[dependabot]

Bumps the cargo-minor-patch group with 7 updates:

Package	From	To
tokio	1.53.2	1.53.3
libc	0.2.190	0.2.191
sha2	0.11.0	0.11.1
zip	9.0.2	9.0.5
aws-sdk-ec2	1.267.0	1.268.0
rustls-native-certs	0.8.4	0.8.5
syn	3.0.8	3.0.9

Updates tokio from 1.53.2 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
• sync: wake waiters outside the lock when closing a semaphore (#8529)
• test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Commits

• a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
• df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
• f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
• 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
• 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
• c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
• 0448618 sync: make tracing_sync tests synchronous (#8427)
• 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
• bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
• 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
• Additional commits viewable in compare view

Updates libc from 0.2.190 to 0.2.191

Release notes

Sourced from libc's releases.

0.2.191

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Changelog

Sourced from libc's changelog.

0.2.191 - 2026-10-16

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Commits

• ccc2ff4 libc: Release 0.2.191
• bce6efb apple: Add mach_task_self and mach_task_self_ to semver checks
• ecf4fd4 apple: Re-restrict mach_vm_map to MacOS-only
• b0e0423 Revert "apple: Disable mach.h API on Apple mobile OSs"
• 9c7f568 apple: add ifaliasreq and in6_aliasreq
• 018c7e9 wasi: Add pthread_condattr_{get,set}clock
• 2c77185 openbsd: add sensordev structure
• e10813c hurd: Add missing POSIX_SPAWN_* flags
• 2ea4bc1 Fix FreeBSD/aarch64
• 6d666fd dragonfly: Parse version from headers rather than CLI
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates zip from 9.0.2 to 9.0.5

Release notes

Sourced from zip's releases.

v9.0.5

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

v9.0.4

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

v9.0.3

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#1054)

Changelog

Sourced from zip's changelog.

9.0.5 - 2026-10-17

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#1079)

9.0.4 - 2026-10-16

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
• update lzma-rust2 and ppmd-rust dependencies (#1060)

9.0.3 - 2026-10-13

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#1054)

Commits

• 0123ed1 chore: release v9.0.5 (#1093)
• 00cf82b docs: Repeal policy of yanking versions with known vulnerabilities, add menti...
• 52165b9 chore: Enable release-plz on backport branches in future (#1079)
• ca51e64 docs: Remove doc links that break when doc build doesn't enable all features ...
• 6639687 fix: use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
• 5e06fa8 fix(write): prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)
• b6f9fb8 Merge commit from fork
• ea2ccfe Merge commit from fork
• 8068ab4 Merge commit from fork
• 0b51128 doc: Clarifications to security policy (#1074)
• Additional commits viewable in compare view

Updates aws-sdk-ec2 from 1.267.0 to 1.268.0

Commits

• See full diff in compare view

Updates rustls-native-certs from 0.8.4 to 0.8.5

Release notes

Sourced from rustls-native-certs's releases.

0.8.5

Avoid unnecessary work by keeping track of duplicate files on Unix systems.

What's Changed

• Read each file in cert directories only once by @​PeterUlb in rustls/rustls-native-certs#256
• Prepare 0.8.5 by @​djc in rustls/rustls-native-certs#257

Commits

• 4bcc4bb Bump version to 0.8.5
• 2d13547 Take semver-compatible dependency updates
• c231965 Read each file in cert directories only once
• da7d23d build(deps): bump rustls from 0.23.44 to 0.23.45 in the crates-io group
• 3f866a2 build(deps): bump rustls from 0.23.43 to 0.23.44 in the crates-io group
• e7d065e build(deps): bump rustls-webpki in the crates-io group
• 1196259 build(deps): bump rustls-webpki in the crates-io group
• 589e968 build(deps): bump rustls from 0.23.42 to 0.23.43 in the crates-io group
• 1d93e38 build(deps): bump serial_test from 3.5.0 to 4.0.1 in the crates-io group
• a54aba3 build(deps): bump the crates-io group with 2 updates
• Additional commits viewable in compare view

Updates syn from 3.0.8 to 3.0.9

Release notes

Sourced from syn's releases.

3.0.9

• Add Punctuated::retain (#2088)

Commits

• 7c44a55 Release 3.0.9
• 13234ab Merge pull request #2088 from dtolnay/retain
• b617dc9 Add Punctuated::retain
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Low Risk
Lockfile-only dependency patch bumps with no application logic changes; minor exposure via Tokio runtime and TLS cert loading paths.

Overview
This PR only updates Cargo.lock as a grouped Dependabot bump (no Cargo.toml or application code changes).

It pins newer patch/minor versions for tokio (1.53.3), libc (0.2.191), sha2 (0.11.1), zip (9.0.5), aws-sdk-ec2 (1.268.0), rustls-native-certs (0.8.5), and syn (3.0.9). The lockfile also reflects transitive pulls of sha2 and syn through AWS SDK, Postgres/TLS, and proc-macro crates.

Notable upstream changes in this range include Tokio runtime/sync/io fixes, sha2 AArch64 round-constant loading fix, zip extraction/write bug fixes (9.0.3–9.0.5), and rustls-native-certs avoiding duplicate cert file reads on Unix.

^{Reviewed by Cursor Bugbot for commit 12a6113. Bugbot is set up for automated code reviews on this repo. Configure here.}