[dependabot]

Bumps the rust-dependencies group with 6 updates in the / directory:

Package	From	To
tokio	1.53.1	1.53.2
insta	1.48.0	1.49.0
pyo3	0.29.2	0.29.3
napi	3.13.0	3.14.0
napi-derive	3.6.9	3.6.10
napi-build	2.5.0	2.6.0

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates insta from 1.48.0 to 1.49.0

Release notes

Sourced from insta's releases.

1.49.0

Release Notes

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.ps1 | iex"

Download cargo-insta 1.49.0

File	Platform	Checksum
cargo-insta-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-insta-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-insta-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-insta-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-insta-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-insta-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

This was written by Codex on behalf of @​max-sixty

Changelog

Sourced from insta's changelog.

1.49.0

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Commits

• 5df39ce Release 1.49.0 (#944)
• 1c28c19 Skip the separate doctest run for nextest with --all-targets (#941)
• 064742e Build cargo-insta for aarch64-unknown-linux-gnu (#942)
• 08b67d9 Remove trailing semicolons from macro bodies (#940)
• 06858e1 fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)
• 70be034 Serialize unit enum variants used as JSON map keys (#934)
• 54d0b96 feat: implement From for SnapshotValue with OsStr (#929)
• 3d62572 [fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)
• 1712876 ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...
• See full diff in compare view

Updates pyo3 from 0.29.2 to 0.29.3

Release notes

Sourced from pyo3's releases.

PyO3 0.29.3

This release is a series of fixes worth landing to the PyO3 0.29 series; the PyO3 0.30 release is planned to follow within a few weeks, however during the development cycle a number of rough edges were discovered which were deemed worth a backport.

The patch broadly includes:

• a further fix the to the opt-out of raw-dylib linking for Windows introduced in PyO3 0.29.1 (the switch to raw-dylib linking was introduced in PyO3 0.29.0),
• fixes to support GraalPy on windows,
• a handful of small performance optimizations,
• a number of non-breaking fixes to the experimental-inspect type stub generation (expect more improvements in 0.30), and
• various other bugfixes such as to FFI definitions, to resolve crashes, and to fix clippy lints caused by PyO3 macros.

For a full list of the exact fixes please consult the CHANGELOG.

Thank you to the following contributors for the improvements:

@​adamgerhant-ai @​alex @​bschoenmaeckers @​charliermarsh @​chirizxc @​davidhewitt @​dependabot[bot] @​dylanpulver @​exg @​FranciscoTGouveia @​JMak-Security @​jonasdedden @​jorenham @​konstin @​latent-9 @​mejrs @​ngoldbaum @​Person-93 @​PeterFaiman @​sneakers-the-rat

Changelog

Sourced from pyo3's changelog.

[0.29.3] - 2026-09-30

Packaging

• Support GraalPy on Windows. #6406

Added

• Add FFI definitions PyModule_GetState_DuringGC, PyModule_GetToken_DuringGC, PyObject_GetTypeData_DuringGC, PyType_GetModuleState_DuringGC, PyType_GetBaseByToken_DuringGC, PyType_GetModule_DuringGC, and PyType_GetModuleByToken_DuringGC for Python 3.15 and up. #6419

Changed

• Optimize u128/i128 conversions on Python 3.15+. #6160
• Preallocate output sets when extracting Python set and frozenset values into Rust hash sets. #6225
• Optimize PyBytes::as_bytes() when not using abi3 or abi3t. #6377

Removed

• Remove FFI definitions PyExc_RecursionErrorInst and Py_UseClassExceptionsFlag (not present in supported Python versions). #6421

Fixed

• Revert removal of FFI definition _PyFrameEvalFunction, _PyInterpreterState_GetEvalFrameFunc and _PyInterpreterState_SetEvalFrameFunc, which are not currently treated as CPython private API despite their name. #6195
• Fix FFI definition PyUnstable_Eval_RequestCodeExtraIndex FFI binding to link to the private CPython symbol on Python versions before 3.12. #6195
• Fix FFI definitions PyByteArray_GET_SIZE, PyList_GET_SIZE, and PySet_GET_SIZE to use an atomic load for free-threaded Python. #6230
• experimental-inspect: deduplicate repeated members of a type union in the generated stubs, and put a space on both sides of the | rather than only before it. #6273
• experimental-inspect: __next__ and __anext__ returning Option<T> (or PyResult<Option<T>>) are now introspected as returning T, since None stops the iteration instead of being yielded. #6274
• Fix clippy::clone_on_copy warnings triggered on nightly Rust by #[pyclass(from_py_object)] on classes which implement Copy. #6309
• experimental-inspect: __pow__, __rpow__ and __get__ now introspect their trailing argument as defaulting to None, matching the CPython slot wrappers which substitute None when it is omitted. #6363
• experimental-inspect: fix the stubs of a package nested inside another package being written into a directory named after its parent instead of its own name. #6365
• Fix many unresolved symbols when linking for PyPy due to incorrect link names in pyo3-ffi. #6389
• Fix empty tuple type hints being rendered as invalid tuple[] instead of tuple[()] in generated stubs and PyStaticExpr display. #6393
• experimental-inspect: escape stub docstrings to prevent invalid Python syntax. #6394
• experimental-inspect: fix the generated type annotation for PyBuffer on python <3.12 by using typing_extensions.Buffer instead of collections.abc.Buffer. #6395
• Fix string constants containing control characters rendering as invalid Python in Display for PyStaticExpr. #6397
• Fix crash when a detached thread is terminated while trying to reattach during interpreter finalization. #6404
• Fix link failures on 32-bit Windows when raw-dylib linking is disabled. #6410
• Fix DLL load failures on Windows with PyPy when raw-dylib linking is disabled. #6410
• Fix FFI definition PyVectorcall_Call failing to link on Python 3.11 and older. #6410
• Fix many unresolved data symbols when linking for PyPy due to incorrect link names in pyo3-ffi. #6421
• Fix linker errors on PyPy for outdated FFI definitions where PyPy moved from a function to a macro. #6422
• Fix crash when GC traverses a #[pyclass] type object during class attribute initialization. #6453

Commits

• 451d99f release: 0.29.3
• a19b491 ci: Exclude the Python extensions article from guide checks (#6472)
• d76560a ci: exclude current release tag from link check (#6463)
• 91c0e7d fix crash with GC during attribute initialization (#6453)
• 9d467b1 only override env vars on Python 3.8
• 945e62a bump GraalPy versions tested in CI, test graalpy on windows (#6406)
• 9712753 fix 3.8 ffi checks
• 42a8fcc fix clippy lint (#6334)
• 018dbcc Add DuringGC FFI bindings for 3.15 (#6419)
• 75ada93 fix FFI cases where PyPy replaced function with macro (#6422)
• Additional commits viewable in compare view

Updates napi from 3.13.0 to 3.14.0

Release notes

Sourced from napi's releases.

napi-v3.14.0

Added

• (napi) lock the allocator on threaded WASI and never hang after a worker crash (#3552)

Commits

• 37109f1 chore: release (#3544)
• 12e6793 chore(release): publish
• 9f46379 chore(deps): update dependency oxc-parser to ^0.152.0 (#3550)
• a94cef3 feat(napi): lock the allocator on threaded WASI and never hang after a worker...
• e50c819 chore(deps): update dependency oxfmt to ^0.71.0 (#3549)
• 29d4fa5 ci: replace yarn with nodejs in msys2 pacboy install (#3553)
• afbe5df chore(deps): update yarn to v4.18.1 (#3547)
• 210bc27 chore(deps): update dependency oxfmt to ^0.70.0 (#3543)
• See full diff in compare view

Updates napi-derive from 3.6.9 to 3.6.10

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.6.10

Other

• update Cargo.toml dependencies

Commits

• 37109f1 chore: release (#3544)
• 12e6793 chore(release): publish
• 9f46379 chore(deps): update dependency oxc-parser to ^0.152.0 (#3550)
• a94cef3 feat(napi): lock the allocator on threaded WASI and never hang after a worker...
• e50c819 chore(deps): update dependency oxfmt to ^0.71.0 (#3549)
• 29d4fa5 ci: replace yarn with nodejs in msys2 pacboy install (#3553)
• afbe5df chore(deps): update yarn to v4.18.1 (#3547)
• 210bc27 chore(deps): update dependency oxfmt to ^0.70.0 (#3543)
• See full diff in compare view

Updates napi-build from 2.5.0 to 2.6.0

Release notes

Sourced from napi-build's releases.

napi-build-v2.6.0

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

Commits

• a94cef3 feat(napi): lock the allocator on threaded WASI and never hang after a worker...
• e50c819 chore(deps): update dependency oxfmt to ^0.71.0 (#3549)
• 29d4fa5 ci: replace yarn with nodejs in msys2 pacboy install (#3553)
• afbe5df chore(deps): update yarn to v4.18.1 (#3547)
• 210bc27 chore(deps): update dependency oxfmt to ^0.70.0 (#3543)
• See full diff in compare view

Dependency audit validation

Merged latest main without rewriting the bot branch. Reviewed actual crates.io source deltas and added precise audits for the grouped updates and Turso 0.8.1 → 0.8.2 pulled from latest main, retaining existing criteria and exemptions. cargo vet --locked passes. No application behavior changes. Full local quality gates, SQLite tests, and benchmark smoke are being validated; CI must pass before merge.

Produced by yolop

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	6bd12bb	Commit Preview URL Branch Preview URL	Oct 07 2026, 04:29 AM