[dependabot]

Bumps the rust-dependencies group with 21 updates in the / directory:

Package	From	To
pulldown-cmark	0.13.5	0.13.6
serde_json	1.0.151	1.0.154
unicode-width	0.2.2	0.2.3
html5ever	0.39.0	0.40.1
arboard	3.6.1	3.7.0
resvg	0.45.1	0.49.0
open	5.4.4	5.4.5
ureq	3.4.2	3.5.0
muda	0.21.1	0.21.2
objc2	0.5.3	0.6.5
objc2-foundation	0.2.2	0.3.2
jupyter-zmq-client	2.0.0	3.0.1
libc	0.2.190	0.2.191
arrow-array	60.0.0	60.1.0
arrow-schema	60.0.0	60.1.0
arrow-cast	60.0.0	60.1.0
rusqlite	0.41.0	0.41.1
getrandom	0.3.4	0.4.3
sha2	0.10.9	0.11.1
quick-xml	0.41.0	0.42.0
zip	9.1.3	9.2.0

Updates pulldown-cmark from 0.13.5 to 0.13.6

Release notes

Sourced from pulldown-cmark's releases.

Fix quadratic parsing of nested image wikilinks

This version backports #1186 to fix quadratic parsing of nested image wikilinks.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.5...v0.13.6

Commits

• 014b61d chore: cargo update and bump version to 0.13.6
• 3288371 Fix quadratic parsing of nested image wikilinks
• See full diff in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates unicode-width from 0.2.2 to 0.2.3

Commits

• f8c8b20 Publish 0.2.3 (#100)
• 5180748 Fix documentation of Kirat Rai rules (#97)
• 0b85fb8 Update to Unicode 18 (#96)
• 832f7ca Fix typo in docs (#90)
• c7b4d42 Fix halfwidth katakana voiced and semi-voiced sound marks in width calculatio...
• a3d4ee6 Fix mistake in the specification of Arabic lam-alef ligature (#92)
• d8654db Split generated file into multiple files, separating static code from generat...
• ab7a6dc Support char iter width (#83)
• b10a4d5 Exclude development scripts from published packages (#80)
• See full diff in compare view

Updates html5ever from 0.39.0 to 0.40.1

Commits

• See full diff in compare view

Updates arboard from 3.6.1 to 3.7.0

Release notes

Sourced from arboard's releases.

v3.7.0

What's Changed

• Return a conversion failure error when CGImageCreate fails by @​complexspaces in 1Password/arboard#205
• Properly encode/decode MIME=text/uri-list by @​luca020400 in 1Password/arboard#217
• Increase windows-sys lower bound to 0.62 by @​T-256 in 1Password/arboard#220
• Add example to Get and Set by @​Its-Just-Nans in 1Password/arboard#224
• Add a wait_once to support waiting for just one clipboard request by @​joshtriplett in 1Password/arboard#213

New Contributors

• @​luca020400 made their first contribution in 1Password/arboard#217
• @​T-256 made their first contribution in 1Password/arboard#220
• @​Its-Just-Nans made their first contribution in 1Password/arboard#224
• @​joshtriplett made their first contribution in 1Password/arboard#213

Full Changelog: 1Password/arboard@v3.6.1...v3.7.0

Commits

• 5f5c863 Release 3.7.0
• ab9663b Add example demonstrating wait_once
• b9000b1 Add a wait_once to support waiting for just one clipboard request
• 2ea0ff6 wayland: Factor out option setting into a method
• b7e47c8 Update lib.rs
• 2b2050e Bump step-security/setup-rust-toolchain from 1.16.1 to 2.0.0
• 6b09682 Bump step-security/harden-runner from 2.20.0 to 2.21.1
• 9f7b05c Bump actions/checkout from 4.3.1 to 7.0.0
• 890e919 Apply GitHub Actions security best practices
• d7c6cc9 bump windows-sys lower bound
• Additional commits viewable in compare view

Updates resvg from 0.45.1 to 0.49.0

Release notes

Sourced from resvg's releases.

v0.49.0

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

v0.48.1

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

v0.48.0

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

v0.47.0

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

v0.46.0

• resvg-0.*.0.tar.xz is a sources archive with vendored Rust dependencies
• resvg-explorer-extension.exe is an SVG thumbnailer for Windows Explorer

Check CHANGELOG.

Changelog

Sourced from resvg's changelog.

[0.49.0] 2026-10-24

This release has an MSRV of 1.85.0 for usvg and resvg and the C API.

Added

• --query-bbox CLI option to query the drawing bounding box without rasterizing it. (#1050)
• mix-blend-mode: plus-lighter (Compositing and Blending Level 2). (#1142)
• feComposite operator="lighter" (SVG 2). (#1142)
• Prebuilt aarch64 release binaries for Linux and Windows. (#1132)

Changed

• usvg::BlendMode and usvg::filter::CompositeOperator have new PlusLighter and Lighter variants. (#1142)
• Group::layer_bounding_box of a group without filters is now clipped by its clip path, so clipped groups allocate smaller layers. This also affects the sizes reported by --query-all and used by --export-id. (#1158)

Fixed

• dominant-baseline is now correctly inherited by nested <tspan> elements, so a nested span stays on the same baseline as its siblings. (#1086)
• Panics and incorrect clipping when a filter region is smaller than its input. (#1144)
• Incorrect transform order on the outermost svg element with a viewBox. (#1085)
• Relative positioning of right-to-left text with dx and dy, including text on a path and text decorations. (#1145)
• text-anchor now uses the actual extent of a text chunk, which dx and textLength can change. (#1145)
• Filters inside rotated or skewed groups are now applied in the user space of the group. This fixes the clipping to filter regions and subregions, as well as the direction of offsets, blurs, turbulence and tiles, and the rendering of feImage. (#1155)
• gradientTransform and patternTransform are now inherited via href. (#1135)
• The bounding box of an <image> with preserveAspectRatio="… slice" is now its viewport, so objectBoundingBox clip paths, masks and filters on it are resolved correctly. (#1077)
• Markers are now clipped to their viewport instead of their viewBox when the aspect ratios differ. (#1163)
• Object bounding box gradients inside masks, patterns and feImage filters used by more than one element are now resolved correctly, instead of being rendered as a flat fill or not at all. (#1164)
• feMorphology kernels are now symmetric and fractional radii are rounded to the nearest pixel. (#1120)
• Font fallback log messages now always name the correct fallback font family. (#1154)
• The resvg CLI no longer rounds fractional image sizes before scaling, and rounds the output size up instead of to the nearest integer. (#875)
• The C API header was missing RESVG_ERROR_SVGZ_UNSUPPORTED, so all following error codes were off by one. (#1122)
• cargo-c now installs ResvgQt.h alongside resvg.h. (#1182)

[0.48.1] 2026-08-02

This release has an MSRV of 1.85.0 for usvg and resvg and the C API.

Changed

• MSRV lowered from 1.89 to 1.85. (#1109)

... (truncated)

Commits

• 66ee0dc Prepare v0.49.0 release (#1183)
• 5192641 Install ResvgQt.h with cargo-c (#1182)
• ef52697 Remove reference to nonexistent check.py from tests README (#1181)
• 054ccf3 Optimize clipped layers (#1158)
• 48d7286 Resolve paint servers in masks, patterns and feImage before caching (#1164)
• 8fef71a Fix marker viewport clipping with preserveAspectRatio (#1163)
• 978775b Fix rendering of filters with skews and rotations (#1155)
• 77b12f4 Fix font fallback logging and avoid repeated lookups (#1154)
• 101e3f1 Bug fixes for RTL text and dx/dy (#1145)
• fa9ff32 Fix feMorphology kernel size and radius rounding (#1120)
• Additional commits viewable in compare view

Updates open from 5.4.4 to 5.4.5

Release notes

Sourced from open's releases.

v5.4.5

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior; the earlier implementation retried unsuccessful operations.

... (truncated)

Changelog

Sourced from open's changelog.

5.4.5 (2026-10-22)

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior;

... (truncated)

Commits

• a60a9d5 Release open v5.4.5
• 4e64f6b Merge pull request #135 from Byron/fix-linux-launchers
• c88759b auto-review
• 42a34b0 fix(unix): check that_detached launchers for immediate failures
• 279c1b2 fix(unix): restore launcher fallback and support Plasma 6
• See full diff in compare view

Updates ureq from 3.4.2 to 3.5.0

Changelog

Sourced from ureq's changelog.

3.5.0

• Prepare 3.5.0 and fix dependency advisories and warnings - #1217
• Add Agent::shutdown() to interrupt requests in flight and close all connections #1211
• Preserve validated request header casing with RequestBuilder::header_raw #1214
• Decode proxy URL credentials once; literal percent signs must be escaped as %25 #1215
• Encode ProxyBuilder credentials and preserve colons in proxy passwords #1215
• Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #1209
• Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #1209
• Clarify timeout budgets, phase boundaries, and proxy DNS #1213
• Bound TLS handshake I/O by the remaining connect/global timeout #1208
• Retry socket reads interrupted by EINTR when timeout (technically breaking) #1205
• Fix native-tls-no-default enabling dependencies without enabling the TLS connector
• Add timeout_per_read and timeout_per_write independently of total phase budgets

3.4.3

• Update TLS dependencies for security fixes #1218

Commits

• 1bd534e Fix changelog
• fee0ad2 Prepare 3.5.0 and fix dependency advisories and warnings
• 7de0ab7 Remove realtime dependencies from tests
• 3f18f90 Add Agent::shutdown() for active and pooled connections
• 04572f2 Expose validated request header casing
• 6b1c275 Fix proxy credential encoding and decoding
• 6a609b4 Apply the connect timeout to the SOCKS handshake and check NO_PROXY first
• 3c818f4 Clarify timeout budgets and phase boundaries
• af3e959 Bound TLS handshake I/O by remaining timeout budgets
• 0ebb046 Retry socket reads interrupted by a signal when a timeout applies (#1205)
• Additional commits viewable in compare view

Updates muda from 0.21.1 to 0.21.2

Release notes

Sourced from muda's releases.

muda v0.21.2

[0.21.2]

• 1802a0d (#430 by @​wonfen) On Windows, Fix menu items going dead after a process has created about 64.5k menus and items.

Updating crates.io index
   Packaging muda v0.21.2 (/home/runner/work/muda/muda)
warning: ignoring example `tao` as `examples/tao.rs` is not included in the published package
warning: ignoring example `winit` as `examples/winit.rs` is not included in the published package
warning: ignoring example `winit_gtk4` as `examples/winit_gtk4.rs` is not included in the published package
warning: ignoring example `wry` as `examples/wry.rs` is not included in the published package
    Updating crates.io index
    Packaged 58 files, 649.2KiB (137.3KiB compressed)
   Verifying muda v0.21.2 (/home/runner/work/muda/muda)
 Downloading crates ...
  Downloaded autocfg v1.5.1
  Downloaded atk-sys v0.18.2
  Downloaded bitflags v2.13.1
  Downloaded atk v0.18.2
  Downloaded cairo-rs v0.18.5
  Downloaded futures-task v0.3.33
  Downloaded gdk-pixbuf-sys v0.18.0
  Downloaded futures-io v0.3.33
  Downloaded dpi v0.1.2
  Downloaded equivalent v1.0.2
  Downloaded futures-macro v0.3.33
  Downloaded cairo-sys-rs v0.18.2
  Downloaded field-offset v0.3.6
  Downloaded gobject-sys v0.18.0
  Downloaded gtk3-macros v0.18.2
  Downloaded heck v0.4.1
  Downloaded proc-macro-error-attr v1.0.4
  Downloaded serde_spanned v0.6.9
  Downloaded toml_datetime v0.6.3
  Downloaded proc-macro-crate v2.0.2
  Downloaded version_check v0.9.5
  Downloaded proc-macro-crate v1.3.1
  Downloaded memoffset v0.9.1
  Downloaded rustc_version v0.4.1
  Downloaded heck v0.5.0
  Downloaded futures-core v0.3.33
  Downloaded futures-executor v0.3.33
  Downloaded gdk-pixbuf v0.18.5
  Downloaded slab v0.4.12
  Downloaded proc-macro-error v1.0.4
  Downloaded system-deps v6.2.2
</tr></table> 

... (truncated)

Changelog

Sourced from muda's changelog.

[0.21.2]

• 1802a0d (#430 by @​wonfen) On Windows, Fix menu items going dead after a process has created about 64.5k menus and items.

Commits

• 33dfdf7 apply version updates (#431)
• 1802a0d fix(windows): recycle menu command ids to keep them within 16 bits (#430)
• See full diff in compare view

Updates objc2 from 0.5.3 to 0.6.5

Commits

• d7d2fa2 Bump objc2 0.6.4 -> 0.6.5
• ed5d37c Cherry-pick #862 for objc2 v0.6.5
• 8852b42 Bump objc2 0.6.3 -> 0.6.4
• 2d39cba Cherry-pick ae1c875 for objc2 v0.6.4
• 2ace80b Cherry-pick relevant parts of 9bd26ee for objc2 v0.6.4
• 6780851 Bump dispatch2 0.3.0 -> 0.3.1
• ad96317 Cherry-pick e429f0a for dispatch2 v0.3.1
• ee273d9 Cherry-pick a4821be for dispatch2 v0.3.1
• b4167b5 Fix documentation on docs.rs
• f5df468 Bump objc2 0.6.1 -> 0.6.2
• Additional commits viewable in compare view

Updates objc2-foundation from 0.2.2 to 0.3.2

Commits

• 8b04944 Merge pull request #536 from madsmtm/new-versions
• a7ca37c Remove production-readyness warning from README
• 611e5f1 Don't require AppKit in UI tests
• 8e3ff12 Fix unstable-c-unwind tests
• cfc226e Fix flaky UI test
• e2abb0d Show diff for UI tests
• 6fef80d Fix tests on aarch64 / with newer LLVM
• 3cfb7c8 Fix doc test on NSMutableDictionary
• 1eb0c10 Bump icrate version 0.0.4 -> 0.1.0
• 6712bb1 Bump block2 version 0.3.0 -> 0.4.0
• Additional commits viewable in compare view

Updates jupyter-zmq-client from 2.0.0 to 3.0.1

Commits

• 50f7cc1 Prepare jupyter-zmq-client 3.0.1 malformed-input patch (#333)
• c772ab9 Reject truncated Jupyter multipart messages before HMAC verification (#332)
• 46d64f6 Release transport majors and Y-sync 0.3 with patched dependencies (#331)
• 29b45be Prepare Ollama 1.2.3 with a reviewed dependency lockfile (#330)
• See full diff in compare view

Updates libc from 0.2.190 to 0.2.191

Release notes

Sourced from libc's releases.

0.2.191

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Changelog

Sourced from libc's changelog.

0.2.191 - 2026-10-16

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Commits

• ccc2ff4 libc: Release 0.2.191
• bce6efb apple: Add mach_task_self and mach_task_self_ to semver checks
• ecf4fd4 apple: Re-restrict mach_vm_map to MacOS-only
• b0e0423 Revert "apple: Disable mach.h API on Apple mobile OSs"
• 9c7f568 apple: add ifaliasreq and in6_aliasreq
• 018c7e9 wasi: Add pthread_condattr_{get,set}clock
• 2c77185 openbsd: add sensordev structure
• e10813c hurd: Add missing POSIX_SPAWN_* flags
• 2ea4bc1 Fix FreeBSD/aarch64
• 6d666fd dragonfly: Parse version from headers rather than CLI
• Additional commits viewable in compare view

Updates arrow-array from 60.0.0 to 60.1.0

Release notes

Sourced from arrow-array's releases.

arrow 60.1.0

Changelog

60.1.0 - (2026-10-23)

Full Changelog

Security fixes

• Redact Parquet encryption keys from Debug output by @​autoCAT6 in #11614

Enhancements

• Implement BatchCoalescer::push_batch_interleaved by @​Rich-T-kid in #11519
• feat(parquet): convert INT96 timestamp statistics by @​Seanium in #11348
• feat: Introduce ArrayReader and ArrayIterator concepts by @​kylebarron in #11161
• feat: Add separate Parquet PageIndex decoder to ParquetMetaDataPushDecoder and ParquetMetaDataReader by @​etseidl in #11438
• feat: add GapInfo to timezone by @​mhilton in #11535
• Make ByteStreamSplit and Alp Encoder/Decoder and their constructors experimentally public by @​jhorstmann in #11481
• Sync Arrow format documentation and Go metadata by @​Phoenix500526 in #11499
• Add ArrayData::sliced to avoid allocations when slicing owned ArrayData by @​memosmorgan in #11433
• feat(parquet): add ParquetPushDecoder::scan_plan for read-ahead planning by @​adriangb in #10555
• feat(arrow-buffer): add i256::wrapping_div_rem and i256::checked_div_rem by @​mbutrovich in #11425
• feat(parquet): Support per-column data page row count limit (#11339) by @​DKER2 in #11349
• Allow configuring DELTA_BINARY_PACKED block layout by @​emecii in #11051
• feature: add safe version of ArrayData::from_pyarrow by @​Rich-T-kid in #10894
• [Arrow] Move parquet-variant-compute StructArrayAssembler to arrow-array by @​cakeni in #10636
• feat(parquet): expose RowSelection::force_mask by @​haohuaijin in #11337
• fix(parquet): support non-primitive map keys in record reader by @​hsdfat in #11229
• feat(arrow-schema): expose FixedShapeTensor logical shape by @​yongster in #11249
• feat(arrow-schema): expose FixedShapeTensor shape by @​yongster in #11247
• perf: Add APIs for filter with known selected-row count by @​neilconway in #11206

... (truncated)

Changelog

Sourced from arrow-array's changelog.

60.1.0 - (2026-10-23)

Full Changelog

Security fixes

• Redact Parquet encryption keys from Debug output by @​autoCAT6 in #11614

Enhancements

• Implement BatchCoalescer::push_batch_interleaved by @​Rich-T-kid in #11519
• feat(parquet): convert INT96 timestamp statistics by @​Seanium in #11348
• feat: Introduce ArrayReader and ArrayIterator concepts by @​kylebarron in #11161
• feat: Add separate Parquet PageIndex decoder to ParquetMetaDataPushDecoder and ParquetMetaDataReader by @​etseidl in #11438
• feat: add GapInfo to timezone by @​mhilton in #11535
• Make ByteStreamSplit and Alp Encoder/Decoder and their constructors experimentally public by @​jhorstmann in #11481
• Sync Arrow format documentation and Go metadata by @​Phoenix500526 in #11499
• Add ArrayData::sliced to avoid allocations when slicing owned ArrayData by @​memosmorgan in #11433
• feat(parquet): add ParquetPushDecoder::scan_plan for read-ahead planning by @​adriangb in #10555
• feat(arrow-buffer): add i256::wrapping_div_rem and i256::checked_div_rem by @​mbutrovich in #11425
• feat(parquet): Support per-column data page row count limit (#11339) by @​DKER2 in #11349
• Allow configuring DELTA_BINARY_PACKED block layout by @​emecii in #11051
• feature: add safe version of ArrayData::from_pyarrow by @​Rich-T-kid in #10894
• [Arrow] Move parquet-variant-compute StructArrayAssembler to arrow-array by @​cakeni in #10636
• feat(parquet): expose RowSelection::force_mask by @​haohuaijin in #11337
• fix(parquet): support non-primitive map keys in record reader by @​hsdfat in #11229
• feat(arrow-schema): expose FixedShapeTensor logical shape by @​yongster in #11249
• feat(arrow-schema): expose FixedShapeTensor shape by @​yongster in #11247
• perf: Add APIs for filter with known selected-row count by @​neilconway in #11206
• perf(parquet): fuse consecutive filters on the same projection by @​haohuaijin in #10859
• feat(variant): allow creating VariantArray from Option items convertible to Variant by @​jabrailkhalil in #11053
• feat(parquet): provide direct access to dictionary pages by @​DarkWanderer in #10420
• Allow for serialization of Parquet Page Index via custom PageIndexProvider by @​etseidl in #11031
• chore(arrow-flight-sql): deprecate register_sql_info from FlightSqlService by @​mnpw in #10904
• Infer CSV headers from sampled column types by @​Jo2234 in #10361
• Feat: support ndv for View types by @​Rich-T-kid in #11163
• feat(ffi): add unsafe constructors and accessors for FFI_ArrowArrayStream by @​kylebarron in #11125
• feat(fixed-sized-binary builder): introduce capacity by @​Rich-T-kid in #11127
• Add Sbbf::estimated_fpp to expose the bloom filter FPP estimate by @​adriangb in #11088
• [Variant] Support list paths in ShreddedSchemaBuilder by @​cakeni in #10635
• deps: removed unneeded once_cell dependency if favor of std::sync::LazyLock by @​aectaan in #11066

Bug fixes

• fix(arrow-select): reject nulls in non-nullable columns in take_record_batch by @​mbutrovich in #11831
• [Variant] Restore object field offsets after failed append by @​osipovartem in #11403
• fix(arrow-select): bounds-check take_record_batch once, with a faster check_bounds for null indices by @​mbutrovich in #11829
• fix(parquet): align encoded Arrow schemas and nested nullability by @​HippoBaro in #11278
• Fix incorrect Decimal statistics for BYTE_ARRAY columns written via ArrowColumnWriter by @​DeviousCardi in #11092
• fix(parquet): return an error for RLE run lengths above the spec limit by @​hhhizzz in #11517
• fix: use correct length in runarray validation by @​Jefffrey in #11668
• fix(parquet): return an error when the footer metadata length exceeds the file in ParquetMetaDataPushDecoder by @​ump45nose in #11697
• fix: account for offset when building RunArray from ArrayData by @​Jefffrey in #11660

... (truncated)

Commits

• b391e5a Update version to 60.1.0...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.