Skip to content

chore(deps): bump the all-cargo group with 5 updates - #40

Merged
m5d215 merged 1 commit into
mainfrom
dependabot/cargo/all-cargo-125db49c87
Aug 3, 2026
Merged

chore(deps): bump the all-cargo group with 5 updates#40
m5d215 merged 1 commit into
mainfrom
dependabot/cargo/all-cargo-125db49c87

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-cargo group with 5 updates:

Package From To
clap 4.6.1 4.6.4
comrak 0.52.0 0.54.0
open 5.3.6 5.4.0
serde 1.0.228 1.0.229
toml 1.1.2+spec-1.1.0 1.1.4+spec-1.1.0

Updates clap from 4.6.1 to 4.6.4

Release notes

Sourced from clap's releases.

v4.6.4

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 87ec1ad chore: Release
  • 78f2529 docs: Update changelog
  • b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
  • 74c6666 fix(complete): Keep zsh candidate order
  • d142d8f Merge pull request #6360 from epage/string
  • ba89563 style: Prefer explicit string operations
  • bea966e Merge pull request #6359 from epage/man
  • b811986 chore(man):Remove unused required-features
  • 0010bf2 Merge pull request #6358 from clap-rs/renovate/crate-ci-typos-1.x
  • bab9b24 chore(deps): Update compatible (dev) (#6357)
  • Additional commits viewable in compare view

Updates comrak from 0.52.0 to 0.54.0

Release notes

Sourced from comrak's releases.

v0.54.0

Changed APIs:

New APIs:

Bug fixes:

Dependency updates:

  • Bump toml from 1.1.0+spec-1.1.0 to 1.1.2+spec-1.1.0 (by @dependabot[bot] in kivikakk/comrak#819)

New Contributors

Diff: kivikakk/comrak@v0.53.0...v0.54.0

v0.53.0

Changed APIs:

Bug fixes:

Stability:

Dependency updates:

... (truncated)

Changelog

Sourced from comrak's changelog.

[v0.54.0] - 2026-07-12

Changed APIs:

New APIs:

Bug fixes:

Dependency updates:

  • Bump toml from 1.1.0+spec-1.1.0 to 1.1.2+spec-1.1.0 (by @dependabot[bot] in kivikakk/comrak#819)

New Contributors

Diff: kivikakk/comrak@v0.53.0...v0.54.0

[v0.53.0] - 2026-07-02

Changed APIs:

Bug fixes:

Stability:

... (truncated)

Commits

Updates open from 5.3.6 to 5.4.0

Release notes

Sourced from open's releases.

v5.4.0

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.
  • 1 unique issue was worked on: #124

Commit Details

... (truncated)

Changelog

Sourced from open's changelog.

5.4.0 (2026-07-12)

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.

... (truncated)

Commits
  • b5c12bd Release open v5.4.0
  • bdc3397 Merge pull request #126 from Byron/fix-wsl
  • 7265cae fix: Align WSL PowerShell invocation with Windows
  • 407b058 Merge pull request #125 from Byron/open-with-dash-dash
  • fd29861 fix: prevent launcher option and shell injection (#124)
  • 7c19c0a feat: cargo run now shows the exact commands that were tried when opening.
  • See full diff in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits
  • beee9fe chore: Release
  • 16e2ac1 docs: Update changelog
  • 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
  • 534039c fix(serde): Deserialize Value datetimes into typed targets
  • 6e45cef test(serde): Reproduce Value datetime deserialization error
  • 4ec099f chore: Release
  • 5a47a51 docs: Update changelog
  • da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
  • 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
  • ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the all-cargo group with 5 updates
6c40a97 
Bumps the all-cargo group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.4` |
| [comrak](https://github.com/kivikakk/comrak) | `0.52.0` | `0.54.0` |
| [open](https://github.com/Byron/open-rs) | `5.3.6` | `5.4.0` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.4+spec-1.1.0` |


Updates `clap` from 4.6.1 to 4.6.4
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.4)

Updates `comrak` from 0.52.0 to 0.54.0
- [Release notes](https://github.com/kivikakk/comrak/releases)
- [Changelog](https://github.com/kivikakk/comrak/blob/main/CHANGELOG.md)
- [Commits](kivikakk/comrak@v0.52.0...v0.54.0)

Updates `open` from 5.3.6 to 5.4.0
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.3.6...v5.4.0)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.2...toml-v1.1.4)

---
updated-dependencies:
- dependency-name: clap
  dependency-version: 4.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-cargo
- dependency-name: comrak
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-cargo
- dependency-name: open
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-cargo
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-cargo
- dependency-name: toml
  dependency-version: 1.1.4+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 1, 2026
@m5d215
m5d215 merged commit 4597af4 into main Aug 3, 2026
3 checks passed
@m5d215
m5d215 deleted the dependabot/cargo/all-cargo-125db49c87 branch August 3, 2026 00:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@m5d215