deps(deps): bump the rust-minor-patch group across 1 directory with 76 updates

[dependabot]

Bumps the rust-minor-patch group with 76 updates in the / directory:

Package	From	To
serde_json	1.0.151	1.0.154
ringbuf	0.5.1	0.5.3
ort	2.0.0-rc.13	2.0.0-rc.14
ureq	3.4.1	3.4.2
tokio	1.53.1	1.53.2
reqwest	0.13.4	0.13.5
clap	4.6.6	4.6.7
arbitrary	1.4.2	1.5.0
aws-lc-rs	1.18.1	1.18.2
aws-lc-sys	0.45.0	0.46.0
bitflags	2.13.1	2.13.2
cc	1.4.5	1.8.0
cfg-if	1.0.4	1.0.5
clap_builder	4.6.6	4.6.7
clap_derive	4.6.4	4.6.7
clap_lex	1.1.0	1.1.1
console	0.16.4	0.16.6
crc32fast	1.5.1	1.5.2
cxx	1.0.200	1.0.205
cxx-build	1.0.200	1.0.205
cxxbridge-cmd	1.0.200	1.0.205
cxxbridge-flags	1.0.200	1.0.205
cxxbridge-macro	1.0.200	1.0.205
derive_arbitrary	1.4.2	1.5.0
either	1.18.0	1.19.0
encoding_rs	0.8.35	0.8.42
find-msvc-tools	0.1.12	0.1.14
h2	0.4.19	0.4.20
hmac-sha256	1.1.14	1.1.15
hyper	1.11.1	1.12.0
hyper-rustls	0.27.9	0.27.10
hyper-util	0.1.20	0.1.21
jiff	0.2.35	0.2.38
jiff-core	0.1.0	0.1.1
jiff-static	0.2.35	0.2.38
libc	0.2.189	0.2.190
libredox	0.1.23	0.1.25
litrs	1.0.0	1.0.1
lru-slab	0.1.2	0.1.3
mio	1.2.3	1.2.4
objc2	0.6.4	0.6.5
ort-sys	2.0.0-rc.13	2.0.0-rc.14
pest	2.9.1	2.9.3
pest_derive	2.9.1	2.9.3
pest_generator	2.9.1	2.9.3
pest_meta	2.9.1	2.9.3
powerfmt	0.2.0	0.2.1
quinn	0.11.11	0.11.12
quinn-proto	0.11.17	0.11.19
rand	0.10.2	0.10.3
redox_users	0.5.2	0.5.3
rustix	1.1.4	1.1.5
rustls	0.23.43	0.23.45
rustls-platform-verifier	0.7.0	0.7.1
rustls-platform-verifier-android	0.1.1	0.2.0
siphasher	1.0.3	1.0.4
smallvec	1.16.0	1.16.3
syn	3.0.5	3.0.9
thiserror	2.0.20	2.0.21
tinyvec	1.13.2	1.13.3
tokio-rustls	0.26.5	0.26.6
tokio-util	0.7.19	0.7.20
toml_datetime	1.1.1+spec-1.1.0	1.1.2+spec-1.1.0
toml_edit	0.25.13+spec-1.1.0	0.25.17+spec-1.1.0
toml_parser	1.1.3+spec-1.1.0	1.1.5+spec-1.1.0
unicase	2.9.0	2.10.0
unicode-ident	1.0.24	1.0.27
ureq-proto	0.6.2	0.6.4
want	0.3.1	0.3.2
yoke-derive	0.8.2	0.8.4
zerocopy	0.8.56	0.8.62
zerocopy-derive	0.8.56	0.8.63
zerofrom-derive	0.1.7	0.1.8
zeroize	1.9.0	1.9.1
zlib-rs	0.6.7	0.6.8
zopfli	0.8.3	0.8.4

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates ringbuf from 0.5.1 to 0.5.3

Commits

• See full diff in compare view

Updates ort from 2.0.0-rc.13 to 2.0.0-rc.14

Release notes

Sourced from ort's releases.

v2.0.0-rc.14

2.0.0-rc.14

💖 If you find ort useful, please consider supporting us on Open Collective 💖

🤔 Need help upgrading? Ask questions in GitHub Discussions or in the pyke.io Discord server!

✨ Supporters get priority (<24h) issue resolution & support!

---

⚠️ Manual environments

ort replaced the manual Environment struct with ort::init all the way back in Nov 2023 with 2.0.0-alpha.1 (yes, before rc hell, we used to be in alpha hell). This was done because only one environment was allowed per process anyway. However, almost every other release since then, there has been some kind of issue stemming from the environment being stored as a global variable.

The trouble caused by this now far outweighs the inconvenience of lugging around another variable everywhere, so in rc.14, you must always first create an Environment to start building sessions:

// pre-rc.14
{
    // optional, even!
    ort::init().commit()?;
let mut model = Session::builder()?
    .with_optimization_level(GraphOptimizationLevel::Level3)?
    .with_intra_threads(4)?
    .commit_from_file("yolov8m.onnx")?;

}
// rc.14
{
let env = ort::init().build()?; // <-- must build an environment first
let mut model = Session::builder(&env)?
.with_optimization_level(GraphOptimizationLevel::Level3)?
.with_intra_threads(4)?
.commit_from_file("yolov8m.onnx")?;
}

Note that you don't need to hold onto env unless you intend to create more sessions. Please refrain from storing environments or sessions as global variables -- we can't fix the issues that causes within ONNX Runtime! And library authors, please remember to allow the user to pass their own Environment.

✨ Rust 1.100 compatibility

rc.14 adds support for the upcoming v2 build dir layout that will ship in Rust 1.100. If you intend to update to Rust 1.100, you should upgrade to rc.14 as soon as possible, since older ort versions will fail to build when copy-dylibs is enabled.

Note that, due to the new layout, tests will no longer be able to see dylibs copied by copy-dylibs; you can try to use ort::util::preload_dylib to manually set the path to provider dylibs instead.

📦 You get a binary! You get a binary! Everyone gets binaries!

🟩 rc.14's prebuilt CUDA binaries add support for RTX 50xx/Blackwell cards on x64. We now also ship aarch64 builds for Jetson Orin/Thor, Grace Hopper/Blackwell, & DGX Spark! Turing & Ampere GPUs remain fully supported.

... (truncated)

Commits

• 1ee1f84 2.0.0-rc.14
• 75021e8 chore: remove deprecated execution_providers alias
• b774fea feat(sys): add model package API
• 7fdadd1 fix: hold onto the right allocator; target correct device when copying
• f2a5f73 chore(sys): update to ONNX Runtime v1.31.0
• 085eb2a fix(training): fix a leak on error & hold onto session builder extras (#659)
• beb1b2f perf: extract tensor shape without allocating
• 9dfd75b fix: prevent tensors from outliving the allocator that allocated them (#656)
• 5dc34f8 refactor(operator): share the inplace and alias index list helpers (#660)
• 7b8ba57 fix: guard async run result and waker with one lock so a completion can't be ...
• Additional commits viewable in compare view

Updates ureq from 3.4.1 to 3.4.2

Changelog

Sourced from ureq's changelog.

3.4.2

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
• Bypass pooling for request connection settings incompatible with the Agent #1201
• Try the next resolved address on unreachable/unavailable connect errors #1195

Commits

• 2e9ef24 3.4.2
• b983841 Bump ureq-proto to 0.6.3
• 075a1d7 Respect request connection settings when pooling
• fb634de Try the next resolved address when a connect fails for that address only (#1195)
• See full diff in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

• fix(blocking): preserve version and extensions in TryFromhttp::Request by @​wwhsaber in seanmonstar/reqwest#3050
• Remove unnecessary clones by @​FranciscoTGouveia in seanmonstar/reqwest#3052
• Add Referrer and Referrer Policy methods to WASM Request API by @​Billy-Sheppard in seanmonstar/reqwest#3049
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in seanmonstar/reqwest#3058
• feat: add Error::is_dns() to identify DNS resolution failures by @​JoakoI98 in seanmonstar/reqwest#3057
• Fix blocking client timeout panic by @​V-Mann-Nick in seanmonstar/reqwest#3060
• Use LookupIpStrategy::Ipv6AndIpv4 to actually prefer IPv6 when using hickory-dns by @​FalkWoldmann in seanmonstar/reqwest#3063
• feat: Add ClientBuilder::http1_max_headers by @​smaeda-ks in seanmonstar/reqwest#3065
• feat: expose the negotiated TLS version via TlsInfo by @​dennisameling in seanmonstar/reqwest#3067
• fix(error): detect timeouts wrapped in body decode errors by @​raphaelroshan in seanmonstar/reqwest#3064
• Remove unnecessary clones and a cast by @​FranciscoTGouveia in seanmonstar/reqwest#3071
• chore(deps): upgrade base64 to 0.23 by @​paolobarbolini in seanmonstar/reqwest#3074
• perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody by @​spellsaif in seanmonstar/reqwest#3085
• fix(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture::poll by @​spellsaif in seanmonstar/reqwest#3084
• src/async_impl/request.rs_improved_doc_for_json_fn: by @​Athleteg in seanmonstar/reqwest#3082
• fix: proxy could use wrong credentials if many matched by @​seanmonstar in seanmonstar/reqwest#3098

New Contributors

• @​wwhsaber made their first contribution in seanmonstar/reqwest#3050
• @​FranciscoTGouveia made their first contribution in seanmonstar/reqwest#3052
• @​Billy-Sheppard made their first contribution in seanmonstar/reqwest#3049
• @​JoakoI98 made their first contribution in seanmonstar/reqwest#3057
• @​V-Mann-Nick made their first contribution in seanmonstar/reqwest#3060
• @​FalkWoldmann made their first contribution in seanmonstar/reqwest#3063
• @​smaeda-ks made their first contribution in seanmonstar/reqwest#3065
• @​raphaelroshan made their first contribution in seanmonstar/reqwest#3064
• @​spellsaif made their first contribution in seanmonstar/reqwest#3085
• @​Athleteg made their first contribution in seanmonstar/reqwest#3082

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

Commits

• de55373 v0.13.5
• 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
• 9f06fd2 docs: improve description of JSON method (#3082)
• 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
• ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
• 4e9a3c7 chore: add pull request template for human-written content
• 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
• 221abe9 chore: Remove unnecessary clones and a cast (#3071)
• 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
• fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
• Additional commits viewable in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates arbitrary from 1.4.2 to 1.5.0

Changelog

Sourced from arbitrary's changelog.

1.5.0

Released 2026-10-05.

Added

• Added support for deriving Arbitrary for types with raw identifiers.

Changed

• Updated derive_arbitrary to syn 3. This raises the MSRV from 1.63.0 to 1.71.0, which is the MSRV of syn 3.

Fixed

• Fixed soundness when generating arrays.
• Fixed nonzero integer generation to always produce a nonzero value.
• Updated derive_arbitrary to include fixes for fully qualified paths.

---

Commits

• 9807b59 Merge pull request #243 from fitzgen/bump-to-1.5.0
• 7a49e61 Bump to version 1.5.0
• aa2802b Merge pull request #242 from drakeo338/claude/241-fix
• a9f7ca5 Update derive_arbitrary to syn 3 and raise MSRV to 1.71
• cd35bd2 Merge pull request #239 from Manishearth/fix-soundness
• 53a651d agent-driven: Fix soundness in try_create_array
• df8afe9 Merge pull request #238 from baloo/baloo/push-lopsmyosqnpv
• 15f5c08 Bring fix for fully qualified path
• 341a8fd Merge pull request #237 from ngildenhuys/downgrading_msrv_deps
• 9b68ef4 ci: adding update commands to downgrade dependencies to fix MSRV test
• Additional commits viewable in compare view

Updates aws-lc-rs from 1.18.1 to 1.18.2

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.2

What's Changed

• Implement Eq and PartialEq for RSA and EdDSA parameters by @​dsykes16 in aws/aws-lc-rs#1228
  • RsaParameters can now be compared directly against RSA verification constants. Algorithms with different digests, padding schemes, or modulus-size ranges compare unequal. EdDSAParameters also gains equality support.
• Add wasm32-wasip2 and wasm32-wasip3 support by @​ricochet in aws/aws-lc-rs#1239
  • Adds non-FIPS builds using universal bindings, with CI coverage under Wasmtime and wasi-sdk 34. WASIp3 requires nightly Rust.
  • Direct aws-lc-sys consumers must disable the default all-bindings feature for these targets.
• Publish the intended RandomizedNonceKey::open_in_place documentation by @​Serophots in aws/aws-lc-rs#1227
  • Makes the existing nonce, ciphertext/tag layout, and buffer-on-error contract visible in rustdoc. No runtime behavior changes.

Upstream AWS-LC

• aws-lc-sys v0.46.0 aligns with AWS-LC v5.11.0 (previously v5.7.0). See also the release notes for v5.8.0, v5.9.0, and v5.10.0.
  • The Ed25519 C-implementation decoder now rejects non-canonical public keys, matching the assembly-optimized implementations: aws/aws-lc#3457
  • Includes ChaCha20-Poly1305 key-material zeroization and fixes ML-KEM CPU feature detection to avoid illegal-instruction failures on x86-64 CPUs with AVX2 but no BMI2: aws/aws-lc#3552 and aws/aws-lc#3596
• aws-lc-fips-sys v0.14.3 updates its bundled AWS-LC FIPS 4.2.0 snapshot and regenerates bindings. It remains on the FIPS 4.x release line.

Build Improvements

• Raise the minimum system AWS-LC version to 5.7.0 by @​justsmth in aws/aws-lc-rs#1243
  • Non-FIPS system-library installations must now provide AWS-LC 5.7.0 or newer, previously 1.68.0. Bundled-source builds and FIPS version requirements are unchanged.
• Fix static FIPS system-library linking by @​justsmth in aws/aws-lc-rs#1236
  • Fixes unresolved FIPS_mode references with GNU ld.bfd when linking a prebuilt static FIPS library, including binaries that do not call crypto and builds where LTO removes those calls.
  • Uses whole-archive linking to retain libcrypto, including in downstream Rust staticlib outputs. This can increase binary size; dynamic FIPS and non-FIPS linking are unchanged.
• Fix Cranelift linking by @​justsmth in aws/aws-lc-rs#1234
  • Normalizes binding link names to avoid undefined-symbol failures, including when Cranelift is selected through Cargo profiles rather than RUSTFLAGS. The AWS_LC_SYS_NO_U1_BINDINGS workaround is no longer needed.
• Fix jitterentropy builds with optimizing CFLAGS and newer cc versions by @​justsmth in aws/aws-lc-rs#1254
  • Keeps filtered flags in effect throughout the jitterentropy builder's lifetime, preventing cached environment reads from allowing flags such as -O2 to override its required -O0.
• Honor AWS_LC_SYS_CC in the main library build by @​justsmth in aws/aws-lc-rs#1255
  • Applies crate-specific compiler overrides before compiler lookup in both CC and CMake build paths, keeping compiler selection and capability probes consistent when cc caches environment reads.
• Improve archive reproducibility through symlinked build paths by @​justsmth in aws/aws-lc-rs#1238
  • Prevents the non-Windows CC builder from incorporating symlink-resolved absolute build paths into archive member names, avoiding unnecessary downstream compile-cache misses. Windows short-path handling is unchanged.
• Upgrade bindgen to 0.73 by @​xtqqczze in aws/aws-lc-rs#1244
• Document the system-library trust model by @​justsmth in aws/aws-lc-rs#1218
  • Clarifies that supplied paths and pkg-config results are trusted build inputs, and that FIPS validation can execute candidate library code before accepting or rejecting it. Documents runner requirements and how to disable automatic system-library detection.

Issues Being Closed

• Cranelift builds fail with codegen-backend = "cranelift" -- aws/aws-lc-rs#1231
• Upgrade bindgen to v0.73 -- aws/aws-lc-rs#1245
• Undefined FIPS_mode when linking a prebuilt FIPS module into a binary that does not use crypto -- aws/aws-lc-rs#1246
• Jitterentropy fails with "must not be compiled with optimizations" in aws-lc-rs v1.18.1 / aws-lc-sys v0.45.0 -- aws/aws-lc-rs#1252

Other Merged PRs

• Add security review workflow by @​nhatnghiho in aws/aws-lc-rs#1226
• docs: align pull request template with AWS-LC by @​justsmth in aws/aws-lc-rs#1219
• ci: verify docs.rs build with read-only crate sources by @​justsmth in aws/aws-lc-rs#1209
• ci: harden workflows and release tooling by @​justsmth in aws/aws-lc-rs#1216

... (truncated)

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Updates aws-lc-sys from 0.45.0 to 0.46.0

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Updates bitflags from 2.13.1 to 2.13.2

Release notes

Sourced from bitflags's releases.

2.13.2

What's Changed

• Flags: adjust order of elements in manual implementation example by @​DanielEScherzer in bitflags/bitflags#494
• Re-pull const declarations outside of nested const by @​KodrAus in bitflags/bitflags#496
• Prepare for 2.13.2 release by @​KodrAus in bitflags/bitflags#497

Full Changelog: bitflags/bitflags@2.13.1...2.13.2

Changelog

Sourced from bitflags's changelog.

2.13.2

What's Changed

• Flags: adjust order of elements in manual implementation example by @​DanielEScherzer in bitflags/bitflags#494
• Re-pull const declarations outside of nested const by @​KodrAus in bitflags/bitflags#496

Full Changelog: bitflags/bitflags@2.13.1...2.13.2

Commits

• 80ce9b5 Merge pull request #497 from bitflags/cargo/2.13.2
• 5822493 prepare for 2.13.2 release
• 48f4f1a Merge pull request #496 from bitflags/fix/rustc-ice
• 2c0b042 re-pull const declarations outside of nested const
• c3f8d31 Merge pull request #494 from DanielEScherzer/flags-docs-example
• 0fc3762 Flags: adjust order of elements in manual implementation example
• See full diff in compare view

Updates cc from 1.4.5 to 1.8.0

Release notes

Sourced from cc's releases.

cc-v1.8.0

Added

• add CC_PREFER_CLANG_CL_OVER_MSVC to override prefer_clang_cl_over_msvc (#2001)

Fixed

• (panic) fix panic in code and replace with error when appropriate (#2008)
• (env) do not panic if WASM_MUSL_SYSROOT not set (#2007)
• (jobserver) help thread gets more token than necessary (#2006)
• stop forwarding -Cprofile-generate/-Cprofile-use to the C compiler (#2003)
• do not apply target crt-static when target is overridden (#1999)

Other

• (parallel) poll for process exit on linux (#2009)
• document NVCC and other environment variables (#2005)
• (jobserver) poll for new token (#2004)
• (parallel) Use poll on unix (#2000)

cc-v1.7.0

Added

• add Tool::get_envs, deprecate Tool::env and store tool env as Arc<OsStr> pairs (#1985)
• link c++ when Clang uses libc++ (#1978)
• add CC_MASM_ASM and fall back to llvm-ml for MASM files (#1975)

Fixed

• (target parsing) for powerpc64-ibm-aix abi (#1989)
• ignore ASCII case in program name checks (#1981)

Other

• (compile) issue compilation cmds more frequently in parallel #1997 #1998
• (cache) Optimize tool detection caching (#1995)
• (cache) optimize EnvSnapshot Hash, PartialEq, Ord impl (#1994)
• Regenerate target info (#1988)

cc-v1.6.0

Added

• add Build::create_archive and emit_link_directives (#1972)
• read the process environment once per Build, on first use (#1969)
• add Build::message_logger for structured access to cc's messages (#1967)
• add CXXSTDLIB_STATIC to link the C++ stdlib statically from outside (#1957)

Fixed

• key the flag support cache on target, host, language and environment (#1965)

... (truncated)

Changelog

Sourced from cc's changelog.

1.8.0 - 2026-10-11

Added

• add CC_PREFER_CLANG_CL_OVER_MSVC to override prefer_clang_cl_over_msvc (#2001)

Fixed

• (panic) fix panic in code and replace with error when appropriate (#2008)
• (env) do not panic if WASM_MUSL_SYSROOT not set (#2007)
• (jobserver) help thread gets more token than necessary (#2006)
• stop forwarding -Cprofile-generate/-Cprofile-use to the C compiler (#2003)
• do not apply target crt-static when target is overridden (#1999)

Other

• (parallel) poll for process exit on linux (#2009)
• document NVCC and other environment variables (#2005)
• (jobserver) poll for new token (#2004)
• (parallel) Use poll on unix (#2000)

1.7.0 - 2026-10-10

Added

• add Tool::get_envs, deprecate Tool::env and store tool env as Arc<OsStr> pairs (#1985)
• link c++ when Clang uses libc++ (#1978)
• add CC_MASM_ASM and fall back to llvm-ml for MASM files (#1975)

Fixed

• (target parsing)...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 3 packages with OpenSSF Scorecard issues.

View full job summary