Skip to content

deps: bump the rust-minor group across 1 directory with 10 updates - #23

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-minor-51348d816c
Open

deps: bump the rust-minor group across 1 directory with 10 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-minor-51348d816c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the rust-minor group with 10 updates in the / directory:

Package From To
chrono 0.4.44 0.4.45
clap 4.6.1 4.6.3
clap_complete 4.6.5 4.6.7
clap_complete_nushell 4.6.0 4.6.1
open 5.3.5 5.4.0
serde 1.0.228 1.0.229
serde_json 1.0.150 1.0.151
thiserror 2.0.18 2.0.19
tokio 1.52.3 1.53.1
uuid 1.23.1 1.24.0

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

Commits
  • 1703382 Prepare 0.4.45 release
  • 881f9ab tz_data: fix tzdata locations on Android
  • f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
  • c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
  • 120686c Bump codecov/codecov-action from 5 to 6
  • See full diff in compare view

Updates clap from 4.6.1 to 4.6.3

Release notes

Sourced from clap's releases.

v4.6.3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 7e0bcca chore: Release
  • 0f09905 docs: Update changelog
  • 9706951 Merge pull request #6353 from truffle-dev/feat-completer-arg-index
  • ac0d148 feat(complete): Index-aware ValueCompleter
  • 1565a3c test(complete): Cover indexed multi-value case
  • 48fc10a Merge pull request #6350 from stefankreutz/missing_docs
  • 7d4c353 docs: Hint at clippy's missing docs lint
  • f6a6701 chore(deps): Update Rust Stable to v1.95 (#6347)
  • ac5fda6 chore: Release
  • b73c627 docs: Update changelog
  • Additional commits viewable in compare view

Updates clap_complete from 4.6.5 to 4.6.7

Commits
  • d3e59a9 chore: Release
  • d997f87 docs: Update changelog
  • fb6058c Merge pull request #6409 from heaths/pwsh-support
  • 2310870 test(complete): Add tests for completer_for_path
  • 5967c17 refactor(complete): Move shell detection to Shells
  • 594602b fix(complete): Detect pwsh for PowerShell
  • 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
  • 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
  • c968b13 chore(deps): Update Rust crate shlex to v2
  • 8f247cb chore(deps): Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates clap_complete_nushell from 4.6.0 to 4.6.1

Release notes

Sourced from clap_complete_nushell's releases.

v4.6.1

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Changelog

Sourced from clap_complete_nushell's changelog.

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Commits
  • 0838e82 chore: Release
  • f8553c9 docs: Update changelog
  • 308f18b Merge pull request #6400 from Benjas333/fix/nushell_completions
  • 7dd8df1 fix(clap_complete_nushell): Disable gen last-args
  • e63b8ec test(clap_complete_nushell): Add last-args test
  • 67c5dfb chore: Release
  • 496398c docs: Update changelog
  • 1d302a9 Merge pull request #6441 from Its-Just-Nans/alias-singular
  • 8a93d4b feat: Display word alias as singular when unique
  • c7c3184 docs(contrib): Fix broken links
  • Additional commits viewable in compare view

Updates open from 5.3.5 to 5.4.0

Release notes

Sourced from open's releases.

v5.4.0

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.
  • 1 unique issue was worked on: #124

Commit Details

... (truncated)

Changelog

Sourced from open's changelog.

5.4.0 (2026-07-12)

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.

... (truncated)

Commits
  • b5c12bd Release open v5.4.0
  • bdc3397 Merge pull request #126 from Byron/fix-wsl
  • 7265cae fix: Align WSL PowerShell invocation with Windows
  • 407b058 Merge pull request #125 from Byron/open-with-dash-dash
  • fd29861 fix: prevent launcher option and shell injection (#124)
  • 7c19c0a feat: cargo run now shows the exact commands that were tried when opening.
  • cfb39d8 Release open v5.3.6
  • 41c4cf0 Merge pull request #123 from Byron/avoid-wslview
  • 44d1d41 fix: use PowerShell instead of wslview on WSL (#122)
  • See full diff in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • See full diff in compare view

Updates thiserror from 2.0.18 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

  • Update to syn 3
Commits
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
  • c50e387 chore: improve thiserror maintenance path
  • d4a2507 Raise minimum tested compiler to rust 1.85
  • 99e8a6c Unpin CI miri toolchain
  • 9ac165c Pin CI miri to nightly-2026-02-11
  • Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

  • signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

  • time: fix alt timer cancellation and insertion race (#8252)

Documented

  • runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

Updates uuid from 1.23.1 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

Commits
  • 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
  • e6db8ec prepare for 1.24.0 release
  • 606f236 Merge pull request #892 from weifanglab/main
  • ab848db feat(fmt): support encoding into MaybeUninit buffers
  • 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
  • 5a7dfe5 prepare for 1.23.5 release
  • 9b4bfc8 Merge pull request #894 from geeknoid/main
  • 5acc5a5 perf: Optimize UUID hex parsing and formatting
  • 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
  • 1e5d867 Merge pull request #891 from frostyplanet/doc
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the rust-minor group across 1 directory with 10 updates
9ac9377 
Bumps the rust-minor group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [chrono](https://github.com/chronotope/chrono) | `0.4.44` | `0.4.45` |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.3` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.6.5` | `4.6.7` |
| [clap_complete_nushell](https://github.com/clap-rs/clap) | `4.6.0` | `4.6.1` |
| [open](https://github.com/Byron/open-rs) | `5.3.5` | `5.4.0` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.19` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.1` | `1.24.0` |



Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.44...v0.4.45)

Updates `clap` from 4.6.1 to 4.6.3
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.3)

Updates `clap_complete` from 4.6.5 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.5...clap_complete-v4.6.7)

Updates `clap_complete_nushell` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete_nushell-v4.6.0...clap_complete_nushell-v4.6.1)

Updates `open` from 5.3.5 to 5.4.0
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.3.5...v5.4.0)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `thiserror` from 2.0.18 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.19)

Updates `tokio` from 1.52.3 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1)

Updates `uuid` from 1.23.1 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.1...v1.24.0)

---
updated-dependencies:
- dependency-name: chrono
  dependency-version: 0.4.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: clap
  dependency-version: 4.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: clap_complete
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: clap_complete_nushell
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: open
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-minor
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants