[dependabot]

Bumps the rust group with 10 updates:

Package	From	To
aws-lc-rs	1.18.1	1.18.2
rustls	0.23.45	0.23.46
json5	1.3.1	1.3.2
keyring-core	1.0.0	1.0.1
libc	0.2.190	0.2.191
schemars	1.2.2	1.2.3
sha2	0.11.0	0.11.1
tokio	1.53.2	1.53.3
tauri	2.12.3	2.12.4
tauri-plugin-single-instance	2.5.3	2.5.4

Updates aws-lc-rs from 1.18.1 to 1.18.2

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.2

What's Changed

• Implement Eq and PartialEq for RSA and EdDSA parameters by @​dsykes16 in aws/aws-lc-rs#1228
  • RsaParameters can now be compared directly against RSA verification constants. Algorithms with different digests, padding schemes, or modulus-size ranges compare unequal. EdDSAParameters also gains equality support.
• Add wasm32-wasip2 and wasm32-wasip3 support by @​ricochet in aws/aws-lc-rs#1239
  • Adds non-FIPS builds using universal bindings, with CI coverage under Wasmtime and wasi-sdk 34. WASIp3 requires nightly Rust.
  • Direct aws-lc-sys consumers must disable the default all-bindings feature for these targets.
• Publish the intended RandomizedNonceKey::open_in_place documentation by @​Serophots in aws/aws-lc-rs#1227
  • Makes the existing nonce, ciphertext/tag layout, and buffer-on-error contract visible in rustdoc. No runtime behavior changes.

Upstream AWS-LC

• aws-lc-sys v0.46.0 aligns with AWS-LC v5.11.0 (previously v5.7.0). See also the release notes for v5.8.0, v5.9.0, and v5.10.0.
  • The Ed25519 C-implementation decoder now rejects non-canonical public keys, matching the assembly-optimized implementations: aws/aws-lc#3457
  • Includes ChaCha20-Poly1305 key-material zeroization and fixes ML-KEM CPU feature detection to avoid illegal-instruction failures on x86-64 CPUs with AVX2 but no BMI2: aws/aws-lc#3552 and aws/aws-lc#3596
• aws-lc-fips-sys v0.14.3 updates its bundled AWS-LC FIPS 4.2.0 snapshot and regenerates bindings. It remains on the FIPS 4.x release line.

Build Improvements

• Raise the minimum system AWS-LC version to 5.7.0 by @​justsmth in aws/aws-lc-rs#1243
  • Non-FIPS system-library installations must now provide AWS-LC 5.7.0 or newer, previously 1.68.0. Bundled-source builds and FIPS version requirements are unchanged.
• Fix static FIPS system-library linking by @​justsmth in aws/aws-lc-rs#1236
  • Fixes unresolved FIPS_mode references with GNU ld.bfd when linking a prebuilt static FIPS library, including binaries that do not call crypto and builds where LTO removes those calls.
  • Uses whole-archive linking to retain libcrypto, including in downstream Rust staticlib outputs. This can increase binary size; dynamic FIPS and non-FIPS linking are unchanged.
• Fix Cranelift linking by @​justsmth in aws/aws-lc-rs#1234
  • Normalizes binding link names to avoid undefined-symbol failures, including when Cranelift is selected through Cargo profiles rather than RUSTFLAGS. The AWS_LC_SYS_NO_U1_BINDINGS workaround is no longer needed.
• Fix jitterentropy builds with optimizing CFLAGS and newer cc versions by @​justsmth in aws/aws-lc-rs#1254
  • Keeps filtered flags in effect throughout the jitterentropy builder's lifetime, preventing cached environment reads from allowing flags such as -O2 to override its required -O0.
• Honor AWS_LC_SYS_CC in the main library build by @​justsmth in aws/aws-lc-rs#1255
  • Applies crate-specific compiler overrides before compiler lookup in both CC and CMake build paths, keeping compiler selection and capability probes consistent when cc caches environment reads.
• Improve archive reproducibility through symlinked build paths by @​justsmth in aws/aws-lc-rs#1238
  • Prevents the non-Windows CC builder from incorporating symlink-resolved absolute build paths into archive member names, avoiding unnecessary downstream compile-cache misses. Windows short-path handling is unchanged.
• Upgrade bindgen to 0.73 by @​xtqqczze in aws/aws-lc-rs#1244
• Document the system-library trust model by @​justsmth in aws/aws-lc-rs#1218
  • Clarifies that supplied paths and pkg-config results are trusted build inputs, and that FIPS validation can execute candidate library code before accepting or rejecting it. Documents runner requirements and how to disable automatic system-library detection.

Issues Being Closed

• Cranelift builds fail with codegen-backend = "cranelift" -- aws/aws-lc-rs#1231
• Upgrade bindgen to v0.73 -- aws/aws-lc-rs#1245
• Undefined FIPS_mode when linking a prebuilt FIPS module into a binary that does not use crypto -- aws/aws-lc-rs#1246
• Jitterentropy fails with "must not be compiled with optimizations" in aws-lc-rs v1.18.1 / aws-lc-sys v0.45.0 -- aws/aws-lc-rs#1252

Other Merged PRs

• Add security review workflow by @​nhatnghiho in aws/aws-lc-rs#1226
• docs: align pull request template with AWS-LC by @​justsmth in aws/aws-lc-rs#1219
• ci: verify docs.rs build with read-only crate sources by @​justsmth in aws/aws-lc-rs#1209
• ci: harden workflows and release tooling by @​justsmth in aws/aws-lc-rs#1216

... (truncated)

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Updates rustls from 0.23.45 to 0.23.46

Commits

• f04804f Delay saving KX hint until handshake confirmation
• 049d39b Bump version to 0.23.46
• 6d0ba08 Eliminate secret from impl Debug for ServerSessionValue
• 2b82b81 unbuffered: update TLS 1.3 traffic keys before exhausting them
• 74343e7 conn: update TLS 1.3 traffic keys within fragmented writes
• 795eea7 Advance the HPKE sequence only after seal succeeds
• d67cb71 stream: provide backpressure while buffering received plaintext
• 7a69ade util: fuse flushes from connections with errors
• 493d089 conn: fuse writes for connections with errors
• db00e01 util: keep flushing after short writes
• Additional commits viewable in compare view

Updates json5 from 1.3.1 to 1.3.2

Commits

• 3927c81 1.3.2
• 5a68eed reject unclosed block comment
• 15ffe98 reject "\9" as invalid escape sequence
• 2c1721f ok_or_else to avoid quadratic time parsing hex numbers
• fd55f90 fix readme example
• See full diff in compare view

Updates keyring-core from 1.0.0 to 1.0.1

Release notes

Sourced from keyring-core's releases.

v1.0.1: Improved testing

This release has no functional changes. The tests have been reworked and improved so that cargo-mutants no longer finds coverage gaps, either in the library API or in the two included credential stores (mock and sample).

What's Changed

• Check semver compatibility against the latest release in CI by @​LucaCappelletti94 in open-source-cooperative/keyring-core#20
• Audit dependencies for RustSec advisories in CI by @​LucaCappelletti94 in open-source-cooperative/keyring-core#19
• Deny rustdoc warnings in CI by @​LucaCappelletti94 in open-source-cooperative/keyring-core#21
• Mutation-test the lines each pull request changes by @​LucaCappelletti94 in open-source-cooperative/keyring-core#22
• Release/crates io OIDC by @​LucaCappelletti94 in open-source-cooperative/keyring-core#23
• Audit workflows with zizmor by @​LucaCappelletti94 in open-source-cooperative/keyring-core#24
• Add cargo-mutants testing by @​brotskydotcom in open-source-cooperative/keyring-core#25

New Contributors

• @​LucaCappelletti94 made their first contribution in open-source-cooperative/keyring-core#20

Full Changelog: open-source-cooperative/keyring-core@v1.0.0...v1.0.1

Commits

• 50fe5c4 Add cargo-mutants testing (#25)
• 97b53d8 Bump version for release.
• 4004baa Integrate review comments.
• 6d2f8a5 Integrate review comments.
• 1aa61ea Clean up .gitignore
• 14d9c94 Improve tests to cover cargo-mutants misses.
• 9f71d13 Set up cargo-mutants config.
• ce48eaf Audit workflows with zizmor (#24)
• 3649f1f Discard changes to .github/workflows/ci.yaml
• aa5add8 Merge branch 'main' into upstream/ci-zizmor
• Additional commits viewable in compare view

Updates libc from 0.2.190 to 0.2.191

Release notes

Sourced from libc's releases.

0.2.191

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Changelog

Sourced from libc's changelog.

