chore(deps): update rust crates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anyhow	workspace.dependencies	patch	1.0.102 → 1.0.104
assert_cmd	workspace.dependencies	patch	2.2.1 → 2.2.2
base64	workspace.dependencies	minor	0.22.1 → 0.23.0
camino	workspace.dependencies	patch	1.2.2 → 1.2.5
cargo (source)	workspace.dependencies	minor	0.96.0 → 0.99.0
chrono	workspace.dependencies	patch	0.4.44 → 0.4.45
clap	workspace.dependencies	patch	4.6.1 → 4.6.6
clap_complete	workspace.dependencies	patch	4.6.4 → 4.6.9
fs-err	workspace.dependencies	patch	3.3.0 → 3.3.1
git2	dependencies	minor	0.20.2 → 0.21.0
h2	workspace.dependencies	patch	0.4.14 → 0.4.19
http	workspace.dependencies	minor	1.4.0 → 1.5.0
ignore (source)	workspace.dependencies	patch	0.4.25 → 0.4.33
itertools	workspace.dependencies	minor	0.14.0 → 0.15.0
parse-changelog	workspace.dependencies	patch	0.6.16 → 0.6.17
rand (source)	workspace.dependencies	patch	0.10.1 → 0.10.2
regex	workspace.dependencies	minor	1.12.3 → 1.13.1
reqwest	workspace.dependencies	patch	0.13.3 → 0.13.4
reqwest-middleware	workspace.dependencies	patch	0.5.1 → 0.5.2
schemars (source)	workspace.dependencies	patch	1.2.1 → 1.2.2
serde (source)	workspace.dependencies	patch	1.0.228 → 1.0.229
serde_json	workspace.dependencies	patch	1.0.149 → 1.0.151
tokio (source)	workspace.dependencies	minor	1.52.3 → 1.53.1
toml	workspace.dependencies	patch	1.1.2+spec-1.1.0 → 1.1.4
toml_edit	workspace.dependencies	patch	0.25.11+spec-1.1.0 → 0.25.13

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

assert-rs/assert_cmd (assert_cmd)

v2.2.2

Compare Source

Fixes

• Ensure #[track_caller] works for better panic messages

marshallpierce/rust-base64 (base64)

v0.23.1

Compare Source

• Make the tests build again on non-SIMD architectures

v0.23.0

Compare Source

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best
  instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar
  GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime
  detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

camino-rs/camino (camino)

v1.2.5

Compare Source

Fixed

Removed unnecessary files from the package.

v1.2.4

Compare Source

Added

Methods to convert between Box<Utf8Path> and Box<Path>:

• From<Box<Utf8Path>> for Box<Path> (as of release, not documented due to rust-lang/rust#158466).
• Utf8Path::into_std_boxed_path(self: Box<Self>)
• Utf8Path::from_boxed_path(path: Box<Path>)
• TryFrom<Box<Path>> for Box<Utf8Path>

Thanks nicopap for your first contribution!

v1.2.3

Compare Source

Performance improvements

• Utf8Path::hash now delegates to std::path::Path::hash, resulting in hashing requiring ~2x fewer instructions. Thanks stormslowly for your first contribution!

rust-lang/cargo (cargo)

v0.99.0

Compare Source

v0.98.0

Compare Source

v0.97.2

Compare Source

v0.97.1

Compare Source

v0.97.0

Compare Source

chronotope/chrono (chrono)

v0.4.45: 0.4.45

Compare Source

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in #​1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in #​1789

clap-rs/clap (clap)

v4.6.6

Compare Source

Features

• Add Command::get_overridden_usage

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal

• Update to syn v3

v4.6.3

Compare Source

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes

• (help) Say alias when there is only one

andrewhickman/fs-err (fs-err)

v3.3.1

• Fix debug_tokio feature so it works as documented. (#​92)

rust-lang/git2-rs (git2)

v0.21.0

Compare Source

0.20.4...main

Added

• Added experimental SHA256 repository support behind the new unstable-sha256 Cargo feature,
  along with *_ext API variants that accept an ObjectFormat.
  #​1206
• Added opts::set_cache_max_size() and opts::get_cached_memory().
  #​1188
• Added Repository::object_format() and a new ObjectFormat enum.
  #​1204
• Added Repository::set_config().
  #​1208
• Added merge_file() along with MergeFileInput.
  #​1210
• Added Repository::refdb_compress() for packing loose refs.
  #​1221
• Added public Refdb type, along with Repository::refdb() and Repository::set_refdb(). Repository::refdb_compress() now delegates to Refdb::compress().
  #​1228
• Added Revspec::into_objects().
  #​1230
• Added BlameHunk::final_committer(), BlameHunk::orig_committer(), BlameHunk::summary(), and BlameHunk::summary_bytes().
  #​1231
• Implemented Clone for Reference.
  #​1233
• Added Repository::author_from_env() and Repository::committer_from_env().
  #​1237
• Added impl From<Utf8Error> for Error.
  #​1239

Changed

• ❗ The ssh, https, and cred Cargo features are no longer enabled by default.
  Previously default = ["ssh", "https"]; now default = [].
  Enable them explicitly if you rely on credential helpers or transport support.
  #​1168
• ❗ CredentialHelper and the url dependency are now gated behind the new cred Cargo feature.
  Enabling ssh or https transitively enables cred.
  #​1168
• ❗ Updated to the 2021 edition.
  #​1173
• ❗ Many string accessors that previously returned Option<&str>
  now return Result<&str, Error> or Result<Option<&str>, Error>,
  so callers can distinguish a missing value from a non-UTF-8 one.
  #​1241
• ❗ BlameHunk::final_signature, BlameHunk::final_committer, BlameHunk::orig_signature, and BlameHunk::orig_committer
  now return Option to avoid segfaults when signature information is missing.
  #​1254
• Bumped requirement to libgit2-sys 0.18.4, which updates libgit2 to 1.9.3.
  #​1242

Fixed

• Fixed MergeOptions::skip_reuc() to use the correct GIT_MERGE_SKIP_REUC flag.
  #​1194
• Repository::submodules() now returns an Error when the underlying git_submodule_lookup() call to libgit2 fails, rather than panicking with a failed assertion.
  #​1220
• Reference::is_valid_name() now propagates errors from CString conversion instead of panicking.
  #​1229
• Fixed Remote::list() to return an empty list instead of erroring
  when the remote advertises no refs.
  #​1250
• ReferenceNames now returns an Err for non-UTF-8 branch names instead of panicking.
  #​1239

Documentation

• Added note regarding potentially confusing behavior of git_checkout_head.
  #​1149
• Added comments describing the IndexAddOption flags.
  #​1163
• Updated README note about the ssh feature.
  #​1187
• Improved function docs for Repository::tag_foreach().
  #​1190
• Fixed doc comment typo in StatusOptions.
  #​1199
• Fixed missing period in module documentation.
  #​1219
• Small wording fix in Signature::from_raw_const() docs.
  #​1222
• Replaced discussion of missing gist in README.
  #​1223
• Documented the bitflag methods for checking flags.
  #​1224
• Clarified CheckoutBuilder::update_index() documentation.
  #​1232
• Added more missing documentation.
  #​1235
• Fixed typo in Repository::stash_save_ext() docs.
  #​1245
• Added example showing retrieval of the latest commit for a file.
  #​1243
• Replaced comma with period in CheckoutBuilder::refresh() docs.
  #​1252

Internals

• Dropped civet/conduit from dev-dependencies.
  #​1170
• Updated dependencies.
  #​1171
• Fixed lockfile verification in CI.
  #​1177
• Updated CI and documentation to cover feature combinations.
  #​1182
• Listed all examples that may need HTTP and SSH.
  #​1196
• Allowed publishing from any ref in the publish workflow.
  #​1198
• Bumped time from 0.3.41 to 0.3.47.
  #​1215
• Added end-to-end test for branch name on initialization.
  #​1244
• Added end-to-end test for stash count.
  #​1246
• Added end-to-end tests demonstrating use of Repository::statuses().
  #​1251
• Internal refactors preparing for experimental SHA256 OID support.
  #​1201
  #​1205

hyperium/h2 (h2)

v0.4.19

Compare Source

• Improve default (auto) small DATA frame budget based on configured connection window.

v0.4.18

Compare Source

• Add data_frame_budget(n) methods to client and server builders.

v0.4.17

Compare Source

• Fix limiting of excessive small DATA frames to ignore EOS frames.
• Fix HPACK encoding table to cap the max size to 4kb.

v0.4.16

Compare Source

• Fix limiting excessive amount of small DATA frames.
• Fix double counting pushed streams when receiving 1xx responses.
• Fix releasing of flow control capacity earlier, when RecvStream is dropped.
• Fix missed wakeup in poll_trailers.
• Fix extra memory retained when copying HeaderValues.
• Fix resets received after END_OF_STREAM to allow the data to still be received.
• Fix busy-looping when IO write returns 0 to mean connection closed.
• Optimize HPACK decoding tables from 4-bit states to 1-byte states.
• Optimize IO writing contention by not holding lock while flushing.

v0.4.15

Compare Source

• Fix closing a connection when header size is "way too large" (currently x4 configured limit).
• Fix overflow calculating padding length if a DATA frame had 255 bytes of padding.
• Fix ignoring library-initiated resets in the connection state loop.
• Fix decoding panic with an absurd amount of headers and no limit to now use try_append().
• Fix rejecting frames on streams whose HEADERS have not been sent.
• Fix poll_capacity() to not return Some(Ok(0)).
• Fix discarding of buffered DATA frames when a reset is scheduled.

hyperium/http (http)

v1.5.0

Compare Source

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

v1.4.2

Compare Source

• Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.
• Fix Uri to properly reject DEL characters.

v1.4.1

Compare Source

• Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.
• Fix Extend for HeaderMap to clamp max size hint and not overflow.
• Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.
• Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

BurntSushi/ripgrep (ignore)

v0.4.33

Compare Source

v0.4.32

Compare Source

v0.4.31

Compare Source

v0.4.30

Compare Source

v0.4.29

Compare Source

v0.4.28

Compare Source

v0.4.27

Compare Source

v0.4.26

Compare Source

rust-itertools/itertools (itertools)

v0.15.0

Compare Source

Breaking

• Restructure Position as struct instead of enum (#​1042, #​1043)
• Canonicalize all_equal_value's error type (#​1032)

Added

• Add *_with_hasher adaptors (#​1007)
• Add strip_prefix and strip_prefix_by methods (#​1104)

Changed

• Remove Clone bounds from tuple_combinations and array_combinations(#​1011)
• must_use for collect_vec (#​1009)
• Make izip! temporary friendly (#​1021)
• Add array_combinations_with_replacement (#​1033)
• Implement Debug for remaining public types (#​1038)
• Specialize ExactlyOneError::count (#​1046)
• Implement PeekingNext for more types, in particular vec::IntoIter (#​1059, #​1073)
• Fix PadUsing::next_back (#​1082)
• Introduce [circular_]array_windows, deprecate tuple_windows (#​1086)
• Deprecate tuple_combinations (replaced by array_combinations) (#​1085)

Notable Internal Changes

• Make into_group_map code more idiomatic (#​1027)
• Fix clippy lints (#​1017, #​1029, #​1076, #​1099)

taiki-e/parse-changelog (parse-changelog)

v0.6.17

Compare Source

• Support code block using four or more `.

• Support code block using ~.

rust-random/rand (rand)

v0.10.2

Compare Source

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#​1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#​1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#​1791)

rust-lang/regex (regex)

v1.13.1

Compare Source

===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#​1364 for (many) more details.

Bug fixes:

• #​1354:
  Fixes previously unsound reverse suffix and inner optimizations.

v1.13.0

Compare Source

===================
This release includes a new API, a regex! macro, for lazy compilation of
a regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:

use regex::regex;

fn is_match(line: &str) -> bool {
    // The regex will be compiled approximately once and reused automatically.
    // This avoids the footgun of using `Regex::new` here, which would
    // guarantee that it would be compiled every time this routine is called.
    // This would likely make this routine much slower than it needs to be.
    regex!(r"bar|baz").is_match(line)
}

let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";

let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #​709:
  Add a new regex! macro for efficient and automatic reuse of a compiled regex.

v1.12.4

Compare Source

===================
This release includes a performance optimization for compilation of regexes
with very large character classes.

Improvements:

• #​1308:
  Avoid re-canonicalizing the entire interval set when pushing new class ranges.

seanmonstar/reqwest (reqwest)

v0.13.4

Compare Source

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

TrueLayer/reqwest-middleware (reqwest-middleware)

v0.5.2

Compare Source

Added

• (reqwest-middleware) stream feature exported. (#​246)
• expose internal reqwest::Client as reference (#​209)

Other

• Adjust third-party middleware list in readme (#​282)

GREsau/schemars (schemars)

v1.2.2

Compare Source

• Update to syn 3 in schemars_derive

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

serde-rs/json (serde_json)

v1.0.151

Compare Source

• Add RawValue::from_string_unchecked (#​1331, thanks @​WonderLawrence)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

tokio-rs/tokio (tokio)

v1.53.1: Tokio v1.53.1

Compare Source

1.53.1 (July 20th, 2026)

Fixed

• signal: restore MSRV by removing OnceLock::wait from the Windows handler (#​8300)

Fixed (unstable)

• time: fix alt timer cancellation and insertion race (#​8252)

Documented

• runtime: remove dead link definition in Runtime::block_on (#​8301)

v1.53.0: Tokio v1.53.0

Compare Source

1.53.0 (July 17th, 2026)

Added

• fs: implement From<OwnedFd> and From<OwnedHandle> for File (#​8266)
• metrics: add task schedule latency metric (#​7986)
• net: add SocketAddr methods to Unix sockets (#​8144)

Changed

• io: add #[inline] to IO trait impls for in-memory types (#​8242)
• net: implement UCred::pid on FreeBSD (#​8086)
• net: support Nuttx target os (#​8259)
• signal: refactor global variables on Windows (#​8231)
• sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#​8095)
• taskdump: support taskdumps on s390x (#​8192)
• time: add #[track_caller] to timeout_at() (#​8077)
• time: consolidate mutex locks on spurious poll (#​8124)
• time: defer waker clone on spurious poll (#​8107)
• time: move lazy-registration state into Sleep (#​8132)
• tracing: remove unnecessary span clone (#​8126)

Fixed

• io: do not treat zero-length reads as EOF in Chain (#​8251)
• net: use getpeereid for QNX peer credentials (#​8270)
• runtime: avoid illegal state in FastRand (#​8078)
• sync: wake mpsc receiver when a queued reserve[_many] returns permits (#​8260)
• taskdump: skip double wake on Trace::capture/Trace::trace_with (#​8043)
• time: avoid stack overflow in runtime constructor (#​8093)
• time (alt timer): ensure timers stay in the same runtime after .reset() (#​8169)

IO uring (unstable)

• fs: use io-uring for fs::try_exists (#​8080)
• fs: use io-uring for renaming files (#​7800)
• rt: flush io-uring CQE in case of CQE overflow (#​8277)

Documented

• docs: clarify cancel safety wording (#​8181)
• fs: clarify create_dir_all succeeds if path exists (#​8149)
• io: add warning about stdout reordering with multiple handles (#​8276)
• net: document pipe try_read*/try_write* readiness behavior (#​8032)
• runtime: document interaction with fork() (#​8202)
• sync: clarify broadcast lagging semantics (#​8239)
• sync: document memory ordering guarantees for Semaphore (#​8119)
• task: explain why yield_now defers its waker (#​8254)
• time: add panic docs to timeout_at() (#​8077)
• time: fix reversed poll order in timeout doc (#​8214)

v1.52.4: Tokio v1.52.4

Compare Source

1.52.4 (July 16th, 2026)

Fixed

• runtime: don't skip the driver when before_park schedules work (#​8222)

Fixed (unstable)

• taskdump: remove crate disambiguators from output (#​8264)

toml-rs/toml (toml)

v1.1.4

Compare Source

v1.1.3

Compare Source

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.