build(deps): bump the cargo-minor-patch group with 10 updates by dependabot[bot] · Pull Request #1146 · ClickHouse/clickhousectl

dependabot · 2026-10-29T04:36:44Z

Bumps the cargo-minor-patch group with 10 updates:

Package	From	To
tokio	`1.53.3`	`1.54.1`
open	`5.4.4`	`5.4.5`
uuid	`1.28.0`	`1.29.0`
zip	`9.0.5`	`9.1.1`
aws-config	`1.12.0`	`1.13.0`
aws-credential-types	`1.3.0`	`1.3.1`
aws-sdk-ec2	`1.268.0`	`1.271.0`
aws-sdk-iam	`1.128.0`	`1.131.0`
aws-sdk-kinesis	`1.125.0`	`1.128.0`
aws-sdk-s3	`1.152.0`	`1.155.0`

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)

net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)

runtime: add Builder::max_io_events_per_busy_tick (#8410)

runtime: stabilize tokio::runtime::worker_index() (#8431)

sync: add SemaphorePermit::semaphore() (#8482)

sync: add blocking_acquire methods to Semaphore (#8269)

sync: add watch::Receiver::is_closed (#8481)

wasm: support JSPI for Emscripten target (#8285, #8627)

wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

fs: reject zero in File::set_max_buf_size (#8449)

io: make copy_buf cooperative (#8459)

io: panic when BufReader or BufStream is created with zero capacity (#8494)

io: panic when in-memory pipe is created with zero capacity (#8397)

io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)

io: support vectored writes in Sink (#8663)

net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)

net: start accepted sockets as readable and writable (#8435)

net: support UCred on Fuchsia (#8257)

process: use mio::unix::pipe for Unix child stdio (#8603)

runtime: cache-pad the shared injection queue and idle state (#8622)

runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)

runtime: make enable_io available whenever rt is enabled (#8387)

runtime: move block_in_place setup into a non-generic function (#8315)

runtime: move the multi-thread inject queue to its own mutex (#8382)

runtime: panic when max_io_events_per_tick is zero (#8476)

runtime: suggest .await in nested block_on panic message (#8501)

sync: avoid atomic reader count in broadcast slots (#8357)

sync: use acquire/release orderings in Notify (#8325)

time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

b53b200 chore: prepare Tokio v1.54.1 (#8693)
5ed619b time: revert "remove the runtime handle from timers" (#8692)
66d34e4 chore: prepare Tokio v1.54.0 (#8667)
0d322ce io: support vectored writes in sink (#8663)
4167c56 codec: expose I/O sources from codec errors (#8665)
cdd9dae fs: propagate iouring stress test failures (#8644)
52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
4890d02 stream: implement FusedStream for JoinSetStream (#8629)
a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
Additional commits viewable in compare view

Updates open from 5.4.4 to 5.4.5

Release notes

Sourced from open's releases.

v5.4.5

Bug Fixes

check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

Extend the fixture tests to call that_detached() directly.

restore launcher fallback and support Plasma 6

When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

Launcher behavior

Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.

Add kde-open6 and kde-open5 before the existing kde-open fallback.

Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.

Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

Bounded detached checks

Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

Historical constraints

55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior; the earlier implementation retried unsuccessful operations.

... (truncated)

Changelog

Sourced from open's changelog.

5.4.5 (2026-10-22)

Bug Fixes

check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

Extend the fixture tests to call that_detached() directly.

restore launcher fallback and support Plasma 6

When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

Launcher behavior

Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.

Add kde-open6 and kde-open5 before the existing kde-open fallback.

Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.

Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

Bounded detached checks

Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

Historical constraints

55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior;

... (truncated)

Commits

a60a9d5 Release open v5.4.5
4e64f6b Merge pull request #135 from Byron/fix-linux-launchers
c88759b auto-review
42a34b0 fix(unix): check that_detached launchers for immediate failures
279c1b2 fix(unix): restore launcher fallback and support Plasma 6
See full diff in compare view

Updates uuid from 1.28.0 to 1.29.0

Release notes

Sourced from uuid's releases.

v1.29.0

What's Changed

Add versioned constructors to NonNilUuid by @RanaPriyansh in uuid-rs/uuid#919

Prepare for 1.29.0 release by @KodrAus in uuid-rs/uuid#920

Full Changelog: uuid-rs/uuid@v1.28.0...v1.29.0

Commits

4643e60 Merge pull request #920 from uuid-rs/cargo/v1.29.0
a3631fd prepare for 1.29.0 release
304913e Merge pull request #919 from RanaPriyansh/fix/non-nil-versioned-constructors-901
d49f963 Reuse existing version tests for NonNilUuid constructors
2f02404 Add versioned constructors to NonNilUuid
See full diff in compare view

Updates zip from 9.0.5 to 9.1.1

Release notes

Sourced from zip's releases.

v9.1.1

🐛 Bug Fixes

store the raw count instead of a bool (#1174)

preserve extra fields in raw_copy_file_touch (#1172)

(write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)

(write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

v9.1.0

🚀 Features

(read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)

Add borrowing inner method to reader wrappers (#1050)

add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)

add file_names_raw iterator (#1082)

🐛 Bug Fixes

raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)

(write) prevent seek panic on streaming writer with comment (#1151)

Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)

apply unix permissions at creation (#1104)

raw_copy_file should work with any extra fields (#1120)

(read) avoid full-file forward scans and redundant allocations in central directory (#1142)

don't enable typed-path's default std feature (#1112)

ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)

resolve decoded CP437 member names (#1080) (#1085)

Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

(write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)

target lzma-rust2 v0.23 (#1096)

Bench

add Criterion benchmarks (#754)

add deflate_many_small_files bench for #633 (#964)

Changelog

Sourced from zip's changelog.

9.1.1 - 2026-10-25

🐛 Bug Fixes

store the raw count instead of a bool (#1174)

preserve extra fields in raw_copy_file_touch (#1172)

(write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)

(write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

(read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)

Add borrowing inner method to reader wrappers (#1050)

add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)

add file_names_raw iterator (#1082)

🐛 Bug Fixes

raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)

(write) prevent seek panic on streaming writer with comment (#1151)

Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)

apply unix permissions at creation (#1104)

raw_copy_file should work with any extra fields (#1120)

(read) avoid full-file forward scans and redundant allocations in central directory (#1142)

don't enable typed-path's default std feature (#1112)

ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)

resolve decoded CP437 member names (#1080) (#1085)

Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

(write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)

target lzma-rust2 v0.23 (#1096)

Bench

add Criterion benchmarks (#754)

add deflate_many_small_files bench for #633 (#964)

Commits

b7201ce chore: release v9.1.1 (#1173)
67b3e52 fix: store the raw count instead of a bool (#1174)
9d710d3 ci: Share cargo-afl build across workflows (#1167)
d6c0278 fix: preserve extra fields in raw_copy_file_touch (#1172)
c3232c4 test: cover unreserved validation for prepared files (#1169)
b49a787 ci(deps): update wasm-pack requirement in /tools/wasm-pack-version (#1171)
4b547b5 build: Fix regex for release commits so it now matches e.g. "fix(write):" (#1...
a7be36a ci: Share nextest build across workflows as we do with wasm-pack (#1165)
c640d2d test: Use Vec::with_capacity for dense AddressHoleCursor segments, since they...
341e267 fix(write): flag a non-ASCII file comment as UTF-8 when writing it (#1160)
Additional commits viewable in compare view

Updates aws-config from 1.12.0 to 1.13.0

Commits

See full diff in compare view

Updates aws-credential-types from 1.3.0 to 1.3.1

Commits

See full diff in compare view

Updates aws-sdk-ec2 from 1.268.0 to 1.271.0

Commits

See full diff in compare view

Updates aws-sdk-iam from 1.128.0 to 1.131.0

Commits

See full diff in compare view

Updates aws-sdk-kinesis from 1.125.0 to 1.128.0

Commits

See full diff in compare view

Updates aws-sdk-s3 from 1.152.0 to 1.155.0

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Medium Risk
Touches async runtime (tokio), AWS request signing and SDK clients, and zip/archive handling in the CLI—areas where minor semver releases can change behavior without code edits.

Overview
Updates Cargo.lock only via Dependabot’s cargo-minor-patch group—no application source changes.

Resolved versions move for the ten declared bumps (tokio 1.53.3→1.54.1, open, uuid, zip, aws-config, aws-credential-types, and aws-sdk-ec2 / iam / kinesis / s3), plus a large transitive refresh of Smithy/AWS runtime crates and the SigV4 signing stack (e.g. aws-sigv4, p256 0.14, ecdsa 0.17).

Notable downstream effects for this repo: clickhousectl uses zip and open; clickhouse-cloud-api and clickhousectl depend on tokio and the AWS SDK crates for cloud/IAM/S3/Kinesis/EC2 calls. tokio 1.54.1 includes a timer regression fix; zip 9.1.x brings stricter read/write/merge behavior from recent releases.

^{Reviewed by Cursor Bugbot for commit 105294e. Bugbot is set up for automated code reviews on this repo. Configure here.}

Bumps the cargo-minor-patch group with 10 updates: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.3` | `1.54.1` | | [open](https://github.com/Byron/open-rs) | `5.4.4` | `5.4.5` | | [uuid](https://github.com/uuid-rs/uuid) | `1.28.0` | `1.29.0` | | [zip](https://github.com/zip-rs/zip2) | `9.0.5` | `9.1.1` | | [aws-config](https://github.com/smithy-lang/smithy-rs) | `1.12.0` | `1.13.0` | | [aws-credential-types](https://github.com/smithy-lang/smithy-rs) | `1.3.0` | `1.3.1` | | [aws-sdk-ec2](https://github.com/awslabs/aws-sdk-rust) | `1.268.0` | `1.271.0` | | [aws-sdk-iam](https://github.com/awslabs/aws-sdk-rust) | `1.128.0` | `1.131.0` | | [aws-sdk-kinesis](https://github.com/awslabs/aws-sdk-rust) | `1.125.0` | `1.128.0` | | [aws-sdk-s3](https://github.com/awslabs/aws-sdk-rust) | `1.152.0` | `1.155.0` | Updates `tokio` from 1.53.3 to 1.54.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.3...tokio-1.54.1) Updates `open` from 5.4.4 to 5.4.5 - [Release notes](https://github.com/Byron/open-rs/releases) - [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md) - [Commits](Byron/open-rs@v5.4.4...v5.4.5) Updates `uuid` from 1.28.0 to 1.29.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.28.0...v1.29.0) Updates `zip` from 9.0.5 to 9.1.1 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v9.0.5...v9.1.1) Updates `aws-config` from 1.12.0 to 1.13.0 - [Release notes](https://github.com/smithy-lang/smithy-rs/releases) - [Changelog](https://github.com/smithy-lang/smithy-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-rs/commits) Updates `aws-credential-types` from 1.3.0 to 1.3.1 - [Release notes](https://github.com/smithy-lang/smithy-rs/releases) - [Changelog](https://github.com/smithy-lang/smithy-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-rs/commits) Updates `aws-sdk-ec2` from 1.268.0 to 1.271.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `aws-sdk-iam` from 1.128.0 to 1.131.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `aws-sdk-kinesis` from 1.125.0 to 1.128.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `aws-sdk-s3` from 1.152.0 to 1.155.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.54.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: open dependency-version: 5.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: uuid dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: zip dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: aws-config dependency-version: 1.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: aws-credential-types dependency-version: 1.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: aws-sdk-ec2 dependency-version: 1.271.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: aws-sdk-iam dependency-version: 1.131.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: aws-sdk-kinesis dependency-version: 1.128.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: aws-sdk-s3 dependency-version: 1.155.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 29, 2026

dependabot Bot requested review from iskakaushik and sdairs as code owners October 29, 2026 04:36

sdairs approved these changes Oct 30, 2026

View reviewed changes

sdairs merged commit f369847 into main Oct 30, 2026
24 of 26 checks passed

Navigation Menu

Repository navigation

build(deps): bump the cargo-minor-patch group with 10 updates - #1146

build(deps): bump the cargo-minor-patch group with 10 updates#1146
sdairs merged 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-35d08e16c4

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited by cursor Bot

Loading

Launcher behavior

Bounded detached checks

Historical constraints

Launcher behavior

Bounded detached checks

Historical constraints

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

Tokio v1.54.0

1.54.0 (October 19th, 2026)

Added

Changed

v5.4.5

Bug Fixes

Launcher behavior

Bounded detached checks

Historical constraints

5.4.5 (2026-10-22)

Bug Fixes

Launcher behavior

Bounded detached checks

Historical constraints

v1.29.0

What's Changed

v9.1.1

🐛 Bug Fixes

v9.1.0

🚀 Features

🐛 Bug Fixes

🚜 Refactor

⚡ Performance

⚙️ Miscellaneous Tasks

Bench

9.1.1 - 2026-10-25

🐛 Bug Fixes

9.1.0 - 2026-10-24

🚀 Features

🐛 Bug Fixes

🚜 Refactor

⚡ Performance

⚙️ Miscellaneous Tasks

Bench

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited by cursor Bot

Loading