build(deps): bump the cargo group across 1 directory with 11 updates

[dependabot]

Bumps the cargo group with 11 updates in the / directory:

Package	From	To
rmcp	3.2.0	3.5.1
tokio	1.53.1	1.53.2
thiserror	2.0.20	2.0.21
duckdb	1.10505.0	1.10506.0
crossbeam-channel	0.5.16	0.5.17
fancy-regex	0.19.0	0.19.2
toml	1.1.5+spec-1.1.0	1.1.8+spec-1.1.0
clap	4.6.6	4.6.7
clap_complete	4.6.9	4.6.11
crossbeam	0.8.4	0.8.5
insta	1.48.0	1.49.0

Updates rmcp from 3.2.0 to 3.5.1

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.5.1

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.1

Fixed

• (server) keep discover lifecycle bootstrap-neutral (#1248)
• keep handler-generated invalid params errors in-band (#1322)
• (model) export object! macro without macros feature (#1318)
• (server) default missing cache hints for 2026-07-28 peers (#1308)

Other

• [rmcp] Notify credential stores when a refresh token is rejected (#1285)

rmcp-macros-v3.5.0

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.0

Added

• update LATEST and add LATEST_WITH_INITIALIZE (#1105)

Fixed

• (model) decode float fields through serde_json::Number (#1300)
• (rmcp) reject duplicate sep-2243 headers (#1274)
• (transport) match explicit default ports in Origin allowlist (#1270)
• (rmcp) tolerate empty cacheScope instead of silently dropping the whole result (#1281)
• (model) preserve explicit null structuredContent in CallToolResult (#1295)

Other

• cargo fmt fixes on validate_standard_headers changes (#1275)

rmcp-macros-v3.4.1

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.4.1

Fixed

• (transport) fall back after JSON discover rejections (#1288)
• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

... (truncated)

Commits

• 79437f2 chore: release v3.5.1 (#1307)
• 4a226c7 fix(server): keep discover lifecycle bootstrap-neutral (#1248)
• 931d471 chore(deps): bump the github-actions group with 6 updates (#1313)
• cf1e9aa fix: keep handler-generated invalid params errors in-band (#1322)
• deef9bb fix(model): export object! macro without macros feature (#1318)
• c0d667e fix(server): default missing cache hints for 2026-07-28 peers (#1308)
• 94c5c03 fix: use MSRV-aware dependency resolver (#1316)
• 8f9a28e fix(examples): fix complex auth server discovery (#1309)
• ae2f9c9 [rmcp] Notify credential stores when a refresh token is rejected (#1285)
• bdd93dc ci: reject multi-line codex auth secret (#1306)
• Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates duckdb from 1.10505.0 to 1.10506.0

Release notes

Sourced from duckdb's releases.

v1.10506.0

What's Changed

• Return errors from Config::set() instead of panicking by @​arijitroy003 in duckdb/duckdb-rs#822
• Fix DuckDB linking with custom target dirs by @​mlafeldt in duckdb/duckdb-rs#828
• Test nightly DuckDB artifacts in CI by @​mlafeldt in duckdb/duckdb-rs#829
• Download nightly artifacts from staging by @​mlafeldt in duckdb/duckdb-rs#830
• Update DuckDB to v1.5.6 by @​okruitho in duckdb/duckdb-rs#880

New Contributors

• @​arijitroy003 made their first contribution in duckdb/duckdb-rs#822

Full Changelog: duckdb/duckdb-rs@v1.10505.0...v1.10506.0

Commits

• 0fec186 Ignore rustdoc lint
• bb2f1f8 Improve pull_request ci
• 577af32 Update DuckDB to v1.5.6
• 49523b0 Merge pull request #830 from duckdb/nightly-staging-artifact
• ef4f022 Download nightly artifacts from staging
• 7e9031f Merge pull request #829 from duckdb/nightly-download-lib
• 2c69799 Test nightly DuckDB artifacts in CI
• d333467 Merge pull request #828 from duckdb/fix-relative-cargo-target-dir
• 0d08291 Fix DuckDB linking with custom target dirs
• dc90d54 Merge pull request #822 from arijitroy003/fix/config-set-return-errors
• Additional commits viewable in compare view

Updates crossbeam-channel from 0.5.16 to 0.5.17

Release notes

Sourced from crossbeam-channel's releases.

crossbeam-channel 0.5.17

• Fix UB in bounded channel when SelectedOperation is leaked. (#1295)
• Fix behavior inconsistency on already received case in at(). (#1296)
• Handle overflow in bounded channel initialization. (#1301)
• Use 64-bit index on 32-bit platforms if 64-bit atomic is available. (#1321)
• Update MSRV policy to support 1 year instead of 6 months to meet rayon's MSRV policy. (#1284)

Commits

• 2920c98 Prepare for the next release
• 808b75a ci: Update codegen job
• 46774e0 channel: Document that send_timeout sends an available message even if the ti...
• 89a3fe4 epoch: Make Shared::null const
• 383d74a Use *::MAX associated constants
• a30b825 channel,deque,queue: Use AtomicU64/u64 in head/tail index if available
• a0e4d29 Replace iterative capacity growth with next_power_of_two (#1216)
• 94f74d2 Recognize x86_64-unknown-linux-gnutsan in build script
• 30e5963 epoch: Add missing fence emulation for tsan
• 708a6bd Handle overflow in bounded channel/queue initialization (#1301)
• Additional commits viewable in compare view

Updates fancy-regex from 0.19.0 to 0.19.2

Release notes

Sourced from fancy-regex's releases.

0.19.2

Added

• Add a leftmost_longest feature (off by default) that adds a method to the RegexBuilder/RegexOptionsBuilder for building a VM which would operate in leftmost-longest match mode instead of the regular leftmost-first mode. Useful for POSIX compliance. (#281)

Changed

Fixed

0.19.1

Added

• Add a perf-dfa-full feature (off by default, mirroring the regex crate) that lets regex-automata eagerly build fully compiled dense DFAs for small patterns, for workloads that compile few regexes and match them very heavily (#272)

Changed

• Add VM instruction for case insensitive literals when in Unicode mode, to keep the build cost bounded (#268) and ensured the toy example graph output remains readable instead of being super verbose (#269)
• Compilation performance: the regex-automata dependency no longer enables the dfa-build feature by default. With dfa-build enabled, meta::Regex eagerly determinizes a full dense DFA for every small pattern, which dominated build time of simple class-containing patterns (e.g. \b(extern)\s+(crate) compiled ~4x slower than with the regex crate, which also ships without dfa-build); searches use the lazy DFA instead, with no measurable match-time difference (#272)
• Compilation performance: identical delegated fragments within one compile now share a single regex-automata engine instead of each building their own. Alternation-heavy patterns (TextMate grammar lookbehinds especially) often repeat the same fragment many times; on such patterns this removes a large share of build time (#277)

Fixed

• The playground didn't show when a literal or backreference was being matched case insensitively in the analysis tree view (#269)
• Seek patterns could become very large when recursive backrefs and subroutine calls were inlined, without bringing much benefit (#270)
• The optimize_nested_repeats pass could rewrite an optional capture group like (\w+)? into (\w*), causing an unmatched optional group to be reported as an empty match (Some("")) instead of None (#276)

Changelog

Sourced from fancy-regex's changelog.

[0.19.2] - 2026-09-13

Added

• Add a leftmost_longest feature (off by default) that adds a method to the RegexBuilder/RegexOptionsBuilder for building a VM which would operate in leftmost-longest match mode instead of the regular leftmost-first mode. Useful for POSIX compliance. (#281)

Changed

Fixed

• Fix a panic in capture_names() for a pattern with a zero-repeated named group such as (?<n>a){0} (#275)
• Literal bytes were being encoded as utf-8 in Ascii mode, now they match the exact byte literal

[0.19.1] - 2026-09-06

Added

• Add a perf-dfa-full feature (off by default, mirroring the regex crate) that lets regex-automata eagerly build fully compiled dense DFAs for small patterns, for workloads that compile few regexes and match them very heavily (#272)

Changed

• Add VM instruction for case insensitive literals when in Unicode mode, to keep the build cost bounded (#268) and ensured the toy example graph output remains readable instead of being super verbose (#269)
• Compilation performance: the regex-automata dependency no longer enables the dfa-build feature by default. With dfa-build enabled, meta::Regex eagerly determinizes a full dense DFA for every small pattern, which dominated build time of simple class-containing patterns (e.g. \b(extern)\s+(crate) compiled ~4x slower than with the regex crate, which also ships without dfa-build); searches use the lazy DFA instead, with no measurable match-time difference (#272)
• Compilation performance: identical delegated fragments within one compile now share a single regex-automata engine instead of each building their own. Alternation-heavy patterns (TextMate grammar lookbehinds especially) often repeat the same fragment many times; on such patterns this removes a large share of build time (#277)

Fixed

• The playground didn't show when a literal or backreference was being matched case insensitively in the analysis tree view (#269)
• Seek patterns could become very large when recursive backrefs and subroutine calls were inlined, without bringing much benefit (#270)
• The optimize_nested_repeats pass could rewrite an optional capture group like (\w+)? into (\w*), causing an unmatched optional group to be reported as an empty match (Some("")) instead of None (#276)

Commits

• e268485 Version 0.19.2
• ee2e3a0 Merge pull request #281 from fancy-regex/leftmost_longest
• c9fa74e add another leftmost longest test assertion
• 797768f add leftmost_longest check to agents.md
• c323111 small refactor to avoid duplicating code
• c063e72 fix bug whereby leftmost longest match wasn't being returned when later, long...
• 04d8796 Update changelog
• 515397a add missing feature flag to documentation
• ba0416f small addition to contributing guide
• 4be8648 feat: gate leftmost_longest behind optional feature flag
• Additional commits viewable in compare view

Updates toml from 1.1.5+spec-1.1.0 to 1.1.8+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates clap_complete from 4.6.9 to 4.6.11

Commits

• 2cb76fd chore: Release
• 0b00b8d docs: Update changelog
• 3443000 Merge pull request #6526 from bonnefoa/fix-completion-escape
• a1b6be7 fix(clap_complete): Fix value escape in zsh completion
• face9e8 test(complete): Add completion test without arg's help
• 88053ab test(complete): Re-enable complete tests
• e6adcc2 chore(release): Simplify replacements
• 13f2db5 chore: Release
• 3304fea docs: Update changelog
• 7b2ad34 Merge pull request #6521 from r-near/feat/derive-deferred-initialization
• Additional commits viewable in compare view

Updates crossbeam from 0.8.4 to 0.8.5

Release notes

Sourced from crossbeam's releases.

crossbeam-utils 0.8.5

• Add AtomicCell::fetch_update (#704)
• Support targets that do not have atomic CAS on stable Rust (#698)

crossbeam-deque 0.8.5

• Remove dependency on cfg-if. (#1072)

crossbeam 0.8.5

• Update MSRV policy to support 1 year instead of 6 months to meet rayon's MSRV policy. (#1284)

Changelog

Sourced from crossbeam's changelog.

Version 0.8.5

• Update MSRV policy to support 1 year instead of 6 months to meet rayon's MSRV policy. (#1284)

Commits

• 2920c98 Prepare for the next release
• 808b75a ci: Update codegen job
• 46774e0 channel: Document that send_timeout sends an available message even if the ti...
• 89a3fe4 epoch: Make Shared::null const
• 383d74a Use *::MAX associated constants
• a30b825 channel,deque,queue: Use AtomicU64/u64 in head/tail index if available
• a0e4d29 Replace iterative capacity growth with next_power_of_two (#1216)
• 94f74d2 Recognize x86_64-unknown-linux-gnutsan in build script
• 30e5963 epoch: Add missing fence emulation for tsan
• 708a6bd Handle overflow in bounded channel/queue initialization (#1301)
• Additional commits viewable in compare view

Updates insta from 1.48.0 to 1.49.0

Release notes

Sourced from insta's releases.

1.49.0

Release Notes

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Install cargo-insta 1.49.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/insta/releases/download/1.49.0/cargo-insta-installer.ps1 | iex"

Download cargo-insta 1.49.0

File	Platform	Checksum
cargo-insta-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
cargo-insta-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
cargo-insta-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
cargo-insta-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
cargo-insta-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
cargo-insta-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

This was written by Codex on behalf of @​max-sixty

Changelog

Sourced from insta's changelog.

1.49.0

• Allow Option<&OsStr> snapshot names, such as Path::file_name(), without explicit string conversion. #929 (@​dislogical)
• Add prebuilt cargo-insta binaries for ARM64 Linux (aarch64-unknown-linux-gnu). #942 (@​aljohri)
• Fix JSON serialization of maps keyed by unit enum variants. Keys use the serialized variant name, including serde renames. #934 (@​teddytennant)
• Remove trailing semicolons from serialization macro bodies to avoid compiler warnings when used in expression position. #940 (@​Tiwalun)
• Mention INSTA_UPDATE=always in snapshot mismatch hints for file snapshots. #927 (@​hiro-nikaitou)
• Update the lockfile's tempfile and rustix dependencies to fix builds with newer Rust toolchains. #939
• Fix cargo insta test --all-targets --test-runner nextest failing with "Can't mix --doc with other target selecting options". Like cargo test --all-targets, it no longer runs doctests. #460

Commits

• 5df39ce Release 1.49.0 (#944)
• 1c28c19 Skip the separate doctest run for nextest with --all-targets (#941)
• 064742e Build cargo-insta for aarch64-unknown-linux-gnu (#942)
• 08b67d9 Remove trailing semicolons from macro bodies (#940)
• 06858e1 fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)
• 70be034 Serialize unit enum variants used as JSON map keys (#934)
• 54d0b96 feat: implement From for SnapshotValue with OsStr (#929)
• 3d62572 [fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)
• 1712876 ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.