[renovate]

This PR contains the following updates:

Package	Type	Update	Change
cedar-policy (source)	dependencies	minor	4.13.0 → 4.14.0
crc32fast	dependencies	patch	1.5.2 → 1.5.3
jsonschema	dependencies	minor	0.58 → 0.60
tokio (source)	dependencies	minor	1.53.3 → 1.54.1

---

Release Notes

cedar-policy/cedar (cedar-policy)

v4.14.0

Compare Source

Release 4.14.0, available on crates.io

Added

• Cedar now supports the external keyword to declare undefined entity type and action.
• Schema can now hold a partial schema, one that still has external declarations.
• Schema::is_complete reports whether any external entity type or action remain.
• Schema::external_entity_types,
  Schema::defined_entity_types, Schema::external_actions and Schema::defined_actions list the
  declarations on each side of that split (#​2615).
• Schema::schema_link links any number of schemas, resolving each external declaration against a
  definition of the same name, and may itself return a partial schema that holds external entity type or action. Schema::schema_link_complete
  additionally requires the result to be complete. Both report the new LinkError (#​2615).
• The new ValidationError::IncompleteSchema reports that policy validation was given a partial
  schema (#​2615).
• The FFI gains link_schemas and schema_completeness, with the usual _json and _json_str
  variants, exposed to JavaScript as linkSchemas and schemaCompleteness (#​2615).
• The protobuf encoding of a schema now carries external declarations, so a partial schema can be
  encoded and decoded (#​2621).
• For the experimental tpe feature, TPE now reduces has, hasTag, in and == applied to non-erroring but unknown expressions when the schema provides enough information to determine the concrete value of the operation.

Changed

• All existing API behavior remain unchanged for inputs that do not involve the new external keyword.
• Several Schema methods now have a defined behavior for external declarations: Schema::entity_types
  and Schema::actions list them, Schema::action_entities excludes external actions, Schema::principals_for_action and
  Schema::resources_for_action return Some with an empty iterator for external actions
  and Schema::ancestors finds an external entity type and includes its declared parent types
  in the hierarchy (#​2615).
• Validator::validate and Validator::validate_with_level refuse a partial schema, reporting
  ValidationError::IncompleteSchema. Only a complete schema can be used to validate policies (#​2615).
• Request::new accepts a partial schema that holds external declarations, and refuses a request whose
  action is external.
• Entities::from_json_value and friends likewise accept a partial schema and
  refuse an entity whose own type is external, while an entity of a defined type may refer to an
  external type in its attributes, tags and ancestors (#​2615).
• Context::from_json_value and friends report ContextJsonError::MissingAction for an external
  action, as they already did for an absent one, and the error message changed accordingly (#​2615).
• EntityUid::from_str() is faster (~15-30x on the EntityUid parsing benchmark), as it no longer
  parses the string and renders the result back out to check that the input was normalized. The same
  optimization was applied to from_normalized_str() for InternalName, UnreservedId and AnyId.
• Remove support for policy templates in the deprecated entity-manifest feature. Policy templates
  were previously accepted, but slots were not included in the manifest.

srijs/rust-crc32fast (crc32fast)

v1.5.3

Compare Source

Stranger6667/jsonschema (jsonschema)

v0.60.1

Fixed

• Panic on numbers past f64 in const, enum, minimum, maximum, exclusiveMinimum, exclusiveMaximum and type: integer when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. #​1790
• #[jsonschema::validator] panicking during expansion, or generating code that panics, on schema numbers past f64 when another crate in the build enables serde_json/arbitrary_precision while the arbitrary-precision feature is off. Such numbers are compile errors, as without that serde_json feature. #​1790
• const, enum and uniqueItems treating objects with the same members in a different key order as unequal when another crate in the build enables serde_json/preserve_order. #​1791
• Wrong results in type: integer, const, enum, uniqueItems, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum for numbers with exponents past one million, such as 1e-2000000, with the arbitrary-precision feature.
• #[jsonschema::validator] rejecting multipleOf with a positive divisor below the smallest f64, such as 1e-400, with the arbitrary-precision feature.

Performance

• Validation of numbers with many digits or large exponents in const, enum, uniqueItems, type: integer, multipleOf, minimum, maximum, exclusiveMinimum and exclusiveMaximum with the arbitrary-precision feature taking time growing faster than the square of the digit count, instead of at most the square.
• Validation of numbers with more than ten thousand digits, written or implied by their exponent, with the arbitrary-precision feature taking time linear in their written length instead of quadratic in their digit count.

v0.60.0

Changed

• ValidationErrorKind::Enum and ValidationErrorKind::Constant holding their values as Arc<Value> shared with the validator, instead of a copy per error. #​1777

Performance

• Validation with unfinished regex matches running each such match once instead of once per run, and comparing errors across runs in linear time instead of quadratic. #​1784
• items and additionalProperties looking up a single-keyword subschema once per array or object instead of once per value.
• is_valid and validate reading fewer cache lines per subschema, by keeping error locations apart from validators.
• is_valid on recursive schemas caching only $ref results that took many steps to compute, instead of every one.
• Error evaluation paths taking memory linear in the $ref nesting depth, not quadratic. #​1778

v0.59.0

Added

• CLI: - as a path reads the schema or an instance from stdin.
• CLI: -V as the version flag; -v stays as an alias.

Changed

• CLI: Exit status 3 for errors that prevent a verdict and 2 for usage errors, so 1 always means an invalid instance or schema.
• CLI: Errors print to stderr instead of stdout.
• CLI: --version prints jsonschema-cli <VERSION> instead of Version: <VERSION>.

Fixed

• CLI: Panic when stdout is closed early, as in jsonschema-cli validate ... | head.
• CLI: Missing file path in the error for an unreadable instance in text output.
• CLI: jsonschema-cli bundle, jsonschema-cli dereference and jsonschema-cli canonicalize truncating the --output file when the write fails partway.
• CLI: jsonschema-cli validate --help describing --offline in terms of --resource, which validate does not accept.
• CLI: Error and warning messages suggesting jsonschema commands instead of the installed jsonschema-cli binary.
• Canonicalizing several subschemas of one prepared document, where a $ref in a later output could point at another subschema.
• canonicalize leaving unevaluatedProperties or unevaluatedItems beside anyOf or oneOf raw.
• canonicalize giving a different form for a oneOf depending on the order of its branches.
• canonicalize output changing when canonicalized again, for a not over a $ref it cannot fully negate.
• canonicalize output changing when canonicalized again, for a oneOf whose branches reduce to the same $ref.
• canonicalize leaving an anyOf over many overlapping objects raw.
• canonicalize leaving dependencies or dependentRequired raw when their keys form a long chain or cycle.
• canonicalize treating -0 as a value distinct from 0 under arbitrary-precision.
• Regex matches the engine cannot finish, such as on reaching the backtrack limit, counted as non-matches, letting not or patternProperties accept invalid instances. #​1715
• canonicalize treating regex matches the engine cannot finish as non-matches.

Performance

• canonicalize giving up sooner on an allOf over unions too wide to model.

tokio-rs/tokio (tokio)

v1.54.1: Tokio v1.54.1

Compare Source

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#​8692)

v1.54.0: Tokio v1.54.0

Compare Source

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#​8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#​8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#​8378)
• runtime: add Builder::max_io_events_per_busy_tick (#​8410)
• runtime: stabilize tokio::runtime::worker_index() (#​8431)
• sync: add SemaphorePermit::semaphore() (#​8482)
• sync: add blocking_acquire methods to Semaphore (#​8269)
• sync: add watch::Receiver::is_closed (#​8481)
• wasm: support JSPI for Emscripten target (#​8285, #​8627)
• wasm: support the wasm32-unknown-emscripten target (#​8281, #​8422, #​8528, #​8628)

Changed

• fs: reject zero in File::set_max_buf_size (#​8449)
• io: make copy_buf cooperative (#​8459)
• io: panic when BufReader or BufStream is created with zero capacity (#​8494)
• io: panic when in-memory pipe is created with zero capacity (#​8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#​8454)
• io: support vectored writes in Sink (#​8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#​8444)
• net: start accepted sockets as readable and writable (#​8435)
• net: support UCred on Fuchsia (#​8257)
• process: use mio::unix::pipe for Unix child stdio (#​8603)
• runtime: cache-pad the shared injection queue and idle state (#​8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#​8414)
• runtime: make enable_io available whenever rt is enabled (#​8387)
• runtime: move block_in_place setup into a non-generic function (#​8315)
• runtime: move the multi-thread inject queue to its own mutex (#​8382)
• runtime: panic when max_io_events_per_tick is zero (#​8476)
• runtime: suggest .await in nested block_on panic message (#​8501)
• sync: avoid atomic reader count in broadcast slots (#​8357)
• sync: use acquire/release orderings in Notify (#​8325)
• time: remove the runtime handle from timers (#​8458)

Fixed

• fs: restore File internal state when op fails (#​8291)
• io: complete zero-length memory stream operations immediately (#​8323)
• io: flush the writer when the reader stalls in copy_buf (#​8424)
• io: keep the shutdown bit when clearing readiness (#​8435)
• io: preserve the full ScheduledIo tick in readiness events (#​8331)
• io: read lines as bytes so a partial line survives an I/O error (#​8400)
• io: retry on ErrorKind::Interrupted in more I/O operations (#​8417, #​8432, #​8448, #​8453, #​8455, #​8460)
• io: use spawn_mandatory_blocking for stdout and stderr (#​8506)
• io: wait for pending operations before BufReader seeks (#​8599)
• net: close CreateFileW handle on SetNamedPipeHandleState failure (#​8418)
• net: fix peer credentials on NetBSD (#​8589)
• net: saturate TcpSocket and UnixSocket listen backlog (#​8511)
• net: treat ENOTCONN as success in UnixStream::shutdown (#​8526)
• runtime: allow building with --all-features without tokio_unstable (#​8401)
• runtime: avoid overflow in shutdown_timeout() (#​8497)
• runtime: fix spawn_blocking hang when only scheduler workers exist (#​8408)
• runtime: fix misleading signal driver panic message (#​8419)
• sync: preserve FIFO lock order when coop budget is exhausted (#​8371)
• sync: use usize for permit count in SemaphorePermit (#​8405)
• time: avoid interval deadline overflow (#​8385)
• time: handle wrapped top-level timer-wheel slots (#​8334)

Unstable

• fs: fall back when io_uring has no IO driver (#​8165)
• metrics: cap log histogram precision (#​8496)
• runtime: add an opt-in sharded spawn_blocking queue (#​8337)
• runtime: expose schedule latency in task hooks (#​8282)
• taskdump: fix idle bookkeeping when a task dump wakes parked workers (#​8372)
• taskdump: skip non-idle tasks during taskdumps (#​8568)

Documented

• docs: fix stray braces and broken links in rustdoc (#​8605)
• fs: document cancellation behavior of tokio::fs (#​8265)
• net: add Safety docs for named pipe from_raw_handle (#​8378)
• net: document that TcpStream::connect returns only the last error (#​8421)
• runtime: add error documentation for runtime::Builder (#​8297)
• runtime: link available_parallelism in worker count docs (#​8625)
• sync: clarify panic behavior of broadcast::channel() (#​8420)
• sync: fix typo in Semaphore documentation (#​8521)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[jonasz-lasut]

/e2e