[dependabot]

Bumps the cargo-version group in /runtime/rust with 5 updates:

Package	From	To
tokio	1.53.3	1.54.1
minijinja	2.24.0	3.0.5
opentelemetry	0.32.0	0.33.1
opentelemetry_sdk	0.32.1	0.33.1
opentelemetry-stdout	0.32.0	0.33.1

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates minijinja from 2.24.0 to 3.0.5

Changelog

Sourced from minijinja's changelog.

3.0.5

• Fixed a panic or abort in Rust when buffering an iterator that reports a huge size hint, or when passing a huge count to the batch or slice filters. Filters like list, sort, reverse, map, slice and batch as well as slicing and concatenating sequences now cap how much they preallocate, so [1, 2]|batch(4611686018427387904) is [[1, 2]] instead of failing with "capacity overflow". #483
• Fixed floats in Go switching to exponent notation from one million up, so 1234567.5 printed as 1.2345675e+06. Like in Rust, a float now prints as its shortest exact decimal without an exponent, so 1234567.5 is 1234567.5 and 1e20 is 100000000000000000000.0. Inside lists and maps, exponent notation is only used below 1e-4 and from 1e16 up, written like 1e20 and 1e-5. NaN now prints as NaN, and infinity inside a list as inf instead of +Inf. #984
• Fixed %s in the format filter formatting floats with %g rules, so "%s"|format(1234567.5) was 1.23457e+06. Like in Python, floats are now formatted like str() does: 1234567.5, 1e+16, 1e-05 or nan. The 0, + and space flags are ignored for floats and strings with %s, like in Python. This applies to both Rust and Go. #984
• Fixed the tojson filter in Go writing floats like integers. Like in Rust, a float stays a float in the output, so 1.0|tojson is 1.0 instead of 1, large and small magnitudes use exponent notation (1.5e+16, 2.5e-7) and infinity becomes null instead of an error. The same applies to values rendered with JSON auto-escaping. #983
• Fixed the upper, lower, capitalize, title and replace filters in Go ignoring values that are not strings. Like in Rust, the value and the replace arguments are converted to strings first, so 1.5|replace(".", ",") is 1,5 and true|upper is TRUE, and a number passed to replace is no longer treated as an empty string. #985
• Fixed slicing and the in operator on iterables such as range() in Go. Like in Rust, range(5)[:2] is now [0, 1] instead of failing with "cannot slice iterator", and 3 in range(5) is true instead of false. Slicing none or undefined gives an empty list like in Rust. Iterables now also print, compare, serialize with tojson and pprint like lists, so range(2) == [0, 1] is true and [range(2)] prints as [[0, 1]] instead of [<iterator>]. The in operator now also works on custom sequence, iterable and map objects. #986
• Fixed none in Go not being treated as an empty sequence by the sort, unique, select, reject, map, groupby, join and urlencode filters and the iterable test. Like in Rust, none|sort is now [] and none|join is an empty string instead of None. #987
• Fixed the odd, even and divisibleby tests in Go ignoring booleans, and divisibleby ignoring a float divisor. Like in Rust, booleans count as 0 and 1, so true is odd is true, and 6.5 is divisibleby(0.5) is true. #988
• Fixed str.format in pycompat cutting floats to six significant digits when no precision is given. Like in Python, such floats are now formatted like str() does, so '{}'.format(3.14159265) is 3.14159265, '{}'.format(1234567.0) is 1234567.0 instead of 1.23457e+06 and '{}'.format(0.0) is 0.0 instead of 0. #991
• Fixed the trim filter in Go ignoring values that are not strings and only stripping ASCII spaces, tabs and newlines by default. Like in Rust, 5|trim|length is now 1, and Unicode whitespace such as a non-breaking space is stripped. #989
• Fixed undefined values not being treated as empty sequences by the sort, unique, select, reject, selectattr, rejectattr, map, batch and groupby filters in Go, and none by batch, selectattr and rejectattr. Like in Rust, undefined|sort is now [] with lenient undefined behavior, while strict and semi-strict undefined behavior still fail except for join and groupby. #990
• Fixed a panic in compile_expression when the expression contains }} followed by more input, such as }} x. This is now a syntax error, like the same text inside a template. #992

3.0.4

• Fixed str.count in pycompat looping forever when counting an empty string. Like in Python, 'abc'.count('') is now 4.
• Fixed str.islower and str.isupper in pycompat returning false for strings with spaces, digits or other uncased characters, and the str.is* predicates returning true for an empty string. They now follow Python, so 'foo bar'.islower() is true and ''.isdigit() is false.
• Fixed str.find and str.rfind in pycompat returning byte offsets. Like in Python they now return character offsets, so 'über'.find('e') is 2.
• Fixed integer addition, subtraction and multiplication in Go losing precision above 2**53 and clamping results that overflow 64 bits, because they were computed with floats. They are now exact, and like in Rust a result that doesn't fit 64 bits becomes a big integer, so 9007199254740993 + 0 is 9007199254740993 and 9223372036854775807 + 1 is 9223372036854775808. #981
• Fixed booleans not being usable as integers in -, *, /, // and % and for repeating strings and sequences in Go. Like in Rust and Jinja2, true - 1 is 0 and "ab" * true is ab.
• Fixed ** failing with a negative integer exponent in Rust. Like in Jinja2, 2 ** -1 is now 0.5. Zero to a negative power now always fails in Rust and Go like a division by zero, instead of producing inf for floats in Rust and for all numbers in Go. #982
• Fixed ** on integers in Go being computed with floats. Like in Rust the result is now exact up to 128 bits and fails beyond that, a float base stays a float so 2.0 ** 3 is 8.0, and booleans count as integers.
• Fixed the sort filter ignoring a comma-separated list of attributes in Go. Like in Rust, sort(attribute="name, state") now sorts by name and then by state instead of leaving the items in their original order. #979
• Fixed the sort filter comparing strings case-sensitively when sorting by several attributes in Rust and Go. Like in Jinja2, each part of the key is now compared case-insensitively unless case_sensitive is set. An attribute list with whitespace-only entries such as "name, " also no longer sorts by an empty attribute in Rust.
• Added the attribute and start arguments to the sum filter and the attribute argument to the join filter for Jinja2 compatibility in Rust and Go. Like in Jinja2 the arguments can be passed positionally or by keyword, and the separator of join can also be passed as d. In Go the first positional argument of sum is now the attribute rather than the start value, so sum(100) needs to be written as sum(start=100). Go previously ignored unknown keyword arguments to sum and join and now fails like Rust. Like in Jinja2, sum in Rust can now also concatenate lists when given a list as start. #980
• Fixed the handling of none arguments to the int, float and round filters in Go. Like in Rust they now count as not given, so 2.5|round(none) is 2.0 instead of an error.
• Fixed the join filter dropping a separator that is not a string in Go. Like in Rust it is converted to a string, so [1, 2]|join(3) is 132.

3.0.3

• Re-release of 3.0.2 without code changes. The Python package for 3.0.2 could not be published to PyPI because the 32-bit Linux wheel failed to build on the new Ubuntu 26.04 GitHub Actions runners, so 3.0.3 is the first release with the 3.0.2 changes on PyPI. All other packages are identical to 3.0.2.

3.0.2

• Macros and variables starting with an underscore are now private and are no longer exported from imported templates in Rust and Go, matching Jinja2. They are not visible as attributes of a module imported with {% import %}, and {% from ... import %} of such a name is a syntax error. State::exports / State.Exports no longer return them either, but they can still be retrieved with lookup. #970
• Fixed modules imported with {% import %} not being iterable in Go.
• Fixed the indent filter indenting blank lines of CRLF text when blank is false, in Rust and Go. A blank line ended up as " \r" instead of "\r", leaving trailing whitespace. #972
• Fixed the wordwrap filter ignoring break_long_words when break_on_hyphens is false. The two arguments are independent in Jinja2, so a word longer than width is still broken unless break_long_words is false. #940
• Fixed chained integer lookups like foo.1.0 failing with a syntax error in Rust and Go. Like in Jinja2, a number right after a dot is now always read as an item index, so foo.1.0 is foo[1][0] instead of foo followed by the float 1.0. #974
• Fixed \x and octal string escapes above \x7f producing invalid UTF-8 in Go. Like in Rust they now produce the code point, so '\xe9' is é. Go now also understands the \b and \f escapes and surrogate pairs written as two \u escapes, and rejects a lone surrogate like Rust does. #975
• Added the method argument to the round filter for Jinja2 compatibility in Rust and Go. It takes common (the default), ceil or floor, and both precision and method can now be passed as keyword arguments. Integers are now rounded to a negative precision like in Jinja2, so 15|round(-1) is 20 rather than 15. #968
• Fixed Python exceptions leaking into later renders in the Python bindings. An exception that MiniJinja did not report, for instance one raised by an iterator after a {% break %}, was raised in place of the next unrelated error. Exceptions are now attached to the error that carries them. Exceptions raised by a loader are also no longer treated as missing templates, so they are no longer ignored by ignore missing or skipped by an include with a list of templates. #967
• The Python package is now also published as free-threaded wheels for Linux, macOS and Windows: a version-specific wheel for CPython 3.14t and an abi3t (PEP 803) wheel for CPython 3.15+. #969
• The Python package metadata includes the readme again, so the PyPI page shows a project description.

3.0.1

• The Python package is now also published as Pyodide wheels (PEP 783 pyemscripten platform tag) for Pyodide 0.29 and 314 so it can be installed with micropip.

... (truncated)

Commits

• 68ab5b6 chore(release): 3.0.5
• fc636f0 fix: report a syntax error instead of panicking on }} in expressions
• f6f9857 fix(go): iterate undefined as an empty sequence in filters like Rust (#990)
• 0d0df9d fix(go): make the trim filter convert values and strip Unicode whitespace lik...
• ce30dad fix(contrib): format floats like str() in str.format when no precision is giv...
• 0b2e87d test: make huge batch count test portable to 32bit targets
• feb2f93 fix(go): coerce booleans and floats in the odd, even and divisibleby tests li...
• e05f317 fix: do not trust size hints when preallocating
• 9c6fe27 fix(go): treat none as an empty iterable in filters like Rust (#987)
• 50470a2 fix(go): support slicing and in on iterables like Rust (#986)
• Additional commits viewable in compare view

Updates opentelemetry from 0.32.0 to 0.33.1

Release notes

Sourced from opentelemetry's releases.

0.33.1

The OTLP exporters for Logs and Metrics are now stable.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Commits

• 372ebbc chore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)
• 5582e71 docs(logs): polish design doc and fill perf numbers (#3566)
• 7ce1269 fix(sdk): log when the periodic metrics reader panics (#3777)
• b547036 fix(prometheus): keep resource labels when scope info is disabled (#3751)
• e8480db chore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)
• 0fdfc48 feat(proto): Add support for protobuffer descriptor output (#3675)
• 87929d7 ci: install markdown-link-check from npm (#3661)
• ff2ab2d docs(trace): explain async context propagation (#3759)
• 2595432 fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...
• 952bdee fix: accept optional whitespace in TraceState (#3761)
• Additional commits viewable in compare view

Updates opentelemetry_sdk from 0.32.1 to 0.33.1

Commits

• 372ebbc chore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)
• 5582e71 docs(logs): polish design doc and fill perf numbers (#3566)
• 7ce1269 fix(sdk): log when the periodic metrics reader panics (#3777)
• b547036 fix(prometheus): keep resource labels when scope info is disabled (#3751)
• e8480db chore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)
• 0fdfc48 feat(proto): Add support for protobuffer descriptor output (#3675)
• 87929d7 ci: install markdown-link-check from npm (#3661)
• ff2ab2d docs(trace): explain async context propagation (#3759)
• 2595432 fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...
• 952bdee fix: accept optional whitespace in TraceState (#3761)
• Additional commits viewable in compare view

Updates opentelemetry-stdout from 0.32.0 to 0.33.1

Release notes

Sourced from opentelemetry-stdout's releases.

0.33.1

The OTLP exporters for Logs and Metrics are now stable.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Commits

• 372ebbc chore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)
• 5582e71 docs(logs): polish design doc and fill perf numbers (#3566)
• 7ce1269 fix(sdk): log when the periodic metrics reader panics (#3777)
• b547036 fix(prometheus): keep resource labels when scope info is disabled (#3751)
• e8480db chore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)
• 0fdfc48 feat(proto): Add support for protobuffer descriptor output (#3675)
• 87929d7 ci: install markdown-link-check from npm (#3661)
• ff2ab2d docs(trace): explain async context propagation (#3759)
• 2595432 fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...
• 952bdee fix: accept optional whitespace in TraceState (#3761)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions