chore(deps): bump the all-deps group with 17 updates

[dependabot]

Bumps the all-deps group with 17 updates:

Package	From	To
proptest	1.11.0	1.12.0
zeroize	1.9.0	1.9.1
arbitrary	1.4.2	1.5.0
derive_arbitrary	1.4.2	1.5.0
syn	2.0.119	3.0.6
ctutils	0.4.2	0.4.3
bit-set	0.8.0	0.11.1
bit-vec	0.8.0	0.10.1
either	1.18.0	1.19.0
r-efi	5.3.0	6.0.0
rand_xorshift	0.4.0	0.5.0
serde_spanned	1.1.1	1.1.2
toml_datetime	1.1.1+spec-1.1.0	1.1.2+spec-1.1.0
toml_parser	1.1.3+spec-1.1.0	1.1.5+spec-1.1.0
toml_writer	1.1.2+spec-1.1.0	1.1.3+spec-1.1.0
zerocopy	0.8.60	0.8.62
zerocopy-derive	0.8.60	0.8.63

Updates proptest from 1.11.0 to 1.12.0

Commits

• 70cf37d Merge pull request #675 from proptest-rs/prep-1.12
• 729e0ff prepare next releases and fix panic handling
• 28c1fad Merge pull request #664 from Expyron/main
• 5ddd9a4 Merge pull request #668 from toddATavail/fix-fork-persisted-failure
• a6a9ac7 Merge pull request #673 from glaziermag/fix-book-deploy
• d57d88b Replace rand_chacha with chacha20
• 9411213 Deploy the book on pushes to main
• 1719745 fix: terminate the fork replay when a persisted failure fails
• 0f55b7a test: a persisted failure in a forked test must be reported
• 4b0594e Merge pull request #669 from proptest-rs/no-fail-fast
• Additional commits viewable in compare view

Updates zeroize from 1.9.0 to 1.9.1

Commits

• 34a6ebc zeroize v1.9.1 (#1553)
• e68c684 zeroize: test under cargo miri in CI (#1552)
• 4a53d7d Update Cargo.lock (#1545)
• a2b1713 zeroize: fix fallback code used by optimization_barrier (#1551)
• 3c5aa70 ctutils v0.4.3 (#1550)
• 6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
• 29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
• f09945d ci: allow triggering workflows manually (#1543)
• 53493df dit v0.0.1-alpha (#1540)
• c89949d Rename aarch64-dit to dit (#1539)
• Additional commits viewable in compare view

Updates arbitrary from 1.4.2 to 1.5.0

Changelog

Sourced from arbitrary's changelog.

1.5.0

Released 2026-10-05.

Added

• Added support for deriving Arbitrary for types with raw identifiers.

Changed

• Updated derive_arbitrary to syn 3. This raises the MSRV from 1.63.0 to 1.71.0, which is the MSRV of syn 3.

Fixed

• Fixed soundness when generating arrays.
• Fixed nonzero integer generation to always produce a nonzero value.
• Updated derive_arbitrary to include fixes for fully qualified paths.

---

Commits

• 9807b59 Merge pull request #243 from fitzgen/bump-to-1.5.0
• 7a49e61 Bump to version 1.5.0
• aa2802b Merge pull request #242 from drakeo338/claude/241-fix
• a9f7ca5 Update derive_arbitrary to syn 3 and raise MSRV to 1.71
• cd35bd2 Merge pull request #239 from Manishearth/fix-soundness
• 53a651d agent-driven: Fix soundness in try_create_array
• df8afe9 Merge pull request #238 from baloo/baloo/push-lopsmyosqnpv
• 15f5c08 Bring fix for fully qualified path
• 341a8fd Merge pull request #237 from ngildenhuys/downgrading_msrv_deps
• 9b68ef4 ci: adding update commands to downgrade dependencies to fix MSRV test
• Additional commits viewable in compare view

Updates derive_arbitrary from 1.4.2 to 1.5.0

Changelog

Sourced from derive_arbitrary's changelog.

