[dependabot]

Bumps the rust-dependencies group with 8 updates:

Package	From	To
rustyline	14.0.0	19.0.0
bincode	1.3.3	3.0.0
llvm-sys	231.0.1	231.0.2
ureq	2.12.1	3.5.1
rand	0.8.8	0.10.3
zip	9.1.3	9.4.1
calamine	0.37.0	0.38.0
log	0.4.34	0.4.35

Updates rustyline from 14.0.0 to 19.0.0

Release notes

Sourced from rustyline's releases.

19.0.0

What's Changed

• Fix some clippy #936
• Bump to actions/checkout@v6 #937
• Ignore clippy::collapsible_match #925
• Replace cfg_if by cfg_select #935
• Replace some cfg(not by cfg_select #939
• Bump rusqlite version #940
• Fix clippy warnings #942
• Fix clippy errors #945
• Use std::assert_matches #941
• Fix page_completions #948 (#949)
• Simplify creation of an editor with a default helper #950
• Coverage #891
• Edition 2024 #952
• Test --no-default-features #953
• Rustfmt group_imports & imports_granularity #956
• Update syn requirement from 2.0.116 to 3.0.2 #958
• Fix clippy warnings #962
• Simplify test code #965
• Simplify tests #967
• Accept Tab as confirmation at the completion list prompt #955 (#968)
• Read VEOF before writing VTIME #970 (#971)
• Fix FTS queries #966, #972 (#973, #989)
• Fix clippy warnings #975
• Check input buffer before polling #976 (#977)
• Fix page completions #980 (#981)
• Rustfmt #982

Full Changelog: kkawakam/rustyline@v18.0.0...v19.0.0

18.0.1

What's Changed

• Fix page_completions #949, #948

Full Changelog: kkawakam/rustyline@v18.0.0...v18.0.1

18.0.0

What's Changed

• Support minimal repaint #882
• Fix edit_kill #887, #885
• On windows, check that prompt is not styled #890, #889, #836, #562, #702, #215
• Bump windows-sys version #892
• Check NO_COLOR environment variable #894
• Fix clippy warning #896
• Update radix_trie requirement from 0.2 to 0.3 #898
• Introduce Prompt trait for styling #893
• Fix partial refresh #899, #897
• Remove doc_auto_cfg #900

... (truncated)

Commits

• 44c7025 Merge pull request #990 from gwenn/19
• 7a5033d Prepare release
• 98beff8 Merge pull request #989 from gwenn/fts
• badf865 Improve FTS queries
• 05eb920 Merge pull request #982 from gwenn/fmt
• 58b38c6 Rustfmt
• 705f9cd Merge pull request #981 from kkawakam/page_completions
• 3053c59 Fix page completions
• b5d88b9 Merge pull request #977 from gwenn/buffer_vs_printer
• f2bbcc5 Check input buffer before polling
• Additional commits viewable in compare view

Updates bincode from 1.3.3 to 3.0.0

Commits

• See full diff in compare view

Updates llvm-sys from 231.0.1 to 231.0.2

Commits

• fb64859 chore: Release llvm-sys version 231.0.2
• 62cdb0e Merge branch 'fix-typo' into 'main'
• 11a7662 Fix typo in name of LLVMDbgVariableRecordGetExpression.
• See full diff in compare view

Updates ureq from 2.12.1 to 3.5.1

Changelog

Sourced from ureq's changelog.

3.5.1

• Bump ureq-proto to 0.7.1 (fixes to connection reuse and transfer encoding) #1224
• Send only cookie names and values in request Cookie headers #1222
• Preserve readable responses after macOS rejects timeout changes on closed sockets #1220

3.5.0

• Prepare 3.5.0 and fix dependency advisories and warnings - #1217
• Add Agent::shutdown() to interrupt requests in flight and close all connections #1211
• Preserve validated request header casing with RequestBuilder::header_raw #1214
• Decode proxy URL credentials once; literal percent signs must be escaped as %25 #1215
• Encode ProxyBuilder credentials and preserve colons in proxy passwords #1215
• Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #1209
• Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #1209
• Clarify timeout budgets, phase boundaries, and proxy DNS #1213
• Bound TLS handshake I/O by the remaining connect/global timeout #1208
• Retry socket reads interrupted by EINTR when timeout (technically breaking) #1205
• Fix native-tls-no-default enabling dependencies without enabling the TLS connector
• Add timeout_per_read and timeout_per_write independently of total phase budgets

3.4.3

• Update TLS dependencies for security fixes #1218

3.4.2

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
• Bypass pooling for request connection settings incompatible with the Agent #1201
• Try the next resolved address on unreachable/unavailable connect errors #1195

3.4.1

• Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199
• Do not pool connections with unconsumed buffered input #1198
• Fix timeout budgets restarting and applying to later phases #1194
• Complete TLS handshake during connect so timeout_connect covers it #1193
• Speed up read_json for responses with a known, small body size #1191

