chore(deps): bump the cargo-deps group across 1 directory with 16 updates

[dependabot]

Bumps the cargo-deps group with 16 updates in the / directory:

Package	From	To
quote	1.0.45	1.0.46
syn	2.0.117	2.0.118
trybuild	1.0.116	1.0.117
log	0.4.31	0.4.33
getrandom	0.4.2	0.4.3
rustversion	1.0.22	1.0.23
anyhow	1.0.102	1.0.103
chrono	0.4.44	0.4.45
html-escape	0.2.13	0.2.14
lru	0.18.0	0.18.1
indicatif	0.18.4	0.18.6
regex	1.12.3	1.13.0
bytes	1.11.1	1.12.1
env_logger	0.11.10	0.11.11
tower-http	0.6.11	0.7.0
uuid	1.23.2	1.23.4

Updates quote from 1.0.45 to 1.0.46

Release notes

Sourced from quote's releases.

1.0.46

• Avoid repeated get_span in quote_spanned (#329, thanks @​Noratrieb)

Commits

• bc4caf2 Release 1.0.46
• dc0e304 Format with rustfmt
• 712114c Drop arrow from syntax of quote_spanned_with_expanded_span
• f93ab8a Eliminate quote_spanned_with_expanded_span_as_expr macro
• 1ff3951 Eliminate __quote_spanned macro
• 64e913a Unify quote_spanned definitions
• 2978e8b Wrap comment to 80 columns
• 7f311a0 Fix PR 329 fat arrow spacing
• 313a8a2 Remove unneeded get_span from PR 329
• 0b33821 Merge pull request #329 from Noratrieb/avoid-repeat-expand
• Additional commits viewable in compare view

Updates syn from 2.0.117 to 2.0.118

Release notes

Sourced from syn's releases.

2.0.118

• Documentation improvements

Commits

• f033ef1 Release 2.0.118
• 45f65f7 Wrap long lint attributes
• b3f9bf8 Mirror PR 1975 from readme to crate-level rustdoc
• 97dc117 Wrap PR 1975 to 80 columns
• 0085b7a Lint repr_transparent_non_zst_fields has been removed
• 9fc1c9d Update test suite to nightly-2026-06-12
• 504bcc7 Update test suite to nightly-2026-06-09
• 353d20b Update test suite to nightly-2026-06-06
• f257a16 Update test suite to nightly-2026-05-25
• b706e6e Update test suite to nightly-2026-05-13
• Additional commits viewable in compare view

Updates trybuild from 1.0.116 to 1.0.117

Release notes

Sourced from trybuild's releases.

1.0.117

• Better error message when TRYBUILD env var is wrong (#332, thanks @​tisonkun)

Commits

• 333eb00 Release 1.0.117
• 820b8a5 Merge pull request #332 from tisonkun/patch-1
• 7e9d0a6 Update actions/checkout@v6 -> v7
• 8dd2668 Better error message when TRYBUILD env var is wrong
• 0ee8f5a Raise required compiler to Rust 1.85
• 4dec71c Resolve unnecessary_map_or clippy lint
• 7d7cc4c Raise required compiler to Rust 1.82
• See full diff in compare view

Updates log from 0.4.31 to 0.4.33

Release notes

Sourced from log's releases.

0.4.32

What's Changed

• Support Value -> string conversions with kv + std features instead of kv_std by @​tisonkun in rust-lang/log#729
• Prepare for 0.4.32 release by @​KodrAus in rust-lang/log#730

Full Changelog: rust-lang/log@0.4.31...0.4.32

Changelog

Sourced from log's changelog.

[0.4.33] - 2026-06-20

What's Changed

• Fixed key comparison by @​matteo-zeggiotti-ok in rust-lang/log#732

New Contributors

• @​matteo-zeggiotti-ok made their first contribution in rust-lang/log#732

Full Changelog: rust-lang/log@0.4.32...0.4.33

[0.4.32] - 2026-06-04

What's Changed

• Support Value -> string conversions with kv + std features instead of kv_std by @​tisonkun in rust-lang/log#729

Full Changelog: rust-lang/log@0.4.31...0.4.32

Commits

• f405739 Merge pull request #734 from rust-lang/cargo/0.4.33
• 6a24abf prepare for 0.4.33 release
• 87e0621 Merge pull request #732 from matteo-zeggiotti-ok/fix-key-comparison
• a9b5711 Review: fallback to the &str hash
• cc89cc6 Review: fixed other comparisons
• 920e7dc Review: fixed comparison on MaybeStaticStr
• 0d71d3c Fixed key comparison
• a5b5b21 Merge pull request #730 from rust-lang/cargo/0.4.32
• c8d3b12 prepare for 0.4.32 release
• ce6cd9f Merge pull request #729 from tisonkun/kv-std-support
• Additional commits viewable in compare view

Updates getrandom from 0.4.2 to 0.4.3

Changelog

Sourced from getrandom's changelog.

0.4.3 - 2026-06-17

Added

• wasm64-unknown-unknown target support for wasm_js backend #848

Changed

• Drop wasip2 and wasip3 dependencies in favor of manual bindings #830

#830: rust-random/getrandom#830 #848: rust-random/getrandom#848

Commits

• 5e7cd57 Release v0.4.3 (#853)
• 1ea268a Use manual bindings for WASIp2/3 (#830)
• f7290b0 Update Cargo.lock (#852)
• 16ce801 Update Cargo.lock (#850)
• e5adfca Add wasm64-unknown-unknown support for wasm_js backend (#848)
• 626df8d Update Cargo.lock (#846)
• 4a01cb2 Update Cargo.lock (#841)
• f87bf39 Update Cargo.lock (#836)
• eadb879 ci: re-enable build job for x86_64-pc-cygwin (#832)
• d715d73 CI: Reduce the number of packages that are updated for wasip2 MSRV test (#825)
• Additional commits viewable in compare view

Updates rustversion from 1.0.22 to 1.0.23

Release notes

Sourced from rustversion's releases.

1.0.23

• Set RUSTVERSION=1 during rustc --version command (#68)

Commits

• 3a7c766 Release 1.0.23
• 9b213c4 Merge pull request #68 from dtolnay/env
• 8ffb0c2 Set RUSTVERSION=1 during rustc --version command
• 79462fd Update actions/upload-artifact@v6 -> v7
• ca1eafe Update actions/checkout@v6 -> v7
• 119e831 Lint clippy::from_iter_instead_of_collect has been removed
• a1dfebc Raise minimum tested compiler to rust 1.85
• f717b8d Unpin CI miri toolchain
• fb69332 Pin CI miri to nightly-2026-02-11
• a389672 Update actions/upload-artifact@v5 -> v6
• Additional commits viewable in compare view

Updates anyhow from 1.0.102 to 1.0.103

Release notes

Sourced from anyhow's releases.

1.0.103

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

Commits

• 5bdb0e2 Release 1.0.103
• e621bd3 Merge pull request #452 from dtolnay/downcast
• 6e8c000 Eliminate pointer->reference->pointer during downcast
• 67c4abd Add regression test for issue 451
• 917a169 Update actions/upload-artifact@v6 -> v7
• d9dc3fa Update actions/checkout@v6 -> v7
• 841522b Raise minimum tested compiler to rust 1.85
• See full diff in compare view

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in chronotope/chrono#1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in chronotope/chrono#1789

Commits

• 1703382 Prepare 0.4.45 release
• 881f9ab tz_data: fix tzdata locations on Android
• f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
• c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
• 120686c Bump codecov/codecov-action from 5 to 6
• See full diff in compare view

Updates html-escape from 0.2.13 to 0.2.14

Commits

• 9b05791 bump version
• 9e2fbad fix a bug, improve code
• 0c6fb93 exclude unused file
• 298b072 fix clippy
• ddaf097 update github workflows
• 6fa2f59 update GitHub workflows
• 93173c5 Update Cargo.toml
• 7b085b7 update github workflows
• 711929c update project
• See full diff in compare view

Updates lru from 0.18.0 to 0.18.1

Changelog

Sourced from lru's changelog.

v0.18.1 - 2026-07-09

• Add find_and_promote method.

Commits

• c6620d1 Merge pull request #237 from jeromefroe/jerome/prepare-0-18-1-release
• da3c0fc Prepare 0.18.1 release
• 1166263 Merge pull request #236 from pixmaip/find-and-promote
• 2daba12 Apply suggestions from code review
• 2ea00dc feat: add find_and_promote API
• See full diff in compare view

Updates indicatif from 0.18.4 to 0.18.6

Release notes

Sourced from indicatif's releases.

0.18.6

What's Changed

• fix: correctly detect dumb terminal on Windows by @​ugur-eren in console-rs/indicatif#818

0.18.5

What's Changed

• Upgrade to rand 0.10 by @​djc in console-rs/indicatif#768
• multi: document common MultiProgress bugs + behavior (#595) by @​chris-laplante in console-rs/indicatif#786
• Use div_duration_f64 by @​ChrisDenton in console-rs/indicatif#792
• Clear the rest of line after drawing to the terminal by @​ChrisDenton in console-rs/indicatif#790
• Fix ProgressDrawTarget.is_stderr() for MultiProgress by @​kojiishi in console-rs/indicatif#803
• Fix height and filler when wrapped at the middle of wide characters by @​kojiishi in console-rs/indicatif#799
• fix: respect NO_COLOR and TERM=dumb environment variable by @​ValentinLeTallec in console-rs/indicatif#808
• Fix stray comma after minus sign in HumanFloatCount by @​sueun-dev in console-rs/indicatif#815
• Fix HumanFloatCount dropping the fractional part by @​greymoth-jp in console-rs/indicatif#816
• style module cleanup by @​djc in console-rs/indicatif#813
• Drop screenshots from MultiProgress documentation by @​djc in console-rs/indicatif#817

Commits

• e4d49d8 Bump version to 0.18.6
• 582727e fix: correctly detect dumb terminal on Windows
• 90156ec Drop screenshots from MultiProgress documentation
• 4dbd0d5 Bump version to 0.18.5
• 24973aa Take semver-compatible dependency versions
• a575ef7 style: inline Template::from_str_with_tab_width()
• 0b94aa2 style: replace from_str() method with FromStr impl
• 398ac69 style: move helper functions to the bottom
• 692705d Fix HumanFloatCount dropping rounding at precision 0
• cbd070d Fix stray comma after minus sign in HumanFloatCount
• Additional commits viewable in compare view

Updates regex from 1.12.3 to 1.13.0

Changelog

Sourced from regex's changelog.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes with very large character classes.

Improvements:

• #1308: Avoid re-canonicalizing the entire interval set when pushing new class ranges.

Commits

• 926af2e 1.13.0
• 7d941a9 regex-automata-0.4.15
• e358341 api: add regex! macro for lazy compilation
• c420333 automata: disable miri on a couple doc tests
• b9d2cf7 github: add FUNDING link
• 0858006 docs: add AI policy for contributors
• 468fc64 automata: reject dense DFA start states that are match states
• 7b96fdc 1.12.4
• 7b89cf0 deps: update to regex-syntax 0.8.11
• 1401679 regex-syntax-0.8.11
• Additional commits viewable in compare view

Updates bytes from 1.11.1 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

• Add BytesMut::extend_from_within() (#818)
• Add BytesMut::try_unsplit() (#746)

Fixed

• Fix panic in get_int if nbytes is zero (#806)

Changed

• Pass vtable data by value (#826)
• Exclude development scripts from published package (#810)

Documented

• Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

• Add BytesMut::extend_from_within() (#818)
• Add BytesMut::try_unsplit() (#746)

Fixed

• Fix panic in get_int if nbytes is zero (#806)

Changed

• Pass vtable data by value (#826)
• Exclude development scripts from published package (#810)

Documented

• Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Commits

• 76c0fbb Release bytes v1.12.1 (#838)
• 924c82b Handle unwinding from Box::new (#837)
• 91402ce Release bytes v1.12.0 (#831)
• 2256e6d chore: add safety comments on unsafe blocks (#827)
• 245adff Pass vtable data by value (#826)
• 00cc5ff Implement BytesMut::extend_from_within (#818)
• 5b79d31 Merge tag 'v1.11.1'
• 804ee6d Make try_unsplit method public (#746)
• fd426ca Exclude development scripts from published package (#810)
• b4ed70d Add test for copy_to_bytes() -> BytesMut avoiding clone (#809)
• Additional commits viewable in compare view

Updates env_logger from 0.11.10 to 0.11.11

Release notes

Sourced from env_logger's releases.

v0.11.11

[0.11.11] - 2026-06-25

Internal

• Updated env_filter

Changelog

Sourced from env_logger's changelog.

[0.11.11] - 2026-06-25

Internal

• Updated env_filter

Commits

• b4d3f2b chore: Release
• cc2b2ef chore: Release
• 69e27d1 docs: Update changelog
• 166880d Merge pull request #411 from epage/parse
• 0a580d0 fix(filter): Remove 'parse' on no_std
• 78d8ef1 Merge pull request #404 from cagatay-y/feature/filter-no_std
• 132fe86 feat(filter): Add support for no_std environments
• 4feafa4 refactor(env_filter): Fix unreachable pub warning
• 92f8d8d Merge pull request #410 from rust-cli/renovate/crate-ci-typos-1.x
• 4e57784 chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
• Additional commits viewable in compare view

Updates tower-http from 0.6.11 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Updates uuid from 1.23.2 to 1.23.4

Release notes

Sourced from uuid's releases.

v1.23.4

What's Changed

• Fix up name of fuzz script in readme by @​KodrAus in uuid-rs/uuid#888
• document fixes by @​frostyplanet in uuid-rs/uuid#889
• Prepare for 1.23.4 release by @​KodrAus in uuid-rs/uuid#890

New Contributors

• @​frostyplanet made their first contribution in uuid-rs/uuid#889

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

What's Changed

• Fix up parser panic on empty input by @​KodrAus in uuid-rs/uuid#886
• Prepare for 1.23.3 release by @​KodrAus in uuid-rs/uuid#887

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

Commits

• 3296d64 Merge pull request #890 from uuid-rs/cargo/v1.23.4
• cba53d0 prepare for 1.23.4 release
• e347af4 Merge pull request #889 from frostyplanet/main
• e9bf55c doc: Fix broken link warnings
• 5351af4 doc: Enable feature flag label for docs.rs
• 1e6a966 Merge pull request #888 from uuid-rs/KodrAus-patch-1
• c9619f6 fix up name of fuzz script in readme
• 20da78b Merge pull request #887 from uuid-rs/cargo/v1.23.3
• 62232ca prepare for 1.23.3 release
• 2320c6a Merge pull request #886 from uuid-rs/fix/parser-panics
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
tower-http	[>= 0.4.a, < 0.5]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Size Comparison

Details

examples	master (KB)	pull request (KB)	diff (KB)	diff (%)
async_clock	100.113	99.933	-0.181	-0.180%
boids	164.772	164.632	-0.141	-0.085%
communication_child_to_parent	93.577	93.435	-0.143	-0.152%
communication_grandchild_with_grandparent	105.969	105.717	-0.252	-0.238%
communication_grandparent_to_grandchild	102.284	102.037	-0.247	-0.242%
communication_parent_to_child	90.965	90.823	-0.142	-0.156%
contexts	106.237	106.004	-0.233	-0.220%
counter	86.135	85.994	-0.141	-0.163%
counter_functional	88.253	88.009	-0.244	-0.277%
dyn_create_destroy_apps	90.021	89.880	-0.142	-0.157%
file_upload	98.718	98.579	-0.139	-0.140%
function_delayed_input	94.556	94.313	-0.242	-0.256%
function_memory_game	168.455	168.210	-0.245	-0.146%
function_router	399.103	400.245	+1.143	+0.286%
function_todomvc	164.956	164.701	-0.255	-0.155%
futures	235.878	235.721	-0.157	-0.067%
game_of_life	100.528	100.371	-0.157	-0.156%
immutable	257.710	257.514	-0.196	-0.076%
inner_html	80.623	80.482	-0.141	-0.174%
js_callback	109.743	109.502	-0.241	-0.220%
keyed_list	175.743	175.603	-0.141	-0.080%
mount_point	84.045	83.906	-0.139	-0.165%
nested_list	112.642	112.486	-0.155	-0.138%
node_refs	91.568	91.426	-0.143	-0.156%
password_strength	1769.250	1771.081	+1.831	+0.103%
portals	93.471	93.326	-0.145	-0.155%
router	365.280	366.430	+1.149	+0.315%
suspense	113.948	113.710	-0.238	-0.209%
timer	88.365	88.225	-0.141	-0.159%
timer_functional	99.319	99.085	-0.234	-0.236%
todomvc	141.845	141.688	-0.157	-0.111%
two_apps	86.028	85.888	-0.141	-0.163%
web_worker_fib	136.371	136.134	-0.237	-0.174%
web_worker_prime	186.442	186.204	-0.238	-0.128%
webgl	82.769	82.626	-0.143	-0.172%

✅ None of the examples has changed their size significantly.