chore(deps): bump the cargo group across 1 directory with 6 updates

[dependabot]

Bumps the cargo group with 6 updates in the / directory:

Package	From	To
rustls	0.23.40	0.23.41
clap_complete	4.6.5	4.6.7
console	0.16.3	0.16.4
quick-xml	0.40.1	0.41.0
anyhow	1.0.102	1.0.103
cc	1.2.63	1.2.66

Updates rustls from 0.23.40 to 0.23.41

Commits

• 642a103 ci: drop Taplo job
• 752c144 Drop nightly clippy tests
• 8d8611a Fix new clippy::useless-borrows-in-formatting
• ebf3297 Fix new clippy::manual_clear
• 46808e7 ci: sync cargo-check-external-types nightly
• 041a8d2 Cargo deny: allow RUSTSEC-2026-0173
• 62e220e Take semver-compatible dependency updates
• 3c14696 Upgrade to hickory-resolver 0.26
• 848a2cc connect-tests: delete ech.rs
• 5ce9cac Bump version to 0.23.41
• Additional commits viewable in compare view

Updates clap_complete from 4.6.5 to 4.6.7

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates console from 0.16.3 to 0.16.4

Release notes

Sourced from console's releases.

0.16.4

What's Changed

• chore: Remove redudant helper and add TermInner constructors by @​ChrisDenton in console-rs/console#284
• Style::from_dotted_str ignore non-ascii by @​danjl1100 in console-rs/console#287
• feat: add is_dumb public function by @​ugur-eren in console-rs/console#290

Commits

• 598eca9 Bump version to 0.16.4
• 0f22c35 feat: add is_dumb public function
• 1426649 Bump actions/checkout from 3 to 7
• d2d89ad ignore non-ascii input in Style::from_dotted_str
• 6cff3e0 document current panic in Style::from_dotted_str via test cases
• dd4334f Apply suggestions from clippy 1.95
• 586efad Remove redundant as_handle helper
• be20e85 Add TermInner::new constructors
• See full diff in compare view

Updates quick-xml from 0.40.1 to 0.41.0

Release notes

Sourced from quick-xml's releases.

v0.41.0 - Secuirity fixes

What's Changed

New Features

• #970: Add NsReader::resolver_mut() and NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.

Bug Fixes

• #969: Attributes (and anything that iterates BytesStart::attributes() with the default with_checks(true)) no longer takes O(N²) time on a start tag with a large number of attributes. Small tags keep the previous linear scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
• #970: NamespaceResolver::push (and hence every NsReader Start/Empty event) now rejects a start tag that declares more than DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace bindings, returning the new NamespaceError::TooManyDeclarations. Previously push allocated one NamespaceBinding per declaration with no upper bound, before the event was returned to the caller, so an NsReader consumer could not bound its memory exposure on untrusted input. The limit is configurable via NamespaceResolver::set_max_declarations_per_element (use usize::MAX to disable).

#969: tafia/quick-xml#969 #970: tafia/quick-xml#970

New Contributors

• @​qifan-sailboat made their first contribution in tafia/quick-xml#972

Full Changelog: tafia/quick-xml@v0.40.1...v0.41.0

Changelog

Sourced from quick-xml's changelog.

0.41.0 -- 2026-06-29

New Features

• #970: Add NsReader::resolver_mut() and NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.

Bug Fixes

• #969: Attributes (and anything that iterates BytesStart::attributes() with the default with_checks(true)) no longer takes O(N²) time on a start tag with a large number of attributes. Small tags keep the previous linear scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
• #970: NamespaceResolver::push (and hence every NsReader Start/Empty event) now rejects a start tag that declares more than DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace bindings, returning the new NamespaceError::TooManyDeclarations. Previously push allocated one NamespaceBinding per declaration with no upper bound, before the event was returned to the caller, so an NsReader consumer could not bound its memory exposure on untrusted input. The limit is configurable via NamespaceResolver::set_max_declarations_per_element (use usize::MAX to disable).

#969: tafia/quick-xml#969 #970: tafia/quick-xml#970

Commits

• 4deda08 Release 0.41.0
• 1b3b73b Remove unused argument to check!
• 07f3db8 Fix O(N²) duplicate-attribute check in Attributes iterator
• 7ca2526 Cap namespace declarations per element in NamespaceResolver::push
• See full diff in compare view

Updates anyhow from 1.0.102 to 1.0.103

Release notes

Sourced from anyhow's releases.

1.0.103

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

Commits

• 5bdb0e2 Release 1.0.103
• e621bd3 Merge pull request #452 from dtolnay/downcast
• 6e8c000 Eliminate pointer->reference->pointer during downcast
• 67c4abd Add regression test for issue 451
• 917a169 Update actions/upload-artifact@v6 -> v7
• d9dc3fa Update actions/checkout@v6 -> v7
• 841522b Raise minimum tested compiler to rust 1.85
• See full diff in compare view

Updates cc from 1.2.63 to 1.2.66

Release notes

Sourced from cc's releases.

cc-v1.2.66

Other

• Fix target parsing for aarch64-unknown-linux-pauthtest (#1779)
• Support new QNX targets (#1775)
• Add kache to the supported compiler wrappers (#1770)

cc-v1.2.65

Other

• Regenerate target info (#1763)

cc-v1.2.64

Other

• Add more bare-metal 32-bit Arm support (#1753)
• Remove unnecessary clone (#1748)
• Add default compiler prefixes for thumbv7a/thumbv7r/thumbv8r bare-metal targets (#1742)

Changelog

Sourced from cc's changelog.

1.2.66 - 2026-07-05

Other

• Fix target parsing for aarch64-unknown-linux-pauthtest (#1779)
• Support new QNX targets (#1775)
• Add kache to the supported compiler wrappers (#1770)

1.2.65 - 2026-06-19

Other

• Regenerate target info (#1763)

1.2.64 - 2026-06-12

Other

• Add more bare-metal 32-bit Arm support (#1753)
• Remove unnecessary clone (#1748)
• Add default compiler prefixes for thumbv7a/thumbv7r/thumbv8r bare-metal targets (#1742)

Commits

• 9c53ddc chore(cc): release v1.2.66 (#1777)
• f2836c0 Fix target parsing (#1779)
• 3299691 ci(test-wasm): do not download pre release of wasi-sdk (#1778)
• bfd1ac9 Support new QNX targets (#1775)
• 1887a73 Add kache to the supported compiler wrappers (#1770)
• e4847e1 Bump actions/checkout from 6.0.3 to 7.0.0 (#1767)
• 640c66a chore(cc): release v1.2.65 (#1764)
• 26e1972 Regenerate target info (#1763)
• 9858eb8 Bump taiki-e/install-action from 2.77.6 to 2.81.8 (#1758)
• 3bcc923 Bump release-plz/action from 0.5.129 to 0.5.130 (#1759)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.