[dependabot]

Bumps the cargo-weekly group with 8 updates:

Package	From	To
tokio	1.53.3	1.54.1
sigstore-verify	0.15.0	0.15.1
zip	9.0.5	9.1.2
crc32fast	1.5.2	1.5.3
similar	3.2.0	3.2.1
smallvec	1.16.3	1.16.4
typed-path	0.12.3	0.13.0
webpki-root-certs	1.0.10	1.0.11

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates sigstore-verify from 0.15.0 to 0.15.1

Release notes

Sourced from sigstore-verify's releases.

sigstore-verify-v0.15.1

Fixed

• (verify) verify RFC 3161 timestamps with managed keys, earliest integrated time (#269)

Other

• [breaking] final API naming polish before 1.0 (#325)
• Crypto agility (#326)
• (deps) remove unused dependencies and features across workspace (#329)
• (verify) [breaking] collapse verification entry points (#316)
• (verify) pass the signing certificate chain to chain verification (#315)
• (verify) remove unit test from verify_bundle example (#314)
• [breaking] document every public item, enforce missing_docs (#271)
• (interop) Make interop tests use conformance test token (#303)
• (verify) [breaking] categorized, matchable verification errors (#264)

Commits

• fc308a2 chore: release v0.15.1 (#339)
• ff9ee68 trust-root: refresh embedded TUF data (#342)
• 362bee1 chore(deps): update webpki-root-certs to 1.0.10 (#341)
• b188022 fix(tsa): verify response messageImprint matches request (#340)
• ab59bb5 chore(deps): update rust to v1.99.1 (#334)
• 6654f7f chore(deps): update rust crate rstest to 0.28 (#335)
• be1c932 chore(deps): update github-actions (#336)
• 7ee1e2c chore(deps): lock file maintenance (#338)
• See full diff in compare view

Updates zip from 9.0.5 to 9.1.2

Release notes

Sourced from zip's releases.

v9.1.1

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

v9.1.0

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)
• target lzma-rust2 v0.23 (#1096)

Bench

• add Criterion benchmarks (#754)
• add deflate_many_small_files bench for #633 (#964)

Changelog

Sourced from zip's changelog.

9.1.2 - 2026-10-26

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#1179)
• (write) reject a Unicode Path extra field that would rename the entry (#1177)
• (extract) prevent following symbolic links during file creation (#1116)

9.1.1 - 2026-10-25

🐛 Bug Fixes

• store the raw count instead of a bool (#1174)
• preserve extra fields in raw_copy_file_touch (#1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#1159)

9.1.0 - 2026-10-24

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#1109)
• Add borrowing inner method to reader wrappers (#1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#1019)
• add file_names_raw iterator (#1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#1124)
• (write) prevent seek panic on streaming writer with comment (#1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#1134)
• apply unix permissions at creation (#1104)
• raw_copy_file should work with any extra fields (#1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#1142)
• don't enable typed-path's default std feature (#1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#1107)
• resolve decoded CP437 member names (#1080) (#1085)
• Debug assertion doesn't account for length of archive comment (#1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#1046) (#1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#1138)

... (truncated)

Commits

• 662ae13 chore: release v9.1.2 (#1176)
• e221cd0 fix: preserve the file kind (normal/directory/symlink) in raw_copy_file_touch...
• 525d81e fix(write): reject a Unicode Path extra field that would rename the entry (#1...
• dcc28ed ci(fuzz): Fixes for fallback when Rust nightly is updated mid-run (#1178)
• 68e7e84 fix(extract): prevent following symbolic links during file creation (#1116)
• b7201ce chore: release v9.1.1 (#1173)
• 67b3e52 fix: store the raw count instead of a bool (#1174)
• 9d710d3 ci: Share cargo-afl build across workflows (#1167)
• d6c0278 fix: preserve extra fields in raw_copy_file_touch (#1172)
• c3232c4 test: cover unreserved validation for prepared files (#1169)
• Additional commits viewable in compare view

Updates crc32fast from 1.5.2 to 1.5.3

Commits

• d2363ea Release 1.5.3
• f694286 Publish to crates.io with trusted publishing
• 348edd9 Expose the total byte length of a CRC32 hash state (#68)
• ad14266 Centralize state handling (#67)
• 92c03d6 bench: switch from bencher to criterion (#66)
• 32b1983 Scope the msrv job to the published library, and take rand 0.10 (#65)
• 369da36 Bump actions/checkout from 4 to 7 in the actions group (#63)
• 6d5596e ci: enable dependabot version updates (#62)
• See full diff in compare view

Updates similar from 3.2.0 to 3.2.1

Changelog

Sourced from similar's changelog.

3.2.1

• Improved real-world diffing performance substantially without changing the produced diffs. On a corpus of real source file revisions, line diffs run about 4x faster with Algorithm::Myers, 5x faster with Algorithm::Histogram, and 2.5x faster with Algorithm::Patience; word diffs run about 2x faster. This comes from a faster line tokenizer, a SipHash-1-3 content hash that consumes whole words (randomly keyed with std), cheaper integer-keyed lookup tables, hashing only the changed middle of Myers line diffs, flat occurrence tables in Histogram, and a gap buffer in the compaction pass that was quadratic on diffs with many ops. Allocation counts and peak memory dropped as well; in particular one sided and heavily unbalanced inputs no longer build index structures proportional to the larger side for Algorithm::Hunt, Algorithm::Histogram, and Algorithm::Patience.
• Fixed Algorithm::Histogram overflowing the stack on inputs with many scattered changes. Pending ranges are now tracked on the heap, so stack usage no longer grows with the number of anchors. #105
• Fixed TextMerge::labels writing carriage returns and newlines verbatim into conflict markers, which let a label add lines to the output that looked like merged content. Line terminators in labels are now replaced with spaces. #101

Commits

• 71d4831 chore(release): prepare 3.2.1
• b61e6c3 test(histogram): skip small stack tests on WASI
• a4ee936 fix(histogram): track pending ranges on the heap
• 96993d9 docs: add runnable example output gallery (#104)
• 1c64280 docs(changelog): describe diff performance and memory improvements
• a3da6ec perf(compact): use a gap buffer for large operation lists
• ce3a403 perf(histogram): reuse indexes and bound unbalanced input allocations
• 2bcae2f perf(myers): skip unchanged hashing and unused split bookkeeping
• 5a5aa8d perf(text): accelerate line and word tokenization
• 80bc240 perf(hash): accelerate content hashing and integer lookups
• Additional commits viewable in compare view

Updates smallvec from 1.16.3 to 1.16.4

Release notes

Sourced from smallvec's releases.

v1.16.4

What's Changed

• Port fuzzer changes from PR #737 to v1 by @​GauravPawar101 in servo/rust-smallvec#753
• chore: bump version by @​alejandro-vaz in servo/rust-smallvec#779

Full Changelog: smallvec/smallvec@v1.16.3...v1.16.4

Commits

• eab7746 chore: bump version (#779)
• bb9e44b Port fuzzer changes from PR #737 to v1 (#753)
• See full diff in compare view

Updates typed-path from 0.12.3 to 0.13.0

Changelog

Sourced from typed-path's changelog.

[0.13.0] - 2026-10-19

• Add optional serde feature to serialize and deserialize paths (#66)
• Treat a complete Windows UNC prefix such as \\server\share as absolute, with or without a trailing separator (#62)
• Return an error from absolutize for ambiguous Windows paths such as C:something and \\server instead of succeeding (#63)
• Fix set_extension and with_extension on paths with anything trailing the file name, such as a trailing separator, so setting the extension of a.bc/ to z yields a.z instead of a.b.z to match std::path (#67)
• Remove a trailing . when set_extension is given an empty extension, so foo. becomes foo to match std::path
• Drop the vacuous for<'enc> binder from the Encoding bounds on Iter and Ancestors
• Include the wasm32-wasip2 fixes from 0.12.4

[0.12.4] - 2026-10-19

• Fix the build on stable wasm32-wasip2, broken since 0.12.1 by an unconditional #![feature(wasip2)] (#71)
• Move the OsStr and OsString conversions on wasm32-wasip2 behind the new nightly-wasip2 feature, which requires a nightly compiler (#72)

Commits

• 93554f5 Bump to release 0.13.0
• 6b65758 ci: build wasm32-wasip1 and wasm32-wasip2, including nightly-wasip2 on nightly
• 272f009 style: apply rustfmt to the wasip2 cfg attributes
• d02245a Make unstable WASI-p2 OS-string conversions opt-in (#72)
• 0fd79eb fix(ci): restore green CI — MSRV test run and clippy on current stable (#70)
• a0d2886 fix(path): ignore anything trailing the file name in set_extension (#68)
• 5dba860 Add serde support (#66)
• 6362c6f absolutize() should return error for ambiguous paths (#63)
• f355a0e Treat complete Windows UNC prefixes as absolute paths (#62)
• ede755a Add AGENTS.md
• See full diff in compare view

Updates webpki-root-certs from 1.0.10 to 1.0.11

Release notes

Sourced from webpki-root-certs's releases.

1.0.11

Track CCADB removal of further eMudhra CAs: "emSign Root CA - C1" and "emSign ECC Root CA - C3": https://bugzilla.mozilla.org/show_bug.cgi?id=2083709

What's Changed

• Remove 2 more eMudhra CAs (C1 and C3) by @​kpcyrd in rustls/webpki-roots#136
• Prepare 1.0.11 by @​ctz in rustls/webpki-roots#137

New Contributors

• @​kpcyrd made their first contribution in rustls/webpki-roots#136

Full Changelog: rustls/webpki-roots@v/1.0.10...v/1.0.11

Commits

• 7ebfa0b Prepare 1.0.11
• 4c905cb Take semver-compatible updates
• f75f3cb Remove 2 more eMudhra CAs (C1 and C3)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mattsse]

Holding this update while CI is blocked: the platform test matrix and Clippy cannot download crc32fast 1.5.4 because Socket's recentlyPublished policy returns HTTP 403. Re-run after the package clears the existing cooldown.

https://github.com/foundry-rs/foundryup/actions/runs/41420794390/job/125195569618