Skip to content

Bump the external-deps group with 12 updates - #96

Open
dependabot[bot] wants to merge 1 commit into
alphafrom
dependabot/cargo/alpha/external-deps-54be18b205
Open

Bump the external-deps group with 12 updates#96
dependabot[bot] wants to merge 1 commit into
alphafrom
dependabot/cargo/alpha/external-deps-54be18b205

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown

Bumps the external-deps group with 12 updates:

Package From To
serde_json 1.0.151 1.0.154
actix-web 4.14.0 4.17.0
tokio 1.53.1 1.54.1
rust-embed 8.12.0 8.13.0
config 0.15.25 0.15.27
toml 1.1.4+spec-1.1.0 1.1.6+spec-1.1.0
thiserror 2.0.19 2.0.21
lazy_static 1.5.0 1.5.1
rand 0.10.2 0.10.3
futures-util 0.3.33 0.3.34
flate2 1.1.9 1.1.10
tokio-util 0.7.19 0.7.20

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

v1.0.153

v1.0.152

Commits
  • 20572a6 Release 1.0.154
  • a91bfaf Fix RandomState links in map documentation
  • 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
  • 4b2d726 Release 1.0.153
  • 83335ee Touch up PR 1345
  • 4b4810a Resolve range_plus_one pedantic clippy lint
  • 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
  • 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
  • c9f1e3b Release 1.0.152
  • 854fc70 Touch up PR 1347
  • Additional commits viewable in compare view

Updates actix-web from 4.14.0 to 4.17.0

Release notes

Sourced from actix-web's releases.

actix-web: v4.17.0

  • Fix Accept parsing and preference selection for quality parameters before media type parameters and for quoted parameter values containing semicolons.
  • Update zstd dependency to 0.14.
  • Update brotli dependency to 9.

actix-web: v4.16.0

  • The TLS crate features no longer enable the http2 crate feature.
  • Prevent TestRequest app data retention by disabling its request pooling.
Commits
  • 15fd3ff chore(actix-web): prepare release 4.17.0
  • 1a351ea chore(awc): prepare release 3.10.0
  • 4ef4b2d chore(actix-http): prepare release 3.19.0
  • 1d6eeb7 fix(actix-http): reject out-of-range WebSocket payload lengths (#4323)
  • b47afd6 fix(actix-http): parse header quality values as exact decimals (#4314)
  • 1f0c38b fix(actix-http): round float quality values to the nearest thousandth (#4315)
  • 5492b7a chore: tweak q item comments
  • 19d672e Fix quality parameter ordering and quoted values (#4301)
  • 8b6a22b chore(deps): update zstd to 0.14 (#4320)
  • efa9c21 chore(deps): update brotli to 9 (#4319)
  • Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

  • time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

  • fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
  • net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
  • runtime: add Builder::max_io_events_per_busy_tick (#8410)
  • runtime: stabilize tokio::runtime::worker_index() (#8431)
  • sync: add SemaphorePermit::semaphore() (#8482)
  • sync: add blocking_acquire methods to Semaphore (#8269)
  • sync: add watch::Receiver::is_closed (#8481)
  • wasm: support JSPI for Emscripten target (#8285, #8627)
  • wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

  • fs: reject zero in File::set_max_buf_size (#8449)
  • io: make copy_buf cooperative (#8459)
  • io: panic when BufReader or BufStream is created with zero capacity (#8494)
  • io: panic when in-memory pipe is created with zero capacity (#8397)
  • io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
  • io: support vectored writes in Sink (#8663)
  • net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
  • net: start accepted sockets as readable and writable (#8435)
  • net: support UCred on Fuchsia (#8257)
  • process: use mio::unix::pipe for Unix child stdio (#8603)
  • runtime: cache-pad the shared injection queue and idle state (#8622)
  • runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
  • runtime: make enable_io available whenever rt is enabled (#8387)
  • runtime: move block_in_place setup into a non-generic function (#8315)
  • runtime: move the multi-thread inject queue to its own mutex (#8382)
  • runtime: panic when max_io_events_per_tick is zero (#8476)
  • runtime: suggest .await in nested block_on panic message (#8501)
  • sync: avoid atomic reader count in broadcast slots (#8357)
  • sync: use acquire/release orderings in Notify (#8325)
  • time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

Updates rust-embed from 8.12.0 to 8.13.0

Updates config from 0.15.25 to 0.15.27

Changelog

Sourced from config's changelog.

[0.15.27] - 2026-09-30

Performance

  • (toml) Reduced parsing overhead

[0.15.26] - 2026-09-21

Compatibility

  • Bump MSRV to 1.88

Internal

  • Upgrade json5 to 1.3
Commits

Updates toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits
  • 572c005 chore: Release
  • 66d0c53 docs: Update changelog
  • 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
  • 0ff90db perf(display): Write encoded strings directly
  • efb2536 perf(display): Move generated representation strings
  • 075c444 refactor(display): Consolidate key-path encoding
  • b48f338 perf(display): Borrow table keys during document output
  • c6c1de3 perf(parser): Move completed table header keys
  • ec90463 perf(parser): Borrow input when creating editable documents
  • d76a48a test: Benchmark rendering generated keys and values
  • Additional commits viewable in compare view

Updates thiserror from 2.0.19 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

  • Fix parsing of generic unit variants in display expressions (#459)

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)
Commits
  • b1827ee Release 2.0.21
  • 58037b5 Merge pull request #459 from dtolnay/turbofish
  • f82a0cf Keep track of nested turbofish depth
  • 72ea492 Raise required compiler to Rust 1.77
  • 72eea0d Resolve io_other_error clippy lint in tests
  • 07f09a2 Raise required compiler to Rust 1.74
  • 2715388 Update ui test suite to nightly-2026-09-22
  • 5a306c7 Update ui test suite to nightly-2026-09-05
  • ef9383b Update ui test suite to nightly-2026-08-22
  • 8336b84 Update ui tests for version 2.0.20
  • Additional commits viewable in compare view

Updates lazy_static from 1.5.0 to 1.5.1

Commits

Updates rand from 0.10.2 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

  • Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)
  • Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)
  • Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

  • Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

Commits
  • 9e7d328 Prepare rand 0.10.3 (#1840)
  • f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
  • ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
  • c994eb1 docs: fix angle unit in quick start example (#1839)
  • 33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
  • 94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
  • bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
  • 521fab6 Stop pinning dependencies (#1820)
  • 3f7c433 Stop pinning dependencies
  • cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
  • Additional commits viewable in compare view

Updates futures-util from 0.3.33 to 0.3.34

Release notes

Sourced from futures-util's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)
Changelog

Sourced from futures-util's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)
Commits

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

New Contributors

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits
  • ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
  • fb5228d Merge pull request #559 from bushrat011899/no_std
  • 6ed3ba3 Add executable no_std example
  • faed8a0 Expand CI to test no_std compatibility and correctness
  • 2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
  • 3fe1126 Centralize usage of std for error and io
  • 98e313a Add GzHeader::mtime_as_duration
  • 0642965 Switch to core implicit prelude and only use std where required
  • 454a63c Remove left-over dbg! statement
  • 2a490b7 Add runtime_detection feature
  • Additional commits viewable in compare view

Updates tokio-util from 0.7.19 to 0.7.20

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the external-deps group with 12 updates
5511e73 
Bumps the external-deps group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` |
| [actix-web](https://github.com/actix/actix-web) | `4.14.0` | `4.17.0` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.54.1` |
| rust-embed | `8.12.0` | `8.13.0` |
| [config](https://github.com/rust-cli/config-rs) | `0.15.25` | `0.15.27` |
| [toml](https://github.com/toml-rs/toml) | `1.1.4+spec-1.1.0` | `1.1.6+spec-1.1.0` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.21` |
| [lazy_static](https://github.com/rust-lang-nursery/lazy-static.rs) | `1.5.0` | `1.5.1` |
| [rand](https://github.com/rust-random/rand) | `0.10.2` | `0.10.3` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.33` | `0.3.34` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.19` | `0.7.20` |


Updates `serde_json` from 1.0.151 to 1.0.154
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.151...v1.0.154)

Updates `actix-web` from 4.14.0 to 4.17.0
- [Release notes](https://github.com/actix/actix-web/releases)
- [Changelog](https://github.com/actix/actix-web/blob/main/CHANGES.md)
- [Commits](actix/actix-web@web-v4.14.0...actix-web-v4.17.0)

Updates `tokio` from 1.53.1 to 1.54.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.54.1)

Updates `rust-embed` from 8.12.0 to 8.13.0

Updates `config` from 0.15.25 to 0.15.27
- [Changelog](https://github.com/rust-cli/config-rs/blob/main/CHANGELOG.md)
- [Commits](rust-cli/config-rs@v0.15.25...v0.15.27)

Updates `toml` from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.4...toml-v1.1.6)

Updates `thiserror` from 2.0.19 to 2.0.21
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.19...2.0.21)

Updates `lazy_static` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/rust-lang-nursery/lazy-static.rs/releases)
- [Commits](https://github.com/rust-lang-nursery/lazy-static.rs/commits)

Updates `rand` from 0.10.2 to 0.10.3
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.10.2...0.10.3)

Updates `futures-util` from 0.3.33 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.33...0.3.34)

Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.9...1.1.10)

Updates `tokio-util` from 0.7.19 to 0.7.20
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-util-0.7.19...tokio-util-0.7.20)

---
updated-dependencies:
- dependency-name: serde_json
  dependency-version: 1.0.154
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: actix-web
  dependency-version: 4.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external-deps
- dependency-name: tokio
  dependency-version: 1.54.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external-deps
- dependency-name: rust-embed
  dependency-version: 8.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: external-deps
- dependency-name: config
  dependency-version: 0.15.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: toml
  dependency-version: 1.1.6+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: thiserror
  dependency-version: 2.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: lazy_static
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: rand
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: futures-util
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
- dependency-name: tokio-util
  dependency-version: 0.7.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: external-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: alpha, 📦 dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants