[dependabot]

Bumps the rust-dependencies group with 8 updates in the / directory:

Package	From	To
clap	4.6.6	4.6.7
clap_complete	4.6.9	4.6.11
serde_json	1.0.151	1.0.154
signal-hook	0.4.4	0.4.5
thiserror	2.0.20	2.0.21
toml	1.1.5+spec-1.1.0	1.1.8+spec-1.1.0
insta	1.48.0	1.49.0
jsonschema	0.55.1	0.58.6

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates clap_complete from 4.6.9 to 4.6.11

Commits

• 2cb76fd chore: Release
• 0b00b8d docs: Update changelog
• 3443000 Merge pull request #6526 from bonnefoa/fix-completion-escape
• a1b6be7 fix(clap_complete): Fix value escape in zsh completion
• face9e8 test(complete): Add completion test without arg's help
• 88053ab test(complete): Re-enable complete tests
• e6adcc2 chore(release): Simplify replacements
• 13f2db5 chore: Release
• 3304fea docs: Update changelog
• 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
• Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates signal-hook from 0.4.4 to 0.4.5

Changelog

Sourced from signal-hook's changelog.

0.4.5

• pipe::register_raw now really sets close-on-exec (FD_CLOEXEC) on the file descriptor, for both pipes and sockets (#206).
• Removed the 32-bit Android sigemptyset/sigaddset fallback, which panicked in emulate_default_handler (#207). Android below API 21 is no longer supported.

Commits

• 1ee5faa Release 0.4.5
• 2003e57 CI: Check only mio 1.x support on the BSDs
• 5eaf084 signal-hook-mio: Drop redundant mio 0.7 dev-dependency
• f7ceb8a Use square brackets for vec! in tests
• 4c1f6f1 CI: Leave out mio 0.6 from BSD checks and doc link check
• e52500e CI: Make the registry manifest parseable by old cargo
• d3f9239 Allow deprecated std::isize in the registry
• 5e09118 Drop hand-rolled sigset fallback on 32-bit Android
• d12e7d9 Set close-on-exec correctly
• See full diff in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates toml from 1.1.5+spec-1.1.0 to 1.1.8+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

Updates insta from 1.48.0 to 1.49.0

Release notes

Sourced from insta's releases.

1.49.0

Release Notes

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.ps1 | iex"

Download cargo-insta 1.49.0

File	Platform	Checksum
cargo-insta-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-insta-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-insta-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-insta-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-insta-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-insta-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

This was written by Codex on behalf of @​max-sixty

Changelog

Sourced from insta's changelog.

1.49.0

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Commits

• 5df39ce Release 1.49.0 (#944)
• 1c28c19 Skip the separate doctest run for nextest with --all-targets (#941)
• 064742e Build cargo-insta for aarch64-unknown-linux-gnu (#942)
• 08b67d9 Remove trailing semicolons from macro bodies (#940)
• 06858e1 fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)
• 70be034 Serialize unit enum variants used as JSON map keys (#934)
• 54d0b96 feat: implement From for SnapshotValue with OsStr (#929)
• 3d62572 [fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)
• 1712876 ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...
• See full diff in compare view

Updates jsonschema from 0.55.1 to 0.58.6

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.58.6

Fixed

• \s in pattern missing most Unicode space separators and U+2028.
• ECMA regex character class literals being interpreted as Rust set operators.

[Ruby] Release 0.58.6

Fixed

• ECMA regex character class literals being interpreted as Rust set operators.
• Installing the source gem.
• \s in pattern missing most Unicode space separators and U+2028.

[Rust] Release 0.58.6

Fixed

• \s in pattern missing most Unicode space separators and U+2028.
• ECMA regex character class literals being interpreted as Rust set operators.

[CLI] Release 0.58.5

No release notes provided.

[Python] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.
• Validator construction holding the GIL while it retrieves external resources over HTTP or from files.

[Ruby] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.
• Validator construction holding the GVL while it retrieves external resources over HTTP or from files.

[Rust] Release 0.58.5

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.

[CLI] Release 0.58.4

No release notes provided.

