Skip to content

Bump the cargo group with 12 updates - #33

Merged
mattpodwysocki merged 1 commit into
mainfrom
dependabot/cargo/cargo-c4c9973e5d
Sep 21, 2026
Merged

Bump the cargo group with 12 updates#33
mattpodwysocki merged 1 commit into
mainfrom
dependabot/cargo/cargo-c4c9973e5d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 12 updates:

Package From To
clap 4.6.6 4.6.7
clap_complete 4.6.9 4.6.11
cfg-if 1.0.4 1.0.5
clap_builder 4.6.6 4.6.7
clap_derive 4.6.4 4.6.7
clap_lex 1.1.0 1.1.1
quinn 0.11.11 0.11.12
quinn-proto 0.11.17 0.11.18
syn 3.0.5 3.0.6
unicode-ident 1.0.24 1.0.26
yoke-derive 0.8.2 0.8.3
zerofrom-derive 0.1.7 0.1.8

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Commits
  • d3e59a9 chore: Release
  • d997f87 docs: Update changelog
  • fb6058c Merge pull request #6409 from heaths/pwsh-support
  • 2310870 test(complete): Add tests for completer_for_path
  • 5967c17 refactor(complete): Move shell detection to Shells
  • 594602b fix(complete): Detect pwsh for PowerShell
  • 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
  • 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
  • c968b13 chore(deps): Update Rust crate shlex to v2
  • 8f247cb chore(deps): Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates clap_complete from 4.6.9 to 4.6.11

Commits
  • 2cb76fd chore: Release
  • 0b00b8d docs: Update changelog
  • 3443000 Merge pull request #6526 from bonnefoa/fix-completion-escape
  • a1b6be7 fix(clap_complete): Fix value escape in zsh completion
  • face9e8 test(complete): Add completion test without arg's help
  • 88053ab test(complete): Re-enable complete tests
  • e6adcc2 chore(release): Simplify replacements
  • 13f2db5 chore: Release
  • 3304fea docs: Update changelog
  • 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
  • Additional commits viewable in compare view

Updates cfg-if from 1.0.4 to 1.0.5

Release notes

Sourced from cfg-if's releases.

v1.0.5

  • Add a note that this crate is deprecated, suggesting cfg_select! instead
Changelog

Sourced from cfg-if's changelog.

1.0.5 - 2026-09-16

  • Add a note that this crate is deprecated, suggesting cfg_select! instead
Commits
  • 8b0a2b0 Deprecation notice + crate version bump
  • efabe3f Add a changelog entry for the upcoming deprecation notice
  • a66c2d4 Bump actions/checkout from 6 to 7
  • bda9677 Bump actions/checkout from 5 to 6
  • See full diff in compare view

Updates clap_builder from 4.6.6 to 4.6.7

Release notes

Sourced from clap_builder's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Changelog

Sourced from clap_builder's changelog.

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Commits
  • 13f2db5 chore: Release
  • 3304fea docs: Update changelog
  • 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
  • 4380302 chore(deps): Update Rust crate trybuild to v1.0.120 (#6509)
  • a812461 Merge pull request #6528 from epage/template
  • 710884f style: Make clippy happy
  • ce800a3 chore: Update from _rust template
  • 78d70f3 feat(derive): Defer enum subcommand initialization
  • 2b2d881 test(derive): Cover subcommand initialization
  • 7f87020 test(derive): Build before nested introspection
  • Additional commits viewable in compare view

Updates clap_derive from 4.6.4 to 4.6.7

Release notes

Sourced from clap_derive's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

v4.6.6

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args
Changelog

Sourced from clap_derive's changelog.

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args
Commits
  • 13f2db5 chore: Release
  • 3304fea docs: Update changelog
  • 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
  • 4380302 chore(deps): Update Rust crate trybuild to v1.0.120 (#6509)
  • a812461 Merge pull request #6528 from epage/template
  • 710884f style: Make clippy happy
  • ce800a3 chore: Update from _rust template
  • 78d70f3 feat(derive): Defer enum subcommand initialization
  • 2b2d881 test(derive): Cover subcommand initialization
  • 7f87020 test(derive): Build before nested introspection
  • Additional commits viewable in compare view

Updates clap_lex from 1.1.0 to 1.1.1

Changelog

Sourced from clap_lex's changelog.

v1.1.1 (2015-07-17)

Bug Fixes

  • fixes a logic bug and allows setting Arg::number_of_values() < 2 (42b6d1fc, closes #161)
Commits
  • 13f2db5 chore: Release
  • 3304fea docs: Update changelog
  • 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
  • 4380302 chore(deps): Update Rust crate trybuild to v1.0.120 (#6509)
  • a812461 Merge pull request #6528 from epage/template
  • 710884f style: Make clippy happy
  • ce800a3 chore: Update from _rust template
  • 78d70f3 feat(derive): Defer enum subcommand initialization
  • 2b2d881 test(derive): Cover subcommand initialization
  • 7f87020 test(derive): Build before nested introspection
  • Additional commits viewable in compare view

Updates quinn from 0.11.11 to 0.11.12

Commits
  • eaec0db Bump versions to 0.11.18 / 0.11.12
  • 4c92955 proto: handle empty ranges in RangeSet::replace
  • 9a66201 proto: avoid panic on high minimum ACK delay
  • abca008 streams: budget send windows against retained storage
  • 3c0adcc streams: release abandoned send buffers on reset
  • d2cf48f quinn: enforce cumulative read_to_end size limits
  • daa5131 quinn: separate read_to_end buffer accumulation
  • 811b548 proto: reject transport parameters with a mismatched length
  • 9bd87c9 proto: preserve the server config for pending incoming connections
  • a708a97 proto: prune queued DATAGRAMs when the active path changes
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.17 to 0.11.18

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.18, quinn 0.11.12

Three more security issues were reported and fixed since 0.11.17:

What's Changed

Commits
  • eaec0db Bump versions to 0.11.18 / 0.11.12
  • 4c92955 proto: handle empty ranges in RangeSet::replace
  • 9a66201 proto: avoid panic on high minimum ACK delay
  • abca008 streams: budget send windows against retained storage
  • 3c0adcc streams: release abandoned send buffers on reset
  • d2cf48f quinn: enforce cumulative read_to_end size limits
  • daa5131 quinn: separate read_to_end buffer accumulation
  • 811b548 proto: reject transport parameters with a mismatched length
  • 9bd87c9 proto: preserve the server config for pending incoming connections
  • a708a97 proto: prune queued DATAGRAMs when the active path changes
  • Additional commits viewable in compare view

Updates syn from 3.0.5 to 3.0.6

Release notes

Sourced from syn's releases.

3.0.6

  • Fix parsing interpolated lifetime at statement start (#2082)
Commits
  • 559cab5 Release 3.0.6
  • 9088cad Merge pull request #2082 from dtolnay/lifetimevar
  • 3eb43bb Fix parsing interpolated lifetime at statement start
  • 7b2f6f9 Add regression test for issue 2081
  • d55bcd2 Update test suite to nightly-2026-09-13
  • 8e37bca Resolve non_kebab_case_bins warning
  • 4dfd88f Update test suite to nightly-2026-09-06
  • See full diff in compare view

Updates unicode-ident from 1.0.24 to 1.0.26

Release notes

Sourced from unicode-ident's releases.

1.0.26

  • Use entry within trie as fallback for out-of-range codepoints (#50, thanks @​Marcondiro)

1.0.25

  • Update to Unicode 18.0.0 (#51)
Commits
  • 48771a6 Release 1.0.26
  • c96ef8c Merge pull request 50 from Marcondiro/branchless-fallback
  • 025b17a Release 1.0.25
  • 750c094 Merge pull request #51 from dtolnay/unicode18.0.0
  • 8f62fe4 Update to Unicode 18.0.0
  • 359c15f Fix regenerate command
  • 528a906 Use entry within trie as fallback for out-of-range codepoints
  • b23d56c Update actions/upload-artifact@v6 -> v7
  • c4d1332 Update actions/checkout@v6 -> v7
  • 673c288 Raise minimum tested compiler to Rust 1.90
  • Additional commits viewable in compare view

Updates yoke-derive from 0.8.2 to 0.8.3

Changelog

Sourced from yoke-derive's changelog.

Changelog

icu4x 2.3.x

Several crates have had patch releases in the 2.3 stream:

  • Components
    • (2.3.1) icu
      • Remove dev-dependency on unpublished crate icu_host_info (unicode-org#8404)
    • (2.3.1) icu_collator
      • Fix panic when a contraction contracts a starter, does not contract a following non-starter, and the non-starter starts another contraction. Occurs in Burmese. (unicode-org#8380)
    • (2.3.1) icu_locale
      • Remove unnecessary dependencies on icu_pattern when unstable feature is not enabled (unicode-org#8397)
  • Data model and providers
    • (2.3.1) icu_provider
      • Improve performance of data loading that uses locale fallback (unicode-org#8406)
    • (2.3.1) icu_provider_source
      • Fix checksum on 32-bit systems (unicode-org#8401)
  • FFI
    • General
      • Upate to Diplomat 0.16.1 (unicode-org#8411)
    • (2.3.1) icu_capi
      • Add missing docs to properties (unicode-org#8407)
    • (2.3.2) icu_capi
      • Add missing stability annotations (unicode-org#8462)
    • (2.3.1) Dart
    • (2.3.2) Dart
      • Cache downloaded pre-built binaries (unicode-org#8426)
      • Add missing stability annotations (unicode-org#8462)
    • (2.3.1) NPM
    • (2.3.2) NPM
      • Add missing stability annotations (unicode-org#8462)
  • Utils
    • (0.2.2) databake-derive
      • Update to syn@3 dependency (unicode-org#8293)
    • (0.8.3) yoke-derive
      • Update to syn@3 dependency (unicode-org#8293)
    • (0.1.8) zerofrom-derive
      • Update to syn@3 dependency (unicode-org#8293)
    • (0.11.5, 0.11.6) zerovec-derive
      • (0.11.5) Fix soundness issue around multi element buffer validation in ULE derives (unicode-org#8393)
      • (0.11.6) Fix when building with MIRIFLAGS=-Zmiri-tree-borrows (unicode-org#8391)
    • (0.11.8) zerovec
      • Fix length check in impl ULE for [T; N] (unicode-org#8400)

icu4x 2.3

  • Components

... (truncated)

Commits

Updates zerofrom-derive from 0.1.7 to 0.1.8

Changelog

Sourced from zerofrom-derive's changelog.

Changelog

icu4x 2.3.x

Several crates have had patch releases in the 2.3 stream:

  • Components
    • (2.3.1) icu
      • Remove dev-dependency on unpublished crate icu_host_info (unicode-org#8404)
    • (2.3.1) icu_collator
      • Fix panic when a contraction contracts a starter, does not contract a following non-starter, and the non-starter starts another contraction. Occurs in Burmese. (unicode-org#8380)
    • (2.3.1) icu_locale
      • Remove unnecessary dependencies on icu_pattern when unstable feature is not enabled (unicode-org#8397)
  • Data model and providers
    • (2.3.1) icu_provider
      • Improve performance of data loading that uses locale fallback (unicode-org#8406)
    • (2.3.1) icu_provider_source
      • Fix checksum on 32-bit systems (unicode-org#8401)
  • FFI
    • General
      • Upate to Diplomat 0.16.1 (unicode-org#8411)
    • (2.3.1) icu_capi
      • Add missing docs to properties (unicode-org#8407)
    • (2.3.2) icu_capi
      • Add missing stability annotations (unicode-org#8462)
    • (2.3.1) Dart
    • (2.3.2) Dart
      • Cache downloaded pre-built binaries (unicode-org#8426)
      • Add missing stability annotations (unicode-org#8462)
    • (2.3.1) NPM
    • (2.3.2) NPM
      • Add missing stability annotations (unicode-org#8462)
  • Utils
    • (0.2.2) databake-derive
      • Update to syn@3 dependency (unicode-org#8293)
    • (0.8.3) yoke-derive
      • Update to syn@3 dependency (unicode-org#8293)
    • (0.1.8) zerofrom-derive
      • Update to syn@3 dependency (unicode-org#8293)
    • (0.11.5, 0.11.6) zerovec-derive
      • (0.11.5) Fix soundness issue around multi element buffer validation in ULE derives (unicode-org#8393)
      • (0.11.6) Fix when building with MIRIFLAGS=-Zmiri-tree-borrows (unicode-org#8391)
    • (0.11.8) zerovec
      • Fix length check in impl ULE for [T; N] (unicode-org#8400)

icu4x 2.3

  • Components

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the cargo group with 12 updates
1cc6a75 
Bumps the cargo group with 12 updates:

| Package | From | To |
| --- | --- | --- |
| [clap](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.6.9` | `4.6.11` |
| [cfg-if](https://github.com/rust-lang/cfg-if) | `1.0.4` | `1.0.5` |
| [clap_builder](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` |
| [clap_derive](https://github.com/clap-rs/clap) | `4.6.4` | `4.6.7` |
| [clap_lex](https://github.com/clap-rs/clap) | `1.1.0` | `1.1.1` |
| [quinn](https://github.com/quinn-rs/quinn) | `0.11.11` | `0.11.12` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.17` | `0.11.18` |
| [syn](https://github.com/dtolnay/syn) | `3.0.5` | `3.0.6` |
| [unicode-ident](https://github.com/dtolnay/unicode-ident) | `1.0.24` | `1.0.26` |
| [yoke-derive](https://github.com/unicode-org/icu4x) | `0.8.2` | `0.8.3` |
| [zerofrom-derive](https://github.com/unicode-org/icu4x) | `0.1.7` | `0.1.8` |


Updates `clap` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.6...clap_complete-v4.6.7)

Updates `clap_complete` from 4.6.9 to 4.6.11
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.9...clap_complete-v4.6.11)

Updates `cfg-if` from 1.0.4 to 1.0.5
- [Release notes](https://github.com/rust-lang/cfg-if/releases)
- [Changelog](https://github.com/rust-lang/cfg-if/blob/main/CHANGELOG.md)
- [Commits](rust-lang/cfg-if@v1.0.4...v1.0.5)

Updates `clap_builder` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@v4.6.6...v4.6.7)

Updates `clap_derive` from 4.6.4 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@v4.6.4...v4.6.7)

Updates `clap_lex` from 1.1.0 to 1.1.1
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_lex-v1.1.0...clap_lex-v1.1.1)

Updates `quinn` from 0.11.11 to 0.11.12
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-0.11.11...quinn-0.11.12)

Updates `quinn-proto` from 0.11.17 to 0.11.18
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.17...quinn-proto-0.11.18)

Updates `syn` from 3.0.5 to 3.0.6
- [Release notes](https://github.com/dtolnay/syn/releases)
- [Commits](dtolnay/syn@3.0.5...3.0.6)

Updates `unicode-ident` from 1.0.24 to 1.0.26
- [Release notes](https://github.com/dtolnay/unicode-ident/releases)
- [Commits](dtolnay/unicode-ident@1.0.24...1.0.26)

Updates `yoke-derive` from 0.8.2 to 0.8.3
- [Release notes](https://github.com/unicode-org/icu4x/releases)
- [Changelog](https://github.com/unicode-org/icu4x/blob/main/CHANGELOG.md)
- [Commits](https://github.com/unicode-org/icu4x/commits/ind/yoke@0.8.3)

Updates `zerofrom-derive` from 0.1.7 to 0.1.8
- [Release notes](https://github.com/unicode-org/icu4x/releases)
- [Changelog](https://github.com/unicode-org/icu4x/blob/main/CHANGELOG.md)
- [Commits](https://github.com/unicode-org/icu4x/commits)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap_complete
  dependency-version: 4.6.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: cfg-if
  dependency-version: 1.0.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap_builder
  dependency-version: 4.6.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap_derive
  dependency-version: 4.6.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap_lex
  dependency-version: 1.1.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: quinn
  dependency-version: 0.11.12
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: quinn-proto
  dependency-version: 0.11.18
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: syn
  dependency-version: 3.0.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: unicode-ident
  dependency-version: 1.0.26
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: yoke-derive
  dependency-version: 0.8.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: zerofrom-derive
  dependency-version: 0.1.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 21, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 21, 2026 08:18
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 21, 2026
mattpodwysocki
mattpodwysocki approved these changes Sep 21, 2026
View reviewed changes

@mattpodwysocki mattpodwysocki left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving. Routine lockfile bump, and the things worth checking on a clap update all hold.

Two direct dependencies move, both patch-level inside the "4" this crate declares: clap 4.6.6 → 4.6.7 and clap_complete 4.6.9 → 4.6.11. The other eleven are transitive.

One thing dependabot's summary doesn't mention

The table lists 12 packages; the lockfile changes 13. The extra one is:

synstructure   0.13.2 -> 0.14.0

Worth a second look for two reasons: it isn't in the PR body at all, and on a 0.x crate a minor bump is semver-incompatible by cargo's rules — so it's the one change here that isn't a patch.

It turns out to be harmless, but only after checking rather than assuming:

synstructure v0.14.0
└── yoke-derive v0.8.3 (proc-macro)
    └── yoke → icu_collections → icu_normalizer → idna_adapter → idna → url

That's the URL-parsing chain, which this CLI leans on for path_segment and redacted_url. But yoke-derive is a proc-macro crate, so synstructure runs at build time and ships in nothing, and url itself is unchanged at 2.5.8 — it doesn't appear in the diff. So there's no runtime path from this to URL handling.

Flagging it mainly because "12 updates" in the title and 13 in the file is the kind of gap worth knowing dependabot leaves, next time one of these lands on something less inert.

What I verified

Not on CI's word alone — in a clean checkout, since my first attempt was in a scratch clone that turned out to have missing git objects and I threw the results away rather than report them.

  • 603 tests across 12 suites, 0 failures. cargo fmt --check and cargo clippy --locked --all-targets clean.

  • cargo audit: exit 0, 201 crate dependencies, no vulnerabilities. So this is routine maintenance rather than a security fix — nothing here closes an advisory, and nothing opens one.

  • The user-visible surface is byte-identical to main:

    --schema            identical   (85,466 bytes)
--help              identical
completion bash     identical   (5,554 lines)

    That last check is the one that matters for a clap bump. clap builds this CLI's entire command tree, so a behavior change there would surface as a changed schema or a changed completion script before any test noticed — and none of the three moved.

Also worth noting it's based on main. Earlier dependabot PRs here targeted a branch that no longer takes changes and had to be closed; that fix is holding.

@mattpodwysocki
mattpodwysocki merged commit d66ad50 into main Sep 21, 2026
8 checks passed
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-c4c9973e5d branch September 21, 2026 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mattpodwysocki mattpodwysocki mattpodwysocki approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mattpodwysocki