Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
alpine (source)	final	minor	3.23 → 3.24
alpine (source)	stage	minor	3.23 → 3.24
anyhow	workspace.dependencies	patch	1.0.102 → 1.0.104
assert_fs	workspace.dependencies	patch	1.1.3 → 1.1.4
async-trait	workspace.dependencies	patch	0.1.89 → 0.1.92
bitwarden (source)	workspace.dependencies	minor	2.0.0 → 2.1.0
chrono	workspace.dependencies	patch	0.4.44 → 0.4.45
clap	workspace.dependencies	patch	4.6.1 → 4.6.7
futures (source)	workspace.dependencies	patch	0.3.32 → 0.3.34
github.com/1password/onepassword-sdk-go	require	patch	v0.4.1-0.20260605221002-f1117e36ce06 → v0.4.1
golang (source)	stage	minor	1.26-alpine → 1.27-alpine
golang.org/x/sys	require	minor	v0.47.0 → v0.48.0
http-body-util	workspace.dependencies	patch	0.1.3 → 0.1.5
humantime	workspace.dependencies	minor	2.3.0 → 2.4.0
hyper (source)	workspace.dependencies	minor	1.9.0 → 1.11.1
hyper-util (source)	workspace.dependencies	patch	0.1.20 → 0.1.21
indexmap	workspace.dependencies	patch	2.14.0 → 2.14.2
nix	workspace.dependencies	patch	0.31.2 → 0.31.3
proc-macro2	workspace.dependencies	patch	1.0.106 → 1.0.107
quote	workspace.dependencies	patch	1.0.45 → 1.0.47
regex	workspace.dependencies	minor	1.12.3 → 1.13.1
rust (source, changelog)	toolchain	minor	1.92 → 1.99
rust (source)	stage	minor	1.95-alpine3.22 → 1.98-alpine3.22
serde (source)	workspace.dependencies	patch	1.0.228 → 1.0.229
serde_json	workspace.dependencies	patch	1.0.149 → 1.0.151
sha2	workspace.dependencies	minor	0.10 → 0.11
syn	workspace.dependencies	patch	2.0.117 → 2.0.119
thiserror	workspace.dependencies	patch	2.0.18 → 2.0.21
tokio (source)	workspace.dependencies	minor	1.52.1 → 1.53.1
tokio-util (source)	workspace.dependencies	patch	0.7.18 → 0.7.19
toml	workspace.dependencies	patch	1.1.2+spec-1.1.0 → 1.1.6
tonistiigi/xx	stage	minor	1.7.0 → 1.9.0
uuid	workspace.dependencies	minor	1.23.1 → 1.26.1

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

assert-rs/assert_fs (assert_fs)

v1.1.4

Compare Source

Performance

• Default to the old tempfile behavior for faster builds

dtolnay/async-trait (async-trait)

v0.1.92

Compare Source

• Resolve double_must_use clippy lint in generated code (#​303)

v0.1.91

Compare Source

v0.1.90

Compare Source

• Update to syn 3

chronotope/chrono (chrono)

v0.4.45: 0.4.45

Compare Source

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in #​1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in #​1789

clap-rs/clap (clap)

v4.6.7

Compare Source

v4.6.6

Compare Source

Features

• Add Command::get_overridden_usage

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal

• Update to syn v3

v4.6.3

Compare Source

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes

• (help) Say alias when there is only one

rust-lang/futures-rs (futures)

v0.3.34

Compare Source

• Preserve cloned waker identity. (#​3032)
• Updato syn to 3. (#​3028)

v0.3.33

Compare Source

• Fix ReadLine's soundness issue regarding to exception safety. (#​3020)
• Fix unsound Send impl for IterPinRef and Iter. (#​3003)
• Fix stacked borrows violation in compat01as03 implementation. (#​3012)
• Fix memory leak in FuturesUnordered::IntoIter. (#​3005)
• Add portable-atomic-alloc feature and use it in FuturesUnordered. (#​3007)
• Re-export alloc::task::Wake. (#​3010)
• Update spin to 0.12. (#​3014)

1password/onepassword-sdk-go (github.com/1password/onepassword-sdk-go)

v0.4.1: Release 0.4.1

Compare Source

1Password Go SDK v0.4.1

NEW

• 1Password Environment access: The SDK can now read variables from a 1Password Environment.

IMPROVED

• Documentation: The README now covers desktop app authentication and an updated list of supported functionality. Example code and comments are consistent with the other 1Password SDKs.
• Terms of Service: The README now links the terms of service that apply to the 1Password APIs/SDKs.

FIXED

• CGO handling: The SDK now builds with CGO_ENABLED=0. CGO is only required for Desktop App Integration.

hyperium/http-body (http-body-util)

v0.1.5

Compare Source

v0.1.4

Compare Source

What's Changed

• Add Fused body combinator that always returns None once completed.
• Add BodyExt::into_stream() to convert a body into a Stream.
• Add Full::into_inner() to get the full Buf.
• Add InspectFrame and InspectErr combinators.

chronotope/humantime (humantime)

v2.4.0: 2.4.0

Compare Source

What's Changed

• feat: allow creating Duration in const context by @​ctron in #​70

hyperium/hyper (hyper)

v1.11.1

Compare Source

Bug Fixes

• http1:
  • detect TE: trailers caselessly and with other values (#​4152) (72fcf545)
  • recognize \n\r\n as a head terminator in the partial-read fast path (#​4147) (3534d75c, closes #​4145)
  • flush bytes buffered by the write re-check before yielding (#​4143) (f660f5bf)
  • evict pooled conn on request-side Connection: close (#​4110) (da19be08)

v1.11.0

Compare Source

Bug Fixes

• http1:
  • discard content-length header when received before transfer-encoding (#​4124) (540fff91, closes #​4123)
  • use append for repeat trailer values in encoder (#​4118) (de1483d7)
  • allow up to max_headers trailers (#​4108) (f584091a)
  • use append for repeat trailers (#​4107) (876effe1)
  • flush buffered data before shutdown (#​4018) (72046cc7, closes #​4022)
  • more strictly enforce max_buf_size when parsing (#​4093) (90ede307, closes #​4081)
• http2: avoid buffering Upgraded writes without send capacity (#​4102) (aecf5abf)

Features

• rt: add ReadBufCursor::initialized_unfilled() method (#​4115) (ccc1e850)

v1.10.1 (2026-05-29)

Bug Fixes

• http1: fix busy loop when peer half-closes and open body (#​4086) (c6cb906f, closes #​4085)

v1.10.1

Compare Source

Bug Fixes

• http1: fix busy loop when peer half-closes and open body (#​4086) (c6cb906f, closes #​4085)

v1.10.0

Compare Source

Bug Fixes

• http1:
  • send error when dispatcher is dropped mid-body (#​4069) (b7a679ba, closes #​3995, #​4016)
  • fix reading large bodies on 32-bit systems (#​4056) (b12f6525, closes #​4055)
  • fix rare missed write wakeup on connections v2 (743a3ba0)
• http2:
  • do not reserve capacity before body data is available (#​4061) (99f24345, closes #​4003)
  • reading trailers shouldn't propagate NO_ERROR from early response (#​3998) (e5ad96b1)

Features

• http2:
  • add reset_stream_duration() client option (#​4068) (156a6f6a, closes #​2599)
  • Add 'header_table_size()' method to server builder (#​4062) (6c9182c4)

hyperium/hyper-util (hyper-util)

v0.1.21

Compare Source

This release bumps the minimal supported Rust version (MSRV) from 1.64 to 1.85.

This release bumps the rust edition from 2021 to 2024.

Additions

• Add crate-level documentation. (#​327)
• Add client::legacy::Builder::http2_header_table_size() method. (#​274)
• Add client::legacy::Builder::http2_max_concurrent_streams() method. (#​274)
• Add client::legacy::Builder::http2_max_local_error_reset_streams() method. (#​277)
• Add client::legacy::connect::HttpConnector::set_mark() method. (#​303)
• Add rt::tracing::WithSpanExecutor<E>, hyper_util::rt::tracing::CurrentSpanExecutor<E>, and hyper_util::rt::tracing::MkSpanExecutor<E, F> executors. (#​323)

Fixes

• Fix client::legacy::Client so that it properly validates CONNECT responses. (#​315)
• Fix client::legacy::Client to cancel the idle interval once its pool empties. (#​292)
• Fix client::legacy::Client to properly handle IPv6 addresses when using a SOCKS proxy. (#​302)
• Fix client::pool::cache to preserve readiness with clones. (#​297)
• Fix client::pool::cache to wake its waiters in FIFO order. (#​298)
• Fix client::pool::singleton::Singleton to properly handle cancellation. (#​299)
• Fix client::pool::singleton::Singleton to share errors with all waiters. (#​296)
• Fix client::proxy::matcher handling for IP wildcards. (#​309)
• The tokio/net feature is narrowed to the client-legacy feature flag, from the client feature flag. (#​276)
• Various fixes to the client::legacy::Client's SOCKS proxying. (#​302) (#​307) (#​308) (#​310)

Changes

This release contains a minor behavioral change for users of the tracing
feature flag to be aware of.

This feature flag was introduced in v0.1.11. When enabled,
rt::TokioExecutor<E> began propagating the currently active tracing::Span
to spawned tasks when hyper::rt::Executor::execute() is called. This caused
issues for some users, due to background tasks keeping a span open for the
duration of a long-lived connection.

This behavior has now been removed from rt::TokioExecutor<E>
(#​322) by default. A
collection of executor wrappers have been added to a new rt::tracing
submodule, to provide facilities for instrumenting a client or server's spawned
tasks. See the module-level documentation of rt::tracing for more
information.

To temporarily preserve the previous rt::TokioExecutor<E> span propagation
behavior, enable the rt-tracing-exec-force feature. Note that this feature
flag will be removed in a future release.

indexmap-rs/indexmap (indexmap)

v2.14.2

Compare Source

• Fix item hygiene in map and set macros. Previously, an internal const CAP
  could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and
  indexset_with_default!. The hasher may also be omitted if it's inferrable.

v2.14.1

Compare Source

• Simplify comparisons where Equivalent isn't needed (Q = K).
• Unify index assertions for bounds checks.
• Fix (or expect) clippy lints.

nix-rust/nix (nix)

v0.31.3

Compare Source

Added

• Enable module ioctl for Cygwin
  (#​2715)
• Add
  CLOCK_BOOTTIME/CLOCK_PROCESS_CPUTIME_ID/CLOCK_THREAD_CPUTIME_ID/CLOCK_UPTIME
  to NetBSD-like platforms (#​2716)
• unistd: add mkfifo for redox
  (#​2749)
• Added kevent64 support on apple targets: Kqueue::kevent64, KEvent64,
  and Kevent64Flags. (#​2781)

Fixed

• fix SaFlags_t definition on redox
  (#​2751)
• Fixed EpollEvent::events() to use from_bits_retain instead of
  from_bits().unwrap(), preventing panics when the kernel returns
  unknown epoll flags. (#​2783)
• Fixed KEvent::flags() and KEvent::fflags() to use from_bits_retain
  instead of from_bits().unwrap(), preventing panics when the kernel
  returns unknown kqueue flags.
  (#​2784)

dtolnay/proc-macro2 (proc-macro2)

v1.0.107

Compare Source

• Documentation improvements

dtolnay/quote (quote)

v1.0.47

Compare Source

• Documentation improvements

v1.0.46

Compare Source

• Avoid repeated get_span in quote_spanned (#​329, thanks @​Noratrieb)

rust-lang/regex (regex)

v1.13.1

Compare Source

===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#​1364 for (many) more details.

Bug fixes:

• #​1354:
  Fixes previously unsound reverse suffix and inner optimizations.

v1.13.0

Compare Source

===================
This release includes a new API, a regex! macro, for lazy compilation of
a regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:

use regex::regex;

fn is_match(line: &str) -> bool {
    // The regex will be compiled approximately once and reused automatically.
    // This avoids the footgun of using `Regex::new` here, which would
    // guarantee that it would be compiled every time this routine is called.
    // This would likely make this routine much slower than it needs to be.
    regex!(r"bar|baz").is_match(line)
}

let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";

let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #​709:
  Add a new regex! macro for efficient and automatic reuse of a compiled regex.

v1.12.4

Compare Source

===================
This release includes a performance optimization for compilation of regexes
with very large character classes.

Improvements:

• #​1308:
  Avoid re-canonicalizing the entire interval set when pushing new class ranges.

rust-lang/rust (rust)

v1.99.0

Compare Source

==========================

Language

• Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows
• Extend unconditional_panic lint to function calls that panic when the chunks/windows size is zero
• Stabilize C-variadic function definitions
• Stabilize the ability to use #[unsafe(naked)] functions to define C-variadic functions (#![feature(c_variadic_naked_functions)]).
• Trait methods are now resolved on an adjusted never type (producing a FCW)
• Coerce from inference variables to trait objects if the inference variable is related via subtyping to a type that is known to be Sized
• Stabilize #[my_macro] mod foo;. This allows outlined modules (mod foo;) anywhere in the body of a custom attribute or derive macro.
• Fix the overflowing_literals lint with repeated negation. For instance, it will now no longer lint on --128_i8, which is already detected by the arithmetic_overflow lint.
• Add POSIX symbols to the invalid_runtime_symbol_definitions and suspicious_runtime_symbol_definitions lints
• Lint unused #[path] attributes on inline modules
• Enable unreachable_cfg_select_predicates lint as part of unused lint group
• Stabilize passing 128-bit integers via vector registers with asm! on x86
• Explicitly document that some allocations are allowed to grow in-place (but none are allowed to shrink)
• We now guarantee that the contents of an UnsafeCell can be accessed without going through get
  • The invalid_reference_casting lint was adjusted accordingly
• Account for globally enabled target features in global_asm!
• Warn if an invalid doc attribute is used on a macro invocation

Compiler

• Convert -Ctarget-cpu into a target-modifier for AVR, AMDGCN and NVPTX
• Enable static_position_independent_executables on all gnu targets
• When providing a suggestion about a missing method, rustc now prefers an exactly matching name from a doc alias attribute over a similarity search from other method names. If your new users sometimes expect a method under a different name, adding a doc alias will now help them find it via rustc suggestions, in addition to helping them find it via rustdoc search: When suggesting method names, prefer exact doc aliases over similar names

Platform Support

• Promote riscv64-unknown-linux-musl to Tier 2 with host tools

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Iteration on RangeInclusive (a..=b ranges) is now optimized better in some circumstances. As a side effect of this, the behavior of RangeInclusive values that has already been exhausted (as an iterator) has changed. For example, the return values of start() and end() on such ranges may return different values, and using such ranges as slice indexes may have different behavior. These behaviors were not guaranteed to be stable, so these changes are considered to not be breaking changes.
• Relax transmute_copy to accept ?Sized types
• Update transmute_copy to use a non-unwinding panic
• Don't escape U+FF9E and U+FF9F in escape_debug_ext
• Re-export core::fmt::NumBuffer in alloc (and std)

Stabilized APIs

• IntoIterator for Box<[T; N]>
• IntoIterator for &Box<[T; N]>
• IntoIterator for &mut Box<[T; N]>
• VecDeque::retain_back
• core::ffi::VaList
• Box::into_non_null
• Box::from_non_null
• Vec::into_parts
• Vec::from_parts
• core::mem::size_of_val_raw
• core::mem::align_of_val_raw
• core::alloc::Layout::for_value_raw
• String::from_utf8_lossy_owned
• string::FromUtf8Error::into_utf8_lossy
• FusedIterator for StepBy<I>
• std::fs::set_times
• std::fs::set_times_nofollow

Cargo

• Add a new built-in profile debug. This is a preparation for transitioning the dev profile away from debugging to give a saner default for faster development iterations. Currently there is no difference between dev and debug profiles. docs #​17214
• Workspace members on edition 2024 or later can now override an inherited workspace dependency's default-features field. For example, serde = { workspace = true, default-features = false } now turns off default features even when the workspace definition enables them. On earlier editions, default-features = false is ignored with a warning. (RFC 3945) #​17126

See also the full Cargo changelog

Rustdoc

• Add new unused_footnote_definition rustdoc lint
• Smarter filtering of trait impls yields performance improvements of 20% on average and up to 40% on some real-world crates. (1, 2, 3, 4, 5)

Compatibility Notes

• Fully deprecate the legacy integral modules. For example, std::i32::MAX should be accessed via i32::MAX instead.
• Upgrade no_mangle_generic_items into hard error
• The Pin::new_unchecked has had its safety invariants changed slightly
• Do not promote references to extern statics
• Ensure that the inferred types of let patterns typecheck
• hermit/fs: Return unsupported() instead of from_raw_os_error(22)
• Fixed a bug where #[repr(simd)] was accidentally allowed on macro invocations on stable Rust
• Abort const-eval when there are generics in the type of the value being produced
• Attributes not applying to anything are now an error in code blocks in doc comments
• Box::leak: tell people to avoid unleaking
• PowerPC inline ASM: Fix scalar floats being in the wrong vector lane on little endian
• Do not take doc(cfg()) into account when filtering doctests
• Infer anonymous lifetimes in the types of associated consts as 'static
• Macros that expand to a semicolon now produce a warning lint (semicolon_in_expressions_from_non_local_macros) even when the macro comes from another crate. Previously, such warnings only appeared for macros from the same crate, to avoid showing warnings that can't be fixed locally; however, this masked problems, as integration tests from the crate providing the macro get compiled as a separate crate, so tests often wouldn't reveal this issue. If you encounter a lint like this, please make sure to report it to the crate providing the macro so they can fix it; don't just silence it in your own crate.
  • semicolon_in_expressions_from_macros: Lint on non-local macros too
  • Split non-local semicolon_in_expressions_from_macros into a separate lint
• In Cargo, incremental compilation is now disabled by default when running in CI. CI is detected via the CI environment variable. #​17220

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

• Update to LLVM 23

v1.98.1

Compare Source

===========================

• rustc: fix miscompilation in generating vtables

v1.98.0

Compare Source

==========================

Language

• Allow shortening lifetime of &mut when unsize-coercing, even in an invariant position. For example, you can now coerce a Cell<&'long mut i32> to a Cell<&'short mut dyn Send>. Such shortenings were already previously allowed when coercing a &mut to a &, or coercing a & to a &.
• Add deny-by-default invalid_runtime_symbol_definitions lint and warn-by-default suspicious_runtime_symbol_definitions lint
  • The lints currently specifically targets core runtime symbols like memcmp, memset, strlen, ... and is planned to be expanded in the next few releases.
• Add warn-by-default c_void_returns lint to check core::ffi::c_void as a return type

Platform Support

• Add powerpc64-unknown-linux-gnuelfv2 as Tier 3
• Add aarch64-unknown-linux-pauthtest as Tier 3 target
• Promote thumbv7a-none-eabi to Tier 2
• Promote thumbv7a-none-eabihf to Tier 2
• Promote thumbv7r-none-eabi to Tier 2
• Promote thumbv7r-none-eabihf to Tier 2
• Promote thumbv8r-none-eabihf to Tier 2

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

• Change Location<'_> lifetime to 'static in Panic[Hook]Info
• Document panic in RangeInclusive::from(legacy::RangeInclusive)
• Document that ManuallyDrop's Box interaction has been fixed
• Stabilize LoongArch CRC Intrinsics
• The derive macro is available at {core,std}::derive. This was previously unintentionally stabilized in 1.96, but is now explicitly accepted as a stabilized API.
  • Please note that the MSRV for {core,std}::derive will be 1.96, and not 1.98.

Stabilized APIs

• str::substr_range
• [T]::subslice_range
• core::fmt::NumBuffer
• <{integer}>::format_into
• Send/Sync for std::process::CommandArgs
• {fN}::algebraic_add
• {fN}::algebraic_sub
• {fN}::algebraic_mul
• {fN}::algebraic_div
• {fN}::algebraic_rem
• NonZero<{integer}>::from_str_radix
• String::from_utf16le
• String::from_utf16le_lossy
• String::from_utf16be
• String::from_utf16be_lossy
• [T]::strip_circumfix
• str::strip_circumfix
• Atomic<T>::from_mut
• Atomic<T>::get_mut_slice
• Atomic<T>::from_mut_slice
• std::range::legacy

Compatibility Notes

• If fully elided, lifetime bounds of trait object types may now resolve differently or even get rejected in very specific niche scenarios
• Error in more cases of ambiguous imports
• Switch the destructors implementation for thread locals on Windows to use Fiber Local Storage (FLS)
• Convert some cases of the ambiguous_glob_imports lint into a hard error
• Where-bounds of the form Type = Type and Type == Type are no longer syntactically allowed
• Ensure Send/Sync is not implemented for std::env::Vars{,Os}
• Fix that in some attributes, arguments were not properly rejected
• repr(transparent) is now more strict about which fields have "trivial" layout and hence can be ignored: repr(C) types, types with private fields, and #[non_exhaustive] types are no longer considered "trivial"
• Correctly check whether types have equal size in transmute() when some repr attributes are involved.
• More characters are escaped when printing strings and chars
• Implement fast path for derive(PartialOrd) when deriving Ord
  This can break crates in practice where a type's PartialOrd and Ord impls were inconsistent with each other.
• Add temporary scope to assert_eq and assert_ne
• Closed a hole in the pattern matching structural equality check, preventing cases where a match of a constant would be allowed, despite disagreeing with a manually written PartialEq implementation, when a derive(PartialEq) implementation for that type also exists.
• On Emscripten the WASM exception handling ABI is now unconditionally used The -Zemscripten-wasm-eh=false flag to switch back to JS exceptions has been removed.
• The UNSAFE_CODE lint is now consistently emitted for all unsafe attributes
• Solaris: remove File::lock implementation, it has the wrong semantics (return "unsupported" instead)
• Windows-gnu targets now specify baseline tools versions
• rustfmt now discovers module files that are defined in cfg_select!
  This may cause more code to be formatted which was previously ignored.

v1.97.1

Compare Source

==========================

• rustc: Fix miscompilation in LLVM optimization
  This backports an LLVM submodule bump to include the LLVM-side fix and a
  revert of the rustc change that is one known trigger for the bug. The rustc
  side revert should not be strictly necessary but is done out of abundance of caution.

[v1.97.0]

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.