[dependabot]

Bumps the rust-dependencies group with 8 updates in the / directory:

Package	From	To
tokio	1.53.1	1.54.1
open	5.4.4	5.4.5
serde_json	1.0.151	1.0.154
toml	1.1.6+spec-1.1.0	1.1.8+spec-1.1.0
sha2	0.11.0	0.11.1
syn	3.0.6	3.0.9
pulldown-cmark	0.13.4	0.13.5
rand	0.10.2	0.10.3

Updates tokio from 1.53.1 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates open from 5.4.4 to 5.4.5

Release notes

Sourced from open's releases.

v5.4.5

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior; the earlier implementation retried unsuccessful operations.

... (truncated)

Changelog

Sourced from open's changelog.

5.4.5 (2026-10-22)

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior;

... (truncated)

Commits

• a60a9d5 Release open v5.4.5
• 4e64f6b Merge pull request #135 from Byron/fix-linux-launchers
• c88759b auto-review
• 42a34b0 fix(unix): check that_detached launchers for immediate failures
• 279c1b2 fix(unix): restore launcher fallback and support Plasma 6
• See full diff in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates syn from 3.0.6 to 3.0.9

Release notes

Sourced from syn's releases.

3.0.9

• Add Punctuated::retain (#2088)

3.0.8

• Fix parsing of <- and -> tokens in expressions (#2086, #2087)

3.0.7

• Fix parsing absolute path expr in labeled break (#2085, thanks @​A4-Tacks)

Commits

• 7c44a55 Release 3.0.9
• 13234ab Merge pull request #2088 from dtolnay/retain
• b617dc9 Add Punctuated::retain
• f18a083 Release 3.0.8
• e1eab98 Merge pull request #2087 from dtolnay/rightarrow
• 5345ee5 Allow end of expr before ->
• 5631c74 Merge pull request #2086 from dtolnay/leftarrow
• c5b3cf0 Fix left arrow being split into less-than and negative-sign
• ec4c2da Release 3.0.7
• f947cf7 Merge pull request #2085 from A4-Tacks/break-label-abs-path
• Additional commits viewable in compare view

Updates pulldown-cmark from 0.13.4 to 0.13.5

Release notes

Sourced from pulldown-cmark's releases.

0.13.5

This release fixes some security issues already fixed in main branch. More details in pulldown-cmark/pulldown-cmark#1181.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.4...v0.13.5

Commits

• 48a2767 Merge pull request #1181 from pulldown-cmark/release-0.13.5
• a126502 feat: cherry-pick pull request #1148 commits into 0.13 branch
• 6da8248 feat: cherry-pick pull request #1155 commits into 0.13 branch
• 73fe547 feat: cherry-pick pull request #1143 commits into 0.13 branch
• cf4ee5f feat: cherry-pick pull request #1136 commits into 0.13 branch
• 63ab297 feat: cherry-pick pull request #1046 commits into 0.13 branch
• fd112a4 chore: cargo update and bump version to 0.13.5
• 078feb5 feat: cherry-pick pull request #1021 commits into 0.13 branch
• 9620194 feat: cherry-pick pull request #1111 commits into 0.13 branch
• e6eafca feat: cherry-pick pull request #1102 commits into 0.13 branch
• Additional commits viewable in compare view

Updates rand from 0.10.2 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

• Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)
• Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)
• Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

• Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

Commits

• 9e7d328 Prepare rand 0.10.3 (#1840)
• f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
• ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
• c994eb1 docs: fix angle unit in quick start example (#1839)
• 33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
• 94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
• bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
• 521fab6 Stop pinning dependencies (#1820)
• 3f7c433 Stop pinning dependencies
• cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions