[renovate]

This PR contains the following updates:

Package	Type	Update	Change
clap	workspace.dependencies	patch	4.6.6 → 4.6.7
indexmap	dependencies	patch	2.14.1 → 2.14.2
napi	dependencies	minor	3.12.2 → 3.15.0
napi-build	build-dependencies	minor	2.4.1 → 2.6.0
napi-derive	dependencies	patch	3.6.3 → 3.6.13
oxc_allocator (source)	dependencies	minor	0.147.0 → 0.155.0
oxc_codegen (source)	dependencies	minor	0.147.0 → 0.155.0
oxc_minifier (source)	dependencies	minor	0.147.0 → 0.155.0
oxc_parser (source)	dependencies	minor	0.147.0 → 0.155.0
oxc_span (source)	dependencies	minor	0.147.0 → 0.155.0
rquickjs	dependencies	minor	0.13 → 0.14
smallvec	dependencies	minor	1.15.2 → 1.16.3
tokio (source)	workspace.dependencies	minor	1.53.1 → 1.54.1
ureq	workspace.dependencies	minor	3.4.0 → 3.5.0
wit-bindgen	dependencies	minor	0.61 → 0.63

---

Release Notes

clap-rs/clap (clap)

v4.6.7

Compare Source

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

indexmap-rs/indexmap (indexmap)

v2.14.2

Compare Source

• Fix item hygiene in map and set macros. Previously, an internal const CAP
  could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and
  indexset_with_default!. The hasher may also be omitted if it's inferrable.

napi-rs/napi-rs (napi)

v3.15.0

Compare Source

Added

• (napi) cancel a ReadableStream through its Reader, and fix ReadableStream::cancel (#​3623)

Fixed

• (napi) set the custom GC aborted flag before Node closes its tsfn (#​3626)
• (napi) TypedArray input leaks and compat buffer copies on wasm (#​3612)
• (napi) copy managed array inputs (#​3607)
• (napi) reject a value of another class on builds without type tags (#​3610)
• (napi) drop unadopted class value and reset factory flag on failed conversion (#​3603)
• (napi) join the Tokio runtime threads at env teardown (#​3592)
• (napi) keep borrowed class args alive across AsyncTask/AsyncBlock (#​3584)

Other

• (cli) cover FreeBSD arm64 (#​3620)
• (cli) record the design behind the threaded WASI heap sync (#​3581)

v3.14.2

Compare Source

Fixed

• (napi) register the wasm cleanup through the env cleanup hook (#​3571)
• (napi) own NativeBorrowScope storage via NonNull to fix aliasing violation (#​3573)
• (napi) bound serde_json::Value conversion depth at 128 levels (#​3568)

v3.14.1

Compare Source

Fixed

• (napi) create objects with napi_define_properties on every Node version (#​3560)

v3.14.0

Compare Source

Added

• (napi) lock the allocator on threaded WASI and never hang after a worker crash (#​3552)

v3.13.0

Compare Source

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#​3541)

Fixed

• (napi) validate native payload provenance for External and instance data (#​3540)

v3.12.7

Compare Source

Fixed

• (napi) guard AsyncTask completion against env teardown (#​3536)

v3.12.6

Compare Source

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#​3528)

v3.12.5

Compare Source

Fixed

• fatal_exception noop in optimized builds (#​3509)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

v3.12.3

Compare Source

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#​3489)
• (napi) catch panics in closure trampolines instead of aborting (#​3473)

Other

• (napi) keep anyhow error cause when converting (#​3477)
• (napi) outline threadsafe callback dispatch (#​3465)
• (napi) outline class instance construction (#​3464)

DelSkayn/rquickjs (rquickjs)

v0.14.0

Compare Source

Breaking Changes

• Removed unused trait StaticJsFunction.

Added

• Added Exception::throw_dom, PredefinedAtom::DOMException, and intrinsic::DOMException.
• Support for wasm32-unknown-unknown from [@​mrchantey]

Fixed

• Fixed Params::is_constructor to return the suggested value instead of false.
• Fixed ExoticMethod to fix type checking for &Ctx
• Fixed Ctx::execute_pending_job treating a job that threw the same as one that ran successfully, leaving the exception pending on the runtime instead of clearing it.
• Fixed Object::instance_of leaving a pending exception on the runtime when the checked object isn't an instance of the given Rust class.

servo/rust-smallvec (smallvec)

v1.16.3

Compare Source

What's Changed

• Port new fuzzer to v1 by @​bolshoytoster in #​678
• fix: overflow during fuzzy check by @​GauravPawar101 in #​693
• chore: bump version by @​alejandro-vaz in #​723

Full Changelog: servo/rust-smallvec@v1.16.2...v1.16.3

v1.16.2

Compare Source

What's Changed

• Backport v2’s retain implementation to v1 by @​charliermarsh in #​596
• Fix element ownership tracking with may_dangle by @​charliermarsh in #​594
• Fix Cargo manual_readme warning by @​Rayan-and-beyond in #​608
• chore: bump version by @​alejandro-vaz in #​617

New Contributors

• @​Rayan-and-beyond made their first contribution in #​608

Full Changelog: servo/rust-smallvec@v1.16.1...v1.16.2

v1.16.1

Compare Source

What's Changed

• Speed up push by expanding triple_mut by @​bolshoytoster in #​557
• chore: bump version to 1.16.1 by @​ryux1 in #​585
• fix: doc warning by @​alejandro-vaz in #​582
• fix: cargo warnings by @​alejandro-vaz in #​581

New Contributors

• @​ryux1 made their first contribution in #​585

Full Changelog: servo/rust-smallvec@v1.16.0...v1.16.1

v1.16.0

Compare Source

What's Changed

• Include debug_metadata/*.natvis in the published crate to fix debugger_visualizer/docs.rs build by @​teddytennant in #​417
• feat: removed debugger visualizer + tests by @​alejandro-vaz in #​420
• feat: added style check to CI && rustfmt.toml by @​alejandro-vaz in #​436

New Contributors

• @​teddytennant made their first contribution in #​417

Full Changelog: servo/rust-smallvec@v1.15.2...v1.16.0

tokio-rs/tokio (tokio)

v1.54.1: Tokio v1.54.1

Compare Source

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#​8692)

v1.54.0: Tokio v1.54.0

Compare Source

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#​8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#​8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#​8378)
• runtime: add Builder::max_io_events_per_busy_tick (#​8410)
• runtime: stabilize tokio::runtime::worker_index() (#​8431)
• sync: add SemaphorePermit::semaphore() (#​8482)
• sync: add blocking_acquire methods to Semaphore (#​8269)
• sync: add watch::Receiver::is_closed (#​8481)
• wasm: support JSPI for Emscripten target (#​8285, #​8627)
• wasm: support the wasm32-unknown-emscripten target (#​8281, #​8422, #​8528, #​8628)

Changed

• fs: reject zero in File::set_max_buf_size (#​8449)
• io: make copy_buf cooperative (#​8459)
• io: panic when BufReader or BufStream is created with zero capacity (#​8494)
• io: panic when in-memory pipe is created with zero capacity (#​8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#​8454)
• io: support vectored writes in Sink (#​8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#​8444)
• net: start accepted sockets as readable and writable (#​8435)
• net: support UCred on Fuchsia (#​8257)
• process: use mio::unix::pipe for Unix child stdio (#​8603)
• runtime: cache-pad the shared injection queue and idle state (#​8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#​8414)
• runtime: make enable_io available whenever rt is enabled (#​8387)
• runtime: move block_in_place setup into a non-generic function (#​8315)
• runtime: move the multi-thread inject queue to its own mutex (#​8382)
• runtime: panic when max_io_events_per_tick is zero (#​8476)
• runtime: suggest .await in nested block_on panic message (#​8501)
• sync: avoid atomic reader count in broadcast slots (#​8357)
• sync: use acquire/release orderings in Notify (#​8325)
• time: remove the runtime handle from timers (#​8458)

Fixed

• fs: restore File internal state when op fails (#​8291)
• io: complete zero-length memory stream operations immediately (#​8323)
• io: flush the writer when the reader stalls in copy_buf (#​8424)
• io: keep the shutdown bit when clearing readiness (#​8435)
• io: preserve the full ScheduledIo tick in readiness events (#​8331)
• io: read lines as bytes so a partial line survives an I/O error (#​8400)
• io: retry on ErrorKind::Interrupted in more I/O operations (#​8417, #​8432, #​8448, #​8453, #​8455, #​8460)
• io: use spawn_mandatory_blocking for stdout and stderr (#​8506)
• io: wait for pending operations before BufReader seeks (#​8599)
• net: close CreateFileW handle on SetNamedPipeHandleState failure (#​8418)
• net: fix peer credentials on NetBSD (#​8589)
• net: saturate TcpSocket and UnixSocket listen backlog (#​8511)
• net: treat ENOTCONN as success in UnixStream::shutdown (#​8526)
• runtime: allow building with --all-features without tokio_unstable (#​8401)
• runtime: avoid overflow in shutdown_timeout() (#​8497)
• runtime: fix spawn_blocking hang when only scheduler workers exist (#​8408)
• runtime: fix misleading signal driver panic message (#​8419)
• sync: preserve FIFO lock order when coop budget is exhausted (#​8371)
• sync: use usize for permit count in SemaphorePermit (#​8405)
• time: avoid interval deadline overflow (#​8385)
• time: handle wrapped top-level timer-wheel slots (#​8334)

Unstable

• fs: fall back when io_uring has no IO driver (#​8165)
• metrics: cap log histogram precision (#​8496)
• runtime: add an opt-in sharded spawn_blocking queue (#​8337)
• runtime: expose schedule latency in task hooks (#​8282)
• taskdump: fix idle bookkeeping when a task dump wakes parked workers (#​8372)
• taskdump: skip non-idle tasks during taskdumps (#​8568)

Documented

• docs: fix stray braces and broken links in rustdoc (#​8605)
• fs: document cancellation behavior of tokio::fs (#​8265)
• net: add Safety docs for named pipe from_raw_handle (#​8378)
• net: document that TcpStream::connect returns only the last error (#​8421)
• runtime: add error documentation for runtime::Builder (#​8297)
• runtime: link available_parallelism in worker count docs (#​8625)
• sync: clarify panic behavior of broadcast::channel() (#​8420)
• sync: fix typo in Semaphore documentation (#​8521)

v1.53.3: Tokio v1.53.3

Compare Source

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#​8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#​8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#​8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#​8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#​8595)
• sync: wake waiters outside the lock when closing a semaphore (#​8529)
• test: fix several flaky tests (#​8196, #​8427, #​8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#​8185)

v1.53.2: Tokio v1.53.2

Compare Source

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#​8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#​8540)
• process: unregister Windows wait before closing child handle (#​8564)
• rt: drop blocking pool mutex before shutting down rejected task (#​8562)
• sync: fix mpsc index wraparound in block reclamation (#​8546)
• sync: forget mpsc Permit before sending value (#​8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#​8548)
• sync: wake broadcast Sender::closed outside mutex (#​8558)
• task: drop replaced waker outside lock in JoinSet (#​8554)
• time: drop timer lock before dropping waker in clear_entry (#​8552)
• time: expire timers directly on shutdown without rotating wheel (#​8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#​8572)
• rt: ignore current_thread task dumps from other runtimes (#​8544)
• rt: preserve io_uring context if a completion waker panics (#​8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#​8542)
• taskdump: restore deferred leaf wakes during capture (#​8445)
• time: drop stored waker when cancelling alt timer entry (#​8550)

algesten/ureq (ureq)

v3.5.0

Compare Source

• Prepare 3.5.0 and fix dependency advisories and warnings - #​1217
  • Add Agent::shutdown() to interrupt requests in flight and close all connections #​1211
  • Preserve validated request header casing with RequestBuilder::header_raw #​1214
  • Decode proxy URL credentials once; literal percent signs must be escaped as %25 #​1215
  • Encode ProxyBuilder credentials and preserve colons in proxy passwords #​1215
  • Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #​1209
  • Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #​1209
  • Clarify timeout budgets, phase boundaries, and proxy DNS #​1213
  • Bound TLS handshake I/O by the remaining connect/global timeout #​1208
  • Retry socket reads interrupted by EINTR when timeout (technically breaking) #​1205
  • Fix native-tls-no-default enabling dependencies without enabling the TLS connector
  • Add timeout_per_read and timeout_per_write independently of total phase budgets

v3.4.3

Compare Source

• Update TLS dependencies for security fixes #​1218

v3.4.2

Compare Source

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
  • Bypass pooling for request connection settings incompatible with the Agent #​1201
  • Try the next resolved address on unreachable/unavailable connect errors #​1195

v3.4.1

Compare Source

• Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #​1199
  • Do not pool connections with unconsumed buffered input #​1198
  • Fix timeout budgets restarting and applying to later phases #​1194
  • Complete TLS handshake during connect so timeout_connect covers it #​1193
  • Speed up read_json for responses with a known, small body size #​1191

bytecodealliance/wit-bindgen (wit-bindgen)

v0.63.0

Compare Source

What's Changed

• guest-rust: Implement a Task handle for spawned futures by @​adamrk in #​1710
• feat(d): Expose some WitVariant internals by @​QuantumSegfault in #​1712
• feat(d): Make use of pragma(inline, true) by @​QuantumSegfault in #​1711
• feat: update message in stubbed go exports by @​asteurer in #​1671
• feat: simplify go sdk generation by @​asteurer in #​1714
• fix(moonbit): modernize generated bindings and cancellation primitives by @​peter-jerry-ye in #​1715
• fix(d): Make sure the component type is linked in for export-only worlds. by @​QuantumSegfault in #​1716
• Issue 1703 by @​asteurer in #​1717
• Fix immediate yield in block_on by @​alexcrichton in #​1719
• Spawn through the wasip3_task_vtable by @​alexcrichton in #​1721
• chore: bump go pkg version by @​asteurer in #​1720
• Fixing rust map lowering interfaces by scoping each use. by @​mpawliszyn in #​1722
• Add line information to error messages in generate!() invocations by @​Qix- in #​1729
• Add accessor support by @​bvisness in #​1726
• Update wasm-tools deps to 261 by @​alexcrichton in #​1735
• Fix non-determinism in the order of with remappings by @​alexkirsz in #​1737
• Export the versioned cabi_realloc on native targets by @​technetos in #​1736
• chore: bump go-pkg version by @​asteurer in #​1738
• Replace --async with --sync by @​Lstarsky0 in #​1730
• feat(moonbit): generate moon.mod and moon.pkg manifests by @​peter-jerry-ye in #​1741
• rust: suppress wake notifications while destroying async tasks by @​lthibault in #​1740
• rust: preserve WASIp3 TLS for no-std task context by @​macovedj in #​1745
• Don't cancel spawned rust tasks on component task cancel by @​alexcrichton in #​1743
• Update wasm-tools dependencies by @​alexcrichton in #​1749
• Release wit-bindgen 0.63.0 by @​github-actions[bot] in #​1748

New Contributors

• @​mpawliszyn made their first contribution in #​1722
• @​Qix- made their first contribution in #​1729
• @​bvisness made their first contribution in #​1726
• @​alexkirsz made their first contribution in #​1737
• @​technetos made their first contribution in #​1736
• @​lthibault made their first contribution in #​1740
• @​macovedj made their first contribution in #​1745

Full Changelog: bytecodealliance/wit-bindgen@v0.62.0...v0.63.0

v0.62.0

Compare Source

What's Changed

• Update tools & wasi-sdk in CI by @​alexcrichton in #​1696
• rust: store local wrapper addresses in async stream/future vtables by @​alexcrichton in #​1699
• Ensure that an async function matches by @​jfleitz in #​1701
• feat(d): Improve export marking & naming by @​QuantumSegfault in #​1702
• fix(d): Fix crashes with large component type embeddings by @​QuantumSegfault in #​1704
• Remove 'static constraint in block_on by @​adamrk in #​1705
• Resolve Cargo warnings on nightly by @​alexcrichton in #​1706
• Remove single remaining threading test by @​alexcrichton in #​1709
• Update dependencies on major version tracks by @​alexcrichton in #​1707
• Release wit-bindgen 0.62.0 by @​github-actions[bot] in #​1708

New Contributors

• @​adamrk made their first contribution in #​1705

Full Changelog: bytecodealliance/wit-bindgen@v0.61.1...v0.62.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.