Skip to content

chore(deps)(deps): Bump the prod group across 1 directory with 8 updates#57

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/prod-af8101a360
Open

chore(deps)(deps): Bump the prod group across 1 directory with 8 updates#57
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/prod-af8101a360

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the prod group with 8 updates in the / directory:

Package From To
clap 4.6.1 4.6.2
toml 1.1.2+spec-1.1.0 1.1.3+spec-1.1.0
tokio 1.52.3 1.52.4
http 1.4.1 1.4.2
rmcp 1.7.0 2.2.0
open 5.3.5 5.4.0
chrono 0.4.44 0.4.45
jsonschema 0.46.5 0.48.0

Updates clap from 4.6.1 to 4.6.2

Release notes

Sourced from clap's releases.

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 0fe0be3 chore: Release
  • 480af9d docs: Update changelog
  • 2b3ddd0 Merge pull request #6340 from liskin/fix-completion-escape
  • 7ffe739 fix(complete): Do not suggest options after "--"
  • d47fc4f test(complete): Options suggested after escape (--)
  • See full diff in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

Updates tokio from 1.52.3 to 1.52.4

Release notes

Sourced from tokio's releases.

Tokio v1.52.4

1.52.4 (July 16th, 2026)

Fixed

  • runtime: don't skip the driver when before_park schedules work (#8222)

Fixed (unstable)

  • taskdump: remove crate disambiguators from output (#8264)

#8264: tokio-rs/tokio#8264 #8222: tokio-rs/tokio#8222

Commits

Updates http from 1.4.1 to 1.4.2

Changelog

Sourced from http's changelog.

1.4.2 (June 8, 2026)

  • Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.
  • Fix Uri to properly reject DEL characters.
Commits

Updates rmcp from 1.7.0 to 2.2.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v2.2.0

Added

  • [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

  • fill missing fully qualified syntax in prompt_handler macros (#866)

Other

  • align README examples with v2 model API (#928)

rmcp-v2.2.0

Added

  • reject auth servers lacking S256 PKCE support (#955)

Fixed

  • pass client conformance suite (#960)
  • don't respond to cancelled requests (#957)
  • fail orphaned streamable HTTP responses on reinit (#914)
  • address 2025-11-25 conformance audit findings (#951)

rmcp-macros-v2.1.0

Added

  • [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

  • fill missing fully qualified syntax in prompt_handler macros (#866)

Other

  • align README examples with v2 model API (#928)

rmcp-v2.1.0

Added

  • add SEP-414 trace context meta accessors (#910)
  • add SEP-2575 meta helpers (#942)

Fixed

  • (transport) make AsyncRwTransport::receive cancel-safe (#941) (#947)
  • (auth) preserve refresh_token when refresh response omits it (#949)
  • block redirect header leaks (#936)
  • don't respond to unparsable messages (#940)

... (truncated)

Commits
  • 5195776 chore: release v2.2.0 (#953)
  • 6dd7b85 chore(deps): update p256 requirement from 0.13 to 0.14 (#959)
  • a037935 fix: pass client conformance suite (#960)
  • dbda50c fix: don't respond to cancelled requests (#957)
  • 45f2f72 fix: fail orphaned streamable HTTP responses on reinit (#914)
  • 95490fa feat: reject auth servers lacking S256 PKCE support (#955)
  • bdf0c32 fix: address 2025-11-25 conformance audit findings (#951)
  • 8e44af4 chore: release v2.1.0 (#950)
  • 4833ec7 fix(transport): make AsyncRwTransport::receive cancel-safe (#941) (#947)
  • 5837e22 fix(auth): preserve refresh_token when refresh response omits it (#949)
  • Additional commits viewable in compare view

Updates open from 5.3.5 to 5.4.0

Release notes

Sourced from open's releases.

v5.4.0

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.
  • 1 unique issue was worked on: #124

Commit Details

... (truncated)

Changelog

Sourced from open's changelog.

5.4.0 (2026-07-12)

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.

... (truncated)

Commits
  • b5c12bd Release open v5.4.0
  • bdc3397 Merge pull request #126 from Byron/fix-wsl
  • 7265cae fix: Align WSL PowerShell invocation with Windows
  • 407b058 Merge pull request #125 from Byron/open-with-dash-dash
  • fd29861 fix: prevent launcher option and shell injection (#124)
  • 7c19c0a feat: cargo run now shows the exact commands that were tried when opening.
  • cfb39d8 Release open v5.3.6
  • 41c4cf0 Merge pull request #123 from Byron/avoid-wslview
  • 44d1d41 fix: use PowerShell instead of wslview on WSL (#122)
  • See full diff in compare view

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

Commits
  • 1703382 Prepare 0.4.45 release
  • 881f9ab tz_data: fix tzdata locations on Android
  • f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
  • c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
  • 120686c Bump codecov/codecov-action from 5 to 6
  • See full diff in compare view

Updates jsonschema from 0.46.5 to 0.48.0

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.48.0

Fixed

  • meta.is_valid and meta.validate incorrectly accepted some Draft 2019-09 schemas that the meta-schema rejects.
  • Integers just outside the i64/u64 range incorrectly compared against numeric bounds through lossy f64 rounding (e.g. {"minimum": -9223372036854775808} accepted -9223372036854775809).

Performance

  • Faster multipleOf validation for integer instances with integer divisors, via integer arithmetic instead of floating-point modulo.

[Ruby] Release 0.48.0

Fixed

  • JSONSchema::Meta.valid? and JSONSchema::Meta.validate! incorrectly accepted some Draft 2019-09 schemas that the meta-schema rejects.
  • Integers just outside the i64/u64 range incorrectly compared against numeric bounds through lossy f64 rounding (e.g. {"minimum" => -9223372036854775808} accepted -9223372036854775809).

Performance

  • Faster multipleOf validation for integer instances with integer divisors, via integer arithmetic instead of floating-point modulo.

[Rust] Release 0.48.0

Added

  • iter_errors for #[jsonschema::validator]-generated validators.

Fixed

  • Per-branch context on generated anyOf and oneOf validation errors, matching runtime validators.
  • $recursiveRef in generated validators incorrectly resolved to the innermost $recursiveAnchor (it should resolve to the outermost one).
  • Integer instances just outside the i64/u64 range incorrectly compared against numeric bounds through lossy f64 rounding under arbitrary-precision (e.g. {"minimum": -9223372036854775808} accepted -9223372036854775809).

Changed

  • One canonical number spelling from canonical::json::to_string under arbitrary-precision ("1e-2" becomes "0.01", "1.50" becomes "1.5") and correctly-rounded float parsing (serde_json's float_roundtrip).

Performance

  • Faster multipleOf validation for integer instances with integer divisors, via integer arithmetic instead of floating-point modulo.

[Python] Release 0.47.0

Added

  • Free-threaded wheels for Python 3.15 (3.15t).
  • Optional iter_errors(instance) method on custom keyword validators for reporting multiple errors from a single keyword. #1071

Changed

  • Update pyo3 to 0.29.
  • Clearer import error on free-threaded Python when older pip installs the abi3 wheel. #1131

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.48.0] - 2026-07-16

Added

  • iter_errors for #[jsonschema::validator]-generated validators.

Fixed

  • Per-branch context on generated anyOf and oneOf validation errors, matching runtime validators.
  • $recursiveRef in generated validators incorrectly resolved to the innermost $recursiveAnchor (it should resolve to the outermost one).
  • Integer instances just outside the i64/u64 range incorrectly compared against numeric bounds through lossy f64 rounding under arbitrary-precision (e.g. {"minimum": -9223372036854775808} accepted -9223372036854775809).

Changed

  • One canonical number spelling from canonical::json::to_string under arbitrary-precision ("1e-2" becomes "0.01", "1.50" becomes "1.5") and correctly-rounded float parsing (serde_json's float_roundtrip).

Performance

  • Faster multipleOf validation for integer instances with integer divisors, via integer arithmetic instead of floating-point modulo.

[0.47.0] - 2026-07-08

Added

  • #[jsonschema::validator] attribute macro (behind the macros feature) that compiles a JSON Schema into is_valid and validate implementations at build time.
  • Keyword::iter_errors for reporting multiple validation errors from a single custom keyword. #1071

Changed

  • Bump MSRV to 1.85.0.

Performance

  • Faster meta-schema validation and schema compilation with the macros feature, via compile-time meta-schema validators.

Fixed

  • type under items asserted with the Validation vocabulary disabled.
  • Disabled vocabularies ignored for $ref targets without their own $schema (e.g. $defs entries).

[0.46.10] - 2026-07-05

Fixed

  • Stack overflow with a self-referential $dynamicRef combined with unevaluatedProperties or unevaluatedItems.
  • Incorrect unevaluatedProperties and unevaluatedItems results when a meta-schema disables the Applicator vocabulary.

[0.46.9] - 2026-07-02

Fixed

... (truncated)

Commits
  • ab95859 chore(ruby): Release 0.48.0
  • 11f01d3 chore(python): Release 0.48.0
  • e22ef91 chore(rust): Release 0.48.0
  • aefb962 fix: Integer instances just outside the i64/u64 range incorrectly compare...
  • 87d5331 build(deps): bump crates/jsonschema/tests/suite
  • 0c832d3 build(deps): bump crates/jsonschema-referencing/tests/suite
  • 9be1914 build(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2
  • 04b5c83 build(deps): bump ruby/setup-ruby from 1.316.0 to 1.318.0
  • 14e1011 refactor: Unify regex limit wiring
  • b142355 docs: Update README
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps): Bump the prod group across 1 directory with 8 updates
188a0a7 
Bumps the prod group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.2` |
| [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.3+spec-1.1.0` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.52.4` |
| [http](https://github.com/hyperium/http) | `1.4.1` | `1.4.2` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `1.7.0` | `2.2.0` |
| [open](https://github.com/Byron/open-rs) | `5.3.5` | `5.4.0` |
| [chrono](https://github.com/chronotope/chrono) | `0.4.44` | `0.4.45` |
| [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.46.5` | `0.48.0` |



Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.2)

Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.2...toml-v1.1.3)

Updates `tokio` from 1.52.3 to 1.52.4
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.52.4)

Updates `http` from 1.4.1 to 1.4.2
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](hyperium/http@v1.4.1...v1.4.2)

Updates `rmcp` from 1.7.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v1.7.0...rmcp-v2.2.0)

Updates `open` from 5.3.5 to 5.4.0
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.3.5...v5.4.0)

Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.44...v0.4.45)

Updates `jsonschema` from 0.46.5 to 0.48.0
- [Release notes](https://github.com/Stranger6667/jsonschema/releases)
- [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md)
- [Commits](Stranger6667/jsonschema@cli-v0.46.5...ruby-v0.48.0)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: toml
  dependency-version: 1.1.3+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: tokio
  dependency-version: 1.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: http
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: rmcp
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod
- dependency-name: open
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
- dependency-name: chrono
  dependency-version: 0.4.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: jsonschema
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 16, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants