[dependabot]

Bumps the cargo-minor-patch group with 12 updates in the / directory:

Package	From	To
thiserror	2.0.20	2.0.21
xxhash-rust	0.8.18	0.8.19
unicode-normalization	0.1.25	0.1.26
clap	4.6.6	4.6.7
memmap2	0.9.11	0.9.12
ureq	3.4.0	3.5.0
serde_json	1.0.151	1.0.154
napi-build	2.4.1	2.6.0
pyo3	0.29.2	0.29.3
pyo3-stub-gen	0.23.0	0.23.1
proptest	1.11.0	1.12.0
insta	1.48.0	1.49.0

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates xxhash-rust from 0.8.18 to 0.8.19

Commits

• See full diff in compare view

Updates unicode-normalization from 0.1.25 to 0.1.26

Commits

• See full diff in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates memmap2 from 0.9.11 to 0.9.12

Changelog

Sourced from memmap2's changelog.

[0.9.12] - 2026-10-21

Added

• Add MmapOptions::map_if_safe() to allow creation read-only mappings of a file from safe code if the kernel can guarantee the file is immutable and large enough. @​alexlarsson
• Add MmapOptions::no_probe_handle() to disable probing of file handles on Windows to improve performance, at the cost of no longer being able to remap later with more capabilities. @​mat-gas
• Add support for OpenHarmony targets (*-unknown-linux-ohos). @​hiyms

Changed

• Cache allocation granularity on Windows to prevent repeated syscalls. @​mat-gas

Commits

• 4692b05 Merge pull request #180 from RazrFalcon/release/v0.9.12
• 9e5c0ee Bump version to 0.9.12.
• b98035d Merge pull request #177 from JaskRendix/extract-test-suite
• 0986677 Merge branch 'master' into extract-test-suite
• d26cc84 Fix map_if_safe() stub.
• 145ee36 Silence clippy warning about trivial identical match arms.
• b402ef2 Fix check_safe_to_map() on Apple targets.
• b544238 Fix formatting.
• f50e480 Move tests to test/ folder.
• 0994bf7 Merge pull request #176 from hiyms/feat/support-ohos
• Additional commits viewable in compare view

Updates ureq from 3.4.0 to 3.5.0

Changelog

Sourced from ureq's changelog.

3.5.0

• Prepare 3.5.0 and fix dependency advisories and warnings - #1217
• Add Agent::shutdown() to interrupt requests in flight and close all connections #1211
• Preserve validated request header casing with RequestBuilder::header_raw #1214
• Decode proxy URL credentials once; literal percent signs must be escaped as %25 #1215
• Encode ProxyBuilder credentials and preserve colons in proxy passwords #1215
• Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #1209
• Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #1209
• Clarify timeout budgets, phase boundaries, and proxy DNS #1213
• Bound TLS handshake I/O by the remaining connect/global timeout #1208
• Retry socket reads interrupted by EINTR when timeout (technically breaking) #1205
• Fix native-tls-no-default enabling dependencies without enabling the TLS connector
• Add timeout_per_read and timeout_per_write independently of total phase budgets

3.4.3

• Update TLS dependencies for security fixes #1218

3.4.2

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
• Bypass pooling for request connection settings incompatible with the Agent #1201
• Try the next resolved address on unreachable/unavailable connect errors #1195

3.4.1

• Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199
• Do not pool connections with unconsumed buffered input #1198
• Fix timeout budgets restarting and applying to later phases #1194
• Complete TLS handshake during connect so timeout_connect covers it #1193
• Speed up read_json for responses with a known, small body size #1191

Commits

• 1bd534e Fix changelog
• fee0ad2 Prepare 3.5.0 and fix dependency advisories and warnings
• 7de0ab7 Remove realtime dependencies from tests
• 3f18f90 Add Agent::shutdown() for active and pooled connections
• 04572f2 Expose validated request header casing
• 6b1c275 Fix proxy credential encoding and decoding
• 6a609b4 Apply the connect timeout to the SOCKS handshake and check NO_PROXY first
• 3c818f4 Clarify timeout budgets and phase boundaries
• af3e959 Bound TLS handshake I/O by remaining timeout budgets
• 0ebb046 Retry socket reads interrupted by a signal when a timeout applies (#1205)
• Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates napi-build from 2.4.1 to 2.6.0

Release notes

Sourced from napi-build's releases.

napi-build-v2.6.0

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

napi-build-v2.5.0

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

napi-build-v2.4.4

Fixed

• (napi) guard AsyncTask completion against env teardown (#3536)

napi-build-v2.4.3

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#3528)

napi-build-v2.4.2

Fixed

• (cli,build) make wasm32-wasip1-threads link with wasi-sdk 34 and Rust nightly (#3492)

Commits

• a94cef3 feat(napi): lock the allocator on threaded WASI and never hang after a worker...
• e50c819 chore(deps): update dependency oxfmt to ^0.71.0 (#3549)
• 29d4fa5 ci: replace yarn with nodejs in msys2 pacboy install (#3553)
• afbe5df chore(deps): update yarn to v4.18.1 (#3547)
• 210bc27 chore(deps): update dependency oxfmt to ^0.70.0 (#3543)
• 2763e12 chore: release (#3538)
• 5ae5cf6 chore(release): publish
• 0da138e feat(cli): self-sign OpenHarmony artifacts with --ohos-sign (#3539)
• 2499a63 feat(async-runtime): offer the MultiThread flavor on wasm32-wasip1-threads (#...
• 886bd07 chore(deps): update dependency oxc-parser to ^0.151.0 (#3542)
• Additional commits viewable in compare view

Updates pyo3 from 0.29.2 to 0.29.3

Release notes

Sourced from pyo3's releases.

PyO3 0.29.3

This release is a series of fixes worth landing to the PyO3 0.29 series; the PyO3 0.30 release is planned to follow within a few weeks, however during the development cycle a number of rough edges were discovered which were deemed worth a backport.

The patch broadly includes:

• a further fix the to the opt-out of raw-dylib linking for Windows introduced in PyO3 0.29.1 (the switch to raw-dylib linking was introduced in PyO3 0.29.0),
• fixes to support GraalPy on windows,
• a handful of small performance optimizations,
• a number of non-breaking fixes to the experimental-inspect type stub generation (expect more improvements in 0.30), and
• various other bugfixes such as to FFI definitions, to resolve crashes, and to fix clippy lints caused by PyO3 macros.

For a full list of the exact fixes please consult the CHANGELOG.

Thank you to the following contributors for the improvements:

@​adamgerhant-ai @​alex @​bschoenmaeckers @​charliermarsh @​chirizxc @​davidhewitt @​dependabot[bot] @​dylanpulver @​exg @​FranciscoTGouveia @​JMak-Security @​jonasdedden @​jorenham @​konstin @​latent-9 @​mejrs @​ngoldbaum @​Person-93 @​PeterFaiman @​sneakers-the-rat

Changelog

Sourced from pyo3's changelog.

[0.29.3] - 2026-09-30

Packaging

• Support GraalPy on Windows. #6406

Added

• Add FFI definitions PyModule_GetState_DuringGC, PyModule_GetToken_DuringGC, PyObject_GetTypeData_DuringGC, PyType_GetModuleState_DuringGC, PyType_GetBaseByToken_DuringGC, PyType_GetModule_DuringGC, and PyType_GetModuleByToken_DuringGC for Python 3.15 and up. #6419

Changed

• Optimize u128/i128 conversions on Python 3.15+. #6160
• Preallocate output sets when extracting Python set and frozenset values into Rust hash sets. #6225
• Optimize PyBytes::as_bytes() when not using abi3 or abi3t. #6377

Removed

• Remove FFI definitions PyExc_RecursionErrorInst and Py_UseClassExceptionsFlag (not present in supported Python versions). #6421

Fixed

• Revert removal of FFI definition _PyFrameEvalFunction, _PyInterpreterState_GetEvalFrameFunc and _PyInterpreterState_SetEvalFrameFunc, which are not currently treated as CPython private API despite their name. #6195
• Fix FFI definition PyUnstable_Eval_RequestCodeExtraIndex FFI binding to link to the private CPython symbol on Python versions before 3.12. #6195
• Fix FFI definitions PyByteArray_GET_SIZE, PyList_GET_SIZE, and PySet_GET_SIZE to use an atomic load for free-threaded Python. #6230
• experimental-inspect: deduplicate repeated members of a type union in the generated stubs, and put a space on both sides of the | rather than only before it. #6273
• experimental-inspect: __next__ and __anext__ returning Option<T> (or PyResult<Option<T>>) are now introspected as returning T, since None stops the iteration instead of being yielded. #6274
• Fix clippy::clone_on_copy warnings triggered on nightly Rust by #[pyclass(from_py_object)] on classes which implement Copy. #6309
• experimental-inspect: __pow__, __rpow__ and __get__ now introspect their trailing argument as defaulting to None, matching the CPython slot wrappers which substitute None when it is omitted. #6363
• experimental-inspect: fix the stubs of a package nested inside another package being written into a directory named after its parent instead of its own name. #6365
• Fix many unresolved symbols when linking for PyPy due to incorrect link names in pyo3-ffi. #6389
• Fix empty tuple type hints being rendered as invalid tuple[] instead of tuple[()] in generated stubs and PyStaticExpr display. #6393
• experimental-inspect: escape stub docstrings to prevent invalid Python syntax. #6394
• experimental-inspect: fix the generated type annotation for PyBuffer on python <3.12 by using typing_extensions.Buffer instead of collections.abc.Buffer. #6395
• Fix string constants containing control characters rendering as invalid Python in Display for PyStaticExpr. #6397
• Fix crash when a detached thread is terminated while trying to reattach during interpreter finalization. #6404
• Fix link failures on 32-bit Windows when raw-dylib linking is disabled. #6410
• Fix DLL load failures on Windows with PyPy when raw-dylib linking is disabled. #6410
• Fix FFI definition PyVectorcall_Call failing to link on Python 3.11 and older. #6410
• Fix many unresolved data symbols when linking for PyPy due to incorrect link names in pyo3-ffi. #6421
• Fix linker errors on PyPy for outdated FFI definitions where PyPy moved from a function to a macro. #6422
• Fix crash when GC traverses a #[pyclass] type object during class attribute initialization. #6453

Commits

• 451d99f release: 0.29.3
• a19b491 ci: Exclude the Python extensions article from guide checks (#6472)
• d76560a ci: exclude current release tag from link check (#6463)
• 91c0e7d fix crash with GC during attribute initialization (#6453)
• 9d467b1 only override env vars on Python 3.8
• 945e62a bump GraalPy versions tested in CI, test graalpy on windows (#6406)
• 9712753 fix 3.8 ffi checks
• 42a8fcc fix clippy lint (#6334)
• 018dbcc Add DuringGC FFI bindings for 3.15 (#6419)
• 75ada93 fix FFI cases where PyPy replaced function with macro (#6422)
• Additional commits viewable in compare view

Updates pyo3-stub-gen from 0.23.0 to 0.23.1

Release notes

Sourced from pyo3-stub-gen's releases.

0.23.1

What's Changed

Enhancement, and other changes

• Start developing 0.23.1 by @​tokenprovider-pyo3stubgen[bot] in Jij-Inc/pyo3-stub-gen#482
• fix(ci): select example packages by Python version by @​termoshtt in Jij-Inc/pyo3-stub-gen#511
• fix(generate): preserve module docstrings in generated init.py by @​konn in Jij-Inc/pyo3-stub-gen#510
• feat: add uuid type support by @​JosephLenton in Jij-Inc/pyo3-stub-gen#508
• support PyClassInitializer by @​patengel in Jij-Inc/pyo3-stub-gen#500
• Add support for Jiff 0.2 types by @​cjdsellers in Jij-Inc/pyo3-stub-gen#496

New Contributors

• @​JosephLenton made their first contribution in Jij-Inc/pyo3-stub-gen#508
• @​cjdsellers made their first contribution in Jij-Inc/pyo3-stub-gen#496

Full Changelog: Jij-Inc/pyo3-stub-gen@0.23.0...0.23.1

Commits

• 5c1f0ea Add support for Jiff 0.2 types (#496)
• c0a334b support PyClassInitializer (#500)
• 588c2c9 build(deps): Bump the dependencies group across 1 directory with 59 updates (...
• 499ab31 feat: add uuid type support (#508)
• 0b6bb78 fix(generate): preserve module docstrings in generated init.py (#510)
• be3aed3 fix(ci): select example packages by Python version (#511)
• 087ecfb build(deps): Bump the dependencies group across 1 directory with 12 updates (...
• 2d52b11 build(deps): Bump actions/checkout from 6 to 7 in the dependencies group (#483)
• 8386cda Start developing 0.23.1 (#482)
• 86de32f build(deps): Bump the dependencies group across 1 directory with 13 updates (...
• See full diff in compare view

Updates proptest from 1.11.0 to 1.12.0

Commits

• 70cf37d Merge pull request #675 from proptest-rs/prep-1.12
• 729e0ff prepare next releases and fix panic handling
• 28c1fad Merge pull request #664 from Expyron/main
• 5ddd9a4 Merge pull request #668 from toddATavail/fix-fork-persisted-failure
• a6a9ac7 Merge pull request #673 from glaziermag/fix-book-deploy
• d57d88b Replace rand_chacha with chacha20
• 9411213 Deploy the book on pushes to main
• 1719745 fix: terminate the fork replay when a persisted failure fails
• 0f55b7a test: a persisted failure in a forked test must be reported
• 4b0594e Merge pull request #669 from proptest-rs/no-fail-fast
• Additional commits viewable in compare view

Updates insta from 1.48.0 to 1.49.0

Release notes

Sourced from insta's releases.

1.49.0

Release Notes

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.ps1 | iex"

Download cargo-insta 1.49.0

File	Platform	Checksum
cargo-insta-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-insta-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-insta-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-insta-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-insta-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-insta-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

This was written by Codex on behalf of @​max-sixty

Changelog

Sourced from insta's changelog.

1.49.0

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Commits

• 5df39ce Release 1.49.0 (#944)
• 1c28c19 Skip the separate doctest run for nextest with --all-targets (#941)
• 064742e Build cargo-insta for aarch64-unknown-linux-gnu (#942)
• 08b67d9 Remove trailing semicolons from macro bodies (#940)
• 06858e1 fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)
• 70be034 Serialize unit enum variants used as JSON map keys (#934)
• 54d0b96 feat: implement From for SnapshotValue with OsStr (#929)
• 3d62572 [fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)
• 1712876 ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions