[dependabot]

Bumps the rust-dependencies group with 3 updates: zip, rten and mail-parser.

Updates zip from 9.1.1 to 9.1.2

Changelog

Sourced from zip's changelog.

9.1.2 - 2026-10-26

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
• (write) reject a Unicode Path extra field that would rename the entry (#1177)
• (extract) prevent following symbolic links during file creation (#1116)

Commits

• 662ae13 chore: release v9.1.2 (#1176)
• e221cd0 fix: preserve the file kind (normal/directory/symlink) in raw_copy_file_touch...
• 525d81e fix(write): reject a Unicode Path extra field that would rename the entry (#1...
• dcc28ed ci(fuzz): Fixes for fallback when Rust nightly is updated mid-run (#1178)
• 68e7e84 fix(extract): prevent following symbolic links during file creation (#1116)
• See full diff in compare view

Updates rten from 0.26.0 to 0.27.0

Changelog

Sourced from rten's changelog.

[0.27.0] - 2026-10-02

Breaking changes:

• The .rten format has been deprecated and is no longer enabled by default. RTen can still load models in this format if the rten_format crate feature is enabled. Users should use .onnx format models instead. See robertknight/rten#1470.

• Model::input_ids no longer includes constants ("initializers") which are listed as graph inputs in very old ONNX models (IR version < 4).

rten

• Added Softsign operator (robertknight/rten#1501)

• Added DynamicQuantizeLSTM contrib operator (robertknight/rten#1495, robertknight/rten#1498)

• Added BitCast operator (robertknight/rten#1479)

• Added ModelOptions::external_data_static and the include_external_data! macro, which enable embedding external data for ONNX models in the binary without copying it (robertknight/rten#1471)

• Fixed loading ONNX models where a graph output is a constant or graph input (robertknight/rten#1493)

• Fixed a panic in ScatterND when running in-place on a non-contiguous input (robertknight/rten#1477)

• Use the buffer pool when making contiguous copies of inputs in scatter and normalization operators (robertknight/rten#1478)

• Reduced compile time and binary size by sharing operator instantiations between element types of the same bit-width and moving code into non-generic helpers. As a side effect, Tile and Trilu now support i8 and u8 tensors (robertknight/rten#1482, robertknight/rten#1484, robertknight/rten#1509)

rten-cli

• Added a rten_format feature to enable loading .rten models (robertknight/rten#1473)

rten-onnx

• Added support for serializing ONNX models

... (truncated)

Commits

• bc1b852 chore: Release
• 1c6130b Update version in change log
• 7ffa264 Merge pull request #1512 from robertknight/group-llvm-lines
• 37122b0 Add script to group cargo llvm-lines output across generic instantiations
• 72cac4a Merge pull request #1511 from robertknight/reduce-inner-iter-code
• 9ebb68a Reduce monomorphized code for TensorBase::{inner_iter, inner_iter_mut}
• 8c3d75a Add changelog entries for changes since 0.26.0
• b3d7a4a Merge pull request #1510 from robertknight/storage-elem-assoc-type
• 2e73635 Use Storage::Elem associated type in more bounds
• 962ea30 Merge pull request #1509 from robertknight/pad-non-generic-helpers
• Additional commits viewable in compare view

Updates mail-parser from 0.11.9 to 1.0.0

Changelog

Sourced from mail-parser's changelog.

[1.0.0] - 2026-10-24

A rewrite of the parser for performance, with a new read-only API. Breaking changes are listed under Changed and Removed; the table at the end of this entry maps the 0.11 API to 1.0.

Added

• Bodies are decoded on access: MessagePart::decoded(), decode_into(), decoded_len() (measures base64 and quoted-printable without decoding), text(), text_into() and text_prefix() (decodes only what the first characters need).
• MessagePart::decoded_checked() and text_checked() also return the DecodeProblems found while decoding (malformed base64 or quoted-printable, unknown transfer encoding, unknown charset, sequences not valid in the charset), which is the RFC 8621 isEncodingProblem flag.
• MessageRef, a view of the root message or of a nested message, with id(), root_part(), container(), source(), source_bytes(), raw(), parts(), the body lists and the header getters; Message::root() and Message::messages().
• Access to MIME boundaries (#127): MessagePart::boundary(), MessagePart::delimiter() and Message::part_by_boundary(), and the raw bytes of a part with raw(), raw_headers() and raw_body(), which exclude the line break before the next delimiter as RFC 2046 defines the body part.
• Part roles (#107): MessagePart::role() (PartRole) gives every part exactly one role, and MessageRef::other_parts() returns the parts in no list.
• MessageRef::has_attachments(), the RFC 8621 hasAttachment rule: an attachment without Content-Disposition: inline.
• MessagePart::html_utf8() and strip_charset_meta() (#109): the HTML with its <meta> charset declarations rewritten to UTF-8, looking only before <body. The default decoding does not scan HTML.
• MessagePart::id(), message(), parent(), kind() (PartKind), children(), nested(), flags() (PartFlags), has_problems(), in_text_body(), in_html_body(), is_attachment(), is_inline(), encoding(), content_transfer_encoding() and has_known_transfer_encoding().
• PartFlags records damaged structure: MISSING_DELIMITER, FALLBACK_DELIMITER, NO_BLANK_LINE, UNTERMINATED, NESTING_LIMIT and LIMIT_REACHED.
• Headers, a view of the header fields of any part: iter(), get(), all(), contains(), value(), has_known(), len() and the typed getters. Header::raw_name() keeps the spelling of the name found in the message, Header::raw_value() returns the bytes after the colon, and Header::parse_as() parses a field again in another form.
• HeaderForm::parse() parses a header value on its own into a ParsedValue. HeaderForm gains CommaList, ContentType, Received and Ignore.
• AddressList (#98): iter() yields Address::Mailbox and Address::Group items in document order, mailboxes() flattens the groups, groups() gives the JMAP asGroupedAddresses shape, and first(), last(), contains() and has_groups(). TextList holds message identifiers and comma-separated lists.
• MessageParser::parse_owned() gives a Message<'static> that owns its input, and MessageParser::parse_with() with MessageBuffers and Message::into_buffers() reuses the storage of one message for the next. MessageBuffers::shrink_to(max_bytes) frees that storage when it exceeds max_bytes; otherwise the buffers keep the capacity of the largest message parsed with them.
• MessageParser::header() sets the form of one header field and unknown_headers() the form of unknown fields; max_depth(), max_parts() and max_encoded_nesting() set the limits (64, 10,000 and 3 by default). After the part limit, the rest of the input stays in the part flagged LIMIT_REACHED: the last part when it is a leaf of the innermost open multipart, else that multipart, or the message/rfc822 part whose nested message had no part yet; the containers left open are not flagged UNTERMINATED.
• HeaderName::key() resolves a name once into a HeaderKey, for Headers::all_key() and Headers::get_key(), which skip the name lookup that all() and get() do on every call.
• 112 header names from Stalwart's metadata list are HeaderName variants: X-Mailer, User-Agent, Precedence, X-Priority, the X-MS-Exchange, X-Google and X-GitHub fields and others.
• Charset, with from_label(), decode(), decode_owned(), decode_append() and decode_checked(), and decoders::charsets::decode() and decode_append().
• Encoding::decode(), decode_checked(), decode_append() and decoded_len() decode a body stored apart from its message exactly as MessagePart::decoded() does.
• PartId and MessageId, and From<Encoding> for u8.
• Value equality for HeaderValue, TextList, AddressList, ContentType, Received and ParsedValue; Debug output that shows the content of the views; Debug for the mailbox iterators. Message, MessageParser and the views are Send + Sync, and Message<'x> is covariant in 'x.

Changed

• The parser was rewritten for performance: SIMD kernels find boundaries and header fields (NEON, AVX2 and SSE2, memchr on other targets), the header field parsers work on bounded slices, a message is stored in a handful of flat vectors whatever its size, and bodies are decoded only on access, through the SIMD codecs of encodify. See the README for measurements.
• New dependencies: memchr, simdutf8 and encodify, next to hashify; encoding_rs and serde stay optional. unsafe code is used in the SIMD kernels and in the audited UTF-8 module, whose two functions turn bytes already validated as UTF-8 into str and String: string spans validated during the parse, and decoded text bodies validated with simdutf8; the rest of the crate denies it. The minimum supported Rust version is 1.98.
• A parsed message is read-only and is read through Copy views (MessageRef, MessagePart, Headers, Header, HeaderValue, AddressList, ContentType, Received and others) that borrow the message, so a value can no longer outlive the Message it came from. Message is still Send, Sync, Clone and Default; Message::default() is an empty message with one root part (id 0, no header field, empty body), so root_part(), parts() and messages() agree.
• The header getters return views by value: from(), to(), cc(), bcc(), reply_to(), sender(), the resent_*() address getters and the list_*() getters return Option<AddressList>; date() and resent_date() return Option<DateTime>; comments() and mime_version() return Option<&str>; in_reply_to(), references(), keywords(), resent_message_id() and return_path() return Option<TextList>; received() returns Option<Received>.
• text_bodies() and html_bodies() yield the text of the parts of the text and HTML bodies (#73), converting HTML to text and text to HTML and skipping parts that are not text; 0.11 yielded the parts, which are now text_body() and html_body(). This change is silent where the item is only measured: message.text_bodies().map(|body| body.len()) still compiles and now measures text.
• Part identifiers are global: parts are numbered in document order across the root message and every nested message, and Message::part() takes such an id. A nested message is a MessageRef (PartKind::Message, MessagePart::nested()), no longer a Message inside the part. A base64 or quoted-printable encoded message/rfc822 part is decoded and parsed during the parse; the offsets of its parts refer to its decoded body, as MessageRef::source() tells.
• Address fields (#98) are an AddressList of mailboxes and groups in document order, whether or not they contain a group. 0.11 returned Address::List when there was no group and turned every run of mailboxes into an unnamed group as soon as there was one; that shape is now AddressList::groups().
• Message identifier fields, Keywords and Content-Language are always a TextList, even with one item; 0.11 switched between Text and TextList. HeaderValue::as_text() returns the last item of a list.
• The body lists follow the RFC 8621 parseStructure algorithm exactly (#67). An image, audio or video part shown in both bodies is no longer also an attachment, and a named text/html alternative that follows a text/plain becomes an attachment while the text/plain is copied into html_body. Where the algorithm is silent: a text part of an alternative whose list an ancestor dropped goes to no list, a multipart that cannot be opened stays an attachment, a part without a usable Content-Type is text/plain (message/rfc822 in a digest), and the name test uses the Content-Disposition filename, else the Content-Type name, an empty name counting as none. The multipart/alternative fix-up also runs when the alternative is not closed.
• PartKind::InlineBinary and MessagePart::is_inline() follow the Content-Disposition (#70): inline, or no disposition on a child of multipart/related other than the first. 0.11 derived them from the RFC 8621 list rule, so images referenced by cid: in a multipart/related were Binary. The body lists are not affected.
• Decoding no longer changes the part tree. 0.11 turned a part whose body failed to decode into a text part flagged is_encoding_problem; 1.0 keeps its kind, decodes it on a best-effort basis and reports the problems through decoded_checked() and text_checked(). MessagePart::encoding() is the declared Content-Transfer-Encoding, comments allowed (base64 (comment) is base64).
• is_encoding_problem is split: MessagePart::has_problems() and flags() for damaged structure, decoded_checked() and text_checked() for decoding.
• MIME delimiters (#156): a delimiter is --boundary at the start of a line followed by --, a space, a tab, CR, LF or the end of the input, checked against every open boundary, innermost first. A --boundary in the middle of a line ends a part only when the part has no valid delimiter at all, and the part is then flagged FALLBACK_DELIMITER. A multipart whose first delimiter is its close delimiter looks for a delimiter in the middle of a line of its preamble the same way (flagged FALLBACK_DELIMITER); a multipart closed before any part is flagged MISSING_DELIMITER and keeps its content in its preamble.
• Malformed structure: a header block ends at a delimiter line (flagged NO_BLANK_LINE), an inner multipart that is never closed is closed by an outer delimiter, a part whose delimiter is missing is decoded and classified by its type, and every part ends by one rule (the end of the input, or before the line break that precedes the next delimiter), so a part never ends past its container: when a delimiter cuts a header block, or ends a part together with its container, the part ends where the container ends, and the last header field may end one line break past offset_body().
• RFC 2047 encoded words are decoded by encodify. No space is inserted between plain text and an adjacent encoded word, whitespace between two encoded words is dropped and whitespace between text and a word is kept as written. Adjacent words of one charset are joined before conversion, so a character split across two words decodes, and one-byte charset names are accepted.
• Base64 bodies: bytes outside the alphabet are skipped and reported, a final unpadded quantum is decoded (0.11 dropped it) and a lone sextet before = no longer produces a byte. Quoted-printable bodies: == and other invalid escapes are kept as written (0.11 failed the whole part on ==), trailing blanks at the end of the input are deleted (RFC 2045, section 6.7), and a soft line break right before a delimiter no longer deletes content.
• Header blocks: a line without a colon at the end of the input is no longer a header field, the last field keeps its value when the input has no final line break, and a bare CR in unstructured text becomes a space.
• Dates: the zone reader no longer consumes the next line after a UT or Z zone, and a one-digit zone such as +5 means +05:00. Received fields: two-digit years follow the date parser (00 to 49 are 20xx), and ] ends an address literal inside comments.
• MessageParser::header(name, form) replaces the builder shorthands and changes the form of one field without dropping the default forms of the others. unknown_headers() also applies to the header names added in 1.0, unless they are registered with header().
• HeaderName: the names added in 1.0 are variants (HeaderName::XMailer), and an Other spelled like a known name, such as Other("X-Mailer"), equals, hashes and orders as that name; MessageParser::header(), Headers::get() and Headers::all() treat it as that name. HeaderName::parse() accepts every character RFC 5322 allows in a field name (printable US-ASCII except the colon; 0.11 accepted only letters, digits, - and _) and never allocates, and the From conversions keep any other string in Other with its spelling (0.11 returned Other(""), which matched no field). Header::name() returns a HeaderName (0.11: &str).
• A header field that is present but blank and parsed as Raw or Text has the value HeaderValue::Text(""), so an empty Subject: gives subject() == Some(""), as RFC 8621 asText does; 0.11 returned no value. HeaderValue::Empty now means that the value does not parse in its form (an empty address list, date or Content-Type included) or that the field is parsed with HeaderForm::Ignore.
• Header field names are matched strictly: a name with whitespace or a control character inside it (Fr om, Sub\tject) or starting with a colon (:From) is an unknown field kept with its spelling, where 0.11 read it as the known field, so mail-parser sees the same From and Subject as DKIM and DMARC verifiers. Space and tab between the name and the colon are still accepted (RFC 5322 obsolete syntax).
• RFC 2231 parameters: the sections of a continued parameter are joined before they are converted, with the charset of the first section that declares one (section 0 in conforming input), and a language parameter (name-language) is reported once; 0.11 moved a repeated 'lang' prefix into the value. A Content-Type or Content-Disposition field keeps at most 1,000 parameters.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions