build(deps): bump the rust-dependencies group across 1 directory with 16 updates

[dependabot]

Bumps the rust-dependencies group with 16 updates in the / directory:

Package	From	To
quinn	361bcb6	55f74c0
quinn-proto	361bcb6	55f74c0
clap	4.6.6	4.6.7
clap_derive	4.6.4	4.6.7
uuid	1.26.0	1.26.1
toml	1.1.5+spec-1.1.0	1.1.6+spec-1.1.0
educe	0.7.6	0.8.1
pest	2.9.1	2.9.2
pest_derive	2.9.1	2.9.2
rustls	0.23.44	0.23.45
rand	0.10.2	0.10.3
hickory-resolver	0.26.2	0.26.3
thiserror	2.0.20	2.0.21
ureq	3.4.1	3.4.2
rustls-platform-verifier	0.7.0	0.7.1
tokio-rustls	0.26.5	0.26.6

Updates quinn from 361bcb6 to 55f74c0

Commits

• 55f74c0 removed previous BBR implementation
• c00afa1 added BBRv3 algorithm, including MaxFilter from Kathleen Nichols
• 18fe9c2 modified Pacer such that congestion controller metrics can be used to adjust ...
• fb28cd0 added more granular packet events for congestion controllers, necessary for s...
• a577f35 quinn: release the endpoint lock during TLS setup on accept
• 1187137 quinn-proto: split connection acceptance into three phases
• 39d47f8 quinn-proto: bundle Connection::new arguments into ConnectionArgs
• a5bd4c2 quinn-proto: route accept CIDs to the pending Incoming
• ab6b605 quinn-proto: register accept's connection after first-packet handling
• 3475b07 ci: run cmsg tests under Miri
• Additional commits viewable in compare view

Updates quinn-proto from 361bcb6 to 55f74c0

Commits

• 55f74c0 removed previous BBR implementation
• c00afa1 added BBRv3 algorithm, including MaxFilter from Kathleen Nichols
• 18fe9c2 modified Pacer such that congestion controller metrics can be used to adjust ...
• fb28cd0 added more granular packet events for congestion controllers, necessary for s...
• a577f35 quinn: release the endpoint lock during TLS setup on accept
• 1187137 quinn-proto: split connection acceptance into three phases
• 39d47f8 quinn-proto: bundle Connection::new arguments into ConnectionArgs
• a5bd4c2 quinn-proto: route accept CIDs to the pending Incoming
• ab6b605 quinn-proto: register accept's connection after first-packet handling
• 3475b07 ci: run cmsg tests under Miri
• Additional commits viewable in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates clap_derive from 4.6.4 to 4.6.7

Release notes

Sourced from clap_derive's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

v4.6.6

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

Changelog

Sourced from clap_derive's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

Commits

• 13f2db5 chore: Release
• 3304fea docs: Update changelog
• 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
• 4380302 chore(deps): Update Rust crate trybuild to v1.0.120 (#6509)
• a812461 Merge pull request #6528 from epage/template
• 710884f style: Make clippy happy
• ce800a3 chore: Update from _rust template
• 78d70f3 feat(derive): Defer enum subcommand initialization
• 2b2d881 test(derive): Cover subcommand initialization
• 7f87020 test(derive): Build before nested introspection
• Additional commits viewable in compare view

Updates uuid from 1.26.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

Commits

• 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
• d4df8f0 prepare for 1.26.1 release
• 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
• fda00eb don't panic in overflowing Timestamp to SystemTime conversion
• c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
• ac065a6 Align the counter diagram
• 34ec102 Seat the v7 counter below the version nibble
• See full diff in compare view

Updates toml from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits

• 572c005 chore: Release
• 66d0c53 docs: Update changelog
• 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
• 0ff90db perf(display): Write encoded strings directly
• efb2536 perf(display): Move generated representation strings
• 075c444 refactor(display): Consolidate key-path encoding
• b48f338 perf(display): Borrow table keys during document output
• c6c1de3 perf(parser): Move completed table header keys
• ec90463 perf(parser): Borrow input when creating editable documents
• d76a48a test: Benchmark rendering generated keys and values
• Additional commits viewable in compare view

Updates educe from 0.7.6 to 0.8.1

Commits

• 561fe8c bump version
• ab1ef51 scan string literals for names instead of parsing them (solve #53)
• 33c8577 drop the changelogs of the releases before 0.8.0
• e91d6b4 share the repeated diagnostics and name the ambiguous Into field error
• 8db38f5 correct the union Clone bound and the Default expression descriptions
• 88f6e56 avoid name clashes with generated identifiers and fix associated type bounds
• bbea893 cover bound(*) and bound(false) for every trait
• 4dc0d12 cover the Ord field attributes an enum PartialOrd falls back to
• a9ebd7a cover the full feature and keep the two documents in step
• 62170a9 walk a field type once when looking for generic parameters
• Additional commits viewable in compare view

Updates pest from 2.9.1 to 2.9.2

Release notes

Sourced from pest's releases.

v2.9.2

What's Changed

• update to unicode 18 by @​tomtau in pest-parser/pest#1202
• Stop Span::lines from yielding a line past the span by @​MaxFreedomPollard in pest-parser/pest#1201

New Contributors

• @​MaxFreedomPollard made their first contribution in pest-parser/pest#1201

Full Changelog: pest-parser/pest@v2.9.1...v2.9.2

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

Commits

• 67e5acb bump version to 2.9.2 (#1206)
• aa27c99 Stop Span::lines from yielding a line past the span (#1201)
• 8f5bc84 ci: add permissions to fuzzing workflow (#1204)
• 7926ec6 ci: add workflow permissions (#1203)
• a055d81 update to unicode 18 (#1202)
• See full diff in compare view

Updates pest_derive from 2.9.1 to 2.9.2

Release notes

Sourced from pest_derive's releases.

v2.9.2

What's Changed

• update to unicode 18 by @​tomtau in pest-parser/pest#1202
• Stop Span::lines from yielding a line past the span by @​MaxFreedomPollard in pest-parser/pest#1201

New Contributors

• @​MaxFreedomPollard made their first contribution in pest-parser/pest#1201

Full Changelog: pest-parser/pest@v2.9.1...v2.9.2

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

Commits

• 67e5acb bump version to 2.9.2 (#1206)
• aa27c99 Stop Span::lines from yielding a line past the span (#1201)
• 8f5bc84 ci: add permissions to fuzzing workflow (#1204)
• 7926ec6 ci: add workflow permissions (#1203)
• a055d81 update to unicode 18 (#1202)
• See full diff in compare view

Updates rustls from 0.23.44 to 0.23.45

Commits

• 2976d90 Prepare 0.23.45
• f9d4ee9 Handshake "alignment" check covers previously-received messages
• c4e92e8 Keep data needed for HRR processing together
• e553a7a server: TLS1.2 is not available after a HRR
• 5dff9da Test whether server negotiates TLS1.2 after HRR
• 185a063 reject a second ClientHello that changes the cipher suite
• 9fafe6d reject a second ClientHello that drops pre_shared_key
• 1b42c5f providers: zeroize private key DER
• See full diff in compare view

Updates rand from 0.10.2 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

• Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)
• Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)
• Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

• Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

Commits

• 9e7d328 Prepare rand 0.10.3 (#1840)
• f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
• ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
• c994eb1 docs: fix angle unit in quick start example (#1839)
• 33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
• 94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
• bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
• 521fab6 Stop pinning dependencies (#1820)
• 3f7c433 Stop pinning dependencies
• cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
• Additional commits viewable in compare view

Updates hickory-resolver from 0.26.2 to 0.26.3

Release notes

Sourced from hickory-resolver's releases.

v0.26.3

This release fixes regressions introduced in v0.26.2 related to DNSSEC verification, QUIC servers, HTTP/3 servers, and minimum dependency versions.

What's Changed

• Fix warnings (release/0.26) by @​divergentdave in hickory-dns/hickory-dns#3877
• resolver: use lenient resolv.conf parsing by @​djc in hickory-dns/hickory-dns#3879
• backport: Fix multi rrsig validation 0.26 by @​MartB in hickory-dns/hickory-dns#3892
• Bump version to 0.26.3 by @​djc in hickory-dns/hickory-dns#3895
• Exclude accepting QUIC connections from timeouts - 0.26 branch by @​divergentdave in hickory-dns/hickory-dns#3906
• [0.26] net: fix insecure ancestor delegation by @​djc in hickory-dns/hickory-dns#3907

Full Changelog: hickory-dns/hickory-dns@v0.26.2...v0.26.3

Commits

• bd37caf net: require authenticated insecure-delegation proofs
• 5a79511 Add conformance test for regression
• c268442 net: fix ancestor delegation issues
• 9488e8e Exclude accepting QUIC connections from timeouts
• 4ad16c3 Bump version to 0.26.3
• cfab556 proto: ignore RRSIGs in DnssecSummary::from_records
• 819a6bc net: try every RRSIG before marking an RRset bogus
• 688231e resolver: use lenient resolv.conf parsing
• ca5d1a1 resolver: Fix 'unused method' with features blocklist,tls-ring
• 678b01b Fix unnecessary qualification warning
• See full diff in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates ureq from 3.4.1 to 3.4.2

Changelog

Sourced from ureq's changelog.

3.4.2

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
• Bypass pooling for request connection settings incompatible with the Agent #1201
• Try the next resolved address on unreachable/unavailable connect errors #1195

Commits

• 2e9ef24 3.4.2
• b983841 Bump ureq-proto to 0.6.3
• 075a1d7 Respect request connection settings when pooling
• fb634de Try the next resolved address when a connect fails for that address only (#1195)
• See full diff in compare view

Updates rustls-platform-verifier from 0.7.0 to 0.7.1

Release notes

Sourced from rustls-platform-verifier's releases.

0.7.1

About

This version contains Windows and Android bugfixes, but its headline feature is a migration to an improved distribution strategy for the Android component of the crate, which must be included by Gradle for Android application/library builds. If you don't build for Android, no need to worry these changes don't affect you. But if you do, please continue reading to understand the required migration steps and benefits. 0.7.1 requires the Android migration to be performed once manually.

Android Revocation

The biggest improvement to functionality in this release is proper support for revocation on Android. As OCSP moves to deprecation, more CAs are exclusively using CRLs to distribute revocation data. Previously this failed to work on Android without workarounds since by default the network fetches for this were blocked. As of 0.2.0 of rustls-platform-verifier-android, this works again as expected. We now bundle an Android App manifest with the library, which Android Studio merges into the main manifest of the app being built.

Android Distribution

As of this release, we have stopped bundling pre-compiled .aar artifacts and a local Maven repository inside each release of rustls-platform-verifier-android. Instead, all future (and past!) Maven artifacts are now hosted on GitHub under the maven-archive branch. The branch's structure creates a remote Maven repository that Gradle can download and synchronize with just like any other. Importantly, this now means that the Android library can be downloaded and resolved independently of cargo's own downloads.

0.2.0 of the Android component is exclusively distributed through this new mechanism, but the 0.1.0 and 0.1.1 releases were also backported to the new repository. This means that no matter what version of rustls-platform-verifier you are using, its possible to migrate your Gradle build configuration to the more modern approach. Once again we have included out-of-the-box Gradle and Kotlin script snippets to configure the repository. See our README guide for more info.

What's Changed

• Update outdated documentation about crate initialization by @​kaezrr in rustls/rustls-platform-verifier#236
• Fix Windows compatibility with hostnames containing a trailing label by @​complexspaces in rustls/rustls-platform-verifier#241
• Remove unnecessary clone by @​FranciscoTGouveia in rustls/rustls-platform-verifier#242
• Permit the fetching of CRL data on Android by @​djc in rustls/rustls-platform-verifier#248
• Fix infinite loop on Android when a system trust anchor has been disabled by the user by @​ChoiSeungMyung in rustls/rustls-platform-verifier#246
• Migrate from Cargo-bundled Maven repository to GitHub-hosted Maven artifact repository by @​complexspaces in rustls/rustls-platform-verifier#251

New Contributors

• @​iadev09 made their first contribution in rustls/rustls-platform-verifier#234
• @​kaezrr made their first contribution in rustls/rustls-platform-verifier#236
• @​FranciscoTGouveia made their first contribution in rustls/rustls-platform-verifier#242
• @​ChoiSeungMyung made their first contribution in rustls/rustls-platform-verifier#246

Full Changelog: rustls/rustls-platform-verifier@v/0.7.0...v/0.7.1

Commits

• 252e251 Release 0.7.1
• 18f5c53 Bump Maven release to 0.2.0
• 2885f2f Bump android-release-support to 0.2.0
• 0e76b93 Update Android documentation and release process for GitHub-published artifacts
• c87abb8 Remove Cargo-bundled Maven repository to setup for GitHub-published artifacts
• 7c3e664 Bundle generated CRL networkSecurityConfig into release manifest
• f4d7c89 Update Android build tooling and associated versions
• f48a4b9 Fix groupId in POM template
• 027c029 Update Android network security config
• a8aa23d Take semver-compatible dependency updates
• Additional commits viewable in compare view

Updates tokio-rustls from 0.26.5 to 0.26.6

Release notes

Sourced from tokio-rustls's releases.

0.26.6

0.26.5 added an optimization to batch multiple reads which could swallow some errors. Buffer errors so that they propagate to the caller as soon as the caller next reads from the stream.

What's Changed

• Buffer and propagate errors from transport by @​dtolnay in rustls/tokio-rustls#205
• Prepare 0.26.6 by @​djc in rustls/tokio-rustls#206

Commits

• 8aebb7c Bump version to 0.26.6
• 6f8509a Rename buffered_err to error
• bd0494d Buffer and propagate errors from transport
• a781340 Add regression test for issue 204
• 9d0dae6 build(deps): bump rustls from 0.23.44 to 0.23.45
• 0ad049e build(deps): bump rustls from 0.23.43 to 0.23.44
• 4f913c7 build(deps): bump rcgen from 0.14.9 to 0.14.10
• See full diff in compare view

[codspeed]

Merging this PR will not alter performance

✅ 22 untouched benchmarks

---

_{Comparing dependabot/cargo/rust-dependencies-be73994ce1 (444f355) with main (9841e2f)}

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.