Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 18, 2026

Bumps the rust-dependencies group with 10 updates in the / directory:

Package From To
pyo3 0.22.6 0.27.2
lopdf 0.34.0 0.39.0
url 2.4.1 2.5.8
reqwest 0.11.27 0.12.28
rusqlite 0.30.0 0.38.0
notify 6.1.1 8.2.0
rayon 1.10.0 1.11.0
wasmtime 19.0.2 40.0.2
sysinfo 0.29.11 0.37.2
axum 0.7.9 0.8.8

Updates pyo3 from 0.22.6 to 0.27.2

Release notes

Sourced from pyo3's releases.

PyO3 0.27.2

This patch contains very minor fixes for the PyO3 0.27 series:

  • Workaround a rustc 1.92+ crash compiling PyO3 with both debug assertions and optimizations enabled.
  • Fix runtime crash when subclassing dicts on PyPy and GraalPy.

There are also a number of documentation improvements applied across the codebase.

Thank you to the following contributors for the improvements:

@​davidhewitt @​dependabot[bot] @​MusicalNinjaDad @​pkalivas @​tpoliaw @​Tpt

PyO3 0.27.1

This release fixes a clippy lint regression in PyO3 0.27.0, and exposes the PySendResult type (the return value from Bound<PyIterator>::send).

Thank you to the following contributors for the improvements:

@​alex @​davidhewitt @​reaperhulk @​tpoliaw

PyO3 0.27.0

This release is the first PyO3 release to be tested against Python 3.14.0 final. There are no significant changes to 3.14 support since PyO3 0.26 which was tested against the 3.14 release candidates.

Support for PyPy 3.9 and PyPy 3.10 (both no longer supported upstream) has been dropped.

The FromPyObject trait has been reworked in a similar fashion to the IntoPyObject trait introduced in PyO3 0.23. This has established a performant and flexible implementation of both these traits and no further changes to the traits are anticipated in the future. Thank you for the patience upgrading through these incremental improvements at the core of PyO3.

The .downcast() family of functions are now deprecated in favour of the .cast() family of functions, which are an incremental improvement to API usability and to error messages on failed conversions.

Operations on the PyCapsule type have been changed without deprecation to fix some issues with lifetimes of return values (in .name() and .reference() specifically). The capsule API now also encourages checking of capsule names, which is one of the few defences available to protect the validity of casting data read by the capsule API.

There are also many other incremental improvements, bug fixes and smaller features.

Please consult the migration guide for help upgrading.

Thank you to everyone who contributed code, documentation, design ideas, bug reports, and feedback. The following contributors' commits are included in this release:

@​alex @​altendky @​bazaah @​bschoenmaeckers @​crepererum @​davidhewitt

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.27.2] - 2025-11-30

Changed

  • Disable subclassing PyDict on GraalPy (unsupported for now, may crash at runtime). #5653

Fixed

  • Fix crash when compiling on Rust 1.92+ with both debug assertions and optimizations enabled. #5638
  • Fix FFI definition of PyDictObject on PyPy. #5653

[0.27.1] - 2025-10-21

Fixed

  • Fix clippy:declare_interior_mutable_const warning from #[pyfunction]. #5538
  • Expose pyo3::types::PySendResult in public API. #5539

[0.27.0] - 2025-10-19

Packaging

  • Extend range of supported versions of hashbrown optional dependency to include version 0.16. #5428
  • Bump optional num-bigint dependency minimum version to 0.4.4. #5471
  • Test against Python 3.14 final release. #5499
  • Drop support for PyPy 3.9 and 3.10. #5516
  • Provide a better error message when building an outdated PyO3 for a too-new Python version. #5519

Added

  • Add FromPyObjectOwned as convenient trait bound for FromPyObject when the data is not borrowed from Python. #4390
  • Add Borrowed::extract, same as PyAnyMethods::extract, but does not restrict the lifetime by deref. #4390
  • experimental-inspect: basic support for #[derive(IntoPyObject)] (no struct fields support yet). #5365
  • experimental-inspect: support #[pyo3(get, set)] and #[pyclass(get_all, set_all)]. #5370
  • Add PyTypeCheck::classinfo_object that returns an object that can be used as parameter in isinstance or issubclass. #5387
  • Implement PyTypeInfo on datetime.* types even when the limited API is enabled. #5388
  • Implement PyTypeInfo on PyIterator, PyMapping and PySequence. #5402
  • Implement PyTypeInfo on PyCode when using the stable ABI. #5403
  • Implement PyTypeInfo on PyWeakrefReference when using the stable ABI. #5404
  • Add pyo3::sync::RwLockExt trait, analogous to pyo3::sync::MutexExt for readwrite locks. #5435
  • Add PyString::from_bytes. #5437
  • Implement AsRef<[u8]> for PyBytes. #5445
  • Add CastError and CastIntoError. #5468
  • Add PyCapsuleMethods::pointer_checked and PyCapsuleMethods::is_valid_checked. #5474
  • Add Borrowed::cast, Borrowed::cast_exact and Borrowed::cast_unchecked. #5475
  • Add conversions for jiff::civil::ISOWeekDate. #5478
  • Add conversions for &Cstr, Cstring and Cow<Cstr>. #5482
  • add #[pyclass(skip_from_py_object)] option, to opt-out of the FromPyObject: PyClass + Clone blanket impl. #5488
  • Add PyErr::add_note. #5489
  • Add FromPyObject impl for Cow<Path> & Cow<OsStr>. #5497

... (truncated)

Commits
  • 117102d release: 0.27.2
  • 2b1d6c5 fix FFI definition of PyDictObject on PyPy (#5653)
  • 032d4d3 ci: add lychee cache (#5616)
  • b4f78c0 fix rumdl formatting
  • 0497d48 ci: remove old netlify build files (#5631)
  • f3d6e05 Avoid introducing generic parameter with implied bounds from an associated ty...
  • c8e6597 ci: pin mdbook to 0.4 for now, properly install mdbook-tabs (#5632)
  • 30cca7e build(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#5629)
  • bb7bb94 Update PyIterator::send docs to match behaviour (#5593)
  • 1acadc5 Add radiate to README examples section (#5561)
  • Additional commits viewable in compare view

Updates lopdf from 0.34.0 to 0.39.0

Release notes

Sourced from lopdf's releases.

0.39.0

What's Changed

Improvements

Fixes

Thanks a lot to the new contributors:

0.38.0

See CHANGELOG.md for details.

Thanks a lot to the new contributors:

0.37.0

See CHANGELOG.md for details.

Thanks a lot to the new contributors:

0.36.0

See CHANGELOG.md for details.

0.35.0

See CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from lopdf's changelog.

v0.38.0 (2025-08-26)

Add

  • Add enhanced PDF decryption support for encrypted documents with empty passwords
  • Add automatic decryption during document loading for better pdftk compatibility
  • Add raw object extraction before parsing to handle encrypted content
  • Add support for decrypting PDFs with compressed object streams
  • Add comprehensive test suite for PDF decryption functionality
  • Add assets/encrypted.pdf test file for decryption testing
  • Add examples demonstrating decryption capabilities (test_decryption.rs, verify_decryption.rs)

Enhance

  • Enhance Reader::read() to detect and handle encrypted PDFs automatically
  • Enhance document loading to attempt empty password authentication by default
  • Enhance object processing to decrypt objects after parsing
  • Enhance support for encrypted PDFs containing object streams

Fix

  • Fix encrypted object parsing by extracting raw bytes before decryption
  • Fix object stream handling in encrypted documents
  • Fix decryption workflow to match pdftk's approach

Implementation Details

  • Modified src/reader.rs to add load_encrypted_document() method
  • Added extract_raw_object() method for raw byte extraction
  • Added parse_raw_object() method for parsing extracted bytes
  • Store raw object bytes in Reader::raw_objects field for deferred decryption
  • Process compressed objects from object streams after decryption

v0.37.0 (2025-08-08)

Add

  • Add complete PDF object streams write support enabling 11-61% file size reduction (#XXX)
  • Add save_modern() method for easy object streams and cross-reference streams usage
  • Add SaveOptions struct with builder pattern for configuring compression settings
  • Add ObjectStreamBuilder for creating object streams programmatically
  • Add cross-reference stream support for PDF 1.5+ compliance
  • Add replace_partial_text() function for partial text replacement in PDFs
  • Add comprehensive test suite with 50+ tests for object streams functionality
  • Add object streams write capability (previously read-only)
  • Add implementation documentation in OBJECT_STREAMS_IMPLEMENTATION.md

... (truncated)

Commits
  • 6cd9a62 Release 0.39
  • 6ee84c3 fix conditionally compile encrypted metadata tests
  • 2391858 feat: Support encrypted PDFs in metadata extraction API
  • e6a78f6 fix test_metadata and clippy warnings
  • 2df8921 add tests
  • c7f2901 feat: Add load_metadata()
  • 6182d41 fix: Replace O(n×m) search_substring with O(n) linear algorithm
  • a2757b5 improvement: do not fail if page does not contain XObject
  • b966eac fix: allow 'length' entry to be present for V=1
  • 72ccb95 fix: Allow empty bfrange sections in CMap parsing to prevent extraction failures
  • Additional commits viewable in compare view

Updates url from 2.4.1 to 2.5.8

Release notes

Sourced from url's releases.

v2.5.7

What's Changed

v.2.5.6

v.2.5.7

New Contributors

Full Changelog: servo/rust-url@v2.5.5...v2.5.7

v2.5.5

What's Changed

New Contributors

Full Changelog: servo/rust-url@v2.5.4...v2.5.5

v2.5.4

What's Changed

... (truncated)

Commits

Updates reqwest from 0.11.27 to 0.12.28

Release notes

Sourced from reqwest's releases.

v0.12.28

What's Changed

Full Changelog: seanmonstar/reqwest@v0.12.27...v0.12.28

v0.12.27

tl;dr

  • Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Pipe.

What's Changed

Full Changelog: seanmonstar/reqwest@v0.12.26...v0.12.27

v0.12.26

tl;dr

  • Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

What's Changed

Full Changelog: seanmonstar/reqwest@v0.12.25...v0.12.26

v0.12.25

Highlights

  • Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
  • Fix sending Proxy-Authorization if only username is configured.
  • Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
  • Refactor internal decompression handling to use tower-http.

What's Changed

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.12.28

  • Fix compiling on Windows if TLS and SOCKS features are not enabled.

v0.12.27

  • Add ClientBuilder::windows_named_pipe(name) option that will force all requests over that Windows Named Piper.

v0.12.26

  • Fix sending Accept-Encoding header only with values configured with reqwest, regardless of underlying tower-http config.

v0.12.25

  • Add Error::is_upgrade() to determine if the error was from an HTTP upgrade.
  • Fix sending Proxy-Authorization if only username is configured.
  • Fix sending Proxy-Authorization to HTTPS proxies when the target is HTTP.
  • Refactor internal decompression handling to use tower-http.

v0.12.24

  • Refactor cookie handling to an internal middleware.
  • Refactor internal random generator.
  • Refactor base64 encoding to reduce a copy.
  • Documentation updates.

v0.12.23

  • Add ClientBuilder::unix_socket(path) option that will force all requests over that Unix Domain Socket.
  • Add ClientBuilder::retry(policy) and reqwest::retry::Builder to configure automatic retries.
  • Add ClientBuilder::dns_resolver2() with more ergonomic argument bounds, allowing more resolver implementations.
  • Add http3_* options to blocking::ClientBuilder.
  • Fix default TCP timeout values to enabled and faster.
  • Fix SOCKS proxies to default to port 1080
  • (wasm) Add cache methods to RequestBuilder.

v0.12.22

  • Fix socks proxies when resolving IPv6 destinations.

v0.12.21

  • Fix socks proxy to use socks4a:// instead of socks4h://.
  • Fix Error::is_timeout() to check for hyper and IO timeouts too.
  • Fix request Error to again include URLs when possible.
  • Fix socks connect error to include more context.
  • (wasm) implement Default for Body.

v0.12.20

... (truncated)

Commits

Updates rusqlite from 0.30.0 to 0.38.0

Release notes

Sourced from rusqlite's releases.

0.38.0

What's Changed

  • bump sqlcipher to 4.10.0 (sqlite 3.50.4) #1725
  • Use CARGO_CFG_TARGET_FEATURE for crt-static check #1737
  • Disable u64, usize ToSql/FromSql impl by default #1732, ##1722 (breaking change)
  • Make statement cache optional #1682, #1173 (breaking change)
  • Remove shell scripts from the published package #1744
  • Use new interfaces with 64-bit length parameters #1749
  • sqlite3_vtab_rhs_value #1753
  • Handle VTab IN values #1754
  • Give access to Connection from VTabCursor::column #1755
  • Bump minimal SQLite version to 3.34.1 #1733, #1731 (breaking change)
  • Bump bundled SQLite version to 3.51.1 #1758
  • Add support for transaction to the vtab module #1761
  • Check Connection is owned when registering Closure as hook #1764 (breaking change)
  • Turn libsqlite3-sys in a !#[no_std] crate #1767
  • Add wasm32-unknown-unknown support #1769, #488, #827
  • Remove useless Send/Sync on Module #1774

Full Changelog: rusqlite/rusqlite@v0.37.0...v0.38.0

0.37.0

What's Changed

  • Add FromSqlError::other convenience conversion #1703
  • Fix warnings #1705
  • Update bindgen requirement from 0.71 to 0.72 #1707
  • Fix for vtab::parameter parsing #1712
  • Fix clippy warning #1713
  • Bump bundled SQLite version to 3.50.2 #1714
  • Fix issue with prettyplease #1717

Full Changelog: rusqlite/rusqlite@v0.36.0...v0.37.0

0.36.0

What's Changed

  • Introduce Name trait to support both &str and &CStr as name #1659
  • Use doc_auto_cfg #1683
  • Feature loadable_extension is incompatible with some other features #1686
  • Add missing wrappers for sqlite3_vtab_nochange and sqlite3_value_nochange #1688
  • Update bindings list #1689
  • Homogenize code related to hooks #1690
  • Try to increase code coverage #1610
  • Bump bundled SQLite version to 3.49.2 #1691
  • Add bindings to sqlite3_table_column_metadata #1692
  • Add bindings to sqlite3_vtab_distinct #1695
  • Fix clippy warning #1697
  • Add query_one #1699
  • Refactor one_column test method #1700

Full Changelog: rusqlite/rusqlite@v0.35.0...v0.36.0

... (truncated)

Commits

Updates notify from 6.1.1 to 8.2.0

Release notes

Sourced from notify's releases.

notify-8.2.0

notify 8.2.0 (2025-08-03)

  • FEATURE: notify user if inotify's max_user_watches has been reached #698
  • FIX: INotifyWatcher ignore events with unknown watch descriptors (instead of EventMask::Q_OVERFLOW) #700

#698: notify-rs/notify#698 #700: notify-rs/notify#700

debouncer-full 0.6.0 (2025-08-03)

  • FEATURE: allow FileIdCache trait implementations to choose ownership of the returned file-ids #664
  • FEATURE: added support for the flume crate #680
  • FIX: skip all Modify events right after a Create event, unless it's a rename event #701

#664: notify-rs/notify#664 #680: notify-rs/notify#680 #701: notify-rs/notify#701

debouncer-mini 0.7.0 (2025-08-03)

  • FEATURE: added support for the flume crate #680

file-id 0.2.3 (2025-08-03)

  • CHANGE: implement AsRef<FileId> for FileId #664

Full Changelog: notify-rs/notify@notify-8.1.0...notify-8.2.0

notify v8.1.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from notify's changelog.

notify 8.2.0 (2025-08-03)

  • FEATURE: notify user if inotify's max_user_watches has been reached #698
  • FIX: INotifyWatcher ignore events with unknown watch descriptors (instead of EventMask::Q_OVERFLOW) #700

#698: notify-rs/notify#698 #700: notify-rs/notify#700

debouncer-full 0.6.0 (2025-08-03)

  • FEATURE: allow FileIdCache trait implementations to choose ownership of the returned file-ids #664
  • FEATURE: added support for the flume crate #680
  • FIX: skip all Modify events right after a Create event, unless it's a rename event #701

#664: notify-rs/notify#664 #680: notify-rs/notify#680 #701: notify-rs/notify#701

debouncer-mini 0.7.0 (2025-08-03)

  • FEATURE: added support for the flume crate #680

file-id 0.2.3 (2025-08-03)

  • CHANGE: implement AsRef<FileId> for FileId #664

notify 8.1.0 (2025-07-03)

  • FEATURE: added support for the flume crate
  • FIX: kqueue-backend: do not double unwatch top-level directory when recursively unwatching #683
  • FIX: Return the crate error PathNotFound instead bubbling up the std::io error #685
  • FIX: fix server hangs when trashing folders on Windows #674

notify 8.0.0 (2025-01-10)

  • CHANGE: update notify-types to version 2.0.0
  • CHANGE: raise MSRV to 1.77 breaking
  • FEATURE: add config option to disable following symbolic links #635
  • FIX: unaligned access to FILE_NOTIFY_INFORMATION #647 breaking

#635: notify-rs/notify#635 #647: notify-rs/notify#647

notify-types 2.0.0 (2025-01-10)

  • CHANGE: replace instant crate with web-time #652 breaking
  • CHANGE: the web-time dependency is now behind the web-time feature breaking

#652: notify-rs/notify#652

debouncer-mini 0.6.0 (2025-01-10)

  • CHANGE: update notify to version 8.0.0

debouncer-full 0.5.0 (2025-01-10)

... (truncated)

Commits

…10 updates

Bumps the rust-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pyo3](https://github.com/pyo3/pyo3) | `0.22.6` | `0.27.2` |
| [lopdf](https://github.com/J-F-Liu/lopdf) | `0.34.0` | `0.39.0` |
| [url](https://github.com/servo/rust-url) | `2.4.1` | `2.5.8` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.11.27` | `0.12.28` |
| [rusqlite](https://github.com/rusqlite/rusqlite) | `0.30.0` | `0.38.0` |
| [notify](https://github.com/notify-rs/notify) | `6.1.1` | `8.2.0` |
| [rayon](https://github.com/rayon-rs/rayon) | `1.10.0` | `1.11.0` |
| [wasmtime](https://github.com/bytecodealliance/wasmtime) | `19.0.2` | `40.0.2` |
| [sysinfo](https://github.com/GuillaumeGomez/sysinfo) | `0.29.11` | `0.37.2` |
| [axum](https://github.com/tokio-rs/axum) | `0.7.9` | `0.8.8` |



Updates `pyo3` from 0.22.6 to 0.27.2
- [Release notes](https://github.com/pyo3/pyo3/releases)
- [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md)
- [Commits](PyO3/pyo3@v0.22.6...v0.27.2)

Updates `lopdf` from 0.34.0 to 0.39.0
- [Release notes](https://github.com/J-F-Liu/lopdf/releases)
- [Changelog](https://github.com/J-F-Liu/lopdf/blob/main/CHANGELOG.md)
- [Commits](J-F-Liu/lopdf@v0.34.0...v0.39.0)

Updates `url` from 2.4.1 to 2.5.8
- [Release notes](https://github.com/servo/rust-url/releases)
- [Commits](servo/rust-url@v2.4.1...v2.5.8)

Updates `reqwest` from 0.11.27 to 0.12.28
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.11.27...v0.12.28)

Updates `rusqlite` from 0.30.0 to 0.38.0
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](rusqlite/rusqlite@v0.30.0...v0.38.0)

Updates `notify` from 6.1.1 to 8.2.0
- [Release notes](https://github.com/notify-rs/notify/releases)
- [Changelog](https://github.com/notify-rs/notify/blob/main/CHANGELOG.md)
- [Commits](notify-rs/notify@notify-6.1.1...notify-8.2.0)

Updates `rayon` from 1.10.0 to 1.11.0
- [Changelog](https://github.com/rayon-rs/rayon/blob/main/RELEASES.md)
- [Commits](rayon-rs/rayon@rayon-core-v1.10.0...rayon-core-v1.11.0)

Updates `wasmtime` from 19.0.2 to 40.0.2
- [Release notes](https://github.com/bytecodealliance/wasmtime/releases)
- [Changelog](https://github.com/bytecodealliance/wasmtime/blob/v40.0.2/RELEASES.md)
- [Commits](bytecodealliance/wasmtime@v19.0.2...v40.0.2)

Updates `sysinfo` from 0.29.11 to 0.37.2
- [Changelog](https://github.com/GuillaumeGomez/sysinfo/blob/main/CHANGELOG.md)
- [Commits](GuillaumeGomez/sysinfo@v0.29.11...v0.37.2)

Updates `axum` from 0.7.9 to 0.8.8
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.8)

---
updated-dependencies:
- dependency-name: pyo3
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: lopdf
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: url
  dependency-version: 2.5.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: reqwest
  dependency-version: 0.12.28
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rusqlite
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: notify
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: rayon
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: wasmtime
  dependency-version: 40.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: sysinfo
  dependency-version: 0.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: axum
  dependency-version: 0.8.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 18, 2026

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot requested a review from Lenvanderhof as a code owner January 18, 2026 15:45
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 19, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Jan 19, 2026
@dependabot dependabot bot deleted the dependabot/cargo/rust-dependencies-670ae517e1 branch January 19, 2026 20:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant