chore(deps): update rust-patch

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anyhow	dependencies	patch	1.0.100 → 1.0.104
anyhow	workspace.dependencies	patch	1.0.100 → 1.0.104
async-trait	dependencies	patch	0.1.89 → 0.1.91
chrono	build-dependencies	patch	0.4.43 → 0.4.45
chrono	dev-dependencies	patch	0.4.43 → 0.4.45
ratatui (source)	workspace.dependencies	patch	0.30.0 → 0.30.2
reqwest	dependencies	patch	0.13.1 → 0.13.4
serde (source)	dependencies	patch	1.0.228 → 1.0.229
serde (source)	dev-dependencies	patch	1.0.228 → 1.0.229
serde_json	dependencies	patch	1.0.149 → 1.0.150
serde_json	dev-dependencies	patch	1.0.149 → 1.0.150
tar	dependencies	patch	0.4.44 → 0.4.46
thiserror	workspace.dependencies	patch	2.0.18 → 2.0.19
toml	dependencies	patch	1.1.0+spec-1.1.0 → 1.1.3
tracing-appender (source)	workspace.dependencies	patch	0.2.4 → 0.2.5
tracing-subscriber (source)	workspace.dependencies	patch	0.3.22 → 0.3.23

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

v1.0.102

Compare Source

• Remove backtrace dependency (#​438, #​439, #​440, #​441, #​442)

v1.0.101

Compare Source

• Add #[inline] to anyhow::Ok helper (#​437, thanks @​Ibitier)

dtolnay/async-trait (async-trait)

v0.1.91

Compare Source

v0.1.90

Compare Source

• Update to syn 3

chronotope/chrono (chrono)

v0.4.45: 0.4.45

Compare Source

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in #​1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in #​1789

v0.4.44: 0.4.44

Compare Source

What's Changed

• docs: match MSRV with Cargo.toml contents by @​coryan in #​1772
• Add track_caller to non-deprecated functions by @​svix-jplatte in #​1774

ratatui/ratatui (ratatui)

v0.30.2

Compare Source

We are excited to announce the new version of ratatui - a Rust library that's all about cooking up TUIs 👨‍🍳🐀

✨ Release highlights: https://ratatui.rs/highlights/v0302/

⚠️ List of breaking changes can be found here.

Features

• 90639c1 (uncategorized) Add Termina backend by @joshka in #​2561

  Summary

  • add the ratatui-termina backend crate using the published termina
    crate
  • expose the backend through the termina feature and Ratatui
    prelude/backend re-exports
  • add a small Termina event-loop example and wire the backend into CI,
    xtask, README generation, and docs

  Refs #​1784

  Validation

  • cargo +nightly fmt
  • cargo check -p ratatui-termina --all-features --all-targets
  • cargo check -p ratatui --no-default-features --features termina
  • cargo check -p xtask
  • cargo check -p release-header
  • cargo xtask check-backend termina
  • cargo xtask test-backend termina
  • cargo xtask rdme --check
  • markdownlint-cli2 ARCHITECTURE.md ratatui-termina/README.md .github/ISSUE_TEMPLATE/bug_report.md

  ---

Bug Fixes

• fce3c80 (widgets) Require thread-safe shadow effects by @joshka in #​2584

  Summary

  • require custom shadow effects to preserve the auto traits expected by
    Block-backed widgets
  • document the CellEffect auto-trait contract
  • add a public widget regression test for the affected ratatui::widgets
    re-exports

  Fixes #​2583

  ---

• e306ce6 (buffer) Create updates for "uncovered" cells by @benjajaja in #​2587

  When a wide cell from the previous buffer is replaced by a short/normal
  cell, the trailing cell does not get an update if its content does not
  change. But if the wide cell has a background (or other) style, the
  terminal did render the trailing cell with that style.

  Force trailing cells to update if background, underline, or modifiers
  are different than the wide cell. We can ignore foreground.

  Fixes #​2585 (see that for the detailed visual reports)

• 81e667f (scrollbar) Keep a large thumb within the track at the end by @satyakwok in #​2594

  Closes #​2582.

  Problem

  When the content is shorter than the viewport, the thumb is large
  relative to the track. With the position at the end, part_lengths
  clamped thumb_start to track_length - 1 while thumb_length was
  clamped independently to [1, track_length], so thumb_start + thumb_length could exceed track_length.

  bar_symbols lays out begin + track_start + thumb + track_end + end
  and zips it against the cells of the area. When the thumb overruns the
  track, track_end saturates to 0 but the thumb still emits more cells
  than the track can hold, so the trailing end symbol is pushed past the
  end of the area. The last visible cell ends up being a thumb (█) where
  the end arrow (▼) should be.

  Concretely, for the issue's repro (VerticalRight, content_length = 9, position = 8, height 24): track is 22, thumb_length = 17,
  thumb_start = 6, and 6 + 17 = 23 > 22.

  This is a regression from v0.30.0, where thumb_length was derived as
  thumb_end - thumb_start and therefore always fit within the track.

  Fix

  Clamp thumb_start to track_length - thumb_length (instead of
  track_length - 1) so the thumb always fits within the track and the
  end symbol is preserved.

  Test

  Two regression tests, both fail on main and pass with the fix:

  • thumb_stays_within_track_for_large_thumb_at_end checks
    part_lengths directly with the issue's parameters — asserts
    thumb_start + thumb_length <= track_length and that the parts sum to
    the track length.
  • render_scrollbar_keeps_end_symbol_for_large_thumb renders the #​2582
    case (both arrows, large thumb at the end) and asserts the end symbol is
    drawn rather than overwritten by a thumb cell.

  All existing scrollbar tests still pass.

Miscellaneous Tasks

• c75d778 (ci) Add cargo-udeps dependency check by @joshka in #​2599

  Adds cargo xtask udeps and runs it from CI as a required job.

  This complements cargo-machete rather than replacing it. cargo-machete
  is a fast static source scan, which is why it missed the package-level
  unused deps fixed in #​2598 when the same dependency names were still
  referenced by example crates. cargo-udeps compiles the workspace and
  checks rustc dep-info, so it can catch unused dependency declarations
  for the package being checked.

  To make the new job pass, this also removes the remaining true-positive
  unused dev-deps and records explicit cargo-udeps ignores for current
  false positives / intentional cases: ratatui-core critical-section,
  ratatui-crossterm's duplicate crossterm version feature shape, and
  ratatui-termwiz's doc-example-only ratatui dev-dependency.

  I searched existing issues and PRs for udeps / cargo-udeps / "cargo
  udeps". I did not find prior ratatui discussion about adopting
  cargo-udeps; the only hits were Dependabot PR bodies for
  taiki-e/install-action release notes mentioning cargo-udeps version
  updates, for example #​1971, #​2095, #​2194, and #​2522.

  Validation:- cargo xtask udeps

  • cargo xtask format --check

  ---

• 4a63d41 (uncategorized) Remove unused dependencies by @KikiKian in #​2598

  Audit removes these dependencies that are not used:

  ratatui/Cargo.toml — Removed from [dev-dependencies]:

  • futures
  • rand_chacha
  • tokio
  • tracing
  • tracing-appender
  • tracing-subscriber

  ratatui-core/Cargo.toml — Moved from [dependencies] →
  [dev-dependencies]:

  • indoc

  ---

Continuous Integration

• 36854ef (uncategorized) Add auto-merge required gate by @joshka in #​2596

  Summary

  This makes GitHub auto-merge usable for Ratatui PRs once maintainers are
  happy with the change but CI is still running.

  The workflow change adds a single aggregate required job to the main
  CI workflow. The repository now has auto-merge
  enabled
  and an ensure checks pass
  ruleset
  that requires that required status context on main.

  Why

  Without a required status context, GitHub's auto-merge button is not
  useful for the maintainer flow we want. The goal is to let a maintainer
  review a PR, decide it is ready, click auto-merge, and move on without
  coming back later just to check whether the remaining jobs finished.

  This does not relax the merge policy. GitHub's own auto-merge behavior
  is to merge only after all required reviews and required status checks
  are satisfied. This change gives GitHub a stable required status to wait
  on automatically.

  Precedent

  I have been using this same auto-merge pattern in
  ratatui/tui-widgets, where
  it has worked well for the intended maintainer flow: once a PR looks
  ready, I can enable auto-merge and let GitHub merge it after the
  remaining checks and review requirements are satisfied.

  How it works

  The new required job depends on the main CI jobs in
  .github/workflows/ci.yml and always runs after them. It fails if any
  required dependency fails, is cancelled, or is skipped.

  The repository ruleset requires only this aggregate required context
  instead of requiring every individual matrix job separately. That gives
  GitHub one stable status to wait on while preserving the existing CI
  coverage.

  Things to know

  • Auto-merge is opt-in per PR. Maintainers still choose when to click
    it.
  • It does not skip review requirements, status checks, labels, or any
    other protection rule.
  • A PR with auto-merge enabled can still show as blocked while checks or
    required reviews are pending. That is expected.
  • If something needs to merge normally, maintainers can still use the
    regular merge path or an allowed ruleset bypass. This is a convenience
    path, not a hard blocker.
  • Existing open PRs may need a rebase or synchronize event after this
    lands so they pick up the new required workflow job.
  • If a new required CI job is added later, it should be added to the
    required.needs list or it will not be represented by the aggregate
    gate.
  • Jobs that are intentionally allowed to fail should be handled
    carefully before adding them to required.needs, because skipped,
    cancelled, and failed dependencies make the aggregate fail.

  Current PR state

  Auto-merge is already enabled on this PR. If you approve it and the
  required checks pass, GitHub will squash-merge it automatically;
  approving it is enough to let the PR merge once the remaining
  requirements are satisfied.

  GitHub docs

  • Automatically merging a pull
    request
  • Managing auto-merge for pull requests in your
    repository
  • About
    rulesets
  • Require status checks to pass before
    merging
  • About status
    checks
  • Troubleshooting required status
    checks

  Validation

  • ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); puts "ok"'
  • actionlint .github/workflows/ci.yml
  • Verified ratatui/ratatui has allow_auto_merge: true
  • Verified the active ensure checks pass ruleset requires status
    context required
  • Verified this PR has squash auto-merge enabled and is blocked pending
    checks/review

New Contributors

• @satyakwok made their first contribution in #​2594
• @KikiKian made their first contribution in #​2598

Full Changelog: ratatui/ratatui@ratatui-v0.30.1...ratatui-v0.30.2

v0.30.1

Compare Source

We are excited to announce the new version of ratatui - a Rust library that's all about cooking up TUIs 👨‍🍳🐀

✨ Release highlights: https://ratatui.rs/highlights/v0302/

⚠️ List of breaking changes can be found here.

Features

• 90639c1 (uncategorized) Add Termina backend by @joshka in #​2561

  Summary

  • add the ratatui-termina backend crate using the published termina
    crate
  • expose the backend through the termina feature and Ratatui
    prelude/backend re-exports
  • add a small Termina event-loop example and wire the backend into CI,
    xtask, README generation, and docs

  Refs #​1784

  Validation

  • cargo +nightly fmt
  • cargo check -p ratatui-termina --all-features --all-targets
  • cargo check -p ratatui --no-default-features --features termina
  • cargo check -p xtask
  • cargo check -p release-header
  • cargo xtask check-backend termina
  • cargo xtask test-backend termina
  • cargo xtask rdme --check
  • markdownlint-cli2 ARCHITECTURE.md ratatui-termina/README.md .github/ISSUE_TEMPLATE/bug_report.md

  ---

Bug Fixes

• fce3c80 (widgets) Require thread-safe shadow effects by @joshka in #​2584

  Summary

  • require custom shadow effects to preserve the auto traits expected by
    Block-backed widgets
  • document the CellEffect auto-trait contract
  • add a public widget regression test for the affected ratatui::widgets
    re-exports

  Fixes #​2583

  ---

• e306ce6 (buffer) Create updates for "uncovered" cells by @benjajaja in #​2587

  When a wide cell from the previous buffer is replaced by a short/normal
  cell, the trailing cell does not get an update if its content does not
  change. But if the wide cell has a background (or other) style, the
  terminal did render the trailing cell with that style.

  Force trailing cells to update if background, underline, or modifiers
  are different than the wide cell. We can ignore foreground.

  Fixes #​2585 (see that for the detailed visual reports)

• 81e667f (scrollbar) Keep a large thumb within the track at the end by @satyakwok in #​2594

  Closes #​2582.

  Problem

  When the content is shorter than the viewport, the thumb is large
  relative to the track. With the position at the end, part_lengths
  clamped thumb_start to track_length - 1 while thumb_length was
  clamped independently to [1, track_length], so thumb_start + thumb_length could exceed track_length.

  bar_symbols lays out begin + track_start + thumb + track_end + end
  and zips it against the cells of the area. When the thumb overruns the
  track, track_end saturates to 0 but the thumb still emits more cells
  than the track can hold, so the trailing end symbol is pushed past the
  end of the area. The last visible cell ends up being a thumb (█) where
  the end arrow (▼) should be.

  Concretely, for the issue's repro (VerticalRight, content_length = 9, position = 8, height 24): track is 22, thumb_length = 17,
  thumb_start = 6, and 6 + 17 = 23 > 22.

  This is a regression from v0.30.0, where thumb_length was derived as
  thumb_end - thumb_start and therefore always fit within the track.

  Fix

  Clamp thumb_start to track_length - thumb_length (instead of
  track_length - 1) so the thumb always fits within the track and the
  end symbol is preserved.

  Test

  Two regression tests, both fail on main and pass with the fix:

  • thumb_stays_within_track_for_large_thumb_at_end checks
    part_lengths directly with the issue's parameters — asserts
    thumb_start + thumb_length <= track_length and that the parts sum to
    the track length.
  • render_scrollbar_keeps_end_symbol_for_large_thumb renders the #​2582
    case (both arrows, large thumb at the end) and asserts the end symbol is
    drawn rather than overwritten by a thumb cell.

  All existing scrollbar tests still pass.

Miscellaneous Tasks

• c75d778 (ci) Add cargo-udeps dependency check by @joshka in #​2599

  Adds cargo xtask udeps and runs it from CI as a required job.

  This complements cargo-machete rather than replacing it. cargo-machete
  is a fast static source scan, which is why it missed the package-level
  unused deps fixed in #​2598 when the same dependency names were still
  referenced by example crates. cargo-udeps compiles the workspace and
  checks rustc dep-info, so it can catch unused dependency declarations
  for the package being checked.

  To make the new job pass, this also removes the remaining true-positive
  unused dev-deps and records explicit cargo-udeps ignores for current
  false positives / intentional cases: ratatui-core critical-section,
  ratatui-crossterm's duplicate crossterm version feature shape, and
  ratatui-termwiz's doc-example-only ratatui dev-dependency.

  I searched existing issues and PRs for udeps / cargo-udeps / "cargo
  udeps". I did not find prior ratatui discussion about adopting
  cargo-udeps; the only hits were Dependabot PR bodies for
  taiki-e/install-action release notes mentioning cargo-udeps version
  updates, for example #​1971, #​2095, #​2194, and #​2522.

  Validation:- cargo xtask udeps

  • cargo xtask format --check

  ---

• 4a63d41 (uncategorized) Remove unused dependencies by @KikiKian in #​2598

  Audit removes these dependencies that are not used:

  ratatui/Cargo.toml — Removed from [dev-dependencies]:

  • futures
  • rand_chacha
  • tokio
  • tracing
  • tracing-appender
  • tracing-subscriber

  ratatui-core/Cargo.toml — Moved from [dependencies] →
  [dev-dependencies]:

  • indoc

  ---

Continuous Integration

• 36854ef (uncategorized) Add auto-merge required gate by @joshka in #​2596

  Summary

  This makes GitHub auto-merge usable for Ratatui PRs once maintainers are
  happy with the change but CI is still running.

  The workflow change adds a single aggregate required job to the main
  CI workflow. The repository now has auto-merge
  enabled
  and an ensure checks pass
  ruleset
  that requires that required status context on main.

  Why

  Without a required status context, GitHub's auto-merge button is not
  useful for the maintainer flow we want. The goal is to let a maintainer
  review a PR, decide it is ready, click auto-merge, and move on without
  coming back later just to check whether the remaining jobs finished.

  This does not relax the merge policy. GitHub's own auto-merge behavior
  is to merge only after all required reviews and required status checks
  are satisfied. This change gives GitHub a stable required status to wait
  on automatically.

  Precedent

  I have been using this same auto-merge pattern in
  ratatui/tui-widgets, where
  it has worked well for the intended maintainer flow: once a PR looks
  ready, I can enable auto-merge and let GitHub merge it after the
  remaining checks and review requirements are satisfied.

  How it works

  The new required job depends on the main CI jobs in
  .github/workflows/ci.yml and always runs after them. It fails if any
  required dependency fails, is cancelled, or is skipped.

  The repository ruleset requires only this aggregate required context
  instead of requiring every individual matrix job separately. That gives
  GitHub one stable status to wait on while preserving the existing CI
  coverage.

  Things to know

  • Auto-merge is opt-in per PR. Maintainers still choose when to click
    it.
  • It does not skip review requirements, status checks, labels, or any
    other protection rule.
  • A PR with auto-merge enabled can still show as blocked while checks or
    required reviews are pending. That is expected.
  • If something needs to merge normally, maintainers can still use the
    regular merge path or an allowed ruleset bypass. This is a convenience
    path, not a hard blocker.
  • Existing open PRs may need a rebase or synchronize event after this
    lands so they pick up the new required workflow job.
  • If a new required CI job is added later, it should be added to the
    required.needs list or it will not be represented by the aggregate
    gate.
  • Jobs that are intentionally allowed to fail should be handled
    carefully before adding them to required.needs, because skipped,
    cancelled, and failed dependencies make the aggregate fail.

  Current PR state

  Auto-merge is already enabled on this PR. If you approve it and the
  required checks pass, GitHub will squash-merge it automatically;
  approving it is enough to let the PR merge once the remaining
  requirements are satisfied.

  GitHub docs

  • Automatically merging a pull
    request
  • Managing auto-merge for pull requests in your
    repository
  • About
    rulesets
  • Require status checks to pass before
    merging
  • About status
    checks
  • Troubleshooting required status
    checks

  Validation

  • ruby -e 'require "yaml"; YAML.load_file(".github/workflows/ci.yml"); puts "ok"'
  • actionlint .github/workflows/ci.yml
  • Verified ratatui/ratatui has allow_auto_merge: true
  • Verified the active ensure checks pass ruleset requires status
    context required
  • Verified this PR has squash auto-merge enabled and is blocked pending
    checks/review

New Contributors

• @satyakwok made their first contribution in #​2594
• @KikiKian made their first contribution in #​2598

Full Changelog: ratatui/ratatui@ratatui-v0.30.1...ratatui-v0.30.2

seanmonstar/reqwest (reqwest)

v0.13.4

Compare Source

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

v0.13.3

Compare Source

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

Compare Source

• Fix HTTP/2 and native-tls ALPN feature combinations.
• Fix HTTP/3 to send h3 ALPN.
• (wasm) fix RequestBuilder::json() from override previously set content-type.

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

serde-rs/json (serde_json)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

composefs/tar-rs (tar)

v0.4.46

Compare Source

Security

• archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by @​cgwalters in #​454

See also GHSA-3cv2-h65g-fgmm

Other changes

• ci: Fix and re-enable reverse dependency testing by @​cgwalters in #​444
• Update astral-tokio-tar requirement from 0.5 to 0.6 by @​dependabot[bot] in #​446
• Update some links by @​atouchet in #​445
• Add support of absolute paths by @​zxvfc in #​426
• docs: Expand notes on concurrent mutations and following symlinks by @​cgwalters in #​453
• Update repo links by @​cgwalters in #​451
• ci: Add crates.io trusted publishing workflow by @​cgwalters in #​456
• Release 0.4.46 by @​cgwalters in #​455

New Contributors

• @​dependabot[bot] made their first contribution in #​446
• @​atouchet made their first contribution in #​445
• @​zxvfc made their first contribution in #​426

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

v0.4.45

Compare Source

dtolnay/thiserror (thiserror)

v2.0.19

Compare Source

• Update to syn 3

toml-rs/toml (toml)

v1.1.3

Compare Source

v1.1.2

Compare Source

v1.1.1

Compare Source

tokio-rs/tracing (tracing-appender)

v0.2.5: tracing-appender 0.2.5

Compare Source

Added

• Add latest symlink builder option (#​3447)

Fixed

• Fix RollingFileAppender broken links in docs (#​3445)
• Fix parsing of date from filename when no time is incuded (#​3471)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path crates/morphir-daemon/Cargo.toml --package toml@1.1.0+spec-1.1.0 --precise 1.1.3
error: package ID specification `toml@1.1.0+spec-1.1.0` did not match any packages
help: there are similar package ID specifications:

  toml@0.8.23
  toml@0.9.11+spec-1.1.0
  toml@1.1.3+spec-1.1.0

File name: Cargo.lock

Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path crates/morphir-design/Cargo.toml --package toml@1.1.0+spec-1.1.0 --precise 1.1.3
error: package ID specification `toml@1.1.0+spec-1.1.0` did not match any packages
help: there are similar package ID specifications:

  toml@0.8.23
  toml@0.9.11+spec-1.1.0
  toml@1.1.3+spec-1.1.0