This PR contains the following updates:

Package	Type	Update	Change
aho-corasick	workspace.dependencies	patch	1.1.4 → 1.1.5
anyhow	workspace.dependencies	patch	1.0.102 → 1.0.104
arc-swap	workspace.dependencies	patch	1.9.1 → 1.9.2
async-trait	workspace.dependencies	patch	0.1.89 → 0.1.92
bitflags	workspace.dependencies	patch	2.13.1 → 2.13.2
bytes	workspace.dependencies	patch	1.12.0 → 1.12.1
camino	workspace.dependencies	patch	1.2.3 → 1.2.6
cargo_toml (source)	workspace.dependencies	patch	1.0.0 → 1.0.1
cfg-if	workspace.dependencies	patch	1.0.4 → 1.0.5
clap	workspace.dependencies	patch	4.6.1 → 4.6.7
fast-glob	workspace.dependencies	patch	1.1.0 → 1.1.1
futures (source)	workspace.dependencies	patch	0.3.32 → 0.3.34
glob	dev-dependencies	patch	0.3.3 → 0.3.4
hstr	workspace.dependencies	patch	4.0.1 → 4.0.2
html-escape (source)	workspace.dependencies	patch	0.2.13 → 0.2.15
indexmap	workspace.dependencies	patch	2.14.0 → 2.14.2
indicatif	workspace.dependencies	patch	0.18.4 → 0.18.6
json-escape-simd	workspace.dependencies	patch	3.1.1 → 3.1.2
json-strip-comments	workspace.dependencies	patch	3.1.1 → 3.1.2
lightningcss	workspace.dependencies	patch	1.0.0-alpha.71 → 1.0.0-alpha.72
memchr	workspace.dependencies	patch	2.8.2 → 2.8.3
pnp (source)	workspace.dependencies	patch	0.12.11 → 0.12.12
proc-macro2	workspace.dependencies	patch	1.0.106 → 1.0.107
quote	workspace.dependencies	patch	1.0.45 → 1.0.47
ref-cast	workspace.dependencies	patch	1.0.23 → 1.0.27
rustc-hash	workspace.dependencies	patch	2.1.2 → 2.1.3
ryu-js	workspace.dependencies	patch	1.0.2 → 1.0.3
serde (source)	workspace.dependencies	patch	1.0.228 → 1.0.229
serde_json	workspace.dependencies	patch	1.0.150 → 1.0.151
similar-asserts	workspace.dependencies	patch	1.5.0 → 1.7.0
stacker	workspace.dependencies	patch	0.1.24 → 0.1.25
syn	workspace.dependencies	patch	2.0.117 → 2.0.119
thiserror	workspace.dependencies	patch	2.0.18 → 2.0.20
thread_local	workspace.dependencies	patch	1.1.9 → 1.1.10
triomphe	workspace.dependencies	patch	0.1.14 → 0.1.16
trybuild	workspace.dependencies	patch	1.0.116 → 1.0.121
twox-hash	workspace.dependencies	patch	2.1.2 → 2.1.4
wasi-common	workspace.dependencies	patch	36.0.13 → 36.0.15
wasmtime	workspace.dependencies	patch	36.0.13 → 36.0.15
xxhash-rust	workspace.dependencies	patch	0.8.15 → 0.8.18

---

---

Release Notes

BurntSushi/aho-corasick (aho-corasick)

v1.1.5

Compare Source

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

vorner/arc-swap (arc-swap)

v1.9.2

• Document RefCnt must not panic (#​208).

dtolnay/async-trait (async-trait)

v0.1.92

Compare Source

• Resolve double_must_use clippy lint in generated code (#​303)

v0.1.91

Compare Source

v0.1.90

Compare Source

• Update to syn 3

bitflags/bitflags (bitflags)

v2.13.2

Compare Source

What's Changed

• Flags: adjust order of elements in manual implementation example by @​DanielEScherzer in #​494
• Re-pull const declarations outside of nested const by @​KodrAus in #​496

Full Changelog: bitflags/bitflags@2.13.1...2.13.2

tokio-rs/bytes (bytes)

v1.12.1

Compare Source

Fixed

• Properly handle when Box::new panics (#​837)

camino-rs/camino (camino)

v1.2.6

Compare Source

Fixed

• The Utf8Path::ends_with parameter is now called child to match std::path::Path::ends_with. Thanks hxperl for your first contribution!

v1.2.5

Compare Source

Fixed

Removed unnecessary files from the package.

v1.2.4

Compare Source

Added

Methods to convert between Box<Utf8Path> and Box<Path>:

• From<Box<Utf8Path>> for Box<Path> (as of release, not documented due to rust-lang/rust#158466).
• Utf8Path::into_std_boxed_path(self: Box<Self>)
• Utf8Path::from_boxed_path(path: Box<Path>)
• TryFrom<Box<Path>> for Box<Utf8Path>

Thanks nicopap for your first contribution!

lib.rs/cargo_toml (cargo_toml)

v1.0.1

Compare Source

rust-lang/cfg-if (cfg-if)

v1.0.5

Compare Source

• Add a note that this crate is deprecated, suggesting cfg_select! instead

clap-rs/clap (clap)

v4.6.7

Compare Source

v4.6.6

Compare Source

Features

• Add Command::get_overridden_usage

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal

• Update to syn v3

v4.6.3

Compare Source

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes

• (help) Say alias when there is only one

oxc-project/fast-glob (fast-glob)

v1.1.1

Compare Source

Fixed

• apply the negation offset to the globstar segment check (#​171)

Other

• reduce Rust dev debug info (#​162)

rust-lang/futures-rs (futures)

v0.3.34

Compare Source

• Preserve cloned waker identity. (#​3032)
• Updato syn to 3. (#​3028)

v0.3.33

Compare Source

• Fix ReadLine's soundness issue regarding to exception safety. (#​3020)
• Fix unsound Send impl for IterPinRef and Iter. (#​3003)
• Fix stacked borrows violation in compat01as03 implementation. (#​3012)
• Fix memory leak in FuturesUnordered::IntoIter. (#​3005)
• Add portable-atomic-alloc feature and use it in FuturesUnordered. (#​3007)
• Re-export alloc::task::Wake. (#​3010)
• Update spin to 0.12. (#​3014)

rust-lang/glob (glob)

v0.3.4

Compare Source

• Cache filename for sorting in fill_todo (#​181)
• Replace into_error method with impl Into (#​179)
• Replace tempdir with tempfile (#​176)
• Set the edition to 2021 (#​188)

magiclen/html-escape (html-escape)

v0.2.15

Compare Source

v0.2.14

Compare Source

indexmap-rs/indexmap (indexmap)

v2.14.2

Compare Source

• Fix item hygiene in map and set macros. Previously, an internal const CAP
  could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and
  indexset_with_default!. The hasher may also be omitted if it's inferrable.

v2.14.1

Compare Source

• Simplify comparisons where Equivalent isn't needed (Q = K).
• Unify index assertions for bounds checks.
• Fix (or expect) clippy lints.

console-rs/indicatif (indicatif)

v0.18.6

Compare Source

What's Changed

• fix: correctly detect dumb terminal on Windows by @​ugur-eren in #​818

v0.18.5

Compare Source

What's Changed

• Upgrade to rand 0.10 by @​djc in #​768
• multi: document common MultiProgress bugs + behavior (#​595) by @​chris-laplante in #​786
• Use div_duration_f64 by @​ChrisDenton in #​792
• Clear the rest of line after drawing to the terminal by @​ChrisDenton in #​790
• Fix ProgressDrawTarget.is_stderr() for MultiProgress by @​kojiishi in #​803
• Fix height and filler when wrapped at the middle of wide characters by @​kojiishi in #​799
• fix: respect NO_COLOR and TERM=dumb environment variable by @​ValentinLeTallec in #​808
• Fix stray comma after minus sign in HumanFloatCount by @​sueun-dev in #​815
• Fix HumanFloatCount dropping the fractional part by @​greymoth-jp in #​816
• style module cleanup by @​djc in #​813
• Drop screenshots from MultiProgress documentation by @​djc in #​817

napi-rs/escape-simd (json-escape-simd)

v3.1.2

Compare Source

Changed

• Implementation now lives in the shared escape-simd crate. Public JSON API (escape, escape_into) is unchanged.

oxc-project/json-strip-comments (json-strip-comments)

v3.1.2

Compare Source

Other

• (json-strip-comments) exclude extraneous files from published package (#​209)
• (deps) update rust crates (#​210)
• (deps) update semgrep/semgrep docker tag to v1.171.0 (#​211)
• (semgrep) add scan workflow (#​208)
• (deps) update actions/setup-node action to v7 (#​207)
• (deps) update actions/setup-node action to v6.5.0 (#​206)
• (deps) update dependency rust to v1.97.1 (#​205)
• update sponsor section
• (deps) update rust crates (#​203)
• (deps) update codspeedhq/action action to v4.18.5 (#​202)
• (deps) update dependency rust to v1.97.0 (#​201)
• restore original Apache-2.0 license (#​200)
• (deps) update rust to v1.96.1 (#​199)
• standardize rustfmt config
• normalize README sponsor section
• configure clippy exported api lint (#​196)
• add crates environment to release workflow
• (deps) update github actions (#​193)
• use codspeed simulation mode (#​192)
• use codspeed mode input (#​191)
• enable codspeed simulation (#​190)
• (deps) update rust crates (#​189)
• (deps) update github actions (#​188)
• (deps) update rust crates (#​187)
• (deps) update github actions to v4.17.5 (#​186)
• (deps) update github actions to v4.17.0 (#​185)
• (deps) update rust crates (#​183)
• (deps) update github actions (#​182)
• (deps) update dependency rust to v1.96.0 (#​181)
• (deps) update rust crates (#​180)
• (deps) update github actions (#​179)
• switch security workflow to ubuntu-latest (#​178)
• update packageManager to pnpm 11.0.4 (#​177)
• (deps) update github actions (#​176)
• (deps) update pnpm/action-setup action to v6.0.4 (#​175)
• (deps) update github actions (#​174)
• (deps) update github-actions (#​172)

BurntSushi/memchr (memchr)

v2.8.3

Compare Source

yarnpkg/pnp-rs (pnp)

v0.12.12

Compare Source

Other

• (deps) bump regress to 0.12.0 (#​113)

dtolnay/proc-macro2 (proc-macro2)

v1.0.107

Compare Source

• Documentation improvements

dtolnay/quote (quote)

v1.0.47

Compare Source

• Documentation improvements

v1.0.46

Compare Source

• Avoid repeated get_span in quote_spanned (#​329, thanks @​Noratrieb)

dtolnay/ref-cast (ref-cast)

v1.0.27

Compare Source

• Suppress let_underscore_must_use clippy restriction in generated code (#​56)

v1.0.26

Compare Source

• Update to syn 3

v1.0.25

Compare Source

• Use differently named __private module per patch release (#​52)

v1.0.24

Compare Source

• Documentation improvements

rust-lang/rustc-hash (rustc-hash)

v2.1.3

Compare Source

• Use derive_const to fix feature = "nightly" build
• Internally update to rand 0.9

boa-dev/ryu-js (ryu-js)

v1.0.3

Compare Source

Breaking Changes

• Minimum rust version has been bumped from 1.64.0 to 1.71.0.

Bug Fixes

• BUG #​56: Fix panic in format64_to_fixed when rounding carries past all integer digits. (@​Ansh-699)

Internal Improvements

• INTERNAL #​57: Sync upstream/main. (@​jedel1043)
• INTERNAL #​63: Make Cursor store unsigned integer len and index. (@​HalidOdat)

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

serde-rs/json (serde_json)

v1.0.151

Compare Source

• Add RawValue::from_string_unchecked (#​1331, thanks @​WonderLawrence)

rust-lang/stacker (stacker)

v0.1.25

Compare Source

dtolnay/syn (syn)

v2.0.119

Compare Source

• Preserve attributes on tail-call expressions in statement position (#​1994)
• Parse field-representing types builtin in type position (#​1996)

v2.0.118

Compare Source

• Documentation improvements

dtolnay/thiserror (thiserror)

v2.0.20

Compare Source

• Suppress redundant_field_names clippy lint in generated code (#​454)

v2.0.19

Compare Source

• Update to syn 3

Amanieu/thread_local-rs (thread_local)

v1.1.10

Compare Source

Fixed

• Fix undefined behavior when get_or or get_or_try reentrantly initializes the same ThreadLocal (#​97).
• Fix an integer underflow in iterator size_hint implementations (#​89).
• Fix compilation with the nightly feature enabled (#​96).

Changed

• ThreadLocal::get no longer allocates a thread ID or registers a thread-local destructor when no value exists for the current thread (#​84).

Manishearth/triomphe (triomphe)

v0.1.16

Compare Source

v0.1.15

Compare Source

dtolnay/trybuild (trybuild)

v1.0.121

Compare Source

• Replace target_triple dependency with target_tuple

v1.0.120

Compare Source

• Collect more path dependencies from dev deps and target deps (#​340)
• Prefer longest match in path dependency search (#​341, #​342)

v1.0.119

Compare Source

• Fix detection of crate features in new Cargo build-dir layout (#​338, thanks @​ranger-ross)

v1.0.118

Compare Source

• Normalize cargo registry paths for any registry source (#​331, thanks @​devjgm)
• Limit custom registry to new normalization level (#​334)

v1.0.117

Compare Source

• Better error message when TRYBUILD env var is wrong (#​332, thanks @​tisonkun)

shepmaster/twox-hash (twox-hash)

v2.1.4

Compare Source

Changed

• Documentation added about the stability of the hashing algorithms.

v2.1.3

Compare Source

Fixed

• Removed a panic that could occur when using XxHash32 or XxHash64
  in debug mode. Release mode is unaffected.

Changed

• The version range for the optional rand dependency now allows 0.10
  in addition to 0.9.

bytecodealliance/wasmtime (wasi-common)

v36.0.15

Compare Source

36.0.15

Released 2026-09-10

Changed

• Wasmtime's internal implementation of wasmtime-wasi no longer depends on
  cap-std crates for the underlying implementation. Instead the cap-std
  implementation was vendored into wasmtime-wasi. This is intended to have no
  visible side effects or result in any behavior changes.
  #​14219

v36.0.14

Compare Source

36.0.14

Released 2026-08-20

Fixed

• Filesystem sandbox escape when paths or symlinks contain trailing slashes.
  GHSA-vqjp-4c8c-hfgg

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 8am on saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.