1.5.0

Released 2026-10-05.

Added

• Added support for deriving Arbitrary for types with raw identifiers.

Changed

• Updated derive_arbitrary to syn 3. This raises the MSRV from 1.63.0 to 1.71.0, which is the MSRV of syn 3.

Fixed

• Fixed soundness when generating arrays.
• Fixed nonzero integer generation to always produce a nonzero value.
• Updated derive_arbitrary to include fixes for fully qualified paths.

---

Commits

• 9807b59 Merge pull request #243 from fitzgen/bump-to-1.5.0
• 7a49e61 Bump to version 1.5.0
• aa2802b Merge pull request #242 from drakeo338/claude/241-fix
• a9f7ca5 Update derive_arbitrary to syn 3 and raise MSRV to 1.71
• cd35bd2 Merge pull request #239 from Manishearth/fix-soundness
• 53a651d agent-driven: Fix soundness in try_create_array
• df8afe9 Merge pull request #238 from baloo/baloo/push-lopsmyosqnpv
• 15f5c08 Bring fix for fully qualified path
• 341a8fd Merge pull request #237 from ngildenhuys/downgrading_msrv_deps
• 9b68ef4 ci: adding update commands to downgrade dependencies to fix MSRV test
• Additional commits viewable in compare view

Updates syn from 2.0.119 to 3.0.6

Release notes

Sourced from syn's releases.

3.0.6

• Fix parsing interpolated lifetime at statement start (#2082)

3.0.5

• Report correct span for lex errors from LitStr::parse_with (#2080, thanks @​sunshowers)

3.0.4

• Allow safe fn in impl Parse for ForeignItemFn (#2078)

3.0.3

• Documentation improvements

3.0.2

• Add Error::new_range(start..end, "msg") (#2068, #2070)
• Add Cursor::prev_span

3.0.1

• Parse const traits (#2056, #2057, #2058, #2063, #2064)
• Parse unsafe binder types (#2065)
• Parse impl restrictions (#2066)

3.0.0

This release contains adjustments to the syntax tree to account for ongoing Rust language development from the 3 years since syn 2.0.0 and to anticipate some in-flight Rust language RFCs.

These include: default values in fields, pinned type sugar, raw lifetimes, generator blocks and functions, unnamed enum variants, attributes in tuple types and tuple patterns, named arguments in parenthesized generic argument lists, lightweight clones, const traits, const function pointers, mutability restricted fields, supertrait auto implementation, final associated functions, trait implementability restrictions, const blocks in path arguments, item-level const blocks, return type notation, never patterns, function delegation, mutable by-reference bindings, in-place initialization, field projections, explicitly dyn-compatible traits, view types, file-level frontmatter, generic const arguments, guard patterns, lazy type aliases, explicitly safe foreign items, super let, unsafe fields, pattern types, heterogeneous try-blocks, function contracts, async function trait bounds, static closure coroutine syntax, unsafe binder types, move expressions, for-await loops, and postfix keywords.

Breaking changes

Modifiers

To reserve more room for language evolution, there are 10 new non-exhaustive structs in the syntax tree having the following commonality:

• Name ending in Modifiers. {BlockModifiers, ClosureModifiers, ConstModifiers, FieldModifiers, FnModifiers, ImplModifiers, LocalModifiers, TraitBoundModifiers, TraitModifiers, TypeModifiers}

• Each implements Default. The default value is guaranteed to comprise no tokens.

• Non-exhaustive. Can only be instantiated by Syn's parser or by creating and then mutating ▁▁Modifiers::default().

• Does not implement Parse. When parsing, they are parsed by the enclosing syntax tree node.

• Does not implement ToTokens. In some cases the syntax that these nodes might hold in the future is not necessarily contiguous tokens.

• Provides .require_empty() -> Result<()> which returns a meaningfully spanned error if the modifiers are different from the empty default. This enables a caller to reject syntax it does not recognize without knowing what that syntax may be.

Types

... (truncated)

Commits

• 559cab5 Release 3.0.6
• 9088cad Merge pull request #2082 from dtolnay/lifetimevar
• 3eb43bb Fix parsing interpolated lifetime at statement start
• 7b2f6f9 Add regression test for issue 2081
• d55bcd2 Update test suite to nightly-2026-09-13
• 8e37bca Resolve non_kebab_case_bins warning
• 4dfd88f Update test suite to nightly-2026-09-06
• e0ad92d Release 3.0.5
• 74e7d75 Merge pull request #2080 from sunshowers/lit-str-span
• 4c264f3 In LitStr::parse_with, report correct span for lex errors
• Additional commits viewable in compare view

Updates ctutils from 0.4.2 to 0.4.3

Commits

• 3c5aa70 ctutils v0.4.3 (#1550)
• 6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
• 29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
• f09945d ci: allow triggering workflows manually (#1543)
• 53493df dit v0.0.1-alpha (#1540)
• c89949d Rename aarch64-dit to dit (#1539)
• 7b85b1b zeroize: tweak proxy allocator test (#1538)
• cfe22d1 zeroize: remove internal use of optimization_barrier (#1535)
• 398d0eb cpufeatures: add Speculation Barrier (SB) support for AArch64 (#1536)
• 98d49ed zeroize: avoid double-zeroizing Vec's initialized elements (#1525)
• Additional commits viewable in compare view

Updates bit-set from 0.8.0 to 0.11.1

Changelog

Sourced from bit-set's changelog.

Version 0.11.0 (TO BE RELEASED)

Version 0.10.1

• indexing into a BitVec has simpler codegen (contain-rs/bit-vec#153)

Version 0.10.0 (VULNERABILITY FIX)

• fixed a soundness issue where deserializeing from an untrusted source could make fn get_unchecked perform undefined behavior, and could make other functions return incorrect results
• removed nanoserde support
• moved all the crates into a workspace

Version 0.9.1

• Fixed issue with the serde feature

Version 0.9.0

• Minimal Supported Rust Version is now 1.82
• fn remove is implemented
• fn fill is implemented
• fn remove_all is implemented
• fn clear is deprecated. Please use .fill(false) instead!
• fn push_within_capacity is implemented
• bug fix: .skip(n) on our iterators is now O(1) instead of O(n) time
• fn to_bytes is optimized with a lookup table
• some clippy lints are enabled
• nanoserde version is now 0.2

Commits

• See full diff in compare view

Updates bit-vec from 0.8.0 to 0.10.1

Changelog

Sourced from bit-vec's changelog.

Version 0.10.1

• indexing into a BitVec has simpler codegen (contain-rs/bit-vec#153)

Version 0.10.0 (VULNERABILITY FIX)

• fixed a soundness issue where deserializeing from an untrusted source could make fn get_unchecked perform undefined behavior, and could make other functions return incorrect results
• removed nanoserde support
• moved all the crates into a workspace

Version 0.9.1

• Fixed issue with the serde feature

Version 0.9.0

• Minimal Supported Rust Version is now 1.82
• fn remove is implemented
• fn fill is implemented
• fn remove_all is implemented
• fn clear is deprecated. Please use .fill(false) instead!
• fn push_within_capacity is implemented
• bug fix: .skip(n) on our iterators is now O(1) instead of O(n) time
• fn to_bytes is optimized with a lookup table
• some clippy lints are enabled
• nanoserde version is now 0.2

Commits

• See full diff in compare view

Updates either from 1.18.0 to 1.19.0

Changelog

Sourced from either's changelog.

• 1.19.0 - 2026-10-06
  • Add is_left_or and is_right_or, by @​A4-Tacks (#145)
  • Add #[inline] to fold functions, by @​joshtriplett (#147)

Commits

• 1e4326d Merge pull request #148 from cuviper/release-1.19.0
• 5278988 Release 1.19.0
• 44a0670 Merge pull request #147 from joshtriplett/either-fold-inline
• ecabe24 Add #[inline] to fold functions
• 50d4708 Merge pull request #145 from A4-Tacks/is-or
• f9cbdd3 feat: Add is_left_or and is_right_or
• See full diff in compare view

Updates r-efi from 5.3.0 to 6.0.0

Release notes

Sourced from r-efi's releases.

r-efi-6.0.0

# r-efi - UEFI Reference Specification Protocol Constants and Definitions
CHANGES WITH 6.0.0:
* Change all function prototypes to use `unsafe fn`. This is a major
  change, but reflects what all downstream users have already assumed.


Drop the obsolete efiapi and examples feature flags. The former

was unused, and the latter is an alias for native.


The eficall!{} macro is now fully inline in all of r-efi. It is

still provided for external users, but will no longer be used by

r-efi. All users are recommended to use extern "efiapi" directly.


Contributions from: Alan Egerton, David Rheinsberg

Dußlingen, 2026-02-03

Changelog

Sourced from r-efi's changelog.

CHANGES WITH 6.0.0:

    * Change all function prototypes to use `unsafe fn`. This is a major
      change, but reflects what all downstream users have already assumed.
* Drop the obsolete `efiapi` and `examples` feature flags. The former
  was unused, and the latter is an alias for `native`.

The eficall!{} macro is now fully inline in all of r-efi. It is

still provided for external users, but will no longer be used by

r-efi. All users are recommended to use extern "efiapi" directly.

Contributions from: Alan Egerton, David Rheinsberg

Dußlingen, 2026-02-03

Commits

• 7e1b032 r-efi: prepare v6.0.0
• 96504bb r-efi: inline eficall!{}
• ea21433 build: drop unused feature flags
• 48b1a11 r-efi: extend the transpose guidelines
• e701536 build: synchronize AUTHORS
• 6f2330e r-efi: update remaining prototypes to unsafe fn
• 60793e0 Fix signatures of most EFI functions to be unsafe
• See full diff in compare view

Updates rand_xorshift from 0.4.0 to 0.5.0

Commits

• See full diff in compare view

Updates serde_spanned from 1.1.1 to 1.1.2

Commits

• f72038c chore: Release
• 1ae5851 docs: Update changelog
• 40edb38 perf(parser): Improve pre-allocation estimate (#1241)
• 23ba129 perf(parser): Improve pre-allocation estimate
• 9750f43 chore(deps): Update Rust Stable to v1.99 (#1227)
• 66cdc5e style: Make clippy happy
• 8ab3cc9 chore(deps): Update Rust Stable to v1.99
• 08ef261 bench: Include tokio's published manifest (#1232)
• 7054f9e bench: Include tokio's published manifest
• 3423628 chore(deps): Update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.1 (...
• Additional commits viewable in compare view

Updates toml_datetime from 1.1.1+spec-1.1.0 to 1.1.2+spec-1.1.0

Commits

• f72038c chore: Release
• 1ae5851 docs: Update changelog
• 40edb38 perf(parser): Improve pre-allocation estimate (#1241)
• 23ba129 perf(parser): Improve pre-allocation estimate
• 9750f43 chore(deps): Update Rust Stable to v1.99 (#1227)
• 66cdc5e style: Make clippy happy
• 8ab3cc9 chore(deps): Update Rust Stable to v1.99
• 08ef261 bench: Include tokio's published manifest (#1232)
• 7054f9e bench: Include tokio's published manifest
• 3423628 chore(deps): Update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.1 (...
• Additional commits viewable in compare view

Updates toml_parser from 1.1.3+spec-1.1.0 to 1.1.5+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

Updates toml_writer from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

• f72038c chore: Release
• 1ae5851 docs: Update changelog
• 40edb38 perf(parser): Improve pre-allocation estimate (#1241)
• 23ba129 perf(parser): Improve pre-allocation estimate
• 9750f43 chore(deps): Update Rust Stable to v1.99 (#1227)
• 66cdc5e style: Make clippy happy
• 8ab3cc9 chore(deps): Update Rust Stable to v1.99
• 08ef261 bench: Include tokio's published manifest (#1232)
• 7054f9e bench: Include tokio's published manifest
• 3423628 chore(deps): Update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.1 (...
• Additional commits viewable in compare view

Updates zerocopy from 0.8.60 to 0.8.62

Release notes

Sourced from zerocopy's releases.

v0.8.62

What's Changed

• Add codegen tests and documentation for Ref; gate too-slow Kani harness by @​jswrenn in google/zerocopy#3791
• Preserve Ref pointer metadata by @​joshlf in google/zerocopy#3626
• Guard nightly-only Miri code with #[cfg(all(miri, test))] by @​joshlf in google/zerocopy#3802

Full Changelog: google/zerocopy@v0.8.61...v0.8.62

v0.8.61

What's Changed

• Fix Kani builds without derive and release 0.8.61 by @​joshlf in google/zerocopy#3793

Full Changelog: google/zerocopy@v0.8.60...v0.8.61

Commits

• dcb8149 Release 0.8.62 (#3803)
• c428c33 Guard nightly-only Miri code with #[cfg(all(miri, test))] (#3802)
• 12f746d Preserve Ref pointer metadata (#3626)
• 6b00ca0 Add codegen tests and documentation for Ref; gate too-slow Kani harness (#3...
• 7bbce8d Fix Kani builds without derive and release 0.8.61 (#3793)
• See full diff in compare view

Updates zerocopy-derive from 0.8.60 to 0.8.63

Release notes

Sourced from zerocopy-derive's releases.

v0.8.63

What's Changed

• [anneal][v1] Optimize SHA-2 in development and test builds by @​joshlf in google/zerocopy#3813
• Bump the cargo group across 3 directories with 1 update by @​dependabot[bot] in google/zerocopy#3796
• [anneal] Build Intel Mac artifacts with Rosetta by @​joshlf in google/zerocopy#3853
• [ci] Check packaged licenses by @​neonjava in google/zerocopy#3857
• Release 0.8.63 with packaged SPDX header checks by @​joshlf in google/zerocopy#3859

New Contributors

• @​neonjava made their first contribution in google/zerocopy#3857

Full Changelog: google/zerocopy@v0.8.62...v0.8.63

v0.8.62

What's Changed

• Add codegen tests and documentation for Ref; gate too-slow Kani harness by @​jswrenn in google/zerocopy#3791
• Preserve Ref pointer metadata by @​joshlf in google/zerocopy#3626
• Guard nightly-only Miri code with #[cfg(all(miri, test))] by @​joshlf in google/zerocopy#3802

Full Changelog: google/zerocopy@v0.8.61...v0.8.62

v0.8.61

What's Changed

• Fix Kani builds without derive and release 0.8.61 by @​joshlf in google/zerocopy#3793

Full Changelog: google/zerocopy@v0.8.60...v0.8.61

Commits

• c55af49 Release 0.8.63 with packaged SPDX header checks (#3859)
• 4492265 [ci] Check packaged licenses (#3857)
• 28fbee8 [CI] Bump the all-actions group with 6 updates (#3856)
• f7ec49b [anneal] Build Intel Mac artifacts with Rosetta (#3853)
• d51a14e Bump the cargo group across 3 directories with 1 update (#3796)
• 5bc5ede [anneal][v1] Optimize SHA-2 in development and test builds (#3813)
• dcb8149 Release 0.8.62 (#3803)
• c428c33 Guard nightly-only Miri code with #[cfg(all(miri, test))] (#3802)
• 12f746d Preserve Ref pointer metadata (#3626)
• 6b00ca0 Add codegen tests and documentation for Ref; gate too-slow Kani harness (#3...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions