build(deps): update dua-core requirement from =4.0.0 to =4.1.0

[dependabot]

Updates the requirements on dua-core to permit the latest version.

Release notes

Sourced from dua-core's releases.

dua-core v4.1.0

New Features

• stream roots and support cancellable walks Accept newly discovered roots in a running fixed-size worker pool. Keep per-root predicates and completion accounting, and prioritize submitted roots so existing directory trees cannot starve them.

  • Add RootSender, stream_roots(), and Walk::next_cancellable().
  • Disconnect bounded output before joining workers during teardown.
  • Preserve native enumeration and bounded parallel metadata processing.
  • Cover independent completion, submission priority, input closure, full-channel shutdown, and cancellation.

Performance

• parallelize I/O-bound macOS directory scans This was an issue I encountered on APFS, a directory created by rustc with more than 1m files in it. In that case, bulk reading is slow (while efficient), and it turned out to be better to detect this and switch over to stat-based traversal.

  While looking at the filesystem probing code more closely (and how it's not dependent on CPU performance by differntiating wall time from kernel time), I basically rubber-stamped all the other code. Too much to look at, too foreign by now. But it did look cleaned up, so 👍.

  The reported target-directory scan left one worker waiting inside getattrlistbulk at about 15% of a CPU core. Native directory collection also held an entire parent directory before publishing entries and child jobs.

  Probe at most two initial bulk buffers before publishing them. Compare calling-thread user and kernel CPU time with elapsed time, and select the existing parallel stat queue when both refills spend more time waiting than executing. Reopen through ordinary enumeration only after that decision, discarding the unpublished probe to avoid mixed cursors or duplicate entries. Keep bulk reads when the probe is CPU-bound. The initial probe deliberately does not adapt to later cache changes.

  Share streaming native traversal between ordering modes, preserve parent ordering and APFS metadata, and bound queued metadata jobs by processing new batches inline when the queue fills.

  Regression coverage checks scale-independent timing decisions, bounded probing and metadata backlogs, streamed child jobs, parent ordering, and stat/native parity for clones, resource forks, hard links and symlinks. The timing test failed against the provisional fixed latency policy; the queue-bound test failed without backpressure.

Commit Statistics

... (truncated)

Changelog

Sourced from dua-core's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

2.45.0 (2026-09-12)

This release packs an incredibly useful new sub-command called dua clean [--depth N], to automatically and efficiently find typical build products that you may want to delete, for Rust and Zig and Node for now.

Also, when deleting entries, the TUI does not block anymore, but shows the decreasing number of bytes as files are deleted, until the marked entry finally disappers. The TUI can still be used then, albeit in read-only mode.

Oh, and it also got faster on macOS when there are folders with a lot of files, when it will switch aways from bulk-reads to multi-threaded stat calls instead, which in my case led to a 2.5x speedup.

New Features

• add Git-aware dua clean and background deletion This commit was mostly rubber-stamped, but tested for a week or so before that. By now it's fair to accept that dua is in "tool that needs to work, without needing to be very familiar with how it works" territory, while I still look at the code at least but without the requirement to understand it all.

  Add dua clean [--depth N] [DIRECTORY]... to discover disposable build artifacts and caches, size accepted candidates, and offer them in a dedicated cleanup hub. Keep the TUI responsive during scanning, deletion, and trashing.

  Discovery and safety

  • Search directory entries and types before collecting size metadata. Recognize Node dependencies, Python caches and virtual environments, Cargo build output, and Zig caches and output. Require project markers for ambiguous names.
  • In Git repositories, require expendable ignore matches and reject tracked contents, conflict stages, gitlinks, and sparse ancestors. Consult HEAD when the index is absent and reject candidates when validation fails.
  • Reject nested repositories, case variants of Git markers, unreadable contents, excluded descendants, and disallowed filesystem boundaries.
  • Feed discovered roots into dua-core's running walker within the configured thread budget. Bound active candidates and publish each independently after sizing and validation; commit hardlink/APFS accounting only on acceptance.
  • Search without a depth limit by default; --depth bounds discovery. Support traversal filters and --once, with no snapshot import/export or parent scanning in clean mode.

... (truncated)

Commits

• 65c197d Release dua-core v4.1.0, dua-cli v2.45.0
• 19929e8 prepare changelog prior to release
• ed276c2 Merge pull request #399 from Byron/dua-clean
• 0661576 feat: add Git-aware dua clean and background deletion
• c2c6f67 feat(dua-core): stream roots and support cancellable walks
• 46b8556 Merge pull request #401 from Byron/faster-bulk-traversal
• 249bdf3 perf: parallelize I/O-bound macOS directory scans
• 6654723 Merge pull request #402 from Byron/copilot/clarify-language-listing
• e159c45 docs: refine translation list wording
• a51189a docs: clarify translation list ordering
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)