chore(deps): bump the cargo group with 13 updates

[dependabot]

Bumps the cargo group with 13 updates:

Package	From	To
syn	3.0.6	3.0.9
aws-lc-rs	1.18.1	1.18.2
aws-lc-sys	0.45.0	0.46.0
cc	1.6.0	1.8.0
deranged	0.5.8	0.5.9
rustls	0.23.45	0.23.46
rustls-native-certs	0.8.4	0.8.5
serde_json	1.0.151	1.0.154
smallvec	1.16.2	1.16.3
tokio	1.53.2	1.53.3
unicode-ident	1.0.26	1.0.27
zerocopy	0.8.62	0.8.63
zerocopy-derive	0.8.62	0.8.63

Updates syn from 3.0.6 to 3.0.9

Release notes

Sourced from syn's releases.

3.0.9

• Add Punctuated::retain (#2088)

3.0.8

• Fix parsing of <- and -> tokens in expressions (#2086, #2087)

3.0.7

• Fix parsing absolute path expr in labeled break (#2085, thanks @​A4-Tacks)

Commits

• 7c44a55 Release 3.0.9
• 13234ab Merge pull request #2088 from dtolnay/retain
• b617dc9 Add Punctuated::retain
• f18a083 Release 3.0.8
• e1eab98 Merge pull request #2087 from dtolnay/rightarrow
• 5345ee5 Allow end of expr before ->
• 5631c74 Merge pull request #2086 from dtolnay/leftarrow
• c5b3cf0 Fix left arrow being split into less-than and negative-sign
• ec4c2da Release 3.0.7
• f947cf7 Merge pull request #2085 from A4-Tacks/break-label-abs-path
• Additional commits viewable in compare view

Updates aws-lc-rs from 1.18.1 to 1.18.2

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.2

What's Changed

• Implement Eq and PartialEq for RSA and EdDSA parameters by @​dsykes16 in aws/aws-lc-rs#1228
  • RsaParameters can now be compared directly against RSA verification constants. Algorithms with different digests, padding schemes, or modulus-size ranges compare unequal. EdDSAParameters also gains equality support.
• Add wasm32-wasip2 and wasm32-wasip3 support by @​ricochet in aws/aws-lc-rs#1239
  • Adds non-FIPS builds using universal bindings, with CI coverage under Wasmtime and wasi-sdk 34. WASIp3 requires nightly Rust.
  • Direct aws-lc-sys consumers must disable the default all-bindings feature for these targets.
• Publish the intended RandomizedNonceKey::open_in_place documentation by @​Serophots in aws/aws-lc-rs#1227
  • Makes the existing nonce, ciphertext/tag layout, and buffer-on-error contract visible in rustdoc. No runtime behavior changes.

Upstream AWS-LC

• aws-lc-sys v0.46.0 aligns with AWS-LC v5.11.0 (previously v5.7.0). See also the release notes for v5.8.0, v5.9.0, and v5.10.0.
  • The Ed25519 C-implementation decoder now rejects non-canonical public keys, matching the assembly-optimized implementations: aws/aws-lc#3457
  • Includes ChaCha20-Poly1305 key-material zeroization and fixes ML-KEM CPU feature detection to avoid illegal-instruction failures on x86-64 CPUs with AVX2 but no BMI2: aws/aws-lc#3552 and aws/aws-lc#3596
• aws-lc-fips-sys v0.14.3 updates its bundled AWS-LC FIPS 4.2.0 snapshot and regenerates bindings. It remains on the FIPS 4.x release line.

Build Improvements

• Raise the minimum system AWS-LC version to 5.7.0 by @​justsmth in aws/aws-lc-rs#1243
  • Non-FIPS system-library installations must now provide AWS-LC 5.7.0 or newer, previously 1.68.0. Bundled-source builds and FIPS version requirements are unchanged.
• Fix static FIPS system-library linking by @​justsmth in aws/aws-lc-rs#1236
  • Fixes unresolved FIPS_mode references with GNU ld.bfd when linking a prebuilt static FIPS library, including binaries that do not call crypto and builds where LTO removes those calls.
  • Uses whole-archive linking to retain libcrypto, including in downstream Rust staticlib outputs. This can increase binary size; dynamic FIPS and non-FIPS linking are unchanged.
• Fix Cranelift linking by @​justsmth in aws/aws-lc-rs#1234
  • Normalizes binding link names to avoid undefined-symbol failures, including when Cranelift is selected through Cargo profiles rather than RUSTFLAGS. The AWS_LC_SYS_NO_U1_BINDINGS workaround is no longer needed.
• Fix jitterentropy builds with optimizing CFLAGS and newer cc versions by @​justsmth in aws/aws-lc-rs#1254
  • Keeps filtered flags in effect throughout the jitterentropy builder's lifetime, preventing cached environment reads from allowing flags such as -O2 to override its required -O0.
• Honor AWS_LC_SYS_CC in the main library build by @​justsmth in aws/aws-lc-rs#1255
  • Applies crate-specific compiler overrides before compiler lookup in both CC and CMake build paths, keeping compiler selection and capability probes consistent when cc caches environment reads.
• Improve archive reproducibility through symlinked build paths by @​justsmth in aws/aws-lc-rs#1238
  • Prevents the non-Windows CC builder from incorporating symlink-resolved absolute build paths into archive member names, avoiding unnecessary downstream compile-cache misses. Windows short-path handling is unchanged.
• Upgrade bindgen to 0.73 by @​xtqqczze in aws/aws-lc-rs#1244
• Document the system-library trust model by @​justsmth in aws/aws-lc-rs#1218
  • Clarifies that supplied paths and pkg-config results are trusted build inputs, and that FIPS validation can execute candidate library code before accepting or rejecting it. Documents runner requirements and how to disable automatic system-library detection.

Issues Being Closed

• Cranelift builds fail with codegen-backend = "cranelift" -- aws/aws-lc-rs#1231
• Upgrade bindgen to v0.73 -- aws/aws-lc-rs#1245
• Undefined FIPS_mode when linking a prebuilt FIPS module into a binary that does not use crypto -- aws/aws-lc-rs#1246
• Jitterentropy fails with "must not be compiled with optimizations" in aws-lc-rs v1.18.1 / aws-lc-sys v0.45.0 -- aws/aws-lc-rs#1252

Other Merged PRs

• Add security review workflow by @​nhatnghiho in aws/aws-lc-rs#1226
• docs: align pull request template with AWS-LC by @​justsmth in aws/aws-lc-rs#1219
• ci: verify docs.rs build with read-only crate sources by @​justsmth in aws/aws-lc-rs#1209
• ci: harden workflows and release tooling by @​justsmth in aws/aws-lc-rs#1216

... (truncated)

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Updates aws-lc-sys from 0.45.0 to 0.46.0

Commits

• 9df4975 Prepare aws-lc-fips-sys v0.14.3 (#1258)
• 83d5809 Prepare aws-lc-sys v0.46.0 and aws-lc-rs v1.18.2 (#1256)
• a97b9df fix(builder): export AWS_LC_SYS_CC before the main build's compiler lookup (#...
• 040d834 fix: normalize binding link names for Cranelift (#1234)
• ecd9a26 fix(builder): hold jitterentropy CFLAGS guard for the builder's lifetime (#1254)
• d17b165 fix: link static FIPS system libcrypto with whole-archive (#1236)
• 841a718 fix: update Clippy allowances for bindgen 0.73 (#1250)
• 4492dcd build(deps): upgrade bindgen to version 0.73 (#1244)
• a0314cb fix(builder): use unresolved CARGO_MANIFEST_DIR for source paths (#1238)
• e81bb0d build(deps): bump codecov/codecov-action from 7.1.0 to 7.1.1 (#1237)
• Additional commits viewable in compare view

Updates cc from 1.6.0 to 1.8.0

Release notes

Sourced from cc's releases.

cc-v1.8.0

Added

• add CC_PREFER_CLANG_CL_OVER_MSVC to override prefer_clang_cl_over_msvc (#2001)

Fixed

• (panic) fix panic in code and replace with error when appropriate (#2008)
• (env) do not panic if WASM_MUSL_SYSROOT not set (#2007)
• (jobserver) help thread gets more token than necessary (#2006)
• stop forwarding -Cprofile-generate/-Cprofile-use to the C compiler (#2003)
• do not apply target crt-static when target is overridden (#1999)

Other

• (parallel) poll for process exit on linux (#2009)
• document NVCC and other environment variables (#2005)
• (jobserver) poll for new token (#2004)
• (parallel) Use poll on unix (#2000)

cc-v1.7.0

Added

• add Tool::get_envs, deprecate Tool::env and store tool env as Arc<OsStr> pairs (#1985)
• link c++ when Clang uses libc++ (#1978)
• add CC_MASM_ASM and fall back to llvm-ml for MASM files (#1975)

Fixed

• (target parsing) for powerpc64-ibm-aix abi (#1989)
• ignore ASCII case in program name checks (#1981)

Other

• (compile) issue compilation cmds more frequently in parallel #1997 #1998
• (cache) Optimize tool detection caching (#1995)
• (cache) optimize EnvSnapshot Hash, PartialEq, Ord impl (#1994)
• Regenerate target info (#1988)

Changelog

Sourced from cc's changelog.

1.8.0 - 2026-10-11

Added

• add CC_PREFER_CLANG_CL_OVER_MSVC to override prefer_clang_cl_over_msvc (#2001)

Fixed

• (panic) fix panic in code and replace with error when appropriate (#2008)
• (env) do not panic if WASM_MUSL_SYSROOT not set (#2007)
• (jobserver) help thread gets more token than necessary (#2006)
• stop forwarding -Cprofile-generate/-Cprofile-use to the C compiler (#2003)
• do not apply target crt-static when target is overridden (#1999)

Other

• (parallel) poll for process exit on linux (#2009)
• document NVCC and other environment variables (#2005)
• (jobserver) poll for new token (#2004)
• (parallel) Use poll on unix (#2000)

1.7.0 - 2026-10-10

Added

• add Tool::get_envs, deprecate Tool::env and store tool env as Arc<OsStr> pairs (#1985)
• link c++ when Clang uses libc++ (#1978)
• add CC_MASM_ASM and fall back to llvm-ml for MASM files (#1975)

Fixed

• (target parsing) for powerpc64-ibm-aix abi (#1989)
• ignore ASCII case in program name checks (#1981)

Other

• (compile) issue compilation cmds more frequently in parallel #1997 #1998
• (cache) Optimize tool detection caching (#1995)
• (cache) optimize EnvSnapshot Hash, PartialEq, Ord impl (#1994)
• Regenerate target info (#1988)

Commits

• d0454ee chore(cc): release v1.8.0 (#2010)
• fd18a6c perf(parallel): poll for process exit on linux (#2009)
• b69d7eb fix(panic): fix panic in code and replace with error when appropriate (#2008)
• 78eaf8f fix(env): do not panic if WASM_MUSL_SYSROOT not set (#2007)
• ca93d67 docs: document NVCC and other environment variables (#2005)
• e4f1339 fix(jobserver): help thread gets more token than necessary (#2006)
• 369070e perf(jobserver): poll for new token (#2004)
• 360d734 fix: stop forwarding -Cprofile-generate/-Cprofile-use to the C compiler (#2003)
• 5832160 refactor(forward_available): use let-else (#2002)
• fb83356 feat: add CC_PREFER_CLANG_CL_OVER_MSVC to override `prefer_clang_cl_over_ms...
• Additional commits viewable in compare view

Updates deranged from 0.5.8 to 0.5.9

Commits

• See full diff in compare view

Updates rustls from 0.23.45 to 0.23.46

Commits

• f04804f Delay saving KX hint until handshake confirmation
• 049d39b Bump version to 0.23.46
• 6d0ba08 Eliminate secret from impl Debug for ServerSessionValue
• 2b82b81 unbuffered: update TLS 1.3 traffic keys before exhausting them
• 74343e7 conn: update TLS 1.3 traffic keys within fragmented writes
• 795eea7 Advance the HPKE sequence only after seal succeeds
• d67cb71 stream: provide backpressure while buffering received plaintext
• 7a69ade util: fuse flushes from connections with errors
• 493d089 conn: fuse writes for connections with errors
• db00e01 util: keep flushing after short writes
• Additional commits viewable in compare view

Updates rustls-native-certs from 0.8.4 to 0.8.5

Release notes

Sourced from rustls-native-certs's releases.

0.8.5

Avoid unnecessary work by keeping track of duplicate files on Unix systems.

What's Changed

• Read each file in cert directories only once by @​PeterUlb in rustls/rustls-native-certs#256
• Prepare 0.8.5 by @​djc in rustls/rustls-native-certs#257

Commits

• 4bcc4bb Bump version to 0.8.5
• 2d13547 Take semver-compatible dependency updates
• c231965 Read each file in cert directories only once
• da7d23d build(deps): bump rustls from 0.23.44 to 0.23.45 in the crates-io group
• 3f866a2 build(deps): bump rustls from 0.23.43 to 0.23.44 in the crates-io group
• e7d065e build(deps): bump rustls-webpki in the crates-io group
• 1196259 build(deps): bump rustls-webpki in the crates-io group
• 589e968 build(deps): bump rustls from 0.23.42 to 0.23.43 in the crates-io group
• 1d93e38 build(deps): bump serial_test from 3.5.0 to 4.0.1 in the crates-io group
• a54aba3 build(deps): bump the crates-io group with 2 updates
• Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates smallvec from 1.16.2 to 1.16.3

Release notes

Sourced from smallvec's releases.

v1.16.3

What's Changed

• Port new fuzzer to v1 by @​bolshoytoster in servo/rust-smallvec#678
• fix: overflow during fuzzy check by @​GauravPawar101 in servo/rust-smallvec#693
• chore: bump version by @​alejandro-vaz in servo/rust-smallvec#723

Full Changelog: servo/rust-smallvec@v1.16.2...v1.16.3

Commits

• 7ad35d2 chore: bump version (#723)
• 8aaf33e fix: overflow during fuzzy check (#693)
• c936db1 Port new fuzzer to v1 (#678)
• See full diff in compare view

Updates tokio from 1.53.2 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
• sync: wake waiters outside the lock when closing a semaphore (#8529)
• test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Commits

• a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
• df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
• f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
• 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
• 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
• c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
• 0448618 sync: make tracing_sync tests synchronous (#8427)
• 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
• bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
• 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
• Additional commits viewable in compare view

Updates unicode-ident from 1.0.26 to 1.0.27

Release notes

Sourced from unicode-ident's releases.

1.0.27

• Optimize trie layout to create headroom for new identifiers in future unicode versions (#54, #56)

Commits

• c1ac3af Release 1.0.27
• ff8907c Merge pull request #56 from dtolnay/segment
• b57403f Split base address for two different lookups
• 4e958c4 Merge pull request #55 from dtolnay/indexset
• 7da4079 Replace chunk layout with IndexSet
• 97d6034 Merge pull request #54 from dtolnay/overflow
• c7e447b Defer half-chunk overflow enforcement
• 639d388 Merge pull request #53 from dtolnay/triestat
• 662f912 Update trie statistics in readme for Unicode 18.0.0
• 2bdb95a Merge pull request #52 from dtolnay/naming
• Additional commits viewable in compare view

Updates zerocopy from 0.8.62 to 0.8.63

Release notes

Sourced from zerocopy's releases.

v0.8.63

What's Changed

• [anneal][v1] Optimize SHA-2 in development and test builds by @​joshlf in google/zerocopy#3813
• Bump the cargo group across 3 directories with 1 update by @​dependabot[bot] in google/zerocopy#3796
• [anneal] Build Intel Mac artifacts with Rosetta by @​joshlf in google/zerocopy#3853
• [ci] Check packaged licenses by @​neonjava in google/zerocopy#3857
• Release 0.8.63 with packaged SPDX header checks by @​joshlf in google/zerocopy#3859

New Contributors

• @​neonjava made their first contribution in google/zerocopy#3857

Full Changelog: google/zerocopy@v0.8.62...v0.8.63

Commits

• c55af49 Release 0.8.63 with packaged SPDX header checks (#3859)
• 4492265 [ci] Check packaged licenses (#3857)
• 28fbee8 [CI] Bump the all-actions group with 6 updates (#3856)
• f7ec49b [anneal] Build Intel Mac artifacts with Rosetta (#3853)
• d51a14e Bump the cargo group across 3 directories with 1 update (#3796)
• 5bc5ede [anneal][v1] Optimize SHA-2 in development and test builds (#3813)
• See full diff in compare view

Updates zerocopy-derive from 0.8.62 to 0.8.63

Release notes

Sourced from zerocopy-derive's releases.

v0.8.63

What's Changed

• [anneal][v1] Optimize SHA-2 in development and test builds by @​joshlf in google/zerocopy#3813
• Bump the cargo group across 3 directories with 1 update by @​dependabot[bot] in google/zerocopy#3796
• [anneal] Build Intel Mac artifacts with Rosetta by @​joshlf in google/zerocopy#3853
• [ci] Check packaged licenses by @​neonjava in google/zerocopy#3857
• Release 0.8.63 with packaged SPDX header checks by @​joshlf in google/zerocopy#3859

New Contributors

• @​neonjava made their first contribution in google/zerocopy#3857

Full Changelog: google/zerocopy@v0.8.62...v0.8.63

Commits

• c55af49 Release 0.8.63 with packaged SPDX header checks (#3859)
• 4492265 [ci] Check packaged licenses (#3857)
• 28fbee8 [CI] Bump the all-actions group with 6 updates (#3856)
• f7ec49b [anneal] Build Intel Mac artifacts with Rosetta (#3853)
• d51a14e Bump the cargo group across 3 directories with 1 update (#3796)
• 5bc5ede [anneal][v1] Optimize SHA-2 in development and test builds (#3813)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions