[dependabot]

Bumps the rust-dependencies group with 6 updates in the / directory:

Package	From	To
clap	4.6.6	4.6.7
clap_complete	4.6.9	4.6.11
thiserror	2.0.20	2.0.21
toml	1.1.5+spec-1.1.0	1.1.6+spec-1.1.0
insta	1.48.0	1.49.0
jsonschema	0.55.1	0.58.5

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates clap_complete from 4.6.9 to 4.6.11

Commits

• 2cb76fd chore: Release
• 0b00b8d docs: Update changelog
• 3443000 Merge pull request #6526 from bonnefoa/fix-completion-escape
• a1b6be7 fix(clap_complete): Fix value escape in zsh completion
• face9e8 test(complete): Add completion test without arg's help
• 88053ab test(complete): Re-enable complete tests
• e6adcc2 chore(release): Simplify replacements
• 13f2db5 chore: Release
• 3304fea docs: Update changelog
• 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
• Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates toml from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits

• 572c005 chore: Release
• 66d0c53 docs: Update changelog
• 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
• 0ff90db perf(display): Write encoded strings directly
• efb2536 perf(display): Move generated representation strings
• 075c444 refactor(display): Consolidate key-path encoding
• b48f338 perf(display): Borrow table keys during document output
• c6c1de3 perf(parser): Move completed table header keys
• ec90463 perf(parser): Borrow input when creating editable documents
• d76a48a test: Benchmark rendering generated keys and values
• Additional commits viewable in compare view

Updates insta from 1.48.0 to 1.49.0

Release notes

Sourced from insta's releases.

1.49.0

Release Notes

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.ps1 | iex"

Download cargo-insta 1.49.0

File	Platform	Checksum
cargo-insta-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-insta-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-insta-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-insta-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-insta-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-insta-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

This was written by Codex on behalf of @​max-sixty

Changelog

Sourced from insta's changelog.

1.49.0

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Commits

• 5df39ce Release 1.49.0 (#944)
• 1c28c19 Skip the separate doctest run for nextest with --all-targets (#941)
• 064742e Build cargo-insta for aarch64-unknown-linux-gnu (#942)
• 08b67d9 Remove trailing semicolons from macro bodies (#940)
• 06858e1 fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)
• 70be034 Serialize unit enum variants used as JSON map keys (#934)
• 54d0b96 feat: implement From for SnapshotValue with OsStr (#929)
• 3d62572 [fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)
• 1712876 ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...
• See full diff in compare view

Updates jsonschema from 0.55.1 to 0.58.5

Release notes

Sourced from jsonschema's releases.

[CLI] Release 0.58.5

No release notes provided.

[Python] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.
• Validator construction holding the GIL while it retrieves external resources over HTTP or from files.

[Ruby] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.
• Validator construction holding the GVL while it retrieves external resources over HTTP or from files.

[Rust] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.

[CLI] Release 0.58.4

No release notes provided.

[Python] Release 0.58.4

Fixed

• repr of a validator_for validator naming the default draft instead of the one $schema declares.
• unevaluatedProperties and unevaluatedItems beside a $recursiveRef ignoring what the reference target evaluates.
• unevaluatedProperties ignoring the configured regex engine and its limits for patternProperties.
• Absolute keyword location and schemaLocation of keywords a $ref JSON Pointer reaches through a subschema with its own $id.
• type, minItems and maxItems ignored beside items when the applicator vocabulary is disabled.
• Absolute keyword location and schemaLocation of keywords inside a nested $id resource counting from the document root.
• required beside properties ignored when the applicator vocabulary is disabled, and required, minContains and maxContains applied when the validation vocabulary is disabled.
• Absolute keyword location and evaluation output of type errors in a type-only items subschema pointing at items instead of the failing element's type.
• Absolute keyword location of patternProperties annotations missing its JSON Pointer fragment.
• Evaluation output of type: array beside schema-form items omitting passing type, minItems and maxItems units and nesting failing ones under items.
• Evaluation output schemaLocation and absolute keyword location of $ref, $dynamicRef and $recursiveRef nodes not pointing at the reference target.
• Evaluation output schemaLocation URIs not percent-encoding their fragment, such as a space in a property name.
• Absolute keyword location of errors and annotations from a whole subschema, such as false, missing its JSON Pointer fragment.
• Absolute keyword location of required, minContains and maxContains errors pointing at a sibling keyword.
• Evaluation annotations from $ref siblings in Draft 4, 6 and 7 schemas.
• Masked additionalItems messages counting allowed items instead of extra ones, and "1 items" in masked unevaluatedItems messages.
• $dynamicRef and $recursiveRef resolving in the dynamic scope of another path to the same schema, depending on property order.
• unevaluatedProperties and unevaluatedItems ignoring what then or else evaluates when if is true or false.
• Stack overflow when building validators for long $ref chains.
• format: "regex" and meta-schema validation rejecting escaped punctuation such as \- in patterns.
• Build errors for an invalid patternProperties regex reporting the subschema instead of the pattern and its location.

[Ruby] Release 0.58.4

Fixed

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.58.5] - 2026-10-02

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.

[0.58.4] - 2026-10-01

Fixed

• Validator::draft returning the default draft instead of the one $schema declares.
• unevaluatedProperties and unevaluatedItems beside a $recursiveRef ignoring what the reference target evaluates.
• unevaluatedProperties ignoring the configured regex engine and its limits for patternProperties.
• Absolute keyword location and schemaLocation of keywords a $ref JSON Pointer reaches through a subschema with its own $id.
• type, minItems and maxItems ignored beside items when the applicator vocabulary is disabled.
• Absolute keyword location and schemaLocation of keywords inside a nested $id resource counting from the document root.
• required beside properties ignored when the applicator vocabulary is disabled, and required, minContains and maxContains applied when the validation vocabulary is disabled.
• Absolute keyword location and evaluation output of type errors in a type-only items subschema pointing at items instead of the failing element's type.
• Absolute keyword location of patternProperties annotations missing its JSON Pointer fragment.
• Evaluation output of type: array beside schema-form items omitting passing type, minItems and maxItems units and nesting failing ones under items.
• Evaluation output schemaLocation and absolute keyword location of $ref, $dynamicRef and $recursiveRef nodes not pointing at the reference target.
• Evaluation output schemaLocation URIs not percent-encoding their fragment, such as a space in a property name.
• Absolute keyword location of errors and annotations from a whole subschema, such as false, missing its JSON Pointer fragment.
• Absolute keyword location of required, minContains and maxContains errors pointing at a sibling keyword.
• Evaluation annotations from $ref siblings in Draft 4, 6 and 7 schemas.
• Masked additionalItems messages counting allowed items instead of extra ones, and "1 items" in masked unevaluatedItems messages.
• $dynamicRef and $recursiveRef resolving in the dynamic scope of another path to the same schema, depending on property order.
• unevaluatedProperties and unevaluatedItems ignoring what then or else evaluates when if is true or false.
• Stack overflow when building validators for long $ref chains.
• format: "regex" and meta-schema validation rejecting escaped punctuation such as \- in patterns.
• Build errors for an invalid patternProperties regex reporting the subschema instead of the pattern and its location.

[0.58.3] - 2026-09-30

Fixed

• Keywords of a subschema declaring a Draft 2019-09+ $schema under a Draft 4, 6 or 7 root being ignored.
• Evaluation annotations including those from subschemas of a failing schema (a failing schema produces no annotations).
• Embedded resources declaring their own $schema being checked against the root's meta-schema.

[0.58.2] - 2026-09-28

Fixed

• $dynamicRef targets in another document resolving relative references and reporting absolute keyword locations against the referencing document.
• $ref to an $anchor or fragment $id validating against another anchor in the same document. #1668
• schema_path of errors under a $ref or $dynamicRef to a named schema pointing at the resource root instead of that schema.

[0.58.1] - 2026-09-26

... (truncated)

Commits

• 21a061d chore(rust): Release 0.58.5
• 6c28049 chore: Migrate to the Ruby::gc_* API of magnus 0.9
• 4cfb109 build(deps): update magnus requirement from 0.8 to 0.9
• c0799ca docs: Update readme files
• e9d1f7a build: Pin the gem documentation link to its release tag
• a91b882 docs: Document the offline option
• baa41b6 docs: Wrap long code lines in the Python README
• f21bb64 docs: Tighten the Ruby README
• fbe8de1 docs: Tighten the Python README
• 6f9e4e7 fix: Release the GIL and GVL while retrieving external resources
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.