Skip to content

deps(deps): bump the cargo-deps group across 1 directory with 15 updates - #63

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-deps-4a4dd263b4
Closed

deps(deps): bump the cargo-deps group across 1 directory with 15 updates#63
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-deps-4a4dd263b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo-deps group with 15 updates in the / directory:

Package From To
thiserror 2.0.19 2.0.20
flate2 1.1.9 1.1.10
futures 0.3.33 0.3.34
uuid 1.24.0 1.26.1
ignore 0.4.32 0.4.33
globset 0.4.19 0.4.20
oxibrowser 0.21.0 0.21.1
async-trait 0.1.91 0.1.92
oxibrowser-core 0.21.0 0.21.1
clap 4.6.5 4.6.7
clap_complete 4.6.8 4.6.11
open 5.4.1 5.4.4
blake3 1.8.5 1.8.7
lru 0.18.2 0.18.4
similar 3.1.1 3.2.0

Updates thiserror from 2.0.19 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)
Commits

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

New Contributors

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits
  • ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
  • fb5228d Merge pull request #559 from bushrat011899/no_std
  • 6ed3ba3 Add executable no_std example
  • faed8a0 Expand CI to test no_std compatibility and correctness
  • 2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
  • 3fe1126 Centralize usage of std for error and io
  • 98e313a Add GzHeader::mtime_as_duration
  • 0642965 Switch to core implicit prelude and only use std where required
  • 454a63c Remove left-over dbg! statement
  • 2a490b7 Add runtime_detection feature
  • Additional commits viewable in compare view

Updates futures from 0.3.33 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)
Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)
Commits

Updates uuid from 1.24.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

Commits
  • 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
  • d4df8f0 prepare for 1.26.1 release
  • 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
  • fda00eb don't panic in overflowing Timestamp to SystemTime conversion
  • c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
  • ac065a6 Align the counter diagram
  • 34ec102 Seat the v7 counter below the version nibble
  • cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
  • 34e4f49 don't test macros under miri
  • d9e7242 update nightly used for miri
  • Additional commits viewable in compare view

Updates ignore from 0.4.32 to 0.4.33

Commits

Updates globset from 0.4.19 to 0.4.20

Commits
  • 5055264 globset-0.4.20
  • 020687a ignore,globset: increase pool capacity
  • 5ed408e ignore-0.4.32
  • 435f59f ignore: skip loading unreachable ignore files
  • f9c05a9 index: remove incorrect README
  • 8372866 index: add some initial indexing scaffolding
  • d99ac34 core: add index module
  • 2ed0c00 flags: disable many flags when indexing is enabled
  • 59e318f ignore-0.4.31
  • a9dc222 cargo: set rust-version on all crates
  • Additional commits viewable in compare view

Updates oxibrowser from 0.21.0 to 0.21.1

Release notes

Sourced from oxibrowser's releases.

v0.21.1

Fixed

  • DocumentFragment appendChild no longer kills the JS thread — document.createDocumentFragment was a stub returning a plain object with a bogus __nodeId (1100000); appending it into the document forwarded that id to the Blitz render doc, which panicked with "invalid key", and the unwind permanently killed the session's JS thread (every later Runtime.evaluate failed with "JS thread has died" while captureScreenshot kept returning 200 via its blank-PNG fallback). DocumentFragment now tracks its children, element appendChild splices them into the document per spec (emptying the fragment and flattening nesting), and native-binding panics on the eval path are contained into a per-evaluation error instead of killing the thread. Follow-up hardening: warn instead of silently dropping fragment children lacking a __nodeId, gate connectedCallback firing on an actual insertion, contain panics in SetDocument/SetFrameDocument navigation scripts too (the frame context stays registered), and guard the fragment stub against self-append (infinite flatten loop) and null children (TypeError per spec). Fixes #2.
  • Bing search results decoded past tracking redirects — organic results wrapped in bing.com/ck/a tracking links now expose the real destination (base64url payload after u=a1) instead of the tracking URL, and response bytes are decoded as UTF-8 directly because Bing mislabels charset headers on some locales, which mojibake'd CJK snippets through reqwest's .text().

Security

  • h2 bumped to 0.4.19 — resolves the RUSTSEC advisory on unbounded DATA frames (Cargo.lock-only bump; no manifest change).

Full changelog: https://github.com/project-oxi/oxibrowser/blob/main/CHANGELOG.md

Changelog

Sourced from oxibrowser's changelog.

[0.21.1] - 2026-09-14

Fixed

  • DocumentFragment appendChild no longer kills the JS thread — document.createDocumentFragment was a stub returning a plain object with a bogus __nodeId (1100000); appending it into the document forwarded that id to the Blitz render doc, which panicked with "invalid key", and the unwind permanently killed the session's JS thread (every later Runtime.evaluate failed with "JS thread has died" while captureScreenshot kept returning 200 via its blank-PNG fallback). DocumentFragment now tracks its children, element appendChild splices them into the document per spec (emptying the fragment and flattening nesting), and native-binding panics on the eval path are contained into a per-evaluation error instead of killing the thread. Follow-up hardening: warn instead of silently dropping fragment children lacking a __nodeId, gate connectedCallback firing on an actual insertion, contain panics in SetDocument/SetFrameDocument navigation scripts too (the frame context stays registered), and guard the fragment stub against self-append (infinite flatten loop) and null children (TypeError per spec). Fixes #2.
  • Bing search results decoded past tracking redirects — organic results wrapped in bing.com/ck/a tracking links now expose the real destination (base64url payload after u=a1) instead of the tracking URL, and response bytes are decoded as UTF-8 directly because Bing mislabels charset headers on some locales, which mojibake'd CJK snippets through reqwest's .text().

Security

  • h2 bumped to 0.4.19 — resolves the RUSTSEC advisory on unbounded DATA frames (Cargo.lock-only bump; no manifest change).
Commits
  • 024bd15 chore: release v0.21.1 — bump versions + CHANGELOG
  • acd2181 chore(deps): bump h2 to 0.4.19 — fix RUSTSEC unbounded DATA frames advisory
  • 6a039cf fix(js): address review findings on fragment splice and panic containment
  • 8e25d3f fix(js): splice DocumentFragment children on appendChild instead of killing t...
  • 1de78e5 fix(search): decode Bing /ck/a redirects and trust UTF-8 response bytes
  • See full diff in compare view

Updates async-trait from 0.1.91 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

  • Resolve double_must_use clippy lint in generated code (#303)
Commits

Updates oxibrowser-core from 0.21.0 to 0.21.1

Release notes

Sourced from oxibrowser-core's releases.

v0.21.1

Fixed

  • DocumentFragment appendChild no longer kills the JS thread — document.createDocumentFragment was a stub returning a plain object with a bogus __nodeId (1100000); appending it into the document forwarded that id to the Blitz render doc, which panicked with "invalid key", and the unwind permanently killed the session's JS thread (every later Runtime.evaluate failed with "JS thread has died" while captureScreenshot kept returning 200 via its blank-PNG fallback). DocumentFragment now tracks its children, element appendChild splices them into the document per spec (emptying the fragment and flattening nesting), and native-binding panics on the eval path are contained into a per-evaluation error instead of killing the thread. Follow-up hardening: warn instead of silently dropping fragment children lacking a __nodeId, gate connectedCallback firing on an actual insertion, contain panics in SetDocument/SetFrameDocument navigation scripts too (the frame context stays registered), and guard the fragment stub against self-append (infinite flatten loop) and null children (TypeError per spec). Fixes #2.
  • Bing search results decoded past tracking redirects — organic results wrapped in bing.com/ck/a tracking links now expose the real destination (base64url payload after u=a1) instead of the tracking URL, and response bytes are decoded as UTF-8 directly because Bing mislabels charset headers on some locales, which mojibake'd CJK snippets through reqwest's .text().

Security

  • h2 bumped to 0.4.19 — resolves the RUSTSEC advisory on unbounded DATA frames (Cargo.lock-only bump; no manifest change).

Full changelog: https://github.com/project-oxi/oxibrowser/blob/main/CHANGELOG.md

Changelog

Sourced from oxibrowser-core's changelog.

[0.21.1] - 2026-09-14

Fixed

  • DocumentFragment appendChild no longer kills the JS thread — document.createDocumentFragment was a stub returning a plain object with a bogus __nodeId (1100000); appending it into the document forwarded that id to the Blitz render doc, which panicked with "invalid key", and the unwind permanently killed the session's JS thread (every later Runtime.evaluate failed with "JS thread has died" while captureScreenshot kept returning 200 via its blank-PNG fallback). DocumentFragment now tracks its children, element appendChild splices them into the document per spec (emptying the fragment and flattening nesting), and native-binding panics on the eval path are contained into a per-evaluation error instead of killing the thread. Follow-up hardening: warn instead of silently dropping fragment children lacking a __nodeId, gate connectedCallback firing on an actual insertion, contain panics in SetDocument/SetFrameDocument navigation scripts too (the frame context stays registered), and guard the fragment stub against self-append (infinite flatten loop) and null children (TypeError per spec). Fixes #2.
  • Bing search results decoded past tracking redirects — organic results wrapped in bing.com/ck/a tracking links now expose the real destination (base64url payload after u=a1) instead of the tracking URL, and response bytes are decoded as UTF-8 directly because Bing mislabels charset headers on some locales, which mojibake'd CJK snippets through reqwest's .text().

Security

  • h2 bumped to 0.4.19 — resolves the RUSTSEC advisory on unbounded DATA frames (Cargo.lock-only bump; no manifest change).
Commits
  • 024bd15 chore: release v0.21.1 — bump versions + CHANGELOG
  • acd2181 chore(deps): bump h2 to 0.4.19 — fix RUSTSEC unbounded DATA frames advisory
  • 6a039cf fix(js): address review findings on fragment splice and panic containment
  • 8e25d3f fix(js): splice DocumentFragment children on appendChild instead of killing t...
  • 1de78e5 fix(search): decode Bing /ck/a redirects and trust UTF-8 response bytes
  • See full diff in compare view

Updates clap from 4.6.5 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

v4.6.6

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage
Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage
Commits
  • d3e59a9 chore: Release
  • d997f87 docs: Update changelog
  • fb6058c Merge pull request #6409 from heaths/pwsh-support
  • 2310870 test(complete): Add tests for completer_for_path
  • 5967c17 refactor(complete): Move shell detection to Shells
  • 594602b fix(complete): Detect pwsh for PowerShell
  • 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
  • 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
  • c968b13 chore(deps): Update Rust crate shlex to v2
  • 8f247cb chore(deps): Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates clap_complete from 4.6.8 to 4.6.11

Commits
  • 2cb76fd chore: Release
  • 0b00b8d docs: Update changelog
  • 3443000 Merge pull request #6526 from bonnefoa/fix-completion-escape
  • a1b6be7 fix(clap_complete): Fix value escape in zsh completion
  • face9e8 test(complete): Add completion test without arg's help
  • 88053ab test(complete): Re-enable complete tests
  • e6adcc2 chore(release): Simplify replacements
  • 13f2db5 chore: Release
  • 3304fea docs: Update changelog
  • 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
  • Additional commits viewable in compare view

Updates open from 5.4.1 to 5.4.4

Release notes

Sourced from open's releases.

v5.4.4

Bug Fixes

  • open Windows paths without wildcard expansion

    Opening a child of a bracket-named directory fails because Start-Process resolves parent directories as PowerShell wildcard patterns. The isolated Windows regression test reproduced WildcardPatternException for a copied executable under "【Tiny Asa】 [77P7V-712MB]\child" before this change.

    Use Test-Path and Invoke-Item with LiteralPath for existing items, retaining Start-Process for URLs and application names. These cmdlets also work under PowerShell Constrained Language Mode. Share the embedded script between Windows and WSL, keep targets in environment data, and stop on launch errors to report a nonzero exit status. Preserve the security boundary established in fd29861: cmd /c start remains opt-in through the insecure feature. No previously removed launcher options are restored.

    The integration test launches only a copy of its own test binary, which records its executable path and exits. It checks absolute and relative paths with invalid and valid bracket patterns, Unicode, backticks, quotes, shell metacharacters, and leading dashes in normal and constrained PowerShell sessions, plus failure for a missing executable. It requires neither Explorer nor registered document or URL handlers. Adjust the existing fallback assertion to also allow the opt-in cmd launcher after Explorer with all features enabled.

    Validated locally on Windows with PowerShell 5.1.26100.33438 and rustc 1.97.1: cargo test and cargo test --all-features each passed all 19 tests, including the behavioral regression. git diff --check passed, and cargo package --list includes the embedded script. Test-Path returned false without errors for representative https, mailto, and file URLs. Actual GUI folder, document, URL handling and WSL interop were not exercised locally.

Commit Statistics

  • 2 commits contributed to the release.
  • 8 days passed between releases.
  • 1 commit was understood as conventional.
  • 1 unique issue was worked on: #132

Commit Details

  • #132
    • Open Windows paths without wildcard expansion (ad95c40)
  • Uncategorized

... (truncated)

Changelog

Sourced from open's changelog.

5.4.4 (2026-09-10)

Bug Fixes

  • open Windows paths without wildcard expansion

    Opening a child of a bracket-named directory fails because Start-Process resolves parent directories as PowerShell wildcard patterns. The isolated Windows regression test reproduced WildcardPatternException for a copied executable under "【Tiny Asa】 [77P7V-712MB]\child" before this change.

    Use Test-Path and Invoke-Item with LiteralPath for existing items, retaining Start-Process for URLs and application names. These cmdlets also work under PowerShell Constrained Language Mode. Share the embedded script between Windows and WSL, keep targets in environment data, and stop on launch errors to report a nonzero exit status. Preserve the security boundary established in fd29861: cmd /c start remains opt-in through the insecure feature. No previously removed launcher options are restored.

    The integration test launches only a copy of its own test binary, which records its executable path and exits. It checks absolute and relative paths with invalid and valid bracket patterns, Unicode, backticks, quotes, shell metacharacters, and leading dashes in normal and constrained PowerShell sessions, plus failure for a missing executable. It requires neither Explorer nor registered document or URL handlers. Adjust the existing fallback assertion to also allow the opt-in cmd launcher after Explorer with all features enabled.

    Validated locally on Windows with PowerShell 5.1.26100.33438 and rustc 1.97.1: cargo test and cargo test --all-features each passed all 19 tests, including the behavioral regression. git diff --check passed, and cargo package --list includes the embedded script. Test-Path returned false without errors for representative https, mailto, and file URLs. Actual GUI folder, document, URL handling and WSL interop were not exercised locally.

Commit Statistics

  • 2 commits contributed to the release.
  • 8 days passed between releases.
  • 1 commit was understood as conventional.
  • 1 unique issue was worked on: #132

Commit Details

... (truncated)

Commits

Updates blake3 from 1.8.5 to 1.8.7

Release notes

Sourced from blake3's releases.

1.8.7

version 1.8.7

Changes since 1.8.6:

  • Remove the arrayref dependency. Unfortunately the crates.io owner was compromised.

1.8.6

version 1.8.6

Changes since 1.8.5:

  • update_mmap and update_mmap_rayon (and by extension b3sum) now use seek rather than metadata to get the length of a file/mapping, and they tolerate mmap failures. That means b3sum will now memory map e.g. Linux block devices, which support mapping despite reporting length 0 in metadata. Hashing NUL files on Windows also works now, where previously it was an error unless you used --no-mmap or <. This change was originally proposed by @​nabijaczleweli.
Commits
  • f3149ec version 1.8.7
  • b65bcb7 add #[allow(deprecated)] annotations to fix nightly/beta warnings
  • 483a220 fix warnings related to not using MAX constants
  • ba02549 Codex: remove arrayref
  • 77b257e version 1.8.6
  • 83b1746 use seek instead of metadata to establish mmap length (#570)
  • 9eac279 use vswhere to find Visual Studio in CI
  • fc3d0e9 Fix path to Visual Studio toolchain in CI
  • 8aa5145 a few more colons
  • 6bb9773 use cargo:: build script syntax
  • Additional commits viewable in compare view

Updates lru from 0.18.2 to 0.18.4

Changelog

Sourced from lru's changelog.

v0.18.4 - 2026-09-02

  • Add retain method.

v0.18.3 - 2026-08-27

  • Add sparse constructor.
Commits
  • 2504ad0 Merge pull request #245 from jeromefroe/jerome/prepare-0-18-4-release
  • 419b047 Prepare 0.18.4 release
  • 05ba36e Merge pull request #241 from ChrisJr404/add-retain
  • d84bc5e Revert retain to the simpler removal implementation
  • 36a810e Potential fix for pull request finding
  • e0d578c Merge remote-tracking branch 'up/master' into add-retain
  • 6e6ff26 retain: free the node returned by the map to avoid a dangling entry
  • ceeee6a Merge pull request #244 from jeromefroe/jerome/prepare-0-18-3-release
  • 1810d9a Prepare 0.18.3 release
  • 0f4e37a Merge pull request #242 from drbrain/LruCache-sparse
  • Additional commits viewable in compare view

Updates similar from 3.1.1 to 3.2.0

Changelog

Sourced from similar's changelog.

3.2.0

  • Added structured, line-oriented three-way merging through TextMerge, with merge and diff3 conflict output, configurable labels and marker sizes, owned and borrowed inputs, byte output, and whitespace-insensitive comparison.
  • Added WhitespaceMode and TextDiffConfig::whitespace_mode for Git-style line comparisons that ignore changes in whitespace (-b) or all whitespace (-w).
  • Changed Algorithm::Myers to reduce unmatched/confusing records and use Git-style bounded, non-minimal splits on expensive searches, and added Algorithm::RawMyers for the previous shortest-edit-script behavior without output-changing heuristics.
  • Improved heuristics and performance for most algorithms other than LCS.
  • Improved large-input performance by avoiding quadratic Histogram scans.

3.1.2

  • Fixed Algorithm::Lcs deadline fallback emitting edits twice, which produced out-of-bounds DiffOp ranges and panics when consuming timed-out diffs. #97
  • Fixed Algorithm::Lcs reporting identical subranges with zero-based indices instead of preserving the supplied range offsets. #98
  • Fixed Algorithm::Lcs and Algorithm::Hunt emitting zero-length delete operations when both inputs are empty. #99
Commits
  • e380405 chore(release): prepare 3.2.0
  • 9133b3d ref: Update changelog
  • a56a53f feat(merge): add three-way text merging
  • 7130d06 docs(examples): demonstrate whitespace-insensitive diffs
  • a635843 feat(text): add whitespace-insensitive line diffs
  • 6301178 perf(myers): preserve sparse matches with record reduction
  • f16b309 perf(myers): add bounded heuristic search
  • accea7d chore(clippy): resolve lint warnings
  • 3a5162b perf(algorithms): fast-path nearly disjoint ranges
  • fc32411 feat(fuzzing): add isolated performance campaign runner
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps(deps): bump the cargo-deps group across 1 directory with 15 updates
85e5b5d 
Bumps the cargo-deps group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.20` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` |
| [futures](https://github.com/rust-lang/futures-rs) | `0.3.33` | `0.3.34` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.24.0` | `1.26.1` |
| [ignore](https://github.com/BurntSushi/ripgrep) | `0.4.32` | `0.4.33` |
| [globset](https://github.com/BurntSushi/ripgrep) | `0.4.19` | `0.4.20` |
| [oxibrowser](https://github.com/project-oxi/oxibrowser) | `0.21.0` | `0.21.1` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.91` | `0.1.92` |
| [oxibrowser-core](https://github.com/project-oxi/oxibrowser) | `0.21.0` | `0.21.1` |
| [clap](https://github.com/clap-rs/clap) | `4.6.5` | `4.6.7` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.6.8` | `4.6.11` |
| [open](https://github.com/Byron/open-rs) | `5.4.1` | `5.4.4` |
| [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.5` | `1.8.7` |
| [lru](https://github.com/jeromefroe/lru-rs) | `0.18.2` | `0.18.4` |
| [similar](https://github.com/mitsuhiko/similar) | `3.1.1` | `3.2.0` |



Updates `thiserror` from 2.0.19 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.19...2.0.20)

Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.9...1.1.10)

Updates `futures` from 0.3.33 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.33...0.3.34)

Updates `uuid` from 1.24.0 to 1.26.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.24.0...v1.26.1)

Updates `ignore` from 0.4.32 to 0.4.33
- [Release notes](https://github.com/BurntSushi/ripgrep/releases)
- [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/ripgrep@ignore-0.4.32...ignore-0.4.33)

Updates `globset` from 0.4.19 to 0.4.20
- [Release notes](https://github.com/BurntSushi/ripgrep/releases)
- [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/ripgrep@globset-0.4.19...globset-0.4.20)

Updates `oxibrowser` from 0.21.0 to 0.21.1
- [Release notes](https://github.com/project-oxi/oxibrowser/releases)
- [Changelog](https://github.com/project-oxi/oxibrowser/blob/main/CHANGELOG.md)
- [Commits](project-oxi/oxibrowser@v0.21.0...v0.21.1)

Updates `async-trait` from 0.1.91 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.91...0.1.92)

Updates `oxibrowser-core` from 0.21.0 to 0.21.1
- [Release notes](https://github.com/project-oxi/oxibrowser/releases)
- [Changelog](https://github.com/project-oxi/oxibrowser/blob/main/CHANGELOG.md)
- [Commits](project-oxi/oxibrowser@v0.21.0...v0.21.1)

Updates `clap` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.5...clap_complete-v4.6.7)

Updates `clap_complete` from 4.6.8 to 4.6.11
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.8...clap_complete-v4.6.11)

Updates `open` from 5.4.1 to 5.4.4
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.4.1...v5.4.4)

Updates `blake3` from 1.8.5 to 1.8.7
- [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases)
- [Commits](BLAKE3-team/BLAKE3@1.8.5...1.8.7)

Updates `lru` from 0.18.2 to 0.18.4
- [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md)
- [Commits](jeromefroe/lru-rs@0.18.2...0.18.4)

Updates `similar` from 3.1.1 to 3.2.0
- [Changelog](https://github.com/mitsuhiko/similar/blob/main/CHANGELOG.md)
- [Commits](mitsuhiko/similar@3.1.1...3.2.0)

---
updated-dependencies:
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: futures
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: uuid
  dependency-version: 1.26.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: ignore
  dependency-version: 0.4.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: globset
  dependency-version: 0.4.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: oxibrowser
  dependency-version: 0.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: async-trait
  dependency-version: 0.1.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: oxibrowser-core
  dependency-version: 0.21.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: clap
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: clap_complete
  dependency-version: 4.6.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: open
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: blake3
  dependency-version: 1.8.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: lru
  dependency-version: 0.18.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: similar
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area: ci GitHub Actions, workflows, dependabot, supply chain. dependencies Pull request updates a dependency file. labels Sep 21, 2026
@dependabot
dependabot Bot requested a review from a7garden as a code owner September 21, 2026 00:17
@dependabot dependabot Bot added area: ci GitHub Actions, workflows, dependabot, supply chain. dependencies Pull request updates a dependency file. labels Sep 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 28, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-deps-4a4dd263b4 branch September 28, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@a7garden a7garden Awaiting requested review from a7garden a7garden is a code owner

Assignees

No one assigned

Labels

area: ci GitHub Actions, workflows, dependabot, supply chain. dependencies Pull request updates a dependency file.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants