[dependabot]

Bumps the all-dependencies group with 3 updates: tokio, parking_lot and pluralizer.

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates parking_lot from 0.12.5 to 0.13.0

Release notes

Sourced from parking_lot's releases.

parking_lot-v0.13.0

• Signficantly improved Mutex and RwLock performance under contention by deferring waking up parked threads until after the lock is released. (#545)
• Added per-acquisition state to lock_api raw locks. RawMutex::Guard replaces GuardMarker; rwlocks have separate SharedGuard, ExclusiveGuard, and UpgradableGuard types. Unlock operations consume this state, while upgrade and downgrade operations return replacement state. Bump and raw condition-variable waits borrow and update the state. Consuming operations must release their acquisition on unwind; borrowing operations must restore ownership and valid state, or abort if restoration fails. (#544)
• Raised the MSRV to Rust 1.95 and upgraded all crates to edition 2024. (#533)
• Removed the hardware-lock-elision feature. (#533)
• Removed automatic eventual fairness. Fair unlocking remains available through the explicit fair-unlock APIs. This removes UnparkResult::be_fair. (#533)
• Removed the no-op lock_api/nightly feature. (#533)
• Removed the legacy lock_api const_new methods and the redundant parking_lot const_* constructor functions; the corresponding new methods can be called in constant contexts. (#533)
• Replaced the recursive read methods on RwLock with a dedicated reader-biased RecursiveRwLock type. The RawRwLockRecursive and RawRwLockRecursiveTimed extension traits have been removed from lock_api. (#533)
• Added Once::new_completed for constructing a Once in the completed state. (#520)
• Added Once::{is_completed, wait, wait_force} and the corresponding OnceState query methods. (#533)
• Made additional lock, timeout, parking, and spin-wait accessors usable in constant contexts. (#533)
• Added into_inner_with_raw to lock_api's Mutex, RwLock, and ReentrantMutex. (#524)
• Added RawCondvar, RawCondvarTimed, and the generic Condvar wrapper to lock_api, and implemented parking_lot::Condvar using them. Custom raw condition variables may allow spurious wakeups; their notification methods must then return false or 0. parking_lot::Condvar still guarantees no spurious wakeups and exact notification counts. (#523) (#533)
• Corrected the Send and Sync bounds of lock guards in lock_api. (#533)
• Made RawMutex::is_locked and RawRwLock::{is_locked, is_locked_exclusive} required methods. (#533)
• Renamed MappedRwLockReadGuard::try_map_or_else to try_map_or_err. (#533)
• Clarified the safety requirements of raw lock implementations, including acquire/release synchronization, moving or dropping a locked raw lock, preserving the original lock mode on a failed upgrade, and stable thread IDs. Acquisitions may unwind without leaving a new acquisition held; consuming guard operations release their acquisition on unwind, while bump and wait operations must restore ownership or abort. (#533) (#544)
• Clarified the aliasing requirements of unsafe raw-access, force-unlock, and guard-construction APIs in lock_api. (#533)
• Guard unlocked and unlocked_fair operations now abort if re-locking panics. Default raw-lock bump implementations also abort if re-locking panics. (#533)
• Guard with_upgraded operations abort if raw upgrading or downgrading panics, preserving continuous lock ownership. (#544)
• Parking-lot operations in parking_lot_core are now guaranteed to never unwind. (#533)
• Documented that parking-lot-based synchronization primitives must not be used

... (truncated)

Changelog

Sourced from parking_lot's changelog.

0.13.0 (parking_lot), 0.10.0 (parking_lot_core), 0.5.0 (lock_api) - 2026-10-21

• Signficantly improved Mutex and RwLock performance under contention by deferring waking up parked threads until after the lock is released. (#545)
• Added per-acquisition state to lock_api raw locks. RawMutex::Guard replaces GuardMarker; rwlocks have separate SharedGuard, ExclusiveGuard, and UpgradableGuard types. Unlock operations consume this state, while upgrade and downgrade operations return replacement state. Bump and raw condition-variable waits borrow and update the state. Consuming operations must release their acquisition on unwind; borrowing operations must restore ownership and valid state, or abort if restoration fails. (#544)
• Raised the MSRV to Rust 1.95 and upgraded all crates to edition 2024. (#533)
• Removed the hardware-lock-elision feature. (#533)
• Removed automatic eventual fairness. Fair unlocking remains available through the explicit fair-unlock APIs. This removes UnparkResult::be_fair. (#533)
• Removed the no-op lock_api/nightly feature. (#533)
• Removed the legacy lock_api const_new methods and the redundant parking_lot const_* constructor functions; the corresponding new methods can be called in constant contexts. (#533)
• Replaced the recursive read methods on RwLock with a dedicated reader-biased RecursiveRwLock type. The RawRwLockRecursive and RawRwLockRecursiveTimed extension traits have been removed from lock_api. (#533)
• Added Once::new_completed for constructing a Once in the completed state. (#520)
• Added Once::{is_completed, wait, wait_force} and the corresponding OnceState query methods. (#533)
• Made additional lock, timeout, parking, and spin-wait accessors usable in constant contexts. (#533)
• Added into_inner_with_raw to lock_api's Mutex, RwLock, and ReentrantMutex. (#524)
• Added RawCondvar, RawCondvarTimed, and the generic Condvar wrapper to lock_api, and implemented parking_lot::Condvar using them. Custom raw condition variables may allow spurious wakeups; their notification methods must then return false or 0. parking_lot::Condvar still guarantees no spurious wakeups and exact notification counts. (#523) (#533)
• Corrected the Send and Sync bounds of lock guards in lock_api. (#533)
• Made RawMutex::is_locked and RawRwLock::{is_locked, is_locked_exclusive} required methods. (#533)
• Renamed MappedRwLockReadGuard::try_map_or_else to try_map_or_err. (#533)
• Clarified the safety requirements of raw lock implementations, including acquire/release synchronization, moving or dropping a locked raw lock, preserving the original lock mode on a failed upgrade, and stable thread IDs. Acquisitions may unwind without leaving a new acquisition held; consuming guard operations release their acquisition on unwind, while bump and wait operations must restore ownership or abort. (#533) (#544)
• Clarified the aliasing requirements of unsafe raw-access, force-unlock, and guard-construction APIs in lock_api. (#533)
• Guard unlocked and unlocked_fair operations now abort if re-locking panics. Default raw-lock bump implementations also abort if re-locking panics. (#533)
• Guard with_upgraded operations abort if raw upgrading or downgrading panics, preserving continuous lock ownership. (#544)
• Parking-lot operations in parking_lot_core are now guaranteed to never unwind. (#533)

... (truncated)

Commits

• 1a5c3dd Update changelog
• ec07063 chore: release
• f369d24 Merge pull request #538 from napi-rs/wasi-threads-parker
• 2f4103f Remove the WASI backend note from stable restrictions
• a3e8717 Reuse existing CI jobs for WASI coverage
• c2bfc7b Merge pull request #549 from Amanieu/fix-l4re-condvar-clock
• 696f28b Don't use pthread_condattr_setclock on L4RE
• 52941c0 Share the libc dependency between Unix and WASI
• 4fde6a7 Align the Rust setup action with existing workflows
• f0ce547 Reuse the pthread backend for WASI on stable
• Additional commits viewable in compare view

Updates pluralizer from 0.5.0 to 0.6.0

Release notes

Sourced from pluralizer's releases.

v0.6.0

What's changed

The public API is unchanged, but some outputs change: results now follow the case of the input word more closely. For lowercase and Title-case words they match the pluralize NPM package (on its master branch, which these rules mirror) for every word in /usr/share/dict/words. Outputs not listed below are unchanged.

Changed output

• Title-case words keep their capital when the whole word is replaced: pluralize("Foot", 1, false) returned "foot" and now returns "Foot". Likewise "Goose" becomes "Geese" (was "geese"), "Man" becomes "Men", "He" becomes "They" and "Is" becomes "Are".
• A replacement for text that starts with a capital letter keeps that capital: "SuperMan" becomes "SuperMen" (was "Supermen"), "the Man" becomes "the Men" (was "the men") and "MacOS" stays "MacOS" (was "MacOs").
• A replacement for an UPPERCASE run inside a mixed-case word stays uppercase: "myPERSON" becomes "myPEOPLE" (was "mypeople"), and "myABACUS" becomes "myABACUSES" (was "myABAcuses").
• Text that a rule captures from the word keeps its case: "camelMatrix" becomes "camelMatrices" (was "camelmatrices"), and "mySheep" stays "mySheep" (was "mysheep").
• Irregular words are matched case-insensitively:
  • pluralize("I", 2, false) is "WE" (was "IS"), and pluralize("i", 2, false) is "we" (was "is").
  • Irregular rules added with capitals, such as add_irregular_rule("Octopus", "Octopodes"), now apply. They used to be ignored.
  • For words that are not all lowercase or all UPPERCASE, a replacement written with capitals of its own ("McDonalds") is returned as written, and an all-lowercase one takes the word's capitals on the letters the two start with: with add_irregular_rule("mcdonald", "mcdonalds"), "McDonald" becomes "McDonalds".
  • A word already in the requested form is returned as it is, so "McDonalds" stays "McDonalds" and "fEET" stays "fEET" (was "feet").

Fixed

• pluralize no longer panics on Title-case words where a rule matches text that starts with a multi-byte character, such as pluralize("Café", 2, false), "Résumé" or "Hello 世界". These words now come back unchanged, or inflected where a rule applies (pluralize("Nine—lives", 1, false) is "Nine—life").
• A $ in the input word is kept: pluralize("cost$", 2, false) returned "cost" and now returns "cost$s".
• Calling add_irregular_rule from several threads while other threads call pluralize with both singular and plural counts could deadlock forever. All rule tables now share one lock.
• add_irregular_rule and add_uncountable_rule(UncountableRule::Regex(..)) update all their tables at once, so other threads never see a half-added rule.
• Placements of custom rules: $N now always means capture group N, even when an earlier group did not take part in the match; $10 to $99 work for rules with that many groups; and a $ that is not followed by a digit is kept instead of being deleted along with the next

... (truncated)

Changelog

Sourced from pluralizer's changelog.

0.6.0 - 2026-10-19

The public API is unchanged, but some outputs change: results now follow the case of the input word more closely. For lowercase and Title-case words they match the pluralize NPM package (on its master branch, which these rules mirror) for every word in /usr/share/dict/words. Outputs not listed below are unchanged.

Changed output

• Title-case words keep their capital when the whole word is replaced: pluralize("Foot", 1, false) returned "foot" and now returns "Foot". Likewise "Goose" becomes "Geese" (was "geese"), "Man" becomes "Men", "He" becomes "They" and "Is" becomes "Are".
• A replacement for text that starts with a capital letter keeps that capital: "SuperMan" becomes "SuperMen" (was "Supermen"), "the Man" becomes "the Men" (was "the men") and "MacOS" stays "MacOS" (was "MacOs").
• A replacement for an UPPERCASE run inside a mixed-case word stays uppercase: "myPERSON" becomes "myPEOPLE" (was "mypeople"), and "myABACUS" becomes "myABACUSES" (was "myABAcuses").
• Text that a rule captures from the word keeps its case: "camelMatrix" becomes "camelMatrices" (was "camelmatrices"), and "mySheep" stays "mySheep" (was "mysheep").
• Irregular words are matched case-insensitively:
  • pluralize("I", 2, false) is "WE" (was "IS"), and pluralize("i", 2, false) is "we" (was "is").
  • Irregular rules added with capitals, such as add_irregular_rule("Octopus", "Octopodes"), now apply. They used to be ignored.
  • For words that are not all lowercase or all UPPERCASE, a replacement written with capitals of its own ("McDonalds") is returned as written, and an all-lowercase one takes the word's capitals on the letters the two start with: with add_irregular_rule("mcdonald", "mcdonalds"), "McDonald" becomes "McDonalds".
  • A word already in the requested form is returned as it is, so "McDonalds" stays "McDonalds" and "fEET" stays "fEET" (was "feet").

Fixed

• pluralize no longer panics on Title-case words where a rule matches text that starts with a multi-byte character, such as pluralize("Café", 2, false), "Résumé" or "Hello 世界". These words now come back unchanged, or inflected where a rule applies (pluralize("Nine—lives", 1, false) is "Nine—life").
• A $ in the input word is kept: pluralize("cost$", 2, false) returned "cost" and now returns "cost$s".
• Calling add_irregular_rule from several threads while other threads call pluralize with both singular and plural counts could deadlock forever. All rule tables now share one lock.
• add_irregular_rule and add_uncountable_rule(UncountableRule::Regex(..)) update all their tables at once, so other threads never see a half-added rule.
• Placements of custom rules: $N now always means capture group N, even when an earlier group did not take part in the match; $10 to $99 work for rules with that many groups; and a $ that is not followed by a digit is kept instead of being deleted along with the next character. $0 followed by a digit still means the whole match followed by that digit.

... (truncated)

Commits

• 81b9449 docs: date the 0.6.0 changelog entry
• d681237 upgrade: require regex 1.13.1 and once_cell 1.21.4
• a533821 release: 0.6.0 with faster rule matching and case fixes
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
Major parking_lot affects runtime locking, and pluralizer 0.6 can change macro-generated names; tokio 1.54.x updates async runtime behavior transitively.

Overview
Bumps workspace parking_lot from 0.12 to 0.13 (with lock_api 0.5 / parking_lot_core 0.10 in the lockfile) and pluralizer from 0.5 to 0.6 in es-entity-macros. Cargo.lock also picks up tokio 1.54.1 and minor transitive updates (e.g. libc, once_cell, smallvec).

parking_lot is used for a Mutex in manual clock code; 0.13 is a major release with contention and fairness behavior changes but the same high-level API for typical Mutex use.

pluralizer drives singular/plural table and column names in proc macros (EsQuery, repo helpers). 0.6 keeps the same API but changes inflection output (case preservation, irregular matching) and fixes panics/deadlocks—generated Rust identifiers from table names could differ where inputs were not plain lowercase.

No application logic changes beyond manifest and lockfile updates.

^{Reviewed by Cursor Bugbot for commit 116e0a7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 116e0a7. Configure here.}

[cursor]

Pluralizer bump changes generated table names

Medium Severity

pluralizer 0.6 keeps capitals in irregular replacements, so default table names built as pluralize(entity, 2).to_case(Snake) can change for multi-word PascalCase entities. DataMatrix becomes data_matrices instead of datamatrices, and SalesPerson becomes sales_people instead of salespeople. Existing databases and generated SQL then miss each other.

 

^{Reviewed by Cursor Bugbot for commit 116e0a7. Configure here.}