chore(deps): bump the rust-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the rust-dependencies group with 8 updates in the / directory:

Package	From	To
blake3	1.8.6	1.8.7
clap	4.6.6	4.6.7
toml	1.1.4+spec-1.1.0	1.1.6+spec-1.1.0
reqwest	0.13.4	0.13.5
rustls	0.23.43	0.23.45
yaml-rust2	0.11.0	0.13.0
zstd	0.13.3	0.14.0
rcgen	0.14.9	0.14.10

Updates blake3 from 1.8.6 to 1.8.7

Release notes

Sourced from blake3's releases.

1.8.7

version 1.8.7

Changes since 1.8.6:

• Remove the arrayref dependency. Unfortunately the crates.io owner was compromised.

Commits

• f3149ec version 1.8.7
• b65bcb7 add #[allow(deprecated)] annotations to fix nightly/beta warnings
• 483a220 fix warnings related to not using MAX constants
• ba02549 Codex: remove arrayref
• See full diff in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits

• 572c005 chore: Release
• 66d0c53 docs: Update changelog
• 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
• 0ff90db perf(display): Write encoded strings directly
• efb2536 perf(display): Move generated representation strings
• 075c444 refactor(display): Consolidate key-path encoding
• b48f338 perf(display): Borrow table keys during document output
• c6c1de3 perf(parser): Move completed table header keys
• ec90463 perf(parser): Borrow input when creating editable documents
• d76a48a test: Benchmark rendering generated keys and values
• Additional commits viewable in compare view

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

• fix(blocking): preserve version and extensions in TryFromhttp::Request by @​wwhsaber in seanmonstar/reqwest#3050
• Remove unnecessary clones by @​FranciscoTGouveia in seanmonstar/reqwest#3052
• Add Referrer and Referrer Policy methods to WASM Request API by @​Billy-Sheppard in seanmonstar/reqwest#3049
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in seanmonstar/reqwest#3058
• feat: add Error::is_dns() to identify DNS resolution failures by @​JoakoI98 in seanmonstar/reqwest#3057
• Fix blocking client timeout panic by @​V-Mann-Nick in seanmonstar/reqwest#3060
• Use LookupIpStrategy::Ipv6AndIpv4 to actually prefer IPv6 when using hickory-dns by @​FalkWoldmann in seanmonstar/reqwest#3063
• feat: Add ClientBuilder::http1_max_headers by @​smaeda-ks in seanmonstar/reqwest#3065
• feat: expose the negotiated TLS version via TlsInfo by @​dennisameling in seanmonstar/reqwest#3067
• fix(error): detect timeouts wrapped in body decode errors by @​raphaelroshan in seanmonstar/reqwest#3064
• Remove unnecessary clones and a cast by @​FranciscoTGouveia in seanmonstar/reqwest#3071
• chore(deps): upgrade base64 to 0.23 by @​paolobarbolini in seanmonstar/reqwest#3074
• perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody by @​spellsaif in seanmonstar/reqwest#3085
• fix(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture::poll by @​spellsaif in seanmonstar/reqwest#3084
• src/async_impl/request.rs_improved_doc_for_json_fn: by @​Athleteg in seanmonstar/reqwest#3082
• fix: proxy could use wrong credentials if many matched by @​seanmonstar in seanmonstar/reqwest#3098

New Contributors

• @​wwhsaber made their first contribution in seanmonstar/reqwest#3050
• @​FranciscoTGouveia made their first contribution in seanmonstar/reqwest#3052
• @​Billy-Sheppard made their first contribution in seanmonstar/reqwest#3049
• @​JoakoI98 made their first contribution in seanmonstar/reqwest#3057
• @​V-Mann-Nick made their first contribution in seanmonstar/reqwest#3060
• @​FalkWoldmann made their first contribution in seanmonstar/reqwest#3063
• @​smaeda-ks made their first contribution in seanmonstar/reqwest#3065
• @​raphaelroshan made their first contribution in seanmonstar/reqwest#3064
• @​spellsaif made their first contribution in seanmonstar/reqwest#3085
• @​Athleteg made their first contribution in seanmonstar/reqwest#3082

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

Commits

• de55373 v0.13.5
• 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
• 9f06fd2 docs: improve description of JSON method (#3082)
• 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
• ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
• 4e9a3c7 chore: add pull request template for human-written content
• 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
• 221abe9 chore: Remove unnecessary clones and a cast (#3071)
• 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
• fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
• Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.45

Commits

• 2976d90 Prepare 0.23.45
• f9d4ee9 Handshake "alignment" check covers previously-received messages
• c4e92e8 Keep data needed for HRR processing together
• e553a7a server: TLS1.2 is not available after a HRR
• 5dff9da Test whether server negotiates TLS1.2 after HRR
• 185a063 reject a second ClientHello that changes the cipher suite
• 9fafe6d reject a second ClientHello that drops pre_shared_key
• 1b42c5f providers: zeroize private key DER
• 64ad386 Bump version to 0.23.44
• 1efbf66 bogo: remove PostQuantum setup
• Additional commits viewable in compare view

Updates yaml-rust2 from 0.11.0 to 0.13.0

Changelog

Sourced from yaml-rust2's changelog.

v0.13.0

Changes:

• (#82) encoding_rs was pinned to versions prior to v0.8.40 to maintain the current MSRV.

Development:

• Applied clippy fixes.

v0.12.0

Changes:

• The minimum supported Rust version is now v1.85.0.
• hashlink was upgraded to v0.12.1.
• quickcheck (dev-only dependency) was upgraded to v1.1.0.
• toml (dev-only dependency) was upgraded to v1.1.4.
• (#79) corrected the documentation for Marker::index.

v0.11.1

Changes:

• (#78) Fix parsing short YAML documents to avoid infinite loops.

Commits

• e120694 yaml-rust2 v0.13.0
• 3656505 cargo: pin encoding_rs to versions < 0.8.40 to maintain MSRV
• 8c25872 garden: validate MSRV for the encoding feature flag
• 4212204 garden: add "publish" command
• 461e383 chore(deps): Update Rust crate libtest-mimic to v0.8.2 (#80)
• e1741ae tools: apply clippy fixes
• c015b50 CHANGELOG: reformat for readability
• 3a06469 CHANGELOG: issue typofix
• 0ed0fc7 yaml-rust v0.12.0
• 0534dad scanner: correct the docstring that referenced chars
• Additional commits viewable in compare view

Updates zstd from 0.13.3 to 0.14.0

Commits

• 648acb4 Avoid let...else in the seekable callbacks
• e1152c1 Bump versions for the next release
• 7caed6e Derive the usual traits on ResetDirective
• bf7b1f7 Refuse to reuse a context an error may have left undefined
• 1565618 Check the target, not the host, for MSVC
• 8315a62 Return Ok(0) from Read::read for an empty buffer
• a7cfa93 Keep the std gate on the Cursor WriteBuf impl
• 9bf1692 Say why the Send and Sync impls hold
• 681bcc3 Don't truncate Cursor positions on 32-bit targets
• d5a1fdd Don't hand out a &mut Seekable from AdvancedSeekable
• Additional commits viewable in compare view

Updates rcgen from 0.14.9 to 0.14.10

Release notes

Sourced from rcgen's releases.

0.14.10

What's Changed

• Spec compliance bug fixes by @​cpu in rustls/rcgen#445
• Take advantage of stable ML-DSA in aws-lc-rs by @​djc in rustls/rcgen#447

Commits

• f4a3b16 Bump version to 0.14.10
• dea3d4d Upgrade to botan 0.13
• 788b093 Upgrade to pem 4
• 7ce21f4 Take advantage of stable ML-DSA in aws-lc-rs
• e2dba45 Remove unused RSASSA-PSS signature algorithm
• 37070de Omit reasonCode unspecified(0) from CRL entry extensions
• b247a87 Write extensions for certs that only set KeyUsage or CRLDP
• 85eafdd Reject empty CRL distribution point URIs
• 3a99b50 Encode CRL invalidityDate as GeneralizedTime
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1155c23a-f08f-4f07-91a4-f2f26ca265a0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}