[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rustix	dependencies	patch	1.1.4 → 1.1.5
serde_json	dependencies	patch	1.0.151 → 1.0.154
sha2	dependencies	patch	0.11.0 → 0.11.1
tokio (source)	dependencies	patch	1.53.2 → 1.53.3
toml	dependencies	patch	1.1.6+spec-1.1.0 → 1.1.8
toml_edit	dependencies	patch	0.25.15+spec-1.1.0 → 0.25.17
zip	dependencies	patch	9.0.3 → 9.0.5

---

Release Notes

bytecodealliance/rustix (rustix)

v1.1.5

Compare Source

serde-rs/json (serde_json)

v1.0.154

Compare Source

• Support preserve_order in no_std builds (#​1333, thanks @​razmser)

v1.0.153

Compare Source

• Report invalid UTF-8 at the first bad byte (#​1345, thanks @​00200200)

v1.0.152

Compare Source

• Preserve sign of -0 in arbitrary_precision mode (#​1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#​1347, thanks @​yuxi-liu-wired)

RustCrypto/hashes (sha2)

v0.11.1

Compare Source

tokio-rs/tokio (tokio)

v1.53.3: Tokio v1.53.3

Compare Source

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#​8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#​8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#​8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#​8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#​8595)
• sync: wake waiters outside the lock when closing a semaphore (#​8529)
• test: fix several flaky tests (#​8196, #​8427, #​8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#​8185)

toml-rs/toml (toml)

v1.1.8

Compare Source

v1.1.7

Compare Source

zip-rs/zip2 (zip)

v9.0.5

Compare Source

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#​1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#​1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#​1079)

v9.0.4

Compare Source

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#​1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#​1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#​1065)
• update lzma-rust2 and ppmd-rust dependencies (#​1060)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "after 5pm,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1a986c92-1522-49db-896a-e6dbca23098f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.53.2 ⏵ 1.53.3	-2
	cargo/​serde_json@​1.0.151 ⏵ 1.0.154
	cargo/​rustix@​1.1.4 ⏵ 1.1.5
	cargo/​sha2@​0.11.0 ⏵ 0.11.1
	cargo/​toml@​1.1.6%2Bspec-1.1.0 ⏵ 1.1.8+spec-1.1.0
	cargo/​toml_edit@​0.25.15%2Bspec-1.1.0 ⏵ 0.25.17+spec-1.1.0
	cargo/​zip@​9.0.3 ⏵ 9.0.5

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!