0.2.191 - 2026-10-16

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Commits

• ccc2ff4 libc: Release 0.2.191
• bce6efb apple: Add mach_task_self and mach_task_self_ to semver checks
• ecf4fd4 apple: Re-restrict mach_vm_map to MacOS-only
• b0e0423 Revert "apple: Disable mach.h API on Apple mobile OSs"
• 9c7f568 apple: add ifaliasreq and in6_aliasreq
• 018c7e9 wasi: Add pthread_condattr_{get,set}clock
• 2c77185 openbsd: add sensordev structure
• e10813c hurd: Add missing POSIX_SPAWN_* flags
• 2ea4bc1 Fix FreeBSD/aarch64
• 6d666fd dragonfly: Parse version from headers rather than CLI
• Additional commits viewable in compare view

Updates schemars from 1.2.2 to 1.2.3

Release notes

Sourced from schemars's releases.

v1.2.3

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Changelog

Sourced from schemars's changelog.

[1.2.3] - 2026-10-12

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Commits

• 4791bb7 v1.2.3
• c6a89b7 Put the tag of an internally tagged enum first in properties
• c5cd8b5 fix: schema creation panics with arbitrary precision JSON numbers
• 766d70b Resolve unused_qualifications lint in crate and generated code - #541 (#541)
• d07655e Resolve clippy error
• See full diff in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates tokio from 1.53.2 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
• sync: wake waiters outside the lock when closing a semaphore (#8529)
• test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Commits

• a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
• df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
• f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
• 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
• 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
• c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
• 0448618 sync: make tracing_sync tests synchronous (#8427)
• 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
• bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
• 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
• Additional commits viewable in compare view

Updates tauri from 2.12.3 to 2.12.4

Release notes

Sourced from tauri's releases.

tauri v2.12.4

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1314 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1045 crate dependencies)
Crate:     fxhash
Version:   0.2.1
Warning:   unmaintained
Title:     fxhash - no longer maintained
Date:      2025-09-05
ID:        RUSTSEC-2025-0057
URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057
Crate:     paste
Version:   1.0.15
Warning:   unmaintained
Title:     paste - no longer maintained
Date:      2024-10-07
ID:        RUSTSEC-2024-0436
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0436
Crate:     rustybuzz
Version:   0.20.1
Warning:   unmaintained
Title:     rustybuzz is unmaintained
Date:      2026-07-11
ID:        RUSTSEC-2026-0206
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0206
Crate:     ttf-parser
Version:   0.25.1
Warning:   unmaintained
Title:     ttf-parser is unmaintained
Date:      2026-06-28
ID:        RUSTSEC-2026-0192
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0192
warning: 4 allowed warnings found

[2.12.4]

Enhancements

... (truncated)

Commits

• 59b63ab Apply Version Updates From Current Changes (#16255)
• 55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
• 744ff2b chore(deps): bump rustls to 0.23.46
• c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
• dc637db chore: add missing api change file (#16260)
• b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
• 7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
• 5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
• 5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
• 141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
• Additional commits viewable in compare view

Updates tauri-plugin-single-instance from 2.5.3 to 2.5.4

Release notes

Sourced from tauri-plugin-single-instance's releases.

single-instance v2.5.4

[2.5.4]

• f83c5d3b (#3584 by @​vincentkoc) On Linux, a secondary instance that cannot deliver its arguments to the primary instance now returns a plugin initialization error instead of exiting successfully, and an invalid dbus_id returns an error instead of panicking. When the session bus is unavailable the app keeps launching normally, without single-instance support, and logs a warning.
• b53d1984 (#3686 by @​lucasfernog) On Windows, an argument containing a | is no longer split into several arguments when it is forwarded to the running instance.

Dependencies

• Upgraded to deep-link@2.6.2

Updating crates.io index
   Packaging tauri-plugin-single-instance v2.5.4 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Updating crates.io index
warning: package `yoke-derive v0.8.3` in Cargo.lock is yanked in registry `crates-io`
  |
  = help: consider updating to a version that is not yanked
    Packaged 16 files, 179.7KiB (49.2KiB compressed)
   Uploading tauri-plugin-single-instance v2.5.4 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/single-instance)
    Uploaded tauri-plugin-single-instance v2.5.4 to registry `crates-io`
note: waiting for tauri-plugin-single-instance v2.5.4 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-plugin-single-instance v2.5.4 at registry `crates-io`

Commits

• e7a68fa publish new versions (#3068)
• b5550a3 chore: temp delete updater changefile
• 93426f8 fix: fix docsrs builds
• 4ee61e0 Revert "chore: temp delete updater changefile"
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions