[dependabot]

Updates the requirements on lzma-rust2 to permit the latest version.

Changelog

Sourced from lzma-rust2's changelog.

0.23.0 - 2026-10-18

Added

• Add xz_uncompressed_size to read the uncompressed size of XZ data from its stream indexes, without decoding it.
• Add optional strict completion and deferred error delivery to LzmaReader.
• Add XzStream::set_stop_after_stream_header and XzStream::streams_started to read the check type of every concatenated stream.

Changed

• Breaking change: LzipStream::new and LzipStream::new_mem_limit take allow_multiple_members, like XzStream.

Fixed

• Reject XZ blocks in XzReaderMt that do not end at the index before allocating them.
• Read any number of empty XZ streams in XzReader without growing the call stack.
• Read any number of empty XZ blocks in XzReaderMt without growing the call stack.
• Read the XZ index record by record without collecting the records in memory.
• Finish Lzma2ReaderMt on empty input with empty output.

0.22.0 - 2026-10-11

Added

• Add a bounded, streaming Bcj2Writer with four raw outputs and configurable branch conversion limits.
• Add Bcj2Reader::finish for strict input completion.
• Add Bcj2Reader::try_new for checked stream counts.
• Add LzipReaderMt::new_mem_limit to limit decoder and member-buffer memory per LZIP member.
• Add cooperative cancellation to Lzma2WriterMt, reported as EncoderCancelled.

Fixed

• Allow the range encoder to defer more than 4 GiB of bytes in very long streams.
• Bound pending worker jobs and ordered results in multi-threaded writers and the LZIP reader.
• Join workers after completion, errors, and drop; return thread-spawn failures as I/O errors.
• Synchronize worker queue closure to prevent missed shutdown wakeups.
• Read consecutive empty LZIP members without growing the LzipReaderMt call stack.
• Return OutOfMemory instead of panicking when a LZIP member requests an impossible allocation.
• Reject malformed LZIP MT member spans before decoding an embedded second member.
• Stop active LZIP member decoding when the worker pool shuts down.
• Retry interrupted BCJ2 reads without losing fragmented branch addresses.
• Reject truncated BCJ2 streams and incomplete branch addresses.
• Validate the BCJ2 range stream even when the declared output is empty.
• Preserve BCJ2 input errors after returning decoded bytes.
• Reject invalid BCJ2 stream counts without panicking.
• Keep BCJ2 output sizes above 4 GiB intact on 32-bit targets.
• Wrap BCJ2 instruction positions at 32 bits.
• Fix LzmaOptions::get_memory_usage() mixing bytes with KiB and undercounting hash-table memory.
• Fix LzmaOptions::get_memory_usage() underestimating memory for custom lc and lp values.

... (truncated)

Commits

• 79f8509 chore: prepare release v0.23.0
• 06f0b5e Finish Lzma2ReaderMt on empty input
• 7e2111c Read the XZ index record by record
• f130461 Read empty XZ blocks in XzReaderMt without recursion
• f866aee Read empty XZ streams in XzReader without recursion
• dfbb2a4 Fix clippy warnings
• aee6a0f Reject XZ index records past the index in XzReaderMt
• d6268a2 Let LzipStream stop after the first member
• b314d45 Let XzStream stop after each stream header
• 3fb3ad2 Fix declared-end validation and make error deferral opt-in
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[weiji14]

FYI, I think we also need to update the python/Cargo.lock file to use lzma-rust2=0.23 (realized this when running some uv commands). I did it in 3418386