[Python] Release 0.58.4

Fixed

• repr of a validator_for validator naming the default draft instead of the one $schema declares.
• unevaluatedProperties and unevaluatedItems beside a $recursiveRef ignoring what the reference target evaluates.
• unevaluatedProperties ignoring the configured regex engine and its limits for patternProperties.
• Absolute keyword location and schemaLocation of keywords a $ref JSON Pointer reaches through a subschema with its own $id.
• type, minItems and maxItems ignored beside items when the applicator vocabulary is disabled.

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.58.6] - 2026-10-06

Fixed

• \s in pattern missing most Unicode space separators and U+2028.
• ECMA regex character class literals being interpreted as Rust set operators.

[0.58.5] - 2026-10-02

Fixed

• canonicalize keeping a reference to a cycle of bare references under not or oneOf instead of treating it as accepting every value.

[0.58.4] - 2026-10-01

Fixed

• Validator::draft returning the default draft instead of the one $schema declares.
• unevaluatedProperties and unevaluatedItems beside a $recursiveRef ignoring what the reference target evaluates.
• unevaluatedProperties ignoring the configured regex engine and its limits for patternProperties.
• Absolute keyword location and schemaLocation of keywords a $ref JSON Pointer reaches through a subschema with its own $id.
• type, minItems and maxItems ignored beside items when the applicator vocabulary is disabled.
• Absolute keyword location and schemaLocation of keywords inside a nested $id resource counting from the document root.
• required beside properties ignored when the applicator vocabulary is disabled, and required, minContains and maxContains applied when the validation vocabulary is disabled.
• Absolute keyword location and evaluation output of type errors in a type-only items subschema pointing at items instead of the failing element's type.
• Absolute keyword location of patternProperties annotations missing its JSON Pointer fragment.
• Evaluation output of type: array beside schema-form items omitting passing type, minItems and maxItems units and nesting failing ones under items.
• Evaluation output schemaLocation and absolute keyword location of $ref, $dynamicRef and $recursiveRef nodes not pointing at the reference target.
• Evaluation output schemaLocation URIs not percent-encoding their fragment, such as a space in a property name.
• Absolute keyword location of errors and annotations from a whole subschema, such as false, missing its JSON Pointer fragment.
• Absolute keyword location of required, minContains and maxContains errors pointing at a sibling keyword.
• Evaluation annotations from $ref siblings in Draft 4, 6 and 7 schemas.
• Masked additionalItems messages counting allowed items instead of extra ones, and "1 items" in masked unevaluatedItems messages.
• $dynamicRef and $recursiveRef resolving in the dynamic scope of another path to the same schema, depending on property order.
• unevaluatedProperties and unevaluatedItems ignoring what then or else evaluates when if is true or false.
• Stack overflow when building validators for long $ref chains.
• format: "regex" and meta-schema validation rejecting escaped punctuation such as \- in patterns.
• Build errors for an invalid patternProperties regex reporting the subschema instead of the pattern and its location.

[0.58.3] - 2026-09-30

Fixed

• Keywords of a subschema declaring a Draft 2019-09+ $schema under a Draft 4, 6 or 7 root being ignored.
• Evaluation annotations including those from subschemas of a failing schema (a failing schema produces no annotations).
• Embedded resources declaring their own $schema being checked against the root's meta-schema.

[0.58.2] - 2026-09-28

Fixed

... (truncated)

Commits

• 117c8e6 chore(ruby): Release 0.58.6
• 55ac166 chore(rust): Release 0.58.6
• 7f9978b build(deps): bump werkzeug from 3.1.6 to 3.1.9 in /crates/jsonschema-py
• c6bdff5 build(deps): bump CodSpeedHQ/action from 5.2.1 to 5.4.0
• 36022e0 fix: ECMA regex character class literals being interpreted as Rust set operators
• 988f42c fix: \s in pattern missing most Unicode space separators and U+2028
• e268761 docs: Create SECURITY.md
• 7fa3ae7 build(deps): bump hegeltest in /
• e98ec2d build(deps): bump serde in /crates/jsonschema-rb/ext/jsonschema
• a52bab3 build(deps): bump serde_json in /crates/jsonschema-rb/ext/jsonschema
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.