[dependabot]

Bumps the rust-minor-and-patch group with 14 updates in the /rust directory:

Package	From	To
serde_json	1.0.151	1.0.154
tokio	1.53.1	1.53.3
uuid	1.24.1	1.28.0
jsonwebtoken	11.0.0	11.1.0
thiserror	2.0.20	2.0.21
proptest	1.11.0	1.12.0
mongodb	3.8.0	3.9.1
clickhouse	0.15.1	0.15.3
lazy_static	1.5.0	1.5.1
tiktoken-rs	0.12.0	0.12.1
flate2	1.1.9	1.1.10
hnsw_rs	0.3.4	0.3.5
clap	4.6.6	4.6.7
rustls	0.23.43	0.23.46

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
• sync: wake waiters outside the lock when closing a semaphore (#8529)
• test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

... (truncated)

Commits

• a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
• df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
• f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
• 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
• 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
• c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
• 0448618 sync: make tracing_sync tests synchronous (#8427)
• 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
• bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
• 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
• Additional commits viewable in compare view

Updates uuid from 1.24.1 to 1.28.0

Release notes

Sourced from uuid's releases.

v1.28.0

What's Changed

• Add optional serde format adapters by @​RanaPriyansh in uuid-rs/uuid#916
• Prepare for 1.28.0 release by @​KodrAus in uuid-rs/uuid#918

New Contributors

• @​RanaPriyansh made their first contribution in uuid-rs/uuid#916

Full Changelog: uuid-rs/uuid@v1.27.0...v1.28.0

v1.27.0

What's Changed

• Accept case-insensitive urn:uuid: prefixes when parsing by @​jaideeppyne in uuid-rs/uuid#912
• Fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos by @​KodrAus in uuid-rs/uuid#915
• Prepare for 1.27.0 release by @​KodrAus in uuid-rs/uuid#917

New Contributors

• @​jaideeppyne made their first contribution in uuid-rs/uuid#912

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

• Add ContextV7::with_additional_precision_bits by @​ChrisJr404 in uuid-rs/uuid#904
• Prepare for 1.26.0 release by @​KodrAus in uuid-rs/uuid#905

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

• Add a serde::bytes module that encodes a Uuid as a byte string by @​ChrisJr404 in uuid-rs/uuid#902
• Prepare for 1.25.0 release by @​KodrAus in uuid-rs/uuid#903

New Contributors

• @​ChrisJr404 made their first contribution in uuid-rs/uuid#902

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

Commits

• 276c236 Merge pull request #918 from uuid-rs/cargo/v1.28.0
• 4b3b9f5 prepare for 1.28.0 release
• cbf9c81 Merge pull request #916 from RanaPriyansh/fix/optional-serde-adapters-840
• 784a022 Inline expected tokens in optional compact serde test
• a5678c3 Simplify optional serde adapter tests to option tokens
• 638a518 Refactor optional serde adapter tests and share byte wrapper
• b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
• ffd8ec5 prepare for 1.27.0 release
• 654fa5b Add optional serde format adapters
• 4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
• Additional commits viewable in compare view

Updates jsonwebtoken from 11.0.0 to 11.1.0

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

• Add dangerous::insecure_decode_claims

Commits

• 4c0ae75 Ready for release
• 46690b5 Add insecure_decode_claims (#539)
• See full diff in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates proptest from 1.11.0 to 1.12.0

Commits

• 70cf37d Merge pull request #675 from proptest-rs/prep-1.12
• 729e0ff prepare next releases and fix panic handling
• 28c1fad Merge pull request #664 from Expyron/main
• 5ddd9a4 Merge pull request #668 from toddATavail/fix-fork-persisted-failure
• a6a9ac7 Merge pull request #673 from glaziermag/fix-book-deploy
• d57d88b Replace rand_chacha with chacha20
• 9411213 Deploy the book on pushes to main
• 1719745 fix: terminate the fork replay when a persisted failure fails
• 0f55b7a test: a persisted failure in a forked test must be reported
• 4b0594e Merge pull request #669 from proptest-rs/no-fail-fast
• Additional commits viewable in compare view

Updates mongodb from 3.8.0 to 3.9.1

Release notes

Sourced from mongodb's releases.

v3.9.1

The MongoDB Rust driver team is pleased to announce the v3.9.1 release of the mongodb crate, now available for download from crates.io.

[!IMPORTANT] This is a security patch release for CVE-2026-88024. Upgrading is recommended for all users.

This release fixes a bug that would allow certain inputs to delete all files in a GridFS bucket.

Full Release Notes

Bugfixes

• RUST-2469 Use exact match for file ID in GridFS methods

v3.9.0

The MongoDB Rust driver team is pleased to announce the v3.9.0 release of the mongodb crate, now available for download from crates.io.

This release adds support for the new baseBackoffMS server error field. The driver now uses the value for baseBackoffMS reported by the server in its retry backoff calculations. This new feature is part of MongoDB's Intelligent Workload Management (IWM) and is available on MongoDB Atlas server versions 9.0+.

Full Release Notes

New Features

• RUST-2409 CSFLE/QE Support for HTTP Proxies (#1756)
• RUST-2412 Send afterClusterTime on writes in causally-consistent sessions (#1742)
• RUST-2446 Use baseBackoffMS in retry backoff calculations (#1749)
• RUST-2133 Allow custom aws credential provider (#1781)

Improvements

• RUST-1820 Use raw documents and smart truncation for tracing and otel (#1757)
• RUST-2396 Report timeout errors for convenient transactions (#1759)
• RUST-2411 Remove support for MongoDB 4.2 (#1770)

Bugfixes

• RUST-2492 Check for inherited unacknowledged write concerns (#1787)

v3.8.2

The MongoDB Rust driver team is pleased to announce the v3.8.2 release of the mongodb crate, now available for download from crates.io.

[!IMPORTANT] This is a security patch release for CVE-2026-81526. Upgrading is recommended for all users.

This release fixes a bug that would allow Client::bulk_write to write to a different database than the one specified in a write model's namespace.

Full Release Notes

Bugfixes

... (truncated)

Commits

• 16bc932 release v3.9.1 (#1792)
• e72eafb RUST-2443 Update version numbers for 3.9.0 (#1789)
• 4406554 RUST-2133 Allow custom aws credential provider (#1781)
• fe6a8cd RUST-2492 Check for inherited unacknowledged write concerns (#1787)
• 01cdcf0 RUST-1740 Break up rest of evergreen config (#1786)
• 7b6e67c RUST-2491 Fix libmongocrypt unversioned install and failing tests (#1785)
• af37d75 Bump the rust-dependencies group across 1 directory with 21 updates (#1784)
• 74eb7bb RUST-2411 Remove support for MongoDB 4.2 (#1770)
• 9a0639e minor: pin rustfmt to a specific nightly release (#1783)
• 57d51e9 RUST-2467 Validate database and collection name arguments against "." and NUL...
• Additional commits viewable in compare view

Updates clickhouse from 0.15.1 to 0.15.3

Changelog

Sourced from clickhouse's changelog.

[0.15.3] - 2026-10-07

Changed

• Changed query parameters to be sent through a multipart/form-data body to avoid issues with URL length limits. (#455)
  • If the Content-Type, Content-Length or Transfer-Encoding headers are already set, they will be overridden. This is not considered a breaking behavior change because user code should never be setting these headers.
• enable_http_compression and http_zlib_compression_level are no longer sent because they may trigger an error in readonly mode. (release PR #487)
  • Only affects Query.
  • See added documentation on Client::with_compression() for details.

Fixed

• Fixed JSON type hints parsing to properly handle parenthesized types. (#478)
• Switched internal schema fetch query issued by Client::insert() to not use the user-set query ID. (#481)
  • If a query ID is already set, a derived query ID is used instead ({query_id}-describe).
• Switched Lz4 compression to use HTTP standard Accept-Encoding negotiation, fixing a regression in ClickHouse 26.9. (#482)
• Fixed handling of JSON type hints starting with SKIP. (#485)

#455: ClickHouse/clickhouse-rs#455 #478: ClickHouse/clickhouse-rs#478 #481: ClickHouse/clickhouse-rs#481 #482: ClickHouse/clickhouse-rs#482 #485: ClickHouse/clickhouse-rs#485 #487: ClickHouse/clickhouse-rs#487

[0.15.2] - 2026-08-24

Added

• Added support for BFloat16 (#417)
• Added serde::uuid_vec for serializing/deserializing Vec<uuid::Uuid> to/from Array(UUID) (#424)
• Implemented Debug for Client (#430)
• Implemented support for selects and data-returning queries using FORMAT Native (#441)
  • Implemented Query::fetch_native() returning NativeCursor which yields Blocks.
  • Block holds data in columnar format and can be indexed by column name or by ordinal.
  • Column::iter() returns an iterator that decodes the column data.
  • All primitive types, Nullable, Array, Tuple, Map and LowCardinality are supported and can be decoded into their appropriate Rust types.
  • Zero-copy decoding to &str, borrowing from the parent Block, is supported.
• Implemented support for inserts using FORMAT Native (#451)
  • Added Client::insert_native() for inserting Blocks
  • Added BlockBuilder API for filling out and validating Blocks
• Client::with_url() now recognizes the database query parameter of the URL. (#456)
  • Added Client::database() to read back the configured default database.
• Added Client::query_raw(), which sends the SQL to the server verbatim, without parsing client-side bind parameters. (#461)
  • In this mode, ? is not treated as a placeholder; ?? is not unescaped; ?fields is not substituted.
  • Server-side parameters via Query::param() still work.

... (truncated)

Commits

• dad4c6d Release 0.15.3 (#487)
• ca0ddbf Fix HTTP LZ4 checksum/history and ZSTD frame decoding (#488)
• af76d45 fix(types): preserve JSON hints starting with SKIP (#485)
• 9d4bed8 perf: move query params to POST body (fix #454) (#455)
• 687eb37 fix(types): parse JSON type hints with parenthesized types (#478)
• 4e6ef63 fix: use a derived query ID for insert schema lookups (#481)
• 8fed7f5 fix: enforce expected ordering in product info added by `clickhouse-ext-arrow...
• ecbae13 perf(arrow): avoid unused query prefix allocation (#471)
• d72ea54 fix: use HTTP compression when requesting Lz4 for result sets (#482)
• fcb8b02 release 0.15.2 (#465)
• Additional commits viewable in compare view

Updates lazy_static from 1.5.0 to 1.5.1

Commits

• See full diff in compare view

Updates tiktoken-rs from 0.12.0 to 0.12.1

Release notes

Sourced from tiktoken-rs's releases.

v0.12.1

A maintenance release that refreshes upstream tiktoken and restores compatibility with the declared Rust 1.85 minimum. Existing public function signatures are unchanged.

Changes

• Refresh the vendor snapshot to OpenAI tiktoken 0.14.0 and align regex dependencies. GPT-5 tokenizer lookup follows upstream's family-prefix matching. (#173)
• Use a 1,050,000-token context-window default for gpt-6* names. This adds context metadata only; GPT-6 tokenizer lookup and token-budget helpers remain unsupported. (#174)
• Fix Rust 1.85 compilation and the default-feature README doctest; test both default and all features across supported platforms. (#170)
• Replace lazy_static with the standard library's LazyLock. (#165)
• Clarify README instructions and remove release-specific wording. (#172)
• Fail release detection on registry errors and remove inactive upload jobs. (#171)

The minimum supported Rust version remains 1.85.

Thanks to @​Expyron for their first contribution in #165.

Full changelog: zurawiki/tiktoken-rs@v0.12.0...v0.12.1

Commits

• 72a5a80 Release tiktoken-rs 0.12.1 (#175)
• bd5afd0 Add a default context window for GPT-6 models (#174)
• 8759c56 Refresh vendored tiktoken to 0.14.0 (#173)
• f1d1dc3 Clarify README wording and remove release-specific prose (#172)
• 8364775 Fail release detection on registry errors and remove empty upload jobs (#171)
• c0961ee Fix and test Rust 1.85 and default-feature support (#170)
• a79050e Replace lazy_static dependency (#165)
• See full diff in compare view

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

• feat: reuse zlib's decoder buffer by @​Vaiz in rust-lang/flate2-rs#532
• feat: add reset method for read::GzDecoder and buffered::GzDecoder by @​Vaiz in rust-lang/flate2-rs#534
• Drop cloudflare-zlib by @​kornelski in rust-lang/flate2-rs#539
• Add a wrapper for the Crc struct by @​MikkelPaulson in rust-lang/flate2-rs#540
• Bump miniz_oxide to 0.9 by @​oscargus in rust-lang/flate2-rs#543
• Upgrade miniz_oxide and add unit tests of the different flush kinds by @​fintelia in rust-lang/flate2-rs#498
• Fix infinite loop in writing gzip header/footer by @​Shnatsel in rust-lang/flate2-rs#547
• test: generate corrupt gzip fixture at runtime by @​nanookclaw in rust-lang/flate2-rs#550
• Reject oversized gzip extra fields by @​Byron in rust-lang/flate2-rs#553
• Reject incomplete deflate streams at EOF by @​Guflly in rust-lang/flate2-rs#556
• Include README.md in a private module by @​bushrat011899 in rust-lang/flate2-rs#562
• Add no_std support using nightly alloc_io by @​bushrat011899 in rust-lang/flate2-rs#559
• Update get_mut() documentation to make clear how 'inner` can be used by @​Byron in rust-lang/flate2-rs#558

New Contributors

• @​Vaiz made their first contribution in rust-lang/flate2-rs#532
• @​MikkelPaulson made their first contribution in rust-lang/flate2-rs#540
• @​oscargus made their first contribution in rust-lang/flate2-rs#543
• @​nanookclaw made their first contribution in rust-lang/flate2-rs#550
• @​Guflly made their first contribution in rust-lang/flate2-rs#556
• @​bushrat011899 made their first contribution in rust-lang/flate2-rs#562

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits

• ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
• fb5228d Merge pull request #559 from bushrat011899/no_std
• 6ed3ba3 Add executable no_std example
• faed8a0 Expand CI to test no_std compatibility and correctness
• 2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
• 3fe1126 Centralize usage of std for error and io
• 98e313a Add GzHeader::mtime_as_duration
• 0642965 Switch to core implicit prelude and only use std where required
• 454a63c Remove left-over dbg! statement
• 2a490b7 Add runtime_detection feature
• Additional commits viewable in compare view

Updates hnsw_rs from 0.3.4 to 0.3.5

Changelog

Sourced from hnsw_rs's changelog.

• version 0.3.5
  • takes into account pull request #39 from vidaunited. Warning if ef_construction <= 2 * max_nb_conn.
  • fix bug in reverse edges management found by vidaunited. It impacted capacity to retrieve data points stored in Hnsw by method search. See pull request #38 (and #37)
  • Doc update in parallel_insertion and modify_scale_level methods. See test file equality.rs
  • dependancies update and clippy cleaning

Commits

• See full diff in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.46

Commits

• f04804f Delay saving KX hint until handshake confirmation
• 049d39b Bump version to 0.23.46
• 6d0ba08 Eliminate secret from impl Debug for ServerSessionValue
• 2b82b81 unbuffered: update TLS 1.3 traffic keys before exhausting them
• 74343e7 conn: update TLS 1.3 traffic keys within fragmented writes
• 795eea7 Advance the HPKE sequence only after seal succeeds
• d67cb71 stream: provide backpressure while buffering received plaintext
• 7a69ade util: fuse flushes from connections with errors
• 493d089 conn: fuse writes for connections with errors
• db00e01 util: keep flushing after short writes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.