3.4.0

• Seal RequestExt (technically breaking) #1189
• Send canonical Basic authentication scheme to CONNECT proxies #1185
• Establish target TLS through HTTPS CONNECT proxies #1183
• Update rustls-platform-verifier to 0.7.0 #1174
• Fix pooled connections never aging out according to max_idle_age #1172
• Strip brackets from IPv6-literal hosts before TLS SNI/ServerName #1171
• RequestExt::middleware_config for conf inside middleware #1169

3.3.0

... (truncated)

Commits

• 33ca9d3 3.5.1
• d1b194c Bump ureq-proto to 0.7.1
• 81d1b40 Bump ureq-proto to 0.7.0
• 0cbee9a docs: clarify body read limit defaults (#1223)
• f92baae Send only cookie names and values in the Cookie header
• f60896d Preserve readable responses after macOS timeout setter failures
• 1bd534e Fix changelog
• fee0ad2 Prepare 3.5.0 and fix dependency advisories and warnings
• 7de0ab7 Remove realtime dependencies from tests
• 3f18f90 Add Agent::shutdown() for active and pooled connections
• Additional commits viewable in compare view

Updates rand from 0.8.8 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

• Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)
• Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)
• Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

• Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

[0.10.2] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
• Use Edition 2024 and MSRV 1.85 (#1653)
• Let Fill be implemented for element types, not sliceable types (#1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
• Remove Clone support for StdRng, ReseedingRng (#1677)
• Use postcard instead of bincode to test the serde feature (#1693)

... (truncated)

Commits

• 9e7d328 Prepare rand 0.10.3 (#1840)
• f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
• ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
• c994eb1 docs: fix angle unit in quick start example (#1839)
• 33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
• 94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
• bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
• 521fab6 Stop pinning dependencies (#1820)
• 3f7c433 Stop pinning dependencies
• cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
• Additional commits viewable in compare view

Updates zip from 9.1.3 to 9.4.1

Release notes

Sourced from zip's releases.

v9.4.1

🐛 Bug Fixes

• Add a OwnedZipFileEntry for #177 (#1270)

🚜 Refactor

• Use boxed slices instead of Vec when growability isn't needed (#1271)

v9.4.0

🚀 Features

• Implement ZipIterable::files_with_reader (#1267)

v9.3.0

🚀 Features

• (write) implement TryFrom for PreparedZipFile (#1258)

v9.2.3

🐛 Bug Fixes

• (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

• Replace std:: with core:: where possible (#1253)

v9.2.2

🚜 Refactor

• Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

• Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.1

🚜 Refactor

• Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

• Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.0

🚀 Features

• (write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)

... (truncated)

Changelog

Sourced from zip's changelog.

9.4.1 - 2026-11-06

🐛 Bug Fixes

• Add a OwnedZipFileEntry for #177 (#1270)

🚜 Refactor

• Use boxed slices instead of Vec when growability isn't needed (#1271)

9.4.0 - 2026-11-05

🚀 Features

• Implement ZipIterable::files_with_reader (#1267)

9.3.0 - 2026-11-03

🚀 Features

• (write) implement TryFrom for PreparedZipFile (#1258)

9.2.3 - 2026-11-03

🐛 Bug Fixes

• (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

• Replace std:: with core:: where possible (#1253)

9.2.2 - 2026-11-01

🚜 Refactor

• Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

• Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

9.2.0 - 2026-10-31

🚀 Features

• (write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)
• add index_for_name_raw (#1210)
• (extract) multi-threaded parallel extraction engine and safe extent pre-allocation (#1207)
• (read) add index-free iterable ZIP reader (#1218)

... (truncated)

Commits

• 96e8cce chore: release v9.4.1 (#1272)
• f1b82f2 docs(example): Fix bug in memory-tracking example where reallocations were co...
• 2308d6d refactor: Use boxed slices instead of Vec when growability isn't needed (#1271)
• b3ad5df fix: Add a OwnedZipFileEntry for #177 (#1270)
• 196b805 chore(deps): update lzma-rust2 from 0.24 to 0.25 (#1268)
• f347dd4 chore: release v9.4.0 (#1269)
• e9b7dcd feat: Implement ZipIterable::files_with_reader (#1267)
• 47765a9 docs(security): Clarify that some "vulnerabilities" are necessary for legitim...
• 53cfe46 ci(deps): bump useblacksmith/checkout from 1.8.1 to 1.8.2 (#1260)
• b66f6b1 ci(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 (#1262)
• Additional commits viewable in compare view

Updates calamine from 0.37.0 to 0.38.0

Release notes

Sourced from calamine's releases.

v0.38.0 - 2026-11-02

Added

• Added an XLSX API to read cell styles. A long requested feature.

  The new worksheet_style() method returns a StyleRange of Style values holding the font, fill, borders, alignment, number format and protection of each cell, with theme and indexed colors resolved, including tints.

  For streaming, XlsxCellReader adds the next_cell_with_style_id() method, which returns each cell value together with its style id in a single pass, and styles() to resolve the id to a Style. Formats without style support return an empty StyleRange. See also the xlsx_style_stream.rs example. [PR #653] and [PR #682].

  [PR #653]: tafia/calamine#653 [PR #682]: tafia/calamine#682

• Added workbook_properties() methods to Xls and Ods in addition to the xlsx and xlsb support in the previous release. The workbook document properties can now be read from all the supported formats, including via open_workbook_auto(). [PR #756] and [PR #757].

  [PR #756]: tafia/calamine#756 [PR #757]: tafia/calamine#757

• Added WorkbookProperties::custom_properties to read the custom, user defined, document properties as a map of property name to text value. [PR #750].

  [PR #750]: tafia/calamine#750

Fixed

• Fixed XLSX reading of packages whose main workbook part isn't named xl/workbook.xml. The part name is now read from _rels/.rels. [Issue #752] and [PR #753].

  [Issue #752]: tafia/calamine#752 [PR #753]: tafia/calamine#753

• Fixed XLSX decoding of _xHHHH_ string escapes to handle all UTF-16 code units, including surrogate pairs, instead of only _x00HH_. [PR #751] and [PR #767].

  [PR #751]: tafia/calamine#751 [PR #767]: tafia/calamine#767

• Fixed XLSB date and time formats not being applied to whole-number cell values stored as integer RK records. These were returned as Data::Int

... (truncated)

Changelog

Sourced from calamine's changelog.

[0.38.0] - 2026-11-02

Added

• Added an XLSX API to read cell styles. A long requested feature.

  The new worksheet_style() method returns a StyleRange of Style values holding the font, fill, borders, alignment, number format and protection of each cell, with theme and indexed colors resolved, including tints.

  For streaming, XlsxCellReader adds the next_cell_with_style_id() method, which returns each cell value together with its style id in a single pass, and styles() to resolve the id to a Style. Formats without style support return an empty StyleRange. See also the xlsx_style_stream.rs example. [PR #653] and [PR #682].

  [PR #653]: tafia/calamine#653 [PR #682]: tafia/calamine#682

• Added workbook_properties() methods to Xls and Ods in addition to the xlsx and xlsb support in the previous release. The workbook document properties can now be read from all the supported formats, including via open_workbook_auto(). [PR #756] and [PR #757].

  [PR #756]: tafia/calamine#756 [PR #757]: tafia/calamine#757

• Added WorkbookProperties::custom_properties to read the custom, user defined, document properties as a map of property name to text value. [PR #750].

  [PR #750]: tafia/calamine#750

Fixed

• Fixed XLSX reading of packages whose main workbook part isn't named xl/workbook.xml. The part name is now read from _rels/.rels. [Issue #752] and [PR #753].

  [Issue #752]: tafia/calamine#752 [PR #753]: tafia/calamine#753

• Fixed XLSX decoding of _xHHHH_ string escapes to handle all UTF-16 code units, including surrogate pairs, instead of only _x00HH_. [PR #751] and [PR #767].

  [PR #751]: tafia/calamine#751 [PR #767]: tafia/calamine#767

• Fixed XLSB date and time formats not being applied to whole-number cell

... (truncated)

Commits

• a4dba3b release: 0.38.0
• 4c11648 tests: rename tests and fixtures to describe what they test (#771)
• 966295c ci: add contributing guide and PR template (#770)
• b8ec4f0 cfb: fix panic and unbounded allocation on malformed compound files (#762)
• 2e80352 xlsb: return an error instead of panicking on malformed BrtName records (#761)
• 0bbe607 xlsx: decode all xHHHH escapes as UTF-16 code units (#767)
• 471982c Fix BIFF5 multibyte string decoding (#765)
• 0db8b93 datetime: roll times that round up to midnight over to the next day (#763)
• 733c60a fix(xlsb): apply date formats to whole-number cell values (#758)
• 0915da4 feat(xls): read workbook document properties (#757)
• Additional commits viewable in compare view

Updates log from 0.4.34 to 0.4.35

Release notes

Sourced from log's releases.

v0.4.35

This release doesn't include source changes. It verifies log's new CI/CD processes.

Other

• rework CI/CD to align with Rust project standards

Changelog

Sourced from log's changelog.

0.4.35 - 2026-10-30

This release doesn't include source changes. It verifies log's new CI/CD processes.

Other

• rework CI/CD to align with Rust project standards

Commits

• a46450b Update CHANGELOG.md
• a715f17 chore: release v0.4.35
• b4e2b12 Merge pull request #747 from rust-lang/chore/release-plz-mgnt
• 6b490b6 run fmt
• 2c7fd52 simplify some crate release tasks for easier automation
• 5bc5545 Merge pull request #745 from marcoienibot/release-plz-disable-semver-check
• 4234b8c Disable release-plz semver check
• 95918ff Merge pull request #744 from Kobzol/trusted-publishing
• e7ed747 Fix Zizmor lints
• e87a3c6 Setup trusted publishing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions