chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #62 · rolldown/zarara

renovate · 2026-11-01T01:41:37Z

This PR contains the following updates:

Package	Type	Update	Change
actions/create-github-app-token	action	minor	`v3.2.0` → `v3.3.0`
actions/download-artifact	action	patch	`v8.0.1` → `v8.0.2`
actions/upload-artifact	action	patch	`v7.0.1` → `v7.0.2`
flate2	workspace.dependencies	patch	`1.1.10` → `1.1.11`
proptest (source)	workspace.dependencies	minor	`1.11.0` → `1.12.0`
rust (source, changelog)	toolchain	minor	`1.98.1` → `1.99.1`
rust		minor	`1.98.1` → `1.99.1`
serde_json	workspace.dependencies	patch	`1.0.151` → `1.0.154`
tokio (source)	workspace.dependencies	minor	`1.53.1` → `1.54.1`

Release Notes

actions/create-github-app-token

`v3.3.0`

Compare Source

Features

update permission inputs (#399) (a47236f)

Bug Fixes

deps: bump nested undici from 6.24.0 to 6.29.0 (#403) (12461a3)
deps: bump the production-dependencies group across 1 directory with 3 updates (#395) (a69c19d)

actions/download-artifact

`v8.0.2`

Compare Source

What's Changed

Update the readme by @danwkennedy in #473
Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Update @actions/artifact to 6.3.1 by @tunc-d in #492
Prepare download-artifact v8.0.2 by @tunc-d in #493

New Contributors

@tunc-d made their first contribution in #492

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact

`v7.0.2`

Compare Source

What's Changed

Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
Updates @actions/artifact to v6.3.1.

New Contributors

@tunc-d made their first contribution in #821

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

rust-lang/flate2-rs (flate2)

`v1.1.11`

Compare Source

Fixed

fixup! Complete sync flushes across output buffer boundaries (#581)
Separate gzip header reads from compressed data
Defer gzip input errors without losing read progress
Preserve gzip header progress on input read errors (#571)

Other

Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
Merge pull request #577 from rust-lang/fix-loop
Setup trusted publishing for the flate2 crate
Complete sync flushes across output buffer boundaries (#581)
Fix "can by extended" typos in deflate and zlib write docs
Merge pull request #579 from NUAAwqy/docs/fix-double-space
Fix double space in read module doc comment
Add missing preposition in README description
Cover decoder retries across the output buffer boundary
Drain output before refilling the buffer
Clarify partial-write buffering behavior
Avoid shifting buffered output on partial writes
Merge pull request #567 from ndossche/more-asserts
Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
Fix encoder writes hanging after try_finish (#576)
Avoid panicking when dropping unfinished compressors
Merge pull request #565 from HDauven/zlib-rs-uninit-output
still allow resetting incomplete write decoders
Assert return result of reset calls
Reject incomplete streams in write decoders
Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
review
Reject incomplete streams when finishing write-side decoders
Preserve window size and gzip mode across Decompress::reset
preserve runtime detection in backend examples (#570)
Make miniz_oxide dictionary clearing explicit on reset
Harden miniz_oxide decompressor reset
Deduplicate zlib-rs flush conversions
Use native zlib-rs uninitialized output

proptest-rs/proptest (proptest)

`v1.12.0`

Compare Source

rust-lang/rust (rust)

`v1.99.1`

Compare Source

===========================

`v1.99.0`

Compare Source

==========================

Language

Add allow-by-default raw_borrows_via_references lint that checks for references that decay immediately into raw borrows
Extend unconditional_panic lint to function calls that panic when the chunks/windows size is zero
Stabilize C-variadic function definitions
Stabilize the ability to use #[unsafe(naked)] functions to define C-variadic functions (#![feature(c_variadic_naked_functions)]).
Trait methods are now resolved on an adjusted never type (producing a FCW)
Coerce from inference variables to trait objects if the inference variable is related via subtyping to a type that is known to be Sized
Stabilize #[my_macro] mod foo;. This allows outlined modules (mod foo;) anywhere in the body of a custom attribute or derive macro.
Fix the overflowing_literals lint with repeated negation. For instance, it will now no longer lint on --128_i8, which is already detected by the arithmetic_overflow lint.
Add POSIX symbols to the invalid_runtime_symbol_definitions and suspicious_runtime_symbol_definitions lints
Lint unused #[path] attributes on inline modules
Enable unreachable_cfg_select_predicates lint as part of unused lint group
Stabilize passing 128-bit integers via vector registers with asm! on x86
Explicitly document that some allocations are allowed to grow in-place (but none are allowed to shrink)
We now guarantee that the contents of an UnsafeCell can be accessed without going through get
- The invalid_reference_casting lint was adjusted accordingly
Account for globally enabled target features in global_asm!
Warn if an invalid doc attribute is used on a macro invocation

Compiler

Convert -Ctarget-cpu into a target-modifier for AVR, AMDGCN and NVPTX
Enable static_position_independent_executables on all gnu targets
When providing a suggestion about a missing method, rustc now prefers an exactly matching name from a doc alias attribute over a similarity search from other method names. If your new users sometimes expect a method under a different name, adding a doc alias will now help them find it via rustc suggestions, in addition to helping them find it via rustdoc search: When suggesting method names, prefer exact doc aliases over similar names

Platform Support

Promote riscv64-unknown-linux-musl to Tier 2 with host tools

Refer to Rust's platform support page
for more information on Rust's tiered platform support.

Libraries

Iteration on RangeInclusive (a..=b ranges) is now optimized better in some circumstances. As a side effect of this, the behavior of RangeInclusive values that has already been exhausted (as an iterator) has changed. For example, the return values of start() and end() on such ranges may return different values, and using such ranges as slice indexes may have different behavior. These behaviors were not guaranteed to be stable, so these changes are considered to not be breaking changes.
Relax transmute_copy to accept ?Sized types
Update transmute_copy to use a non-unwinding panic
Don't escape U+FF9E and U+FF9F in escape_debug_ext
Re-export core::fmt::NumBuffer in alloc (and std)

Stabilized APIs

Cargo

Add a new built-in profile debug. This is a preparation for transitioning the dev profile away from debugging to give a saner default for faster development iterations. Currently there is no difference between dev and debug profiles. docs #17214
Workspace members on edition 2024 or later can now override an inherited workspace dependency's default-features field. For example, serde = { workspace = true, default-features = false } now turns off default features even when the workspace definition enables them. On earlier editions, default-features = false is ignored with a warning. (RFC 3945) #17126

Rustdoc

Add new unused_footnote_definition rustdoc lint
Smarter filtering of trait impls yields performance improvements of 20% on average and up to 40% on some real-world crates. (1, 2, 3, 4, 5)

Compatibility Notes

Fully deprecate the legacy integral modules. For example, std::i32::MAX should be accessed via i32::MAX instead.
Upgrade no_mangle_generic_items into hard error
The Pin::new_unchecked has had its safety invariants changed slightly
Do not promote references to extern statics
Ensure that the inferred types of let patterns typecheck
hermit/fs: Return unsupported() instead of from_raw_os_error(22)
Fixed a bug where #[repr(simd)] was accidentally allowed on macro invocations on stable Rust
Abort const-eval when there are generics in the type of the value being produced
Attributes not applying to anything are now an error in code blocks in doc comments
Box::leak: tell people to avoid unleaking
PowerPC inline ASM: Fix scalar floats being in the wrong vector lane on little endian
Do not take doc(cfg()) into account when filtering doctests
Infer anonymous lifetimes in the types of associated consts as 'static
Macros that expand to a semicolon now produce a warning lint (semicolon_in_expressions_from_non_local_macros) even when the macro comes from another crate. Previously, such warnings only appeared for macros from the same crate, to avoid showing warnings that can't be fixed locally; however, this masked problems, as integration tests from the crate providing the macro get compiled as a separate crate, so tests often wouldn't reveal this issue. If you encounter a lint like this, please make sure to report it to the crate providing the macro so they can fix it; don't just silence it in your own crate.
- semicolon_in_expressions_from_macros: Lint on non-local macros too
- Split non-local semicolon_in_expressions_from_macros into a separate lint
In Cargo, incremental compilation is now disabled by default when running in CI. CI is detected via the CI environment variable. #17220
The Rust Reference no longer recommends using a single pattern to match a union alongside another value, such as in a manually-written tagged union. This was because it was found that such code would, in some circumstances, result in the compiler reading the contents of the union before checking if the rest of the scrutinee matches the rest of the pattern. This can cause undefined behavior in code similar to what the reference previously recommended.

Internal Changes

These changes do not affect any public interfaces of Rust, but they represent
significant improvements to the performance or internals of rustc and related
tools.

Update to LLVM 23

serde-rs/json (serde_json)

`v1.0.154`

Compare Source

Support preserve_order in no_std builds (#1333, thanks @razmser)

`v1.0.153`

Compare Source

Report invalid UTF-8 at the first bad byte (#1345, thanks @00200200)

`v1.0.152`

Compare Source

Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @yuxi-liu-wired)
Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @yuxi-liu-wired)

tokio-rs/tokio (tokio)

`v1.54.1`: Tokio v1.54.1

Compare Source

1.54.1 (October 21st, 2026)

Fixed

time: revert "remove the runtime handle from timers" (#8692)

`v1.54.0`: Tokio v1.54.0

Compare Source

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
runtime: add Builder::max_io_events_per_busy_tick (#8410)
runtime: stabilize tokio::runtime::worker_index() (#8431)
sync: add SemaphorePermit::semaphore() (#8482)
sync: add blocking_acquire methods to Semaphore (#8269)
sync: add watch::Receiver::is_closed (#8481)
wasm: support JSPI for Emscripten target (#8285, #8627)
wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

fs: reject zero in File::set_max_buf_size (#8449)
io: make copy_buf cooperative (#8459)
io: panic when BufReader or BufStream is created with zero capacity (#8494)
io: panic when in-memory pipe is created with zero capacity (#8397)
io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
io: support vectored writes in Sink (#8663)
net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
net: start accepted sockets as readable and writable (#8435)
net: support UCred on Fuchsia (#8257)
process: use mio::unix::pipe for Unix child stdio (#8603)
runtime: cache-pad the shared injection queue and idle state (#8622)
runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
runtime: make enable_io available whenever rt is enabled (#8387)
runtime: move block_in_place setup into a non-generic function (#8315)
runtime: move the multi-thread inject queue to its own mutex (#8382)
runtime: panic when max_io_events_per_tick is zero (#8476)
runtime: suggest .await in nested block_on panic message (#8501)
sync: avoid atomic reader count in broadcast slots (#8357)
sync: use acquire/release orderings in Notify (#8325)
time: remove the runtime handle from timers (#8458)

Fixed

fs: restore File internal state when op fails (#8291)
io: complete zero-length memory stream operations immediately (#8323)
io: flush the writer when the reader stalls in copy_buf (#8424)
io: keep the shutdown bit when clearing readiness (#8435)
io: preserve the full ScheduledIo tick in readiness events (#8331)
io: read lines as bytes so a partial line survives an I/O error (#8400)
io: retry on ErrorKind::Interrupted in more I/O operations (#8417, #8432, #8448, #8453, #8455, #8460)
io: use spawn_mandatory_blocking for stdout and stderr (#8506)
io: wait for pending operations before BufReader seeks (#8599)
net: close CreateFileW handle on SetNamedPipeHandleState failure (#8418)
net: fix peer credentials on NetBSD (#8589)
net: saturate TcpSocket and UnixSocket listen backlog (#8511)
net: treat ENOTCONN as success in UnixStream::shutdown (#8526)
runtime: allow building with --all-features without tokio_unstable (#8401)
runtime: avoid overflow in shutdown_timeout() (#8497)
runtime: fix spawn_blocking hang when only scheduler workers exist (#8408)
runtime: fix misleading signal driver panic message (#8419)
sync: preserve FIFO lock order when coop budget is exhausted (#8371)
sync: use usize for permit count in SemaphorePermit (#8405)
time: avoid interval deadline overflow (#8385)
time: handle wrapped top-level timer-wheel slots (#8334)

Unstable

fs: fall back when io_uring has no IO driver (#8165)
metrics: cap log histogram precision (#8496)
runtime: add an opt-in sharded spawn_blocking queue (#8337)
runtime: expose schedule latency in task hooks (#8282)
taskdump: fix idle bookkeeping when a task dump wakes parked workers (#8372)
taskdump: skip non-idle tasks during taskdumps (#8568)

Documented

docs: fix stray braces and broken links in rustdoc (#8605)
fs: document cancellation behavior of tokio::fs (#8265)
net: add Safety docs for named pipe from_raw_handle (#8378)
net: document that TcpStream::connect returns only the last error (#8421)
runtime: add error documentation for runtime::Builder (#8297)
runtime: link available_parallelism in worker count docs (#8625)
sync: clarify panic behavior of broadcast::channel() (#8420)
sync: fix typo in Semaphore documentation (#8521)

`v1.53.3`: Tokio v1.53.3

Compare Source

1.53.3 (October 13th, 2026)

Added

io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

io: wake and drop DuplexStream wakers outside the lock (#8618)
macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
sync: wake waiters outside the lock when closing a semaphore (#8529)
test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

rt: keep io_uring op alive when submission fails after push (#8185)

`v1.53.2`: Tokio v1.53.2

Compare Source

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)
io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
process: unregister Windows wait before closing child handle (#8564)
rt: drop blocking pool mutex before shutting down rejected task (#8562)
sync: fix mpsc index wraparound in block reclamation (#8546)
sync: forget mpsc Permit before sending value (#8560)
sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
sync: wake broadcast Sender::closed outside mutex (#8558)
task: drop replaced waker outside lock in JoinSet (#8554)
time: drop timer lock before dropping waker in clear_entry (#8552)
time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

fs: clamp io_uring read length to u32::MAX (#8572)
rt: ignore current_thread task dumps from other runtimes (#8544)
rt: preserve io_uring context if a completion waker panics (#8566)
sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
taskdump: restore deferred leaf wakes during capture (#8445)
time: drop stored waker when cancelling alt timer entry (#8550)

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-11-01T01:41:56Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tokio@1.53.1 ⏵ 1.54.1	^-2
	serde_json@1.0.151 ⏵ 1.0.154
	flate2@1.1.10 ⏵ 1.1.11
	proptest@1.11.0 ⏵ 1.12.0

View full report

renovate Bot added the dependencies label Nov 1, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 9fcc8bc to 9d25531 Compare November 6, 2026 02:09

chore(deps): update all non-major dependencies

4edd5cc

renovate Bot force-pushed the renovate/all-minor-patch branch from 9d25531 to 4edd5cc Compare November 6, 2026 12:15

Navigation Menu

Repository navigation

chore(deps): update all non-major dependencies - #62

chore(deps): update all non-major dependencies#62
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Features

Bug Fixes

What's Changed

New Contributors

What's Changed

New Contributors

Fixed

Other

Language

Compiler

Platform Support

Libraries

Stabilized APIs

Cargo

Rustdoc

Compatibility Notes

Internal Changes

v1.54.1: Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

v1.54.0: Tokio v1.54.0

1.54.0 (October 19th, 2026)

Added

Changed

Fixed

Unstable

Documented

v1.53.3: Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

Changed

Fixed

Fixed (unstable)

v1.53.2: Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

Fixed (unstable)

Configuration

Uh oh!

socket-security Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 1, 2026 •

edited

Loading

`v1.54.1`: Tokio v1.54.1

`v1.54.0`: Tokio v1.54.0

`v1.53.3`: Tokio v1.53.3

`v1.53.2`: Tokio v1.53.2

socket-security Bot commented Nov 1, 2026 •

edited

Loading