
• 3c818f4 Clarify timeout budgets and phase boundaries
• af3e959 Bound TLS handshake I/O by remaining timeout budgets
• 0ebb046 Retry socket reads interrupted by a signal when a timeout applies (#1205)
• Additional commits viewable in compare view

Updates rand from 0.8.8 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

• Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)
• Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)
• Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

• Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

[0.10.2] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
• Use Edition 2024 and MSRV 1.85 (#1653)
• Let Fill be implemented for element types, not sliceable types (#1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
• Remove Clone support for StdRng, ReseedingRng (#1677)
• Use postcard instead of bincode to test the serde feature (#1693)

... (truncated)

Commits

• 9e7d328 Prepare rand 0.10.3 (#1840)
• f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
• ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
• c994eb1 docs: fix angle unit in quick start example (#1839)
• 33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
• 94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
• bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
• 521fab6 Stop pinning dependencies (#1820)
• 3f7c433 Stop pinning dependencies
• cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
• Additional commits viewable in compare view

Updates zip from 9.0.3 to 9.0.5

Release notes

Sourced from zip's releases.

v9.0.5

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

v9.0.4

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

Changelog

Sourced from zip's changelog.

9.0.5 - 2026-10-17

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

9.0.4 - 2026-10-16

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

Commits

• 0123ed1 chore: release v9.0.5 (#1093)
• 00cf82b docs: Repeal policy of yanking versions with known vulnerabilities, add menti...
• 52165b9 chore: Enable release-plz on backport branches in future (#1079)
• ca51e64 docs: Remove doc links that break when doc build doesn't enable all features ...
• 6639687 fix: use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• 5e06fa8 fix(write): prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)
• b6f9fb8 Merge commit from fork
• ea2ccfe Merge commit from fork
• 8068ab4 Merge commit from fork
• 0b51128 doc: Clarifications to security policy (#1074)
• Additional commits viewable in compare view

Updates calamine from 0.36.1 to 0.37.0

Release notes

Sourced from calamine's releases.

v0.37.0 - 2026-10-18

Changed

• Updated dependencies for release 0.37.0:

  • zip: 8.6 to 9.0, since the 8.x releases were yanked upstream. ZipError is part of the public error types, hence the minor version bump. [PR #741].
  • quick-xml: 0.41 to 0.42. [PR #711].

  [PR #741]: tafia/calamine#741 [PR #711]: tafia/calamine#711

Added

• Added workbook_properties() methods to Xlsx, Xlsb and Sheets to read the workbook document properties, such as creator, title, and creation date, into a new WorkbookProperties struct. [Issue #677] and [PR #685].

  [Issue #677]: tafia/calamine#677 [PR #685]: tafia/calamine#685

Fixed

• Fixed an issue with XLS worksheets that contain nested substreams, such as an embedded chart, leaking the chart cells into the worksheet. [PR #701].

  [PR #701]: tafia/calamine#701

• Fixed an issue where the column letters beyond Z in formulas where reconstructed incorrectly. [PR #699].

  [PR #699]: tafia/calamine#699

  [PR #707]: tafia/calamine#707

• Fixed the XLSX 1904 date epoch flag being reset by an <x15:workbookPr> extension element. [Issue #706].

  [Issue #706]: tafia/calamine#706

• Fixed an issue to allow XLSX formula string results to decode Excel _xHHHH_ escapes, in the same way as shared and inline strings. [PR #727].

  [PR #727]: tafia/calamine#727

• Fixed an issue to allow XLSX hyperlink attributes to decode XML entities, so that & in a URL is no longer returned as &. [PR #728].

  [PR #728]: tafia/calamine#728

... (truncated)

Changelog

Sourced from calamine's changelog.

[0.37.0] - 2026-10-18

Changed

• Updated dependencies for release 0.37.0:

  • zip: 8.6 to 9.0, since the 8.x releases were yanked upstream. ZipError is part of the public error types, hence the minor version bump. [PR #741].
  • quick-xml: 0.41 to 0.42. [PR #711].

  [PR #741]: tafia/calamine#741 [PR #711]: tafia/calamine#711

Added

• Added workbook_properties() methods to Xlsx, Xlsb and Sheets to read the workbook document properties, such as creator, title, and creation date, into a new WorkbookProperties struct. [Issue #677] and [PR #685].

  [Issue #677]: tafia/calamine#677 [PR #685]: tafia/calamine#685

Fixed

• Fixed an issue with XLS worksheets that contain nested substreams, such as an embedded chart, leaking the chart cells into the worksheet. [PR #701].

  [PR #701]: tafia/calamine#701

• Fixed an issue where the column letters beyond Z in formulas where reconstructed incorrectly. [PR #699].

  [PR #699]: tafia/calamine#699

  [PR #707]: tafia/calamine#707

• Fixed the XLSX 1904 date epoch flag being reset by an <x15:workbookPr> extension element. [Issue #706].

  [Issue #706]: tafia/calamine#706

• Fixed an issue to allow XLSX formula string results to decode Excel _xHHHH_ escapes, in the same way as shared and inline strings. [PR #727].

  [PR #727]: tafia/calamine#727

• Fixed an issue to allow XLSX hyperlink attributes to decode XML entities, so that & in a URL is no longer returned as &. [PR #728].

  [PR #728]: tafia/calamine#728

... (truncated)

Commits

• f2c5948 release: 0.37.0
• 61244e6 xlsx: check/reject invalid boolean cell values (#749)
• 3921997 datetime: limit serial values in to_ymd_hms_milli() (#747)
• d93c5a4 formats: recognize East Asian built-in date and time formats (#734)
• 39ebf5d docs: fix minor typo
• b31d86d fix(cfb): stop allocating from unchecked header sector counts (#729)
• 1035113 git: add .gitattributes to normalize line endings to LF
• b05d6cd Fix CRLF line termination in examples/read_hyperlinks.rs (#736)
• d0ed286 fix(xls): accept DIMENSIONS records with 2 extra trailing bytes (#735)
• 0ddcae7 xls: fix PtgStr parsing for UTF-16 string operands (#730)
• Additional commits viewable in compare view

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates log from 0.4.33 to 0.4.34

Release notes

Sourced from log's releases.

0.4.34

What's Changed

• doc: Add context-logger utility to README by @​alekseysidorov in rust-lang/log#735
• Add alloc support for boxed loggers by @​malezjaa in rust-lang/log#737

New Contributors

• @​alekseysidorov made their first contribution in rust-lang/log#735
• @​malezjaa made their first contribution in rust-lang/log#737

Full Changelog: rust-lang/log@0.4.33...0.4.34

Changelog

Sourced from log's changelog.

[0.4.34] - 2026-08-22

What's Changed

• doc: Add context-logger utility to README by @​alekseysidorov in rust-lang/log#735
• Add alloc support for boxed loggers by @​malezjaa in rust-lang/log#737

New Contributors

• @​alekseysidorov made their first contribution in rust-lang/log#735
• @​malezjaa made their first contribution in rust-lang/log#737

Full Changelog: rust-lang/log@0.4.33...0.4.34

Commits

• 8034743 Merge pull request #738 from rust-lang/cargo/0.4.34
• 7d1e24e prepare for 0.4.34 release
• 3b939b6 Merge pull request #737 from malezjaa/master
• b88266c Add alloc support for boxed loggers
• 037d7a5 doc: Add context-logger utility to README
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions