Skip to content

chore(deps): bump the cargo-dependencies group across 1 directory with 12 updates - #4232

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-fc280c8ba0
Open

chore(deps): bump the cargo-dependencies group across 1 directory with 12 updates#4232
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-fc280c8ba0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the cargo-dependencies group with 12 updates in the / directory:

Package From To
log 0.4.34 0.4.35
crc32fast 1.5.3 1.5.5
quick-xml 0.41.0 0.42.0
moxcms 0.9.1 0.9.2
candle-core 0.9.2 0.11.1
candle-nn 0.9.2 0.11.1
rfd 0.17.2 0.18.0
harfrust 0.13.3 0.15.0
rustls-rustcrypto 0.0.2-alpha 0.1.0-pre.0
webpki-roots 1.0.10 1.0.12
flate2 1.1.10 1.1.11
brotli 9.0.0 9.1.1

Updates log from 0.4.34 to 0.4.35

Release notes

Sourced from log's releases.

v0.4.35

This release doesn't include source changes. It verifies log's new CI/CD processes.

Other

  • rework CI/CD to align with Rust project standards
Changelog

Sourced from log's changelog.

0.4.35 - 2026-10-30

This release doesn't include source changes. It verifies log's new CI/CD processes.

Other

  • rework CI/CD to align with Rust project standards
Commits
  • a46450b Update CHANGELOG.md
  • a715f17 chore: release v0.4.35
  • b4e2b12 Merge pull request #747 from rust-lang/chore/release-plz-mgnt
  • 6b490b6 run fmt
  • 2c7fd52 simplify some crate release tasks for easier automation
  • 5bc5545 Merge pull request #745 from marcoienibot/release-plz-disable-semver-check
  • 4234b8c Disable release-plz semver check
  • 95918ff Merge pull request #744 from Kobzol/trusted-publishing
  • e7ed747 Fix Zizmor lints
  • e87a3c6 Setup trusted publishing
  • Additional commits viewable in compare view

Updates crc32fast from 1.5.3 to 1.5.5

Commits
  • 8a93d2a Release 1.5.5
  • f81fd96 CI: check the aarch64 target at the MSRV and on 1.80 (#80)
  • 0b0c895 CI: check aarch64 kernel detection on known runners (#79)
  • 548781c aarch64: fold with PMULL from 64 bytes (#78)
  • 118796a Release 1.5.4
  • 3400e3b aarch64: merge the 3-way streams with precomputed shift tables (#76)
  • b9e3b49 aarch64: read words without align_to (#74)
  • 6b9d674 baseline: fold 8- and 4-byte tails with the slicing tables (#72)
  • 7bfe6b1 Bounds-check the x86 SIMD loads (#73)
  • c963d3d Deny unsafe code outside the SIMD backends (#75)
  • Additional commits viewable in compare view

Updates quick-xml from 0.41.0 to 0.42.0

Release notes

Sourced from quick-xml's releases.

v0.42.0 - String Ergonomics

What's Changed

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

  • #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
  • #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
  • #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
  • #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
  • #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
  • #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
  • #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
  • #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
  • #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
  • #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

  • #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
  • #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
  • #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
  • #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
  • #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
  • #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
  • #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
  • #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
  • #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
  • #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.
  • #1000: DeError::UnexpectedStart renamed to DeError::MixedContent. That error is emitted when you try to deserialize boolean, number or string field from something like <field>text <tag/> another text</field>.

... (truncated)

Commits
  • 36a2c52 Release 0.42.0
  • a4b9fca cargo fmt
  • 22c99f5 Update Rust Edition to 2024
  • 83351fb Add rename = $value to a table in serde example comments
  • f4db767 Clarify documentation about lifetimes of the events and attributes
  • 9f4c66a Fix formatting for correct assertions in read_nodes_serde
  • 6950ef7 Add GHA job to execute examples
  • dbf9e3f Show XML Decl tracking in examples
  • aab9452 Add writing a Decl event to the writer example
  • 1573e05 Avoid trim_text(true) in the in-depth examples
  • Additional commits viewable in compare view

Updates moxcms from 0.9.1 to 0.9.2

Release notes

Sourced from moxcms's releases.

0.9.2

What's Changed

New Contributors

Full Changelog: awxkee/moxcms@0.9.1...0.9.2

Commits
  • 7678ef7 Merge pull request #213 from awxkee/dev10_26
  • c6ab52f fixed d50 adaptation
  • d273f95 fix f32 clipping
  • e06854b Merge pull request #212 from awxkee/dev10_26
  • 12cca2e bump version
  • 8410444 Merge pull request #211 from lilith/heap-lookup-tables
  • a08c6f2 ci: run the qemu isolated jobs on ubuntu-24.04
  • 6279765 fix: build large lookup tables on the heap
  • 097dccf Merge pull request #201 from marcbachmann/lut8-lab-encoding
  • 4c8bef3 Simplify the 4-ink grid made by planes
  • Additional commits viewable in compare view

Updates candle-core from 0.9.2 to 0.11.1

Commits

Updates candle-nn from 0.9.2 to 0.11.1

Commits

Updates rfd from 0.17.2 to 0.18.0

Release notes

Sourced from rfd's releases.

0.18.0

What's Changed

New Contributors

Full Changelog: PolyMeilex/rfd@0.17.2...0.18.0

Changelog

Sourced from rfd's changelog.

0.18.0

  • Fix some GTK3 memory leaks
  • Add GTK4 backend behind the gtk4 feature
  • MSRV is now 1.92
  • Fix macOS file dialogs ignoring set_directory when set_file_name is also used.
  • Add FileDialog::set_show_hidden_files and AsyncFileDialog::set_show_hidden_files to control hidden file visibility. Supported on macOS, Windows, and Linux (GTK3).
  • Honor FileDialog::set_directory and AsyncFileDialog::set_directory when using the zenity fallback backend on Linux.
  • Fix liblary typo in docs
  • Change wasm title to sanitize text contents via title_el.set_text_content() rather than title_el.set_inner_html().
  • Set wasm dialog styles via set_text_content() rather than set_inner_html(), so rfd no longer uses innerHTML.
  • Fix GTK3 message dialogs using the description as a printf format string, which garbled text containing % and could crash. The description is now shown as given, so %% is no longer shown as %.
  • Support files without an extension in GTK3 and zenity filters, as the XDG portal backend does since #215. A match-all filter ("*") or an empty one ("") now uses the glob "*", not "*.*" or "*.", so a filter such as "All files" matches a name with no dot, like README.
  • Zenity now returns correct paths when a name contains |. Also file names that start or end with a space are kept intact.
Commits
  • 2d35d7d Merge pull request #364 from PolyMeilex/version-bump-0.18
  • c88f6e0 chore: Version bump 0.18.0
  • 66e966f Merge pull request #359 from PolyMeilex/solaris
  • 11f3656 chore: Alias the unixlike cfg
  • 7da8075 chore: Add solaris and illumos as unix-like systems
  • 73b3afe Merge pull request #357 from atouchet/dp
  • a01acfe Use latest version for Deps.rs badge
  • 98d6cf2 Merge pull request #351 from PolyMeilex/gtk3-fix-some-ubs
  • 4b7630a gtk3: Fix g_lists memory leaks
  • 594e5ba Merge pull request #350 from PolyMeilex/manual-gtk-tests
  • Additional commits viewable in compare view

Updates harfrust from 0.13.3 to 0.15.0

Release notes

Sourced from harfrust's releases.

0.15.0

This release matches HarfBuzz v15.0.0, and has an MSRV (minimum supported Rust version) of 1.85.

Breaking changes

  • Update read-fonts to 0.46. Font and the rest of the font model that HarfRust re-exports come from that release.
  • ShapePlanKey::new borrows the font for the lifetime of the key. A plan built for a font with lookup variations matches only keys at the same location.

Added

  • Shape fonts with more than 65,535 glyphs, as specified by ISO/IEC 14496-22:2026: GSUB and GPOS 1.2, GDEF 1.4, the 24-bit coverage and class definition formats, and the extended format of every lookup subtable.
  • Apply FeatureVariations 1.1 lookup variations.
  • Select feature variations at the default location, whose zero coordinates can satisfy a condition.
  • Add opt-in tracing support with Buffer::set_message_function callbacks and hr-shape --trace output, including intermediate Unicode and glyph contents. Tracing also works without std and compiles out when disabled.
  • Extend the C API with subsetting backed by Skera (the subset feature), glyph drawing and painting backed by Skrifa (draw and paint), HarfBuzz C++ ownership helpers, MATH and baseline queries, the set and map APIs, OpenType tag conversion, glyph collection for sets and lookups, face metadata and table enumeration, UTF-16 and Latin-1 buffer input, and batched nominal glyph callbacks.

Changed

  • Parse each lookup once per font and keep it, with the font's GSUB, GPOS, GDEF and AAT tables, alongside the font data. Creating a ShaperFont reads no tables.
  • Keep parsed morx, mort, kern and kerx subtables with the font's tables, and build each AAT table's cache when it is first applied. AAT shaping is 5 to 13% faster.
  • Bound the preprocessing of a font's lookups by work and memory budgets that scale with the size of its layout tables and are shared by GSUB, GPOS and GDEF. Long contextual coverage arrays are read on demand.
  • Reduce code size by replacing the standard library sorts with small heap and insertion sorts, sharing AAT class-set collection, and returning Option from buffer lookups instead of panicking.

Fixed

  • Reject GSUB/GPOS lookups with an out-of-range lookupType instead of truncating it to u8. A malformed font could have e.g. type 3586 dispatched as MultipleSubst, expanding a single character into thousands of glyphs and costing up to a second per shape call. HarfBuzz rejects such tables.

... (truncated)

Changelog

Sourced from harfrust's changelog.

[0.15.0] - 2026-10-21

This release matches HarfBuzz v15.0.0, and has an MSRV (minimum supported Rust version) of 1.85.

Breaking changes

  • Update read-fonts to 0.46. Font and the rest of the font model that HarfRust re-exports come from that release.
  • ShapePlanKey::new borrows the font for the lifetime of the key. A plan built for a font with lookup variations matches only keys at the same location.

Added

  • Shape fonts with more than 65,535 glyphs, as specified by ISO/IEC 14496-22:2026: GSUB and GPOS 1.2, GDEF 1.4, the 24-bit coverage and class definition formats, and the extended format of every lookup subtable.
  • Apply FeatureVariations 1.1 lookup variations.
  • Select feature variations at the default location, whose zero coordinates can satisfy a condition.
  • Add opt-in tracing support with Buffer::set_message_function callbacks and hr-shape --trace output, including intermediate Unicode and glyph contents. Tracing also works without std and compiles out when disabled.
  • Extend the C API with subsetting backed by Skera (the subset feature), glyph drawing and painting backed by Skrifa (draw and paint), HarfBuzz C++ ownership helpers, MATH and baseline queries, the set and map APIs, OpenType tag conversion, glyph collection for sets and lookups, face metadata and table enumeration, UTF-16 and Latin-1 buffer input, and batched nominal glyph callbacks.

Changed

  • Parse each lookup once per font and keep it, with the font's GSUB, GPOS, GDEF and AAT tables, alongside the font data. Creating a ShaperFont reads no tables.
  • Keep parsed morx, mort, kern and kerx subtables with the font's tables, and build each AAT table's cache when it is first applied. AAT shaping is 5 to 13% faster.
  • Bound the preprocessing of a font's lookups by work and memory budgets that scale with the size of its layout tables and are shared by GSUB, GPOS and GDEF. Long contextual coverage arrays are read on demand.
  • Reduce code size by replacing the standard library sorts with small heap and insertion sorts, sharing AAT class-set collection, and returning Option from buffer lookups instead of panicking.

Fixed

  • Reject GSUB/GPOS lookups with an out-of-range lookupType instead of truncating it to u8. A malformed font could have e.g. type 3586 dispatched

... (truncated)

Commits
  • 71d9651 Release 0.15.0 (#564)
  • ae198ac Fix clippy without the tracing feature, and lint that build in CI (#563)
  • 9959177 Merge pull request #542 from harfbuzz/feat/beyond-64k
  • 88d8525 [ot] Charge boxed subtable payloads to the preprocessing budget
  • f32b9c1 [aat] Keep deleted glyphs in the buffer accelerators
  • fbdb8b5 [aat] Keep parsed subtables with the font's tables
  • 6b7e16e [tests] Regenerate shaping tests from HarfBuzz main
  • 10b4a42 Apply lookup variations, with feature variations from read-fonts
  • 8001cea Support beyond-64K fonts with read-fonts 0.46
  • dfa9693 [shape] Select feature variations at the default location (#560)
  • Additional commits viewable in compare view

Updates rustls-rustcrypto from 0.0.2-alpha to 0.1.0-pre.0

Commits
  • 8daa028 v0.1.0-pre.0
  • 2a27dd1 chore: bump rsa from 0.10.0-rc.22 to 0.10.0 (#336)
  • e5f669f fix(deps): Update MSRV to 1.87 and migrate to Edition 2024 (#305)
  • bece600 chore(deps): bump the validation-deps group across 1 directory with 24 update...
  • 70f76c0 chore(deps): bump the validation-deps group across 1 directory with 4 updates...
  • cb967bd chore(deps): bump the validation-deps group across 1 directory with 15 update...
  • 7b44a2d chore(deps): bump the root-deps group across 1 directory with 3 updates (#271)
  • 3d5e87f Bump *-dalek and p384 crates from prerelease to stable (#261)
  • c1de5bc chore(deps): bump the validation-deps group across 1 directory with 11 update...
  • a2f5396 chore(deps): Bump some RustCrypto crates from release candidate to stable (#258)
  • Additional commits viewable in compare view

Updates webpki-roots from 1.0.10 to 1.0.12

Release notes

Sourced from webpki-roots's releases.

1.0.12

What's Changed

Full Changelog: rustls/webpki-roots@v/1.0.11...v/1.0.12

1.0.11

Track CCADB removal of further eMudhra CAs: "emSign Root CA - C1" and "emSign ECC Root CA - C3": https://bugzilla.mozilla.org/show_bug.cgi?id=2083709

What's Changed

New Contributors

Full Changelog: rustls/webpki-roots@v/1.0.10...v/1.0.11

Commits

Updates flate2 from 1.1.10 to 1.1.11

Release notes

Sourced from flate2's releases.

v1.1.11

Fixed

  • fixup! Complete sync flushes across output buffer boundaries (#581)
  • Separate gzip header reads from compressed data
  • Defer gzip input errors without losing read progress
  • Preserve gzip header progress on input read errors (#571)

Other

  • Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
  • Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
  • Merge pull request #577 from rust-lang/fix-loop
  • Setup trusted publishing for the flate2 crate
  • Complete sync flushes across output buffer boundaries (#581)
  • Fix "can by extended" typos in deflate and zlib write docs
  • Merge pull request #579 from NUAAwqy/docs/fix-double-space
  • Fix double space in read module doc comment
  • Add missing preposition in README description
  • Cover decoder retries across the output buffer boundary
  • Drain output before refilling the buffer
  • Clarify partial-write buffering behavior
  • Avoid shifting buffered output on partial writes
  • Merge pull request #567 from ndossche/more-asserts
  • Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
  • Fix encoder writes hanging after try_finish (#576)
  • Avoid panicking when dropping unfinished compressors
  • Merge pull request #565 from HDauven/zlib-rs-uninit-output
  • still allow resetting incomplete write decoders
  • Assert return result of reset calls
  • Reject incomplete streams in write decoders
  • Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
  • review
  • Reject incomplete streams when finishing write-side decoders
  • Preserve window size and gzip mode across Decompress::reset
  • preserve runtime detection in backend examples (#570)
  • Make miniz_oxide dictionary clearing explicit on reset
  • Harden miniz_oxide decompressor reset
  • Deduplicate zlib-rs flush conversions
  • Use native zlib-rs uninitialized output
Changelog

Sourced from flate2's changelog.

1.1.11 - 2026-11-06

Fixed

  • fixup! Complete sync flushes across output buffer boundaries (#581)
  • Separate gzip header reads from compressed data
  • Defer gzip input errors without losing read progress
  • Preserve gzip header progress on input read errors (#571)

Other

  • Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
  • Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
  • Merge pull request #577 from rust-lang/fix-loop
  • Setup trusted publishing for the flate2 crate
  • Complete sync flushes across output buffer boundaries (#581)
  • Fix "can by extended" typos in deflate and zlib write docs
  • Merge pull request #579 from NUAAwqy/docs/fix-double-space
  • Fix double space in read module doc comment
  • Add missing preposition in README description
  • Cover decoder retries across the output buffer boundary
  • Drain output before refilling the buffer
  • Clarify partial-write buffering behavior
  • Avoid shifting buffered output on partial writes
  • Merge pull request #567 from ndossche/more-asserts
  • Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
  • Fix encoder writes hanging after try_finish (#576)
  • Avoid panicking when dropping unfinished compressors
  • Merge pull request #565 from HDauven/zlib-rs-uninit-output
  • still allow resetting incomplete write decoders
  • Assert return result of reset calls
  • Reject incomplete streams in write decoders
  • Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
  • review
  • Reject incomplete streams when finishing write-side decoders
  • Preserve window size and gzip mode across Decompress::reset
  • preserve runtime detection in backend examples (#570)
  • Make miniz_oxide dictionary clearing explicit on reset
  • Harden miniz_oxide decompressor reset
  • Deduplicate zlib-rs flush conversions
  • Use native zlib-rs uninitialized output
Commits
  • cd06529 chore: release v1.1.11
  • 6ff4098 Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
  • 5f68913 Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
  • 5582d95 fixup! Complete sync flushes across output buffer boundaries (#581)
  • d05c7c4 Merge pull request #577 from rust-lang/fix-loop
  • 5c7ee7a Merge pull request #583 from Kobzol/trusted-publishing
  • cc527c6 Setup trusted publishing for the flate2 crate
  • 54f49cd Merge pull request #580 from NUAAwqy/fix/can-by-extended-typo
  • 491df15 Complete sync flushes across output buffer boundaries (#581)
  • a7a1161 Fix "can by extended" typos in deflate and zlib write docs
  • Additional commits viewable in compare view

Updates brotli from 9.0.0 to 9.1.1

Commits
  • a3cb931 release 9.1.1
  • b47cb22 Refactor into a more legible reader
  • e0efe1c BroCatli: hold back trailing header bytes and handle short and chunked streams
  • afa8585 BroCatli: keep both header bytes when an empty stream straddles a byte boundary
  • e951e7e brotli CLI: accept -bare and -bytealign with -catable, exit 1 when rejected
  • c550341 Fix index out of bounds under the disallow_large_window_size feature
  • 73e6947 Release 9.1.0
  • 73766fc Forward portable float from the C FFI crate
  • 6518a4e fix: correct BroCatli empty-stream concatenation for small windows
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Nov 14, 2026
@dependabot
chore(deps): bump the cargo-dependencies group across 1 directory wit…
ed65d19 
…h 12 updates

Bumps the cargo-dependencies group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [log](https://github.com/rust-lang/log) | `0.4.34` | `0.4.35` |
| [crc32fast](https://github.com/srijs/rust-crc32fast) | `1.5.3` | `1.5.5` |
| [quick-xml](https://github.com/tafia/quick-xml) | `0.41.0` | `0.42.0` |
| [moxcms](https://github.com/awxkee/moxcms) | `0.9.1` | `0.9.2` |
| [candle-core](https://github.com/huggingface/candle) | `0.9.2` | `0.11.1` |
| [candle-nn](https://github.com/huggingface/candle) | `0.9.2` | `0.11.1` |
| [rfd](https://github.com/PolyMeilex/rfd) | `0.17.2` | `0.18.0` |
| [harfrust](https://github.com/harfbuzz/harfrust) | `0.13.3` | `0.15.0` |
| [rustls-rustcrypto](https://github.com/RustCrypto/rustls-rustcrypto) | `0.0.2-alpha` | `0.1.0-pre.0` |
| [webpki-roots](https://github.com/rustls/webpki-roots) | `1.0.10` | `1.0.12` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.10` | `1.1.11` |
| [brotli](https://github.com/dropbox/rust-brotli) | `9.0.0` | `9.1.1` |



Updates `log` from 0.4.34 to 0.4.35
- [Release notes](https://github.com/rust-lang/log/releases)
- [Changelog](https://github.com/rust-lang/log/blob/main/CHANGELOG.md)
- [Commits](rust-lang/log@0.4.34...v0.4.35)

Updates `crc32fast` from 1.5.3 to 1.5.5
- [Commits](srijs/rust-crc32fast@v1.5.3...v1.5.5)

Updates `quick-xml` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/tafia/quick-xml/releases)
- [Changelog](https://github.com/tafia/quick-xml/blob/master/Changelog.md)
- [Commits](tafia/quick-xml@v0.41.0...v0.42.0)

Updates `moxcms` from 0.9.1 to 0.9.2
- [Release notes](https://github.com/awxkee/moxcms/releases)
- [Commits](awxkee/moxcms@0.9.1...0.9.2)

Updates `candle-core` from 0.9.2 to 0.11.1
- [Changelog](https://github.com/huggingface/candle/blob/main/CHANGELOG.md)
- [Commits](https://github.com/huggingface/candle/commits)

Updates `candle-nn` from 0.9.2 to 0.11.1
- [Changelog](https://github.com/huggingface/candle/blob/main/CHANGELOG.md)
- [Commits](https://github.com/huggingface/candle/commits)

Updates `rfd` from 0.17.2 to 0.18.0
- [Release notes](https://github.com/PolyMeilex/rfd/releases)
- [Changelog](https://github.com/PolyMeilex/rfd/blob/master/CHANGELOG.md)
- [Commits](PolyMeilex/rfd@0.17.2...0.18.0)

Updates `harfrust` from 0.13.3 to 0.15.0
- [Release notes](https://github.com/harfbuzz/harfrust/releases)
- [Changelog](https://github.com/harfbuzz/harfrust/blob/main/CHANGELOG.md)
- [Commits](harfbuzz/harfrust@0.13.3...0.15.0)

Updates `rustls-rustcrypto` from 0.0.2-alpha to 0.1.0-pre.0
- [Changelog](https://github.com/RustCrypto/rustls-rustcrypto/blob/master/CHANGELOG.md)
- [Commits](RustCrypto/rustls-rustcrypto@v0.0.2-alpha...v0.1.0-pre.0)

Updates `webpki-roots` from 1.0.10 to 1.0.12
- [Release notes](https://github.com/rustls/webpki-roots/releases)
- [Commits](rustls/webpki-roots@v/1.0.10...v/1.0.12)

Updates `flate2` from 1.1.10 to 1.1.11
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Changelog](https://github.com/rust-lang/flate2-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/flate2-rs@1.1.10...v1.1.11)

Updates `brotli` from 9.0.0 to 9.1.1
- [Release notes](https://github.com/dropbox/rust-brotli/releases)
- [Commits](dropbox/rust-brotli@9.0.0...9.1.1)

---
updated-dependencies:
- dependency-name: brotli
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: candle-core
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: candle-nn
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: crc32fast
  dependency-version: 1.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: flate2
  dependency-version: 1.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: harfrust
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: log
  dependency-version: 0.4.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: moxcms
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: quick-xml
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: rfd
  dependency-version: 0.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: rustls-rustcrypto
  dependency-version: 0.1.0-pre.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: webpki-roots
  dependency-version: 1.0.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-dependencies-fc280c8ba0 branch from 0d37d72 to ed65d19 Compare November 14, 2026 05:52

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants