[dependabot]

Bumps the cargo-minor-patch group with 8 updates in the / directory:

Package	From	To
uuid	1.28.0	1.29.0
tokio	1.53.3	1.54.1
open	5.4.4	5.4.5
unicode-width	0.2.2	0.2.3
tauri-winres	0.3.6	0.3.7
rusty-leveldb	4.0.1	4.0.2
plist	1.10.1	1.10.3
memmap2	0.9.11	0.9.12

Updates uuid from 1.28.0 to 1.29.0

Release notes

Sourced from uuid's releases.

v1.29.0

What's Changed

• Add versioned constructors to NonNilUuid by @​RanaPriyansh in uuid-rs/uuid#919
• Prepare for 1.29.0 release by @​KodrAus in uuid-rs/uuid#920

Full Changelog: uuid-rs/uuid@v1.28.0...v1.29.0

Commits

• 4643e60 Merge pull request #920 from uuid-rs/cargo/v1.29.0
• a3631fd prepare for 1.29.0 release
• 304913e Merge pull request #919 from RanaPriyansh/fix/non-nil-versioned-constructors-901
• d49f963 Reuse existing version tests for NonNilUuid constructors
• 2f02404 Add versioned constructors to NonNilUuid
• See full diff in compare view

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates open from 5.4.4 to 5.4.5

Release notes

Sourced from open's releases.

v5.4.5

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior; the earlier implementation retried unsuccessful operations.

... (truncated)

Changelog

Sourced from open's changelog.

5.4.5 (2026-10-22)

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior;

... (truncated)

Commits

• a60a9d5 Release open v5.4.5
• 4e64f6b Merge pull request #135 from Byron/fix-linux-launchers
• c88759b auto-review
• 42a34b0 fix(unix): check that_detached launchers for immediate failures
• 279c1b2 fix(unix): restore launcher fallback and support Plasma 6
• See full diff in compare view

Updates unicode-width from 0.2.2 to 0.2.3

Commits

• f8c8b20 Publish 0.2.3 (#100)
• 5180748 Fix documentation of Kirat Rai rules (#97)
• 0b85fb8 Update to Unicode 18 (#96)
• 832f7ca Fix typo in docs (#90)
• c7b4d42 Fix halfwidth katakana voiced and semi-voiced sound marks in width calculatio...
• a3d4ee6 Fix mistake in the specification of Arabic lam-alef ligature (#92)
• d8654db Split generated file into multiple files, separating static code from generat...
• ab7a6dc Support char iter width (#83)
• b10a4d5 Exclude development scripts from published packages (#80)
• See full diff in compare view

Updates tauri-winres from 0.3.6 to 0.3.7

Release notes

Sourced from tauri-winres's releases.

winres v0.3.7

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1338 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (39 crate dependencies)

[0.3.7]

• Add WindowsResource::compile_for_everything to link the resource into every target of the package, including test binaries.
  • 376950a feat: add compile_for_everything (#42) on 2026-10-19

Updating crates.io index
   Packaging tauri-winres v0.3.7 (/home/runner/work/winres/winres)
    Updating crates.io index
    Packaged 17 files, 158.7KiB (25.2KiB compressed)
   Verifying tauri-winres v0.3.7 (/home/runner/work/winres/winres)
 Downloading crates ...
  Downloaded embed-resource v3.0.9
  Downloaded find-msvc-tools v0.1.9
  Downloaded indexmap v2.11.4
  Downloaded equivalent v1.0.2
  Downloaded shlex v1.3.0
  Downloaded cc v1.2.61
  Downloaded rustc_version v0.4.1
  Downloaded serde_spanned v1.0.4
  Downloaded toml_writer v1.0.7+spec-1.1.0
  Downloaded toml_datetime v1.0.1+spec-1.1.0
  Downloaded toml_parser v1.0.10+spec-1.1.0
  Downloaded serde_core v1.0.228
  Downloaded toml v1.0.7+spec-1.1.0
  Downloaded memchr v2.8.0
  Downloaded winnow v1.0.2
   Compiling serde_core v1.0.228
   Compiling winnow v1.0.2
   Compiling semver v1.0.28
   Compiling shlex v1.3.0
   Compiling toml_writer v1.0.7+spec-1.1.0
   Compiling toml_parser v1.0.10+spec-1.1.0
   Compiling find-msvc-tools v0.1.9
</tr></table> 

... (truncated)

Changelog

Sourced from tauri-winres's changelog.

[0.3.7]

• Add WindowsResource::compile_for_everything to link the resource into every target of the package, including test binaries.
  • 376950a feat: add compile_for_everything (#42) on 2026-10-19

Commits

• 347bd45 publish new versions (#43)
• 376950a feat: add compile_for_everything (#42)
• See full diff in compare view

Updates rusty-leveldb from 4.0.1 to 4.0.2

Commits

• See full diff in compare view

Updates plist from 1.10.1 to 1.10.3

Changelog

Sourced from plist's changelog.

[1.10.3] - 2026-10-21

Changed

• Add tests counting I/O operations when reading binary plists, as a baseline for optimisation (#208).
• Cache small objects of up to 8 bytes when reading binary plists so objects referenced multiple times are only read once (#209).

[1.10.2] - 2026-10-19

Changed

• Always buffer ASCII plist reads, improving direct ASCII reader performance (#206).

Fixed

• Accept \' escape in quoted ASCII plist strings (#204).
• Decode quoted ASCII plist strings as UTF-8 (#203).

Commits

• a2d3e61 Release v1.10.3 (#210)
• 046f048 Cache small objects when reading binary plists (#209)
• ec5170e Count binary reader I/O operations (#208)
• e8ed284 Release v1.10.2 (#207)
• ac2f649 Always buffer ASCII plist reads (#206)
• b43ff12 Decode quoted ASCII plist strings as UTF-8 (#203)
• ade2c5d Accept ' escape in quoted ASCII plist strings (#204)
• See full diff in compare view

Updates memmap2 from 0.9.11 to 0.9.12

Changelog

Sourced from memmap2's changelog.

[0.9.12] - 2026-10-21

Added

• Add MmapOptions::map_if_safe() to allow creation read-only mappings of a file from safe code if the kernel can guarantee the file is immutable and large enough. @​alexlarsson
• Add MmapOptions::no_probe_handle() to disable probing of file handles on Windows to improve performance, at the cost of no longer being able to remap later with more capabilities. @​mat-gas
• Add support for OpenHarmony targets (*-unknown-linux-ohos). @​hiyms

Changed

• Cache allocation granularity on Windows to prevent repeated syscalls. @​mat-gas

Commits

• 4692b05 Merge pull request #180 from RazrFalcon/release/v0.9.12
• 9e5c0ee Bump version to 0.9.12.
• b98035d Merge pull request #177 from JaskRendix/extract-test-suite
• 0986677 Merge branch 'master' into extract-test-suite
• d26cc84 Fix map_if_safe() stub.
• 145ee36 Silence clippy warning about trivial identical match arms.
• b402ef2 Fix check_safe_to_map() on Apple targets.
• b544238 Fix formatting.
• f50e480 Move tests to test/ folder.
• 0994bf7 Merge pull request #176 from hiyms/feat/support-ohos
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 84ffce36-aecb-4c48-90e6-d50cde3025b8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[mtsu-patrol]

Actionable comments posted: 0

Note

Partial review: part of the review did not complete, so other issues may remain.

• The pull request description was truncated at 16000 characters.

[mtsu-patrol]

This pull request bumps eight Rust dependencies to newer minor and patch releases, including tokio and uuid. It keeps the project on current upstream fixes without changing project code. No behavior change is intended beyond what the new dependency versions bring.

No comments posted: the reviewers raised no finding.

Note

Partial review: part of the review did not complete, so other issues may remain.

• The pull request description was truncated at 16000 characters.

Review details

• Model: muse-spark-1.3-contributor
• Compared commits: 76c6338 to f70ea94
• Execution: tests could run in a disposable Linux sandbox
• Files reviewed: 0 of 1
• Duration: 13 s

Files skipped (1)

• Cargo.lock: lockfile

Limitations (1)

• The pull request description was truncated at 16000 characters.