Skip to content

chore(deps): bump the rust-dependencies group in /src-tauri with 15 updates#50

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/src-tauri/rust-dependencies-f5b2e840df
Closed

chore(deps): bump the rust-dependencies group in /src-tauri with 15 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/src-tauri/rust-dependencies-f5b2e840df

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the rust-dependencies group in /src-tauri with 15 updates:

Package From To
tauri 2.11.2 2.11.5
serde_json 1.0.149 1.0.151
serde 1.0.228 1.0.229
log 0.4.32 0.4.33
tauri-plugin-log 2.8.0 2.9.0
sha2 0.10.9 0.11.0
rand 0.9.3 0.10.2
rand_distr 0.5.1 0.6.0
tokio 1.50.0 1.53.1
tokio-tungstenite 0.29.0 0.30.0
futures-util 0.3.32 0.3.33
candle-core 0.9.2 0.11.0
candle-nn 0.9.2 0.11.0
safetensors 0.6.2 0.8.0
tauri-build 2.6.2 2.6.3

Updates tauri from 2.11.2 to 2.11.5

Release notes

Sourced from tauri's releases.

tauri v2.11.5

Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1146 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1085 crate dependencies)
Crate:     atk
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0413
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0413

Crate:     atk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0416

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0416


Crate:     fxhash

Version:   0.2.1

Warning:   unmaintained

Title:     fxhash - no longer maintained

Date:      2025-09-05

ID:        RUSTSEC-2025-0057

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057


Crate:     gdk

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0412

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0412


Crate:     gdk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0418

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0418


Crate:     gdkwayland-sys

</tr></table>

... (truncated)

Commits

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

v1.0.150

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates log from 0.4.32 to 0.4.33

Changelog

Sourced from log's changelog.

[0.4.33] - 2026-06-20

What's Changed

New Contributors

Full Changelog: rust-lang/log@0.4.32...0.4.33

Commits
  • f405739 Merge pull request #734 from rust-lang/cargo/0.4.33
  • 6a24abf prepare for 0.4.33 release
  • 87e0621 Merge pull request #732 from matteo-zeggiotti-ok/fix-key-comparison
  • a9b5711 Review: fallback to the &str hash
  • cc89cc6 Review: fixed other comparisons
  • 920e7dc Review: fixed comparison on MaybeStaticStr
  • 0d71d3c Fixed key comparison
  • See full diff in compare view

Updates tauri-plugin-log from 2.8.0 to 2.9.0

Release notes

Sourced from tauri-plugin-log's releases.

log-js v2.9.0

[2.9.0]

  • f08980f1 (#3445 by @​bajoca05) Added the FileOpenStrategy for log rotation. It defaults to append into existing file if any (previous behaviour), and brings a new feature to create a new file per session: FileOpenStrategy::Rotate.
  • 254f222e (#3477 by @​bajoca05) Migrated from the log crate's kv_unstable feature flag to the kv feature flag stabilized in 0.4.21.
  • 0c23b8ec (#3446 by @​fee1-dead) Removed an unused dependency byte-unit.
npm warn Unknown user config "always-auth". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-log@2.9.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.8kB README.md
npm notice 7.0kB dist-js/index.cjs
npm notice 3.0kB dist-js/index.d.ts
npm notice 6.7kB dist-js/index.js
npm notice 715B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-log
npm notice version: 2.9.0
npm notice filename: tauri-apps-plugin-log-2.9.0.tgz
npm notice package size: 5.0 kB
npm notice unpacked size: 22.1 kB
npm notice shasum: 47faedfef55b09adae53c90555c6e103f6fd49b6
npm notice integrity: sha512-Ql8okrnsguk0e[...]3IFIAP+wP5qSw==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2165401997
+ @tauri-apps/plugin-log@2.9.0

log v2.9.0

[2.9.0]

  • f08980f1 (#3445 by @​bajoca05) Added the FileOpenStrategy for log rotation. It defaults to append into existing file if any (previous behaviour), and brings a new feature to create a new file per session: FileOpenStrategy::Rotate.
  • 254f222e (#3477 by @​bajoca05) Migrated from the log crate's kv_unstable feature flag to the kv feature flag stabilized in 0.4.21.
  • 0c23b8ec (#3446 by @​fee1-dead) Removed an unused dependency byte-unit.

... (truncated)

Commits
  • cad301f publish new versions (#3447)
  • 254f222 chore(log): use kv stable feature rather than unstable (#3477)
  • b1439be chore: ignore cargo audit errors (#3481)
  • d157387 fix(single-instance): Yield unix listener in macos (#3466)
  • 41f6274 docs(log): some builder methods and defaults (#3460)
  • f08980f feat(log): rotate log file on each session (#3445)
  • 78df86f chore(deps): update dependency vite to v8.0.16 [security] (#3458)
  • aecec42 docs(http): fix connectTimeout option in README (#3451)
  • 0767dcb chore(deps): update dependency eslint-plugin-security to v4.0.1 (#3452)
  • 4be7690 fix(positioner): return error instead of panicking when window has no monitor...
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates rand from 0.9.3 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates rand_distr from 0.5.1 to 0.6.0

Changelog

Sourced from rand_distr's changelog.

[0.6.0] — 2026-02-10

  • Bump to MSRV 1.85.0 and Edition 2024 in line with rand (#28)
  • Update rand to version 0.10.0 (#31, #48)

Additions

  • MultiDistribution trait to sample more efficiently from multi-dimensional distributions (#18)
  • Add WeightedAliasIndex::weights() to reconstruct the original weights in O(n) (#25)
  • ConstMultiDistribution trait as support for fixed-dimension distributions (#29)

Changes

  • Moved Dirichlet into the new multi module and implement MultiDistribution for it (#18)
  • Dirichlet no longer uses const generics, which means that its size is not required at compile time. Essentially a revert of [rand#1292]. (#30)

Fixes

  • Fix Geometric::new for small p > 0 where 1 - p rounds to 1 (#36)
  • Use direct-minimal-versions (#38)
  • Fix panic in FisherF::new on almost zero parameters (#39)
  • Fix panic in NormalInverseGaussian::new with very large alpha; this is a Value-breaking change (#40)
  • Fix hang and debug assertion in Zipf::new on invalid parameters (#41)
  • Fix panic in Binomial::sample with n ≥ 2^63; this is a Value-breaking change (#43)
  • Error instead of producing -inf output for Exp when lambda is -0.0 (#44)
  • Avoid returning NaN from Gamma::sample; this is a Value-breaking change and also affects ChiSquared and Dirichlet (#46)
Commits
  • 61d08aa Update rand 0.10 (#50)
  • c97a8f5 Merge pull request #46 from mstoeckl/gamma-avoid-nan
  • df52389 Merge pull request #51 from rust-random/push-qyyzynmpkuuo
  • 35ecffe CHANGELOG fixes
  • 06f586e Merge pull request #48 from mstoeckl/update-rand
  • 7540326 Merge pull request #49 from rust-random/push-kzzruutkmsxs
  • a101e4e Add PR links to the CHANGELOG
  • df2bae8 Update rand dependency to latest rc
  • be28239 Merge pull request #41 from mstoeckl/zipf-edge-case
  • 9a8000b Avoid hangs and debug asserts on invalid parameters for Zipf
  • Additional commits viewable in compare view

Updates tokio from 1.50.0 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

  • signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

  • time: fix alt timer cancellation and insertion race (#8252)

Documented

  • runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

Updates tokio-tungstenite from 0.29.0 to 0.30.0

Changelog

Sourced from tokio-tungstenite's changelog.

0.30.0

Commits

Updates futures-util from 0.3.32 to 0.3.33

Release notes

Sourced from futures-util's releases.

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures-util's changelog.

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits
  • 89cc254 Release 0.3.33
  • cd9f5be ci: Update release workflow
  • d79a499 Resolve rustdoc::broken_intra_doc_links warning
  • 95bbcf8 Resolve rustdoc ambiguous link error
  • 303c165 Resolve rustdoc::redundant_explicit_links warning
  • f34e3f5 ci: Cleanup
  • 66591a2 Enable Miri for more tests
  • ab1072f Simplify target_has_atomic cfg in utility crates
  • cf5d23b Fix unsound compat01as03 implementation (fixes #2514) (#3012)
  • 8ae794f Add portable-atomic-alloc feature and use it in FuturesUnordered (#3007)
  • Additional commits viewable in compare view

Updates candle-core from 0.9.2 to 0.11.0

Commits

Updates candle-nn from 0.9.2 to 0.11.0

Commits

Updates safetensors from 0.6.2 to 0.8.0

Release notes

Sourced from safetensors's releases.

v0.8.0

News

safetensors joins the PyTorch foundation!

Read more on that: https://huggingface.co/blog/safetensors-joins-pytorch-foundation

What's changed

Safetensors 0.8.0 brings direct to Metal loading on Apple Silicon, GIL-free serialization, broader hardware and dtype coverage, and a stronger Python API.

Breaking

The serialize and serialize_file functions now release the GIL during writes, enabling true multithreaded saves from Python. Their input contract has also changed: tensor metadata is now passed via a TensorSpec class (exported from safetensors) instead of plain dicts, making API more explicit and robust to misinputs. This is a breaking change for anyone calling the low-level serialize / serialize_file API directly; the high-level wrappers (safetensors.torch, safetensors.numpy, safetensors.paddle) are updated internally and their public API is unchanged.

The minimum supported Python version is now 3.10 (was 3.9). Python 3.9 reached end-of-life in October 2025.

TensorIndexer::Narrow now carries a step: NonZeroUsize parameter, so a slice is now start:stop:step. This is a fix as this silent error was hidden behind the Storage::Torch variant which offloaded slicing logic to torch directly.

CI

On the platform side, this release adds Windows ARM64 wheel builds, riscv64 Linux wheels, and CI has been hardened with pinned GitHub Actions SHAs.

Also dropped the anaconda CI we had as there's already an automatic tracker via conda-forge.

New features

  • Direct MPS load on Apple Silicon: tensors are directly loaded in an MTLBuffer and handed to the frameworks that support it (only torch atm) via DLPack, skipping needless copies.
  • New backend parameter introduced, for the addition of the pread backend. We now support loading files via pread(2) syscall instead of just mmap. Useful for specific archs/platforms.
  • get_slice now handles ellipsis [...] and strided slices [:, ::8] wherever safetensors does the slicing itself (pread for any framework, MPS, and mmap outside torch/paddle), which silently dropped the step or rejected ... before.
  • MUSA device support for MooreThreads GPUs.
  • New dtype support includes float8_e4m3fnuz and float8_e5m2fnuz (AMD FNUZ FP8 formats).
  • The reader is now explicitly lenient about leading whitespace in the JSON header, which keeps the door open for future page-aligned writes.

Improvements/perf

  • File writes on macOS now use F_NOCACHE for direct I/O, yielding roughly 30% faster save_file on Apple Silicon.
  • The packaging dependency has been dropped from the [torch] extra, replaced by a simple hasattr probe for efficiency.

What's Changed

... (truncated)

Changelog

Sourced from safetensors's changelog.

0.8.0-dev.0 → 0.8.0


Update lockfiles again:

cargo check
cd bindings/python &amp;&amp; uv lock
</code></pre>
<p>Commit:</p>
<pre><code>Set version to 0.8.0
</code></pre>
<p>The Python version is not set in <code>pyproject.toml</code> directly — maturin reads it from <code>bindings/python/Cargo.toml</code> at build time.</p>
<h3>4. Create the release on GitHub</h3>
<p>Go to the <a href="https://github.com/huggingface/safetensors/releases">GitHub Releases page</a> and draft a new release:</p>
<ul>
<li><strong>Choose the release branch</strong> (e.g. <code>git_v0.8.0</code>)</li>
<li><strong>Create a new tag</strong> on publish: <code>v0.8.0</code></li>
<li><strong>Generate release notes</strong> from the previous tag (e.g. <code>v0.7.0</code>)</li>
<li>Add any notable highlights at the top of the generated notes</li>
</ul>
<p>Structure for manual notes:</p>
<pre lang="markdown"><code>## Breaking changes
- ...

New features


    

  • ...
    • 



Bug fixes


    

  • ...
    • 



Internal / CI


    

  • ...
    
</code></pre>
    
<p>Click <strong>Publish release</strong>. This creates the tag, which triggers the three release workflows.</p>
    
<h3>5. Monitor the CI</h3>
    
<p>The tag triggers two workflow runs in the <a href="https://github.com/huggingface/safetensors/actions&quot;&gt;Actions tab</a>:</p>
    
<ul>
    
<li><strong>CI</strong> (Python release) — builds wheels for every platform × Python version, uploads to PyPI. Can take up to over 30 minutes.</li>
    
</ul>
    
<!-- raw HTML omitted -->
    
</blockquote>
    
<p>... (truncated)</p>
    
</details>
    
<details>
    
<summary>Commits</summary>
    • 



<ul>

<li><a href="https://github.com/safetensors/safetensors/commit/a406ca3e7a90598be0cd05a50069cb9bf5ef6ba6&quot;&gt;&lt;code&gt;a406ca3&lt;/code&gt;&lt;/a> fix(release): move crates.io to trusted publisher OIDC</li>

<li><a href="https://github.com/safetensors/safetensors/commit/d0368d14c0a417fb2ca2a6627e9513d17f74f9b7&quot;&gt;&lt;code&gt;d0368d1&lt;/code&gt;&lt;/a> feat: <code>0.8.0</code></li>

<li><a href="https://github.com/safetensors/safetensors/commit/5ec3ec14c506d09598df6d96f36cd9a4ea94aafa&quot;&gt;&lt;code&gt;5ec3ec1&lt;/code&gt;&lt;/a> fix(release): move to pypi trusted publisher OIDC (<a href="https://redirect.github.com/huggingface/safetensors/issues/778&quot;&gt;#778&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/e37dc536ce598ef1d71a9ad712987571f2f05808&quot;&gt;&lt;code&gt;e37dc53&lt;/code&gt;&lt;/a> feat: bump main to <code>0.9.0-dev.0</code> (<a href="https://redirect.github.com/huggingface/safetensors/issues/777&quot;&gt;#777&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/6e32aa7b029d323238233110c1cdecae22cbe564&quot;&gt;&lt;code&gt;6e32aa7&lt;/code&gt;&lt;/a> refactor: replace <code>_host_alias_storage</code> w/ <code>MTLBuffer</code> (<a href="https://redirect.github.com/huggingface/safetensors/issues/767&quot;&gt;#767&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/24b0b2857fef49be734b9ab72ce97c09bb25f5b9&quot;&gt;&lt;code&gt;24b0b28&lt;/code&gt;&lt;/a> fix: write to tempfile + rename to preserve mmap source (<a href="https://redirect.github.com/huggingface/safetensors/issues/764&quot;&gt;#764&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/73132135947275c5dda135438e4c2e4bd70a2b10&quot;&gt;&lt;code&gt;7313213&lt;/code&gt;&lt;/a> Update free-threading tests for Python 3.14 (<a href="https://redirect.github.com/huggingface/safetensors/issues/699&quot;&gt;#699&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/e9091e13ec359e9e5b8b45413fcbe340444dde1c&quot;&gt;&lt;code&gt;e9091e1&lt;/code&gt;&lt;/a> feat: add <code>backend</code> with pread file (<a href="https://redirect.github.com/huggingface/safetensors/issues/760&quot;&gt;#760&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/1b0fe9c6acf3ac2ec7f4a0fd13bccfc0b65ce765&quot;&gt;&lt;code&gt;1b0fe9c&lt;/code&gt;&lt;/a> fix(ci): security audit slack message format (<a href="https://redirect.github.com/huggingface/safetensors/issues/757&quot;&gt;#757&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/safetensors/safetensors/commit/7efac22872a53ae3b30a15f8e786404322f10458&quot;&gt;&lt;code&gt;7efac22&lt;/code&gt;&lt;/a> [MPS] Fast load of the tensors (<a href="https://redirect.github.com/huggingface/safetensors/issues/756&quot;&gt;#756&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/huggingface/safetensors/compare/v0.6.2...v0.8.0&quot;&gt;compare view</a></li>

</ul>

</details>


<br />


Updates tauri-build from 2.6.2 to 2.6.3



Release notes

Sourced from tauri-build's releases.




tauri-build v2.6.3



Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 1133 security advisories (from /home/runner/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (1085 crate dependencies)
Crate:     atk
Version:   0.18.2
Warning:   unmaintained
Title:     gtk-rs GTK3 bindings - no longer maintained
Date:      2024-03-04
ID:        RUSTSEC-2024-0413
URL:       https://rustsec.org/advisories/RUSTSEC-2024-0413

Crate:     atk-sys

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintained

Date:      2024-03-04

ID:        RUSTSEC-2024-0416

URL:       https://rustsec.org/advisories/RUSTSEC-2024-0416


Crate:     fxhash

Version:   0.2.1

Warning:   unmaintained

Title:     fxhash - no longer maintained

Date:      2025-09-05

ID:        RUSTSEC-2025-0057

URL:       https://rustsec.org/advisories/RUSTSEC-2025-0057


Crate:     gdk

Version:   0.18.2

Warning:   unmaintained

Title:     gtk-rs GTK3 bindings - no longer maintainedDescription has been truncated

@dependabot
chore(deps): bump the rust-dependencies group
0bd4a86 
Bumps the rust-dependencies group in /src-tauri with 15 updates:

| Package | From | To |
| --- | --- | --- |
| [tauri](https://github.com/tauri-apps/tauri) | `2.11.2` | `2.11.5` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.151` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [log](https://github.com/rust-lang/log) | `0.4.32` | `0.4.33` |
| [tauri-plugin-log](https://github.com/tauri-apps/plugins-workspace) | `2.8.0` | `2.9.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [rand](https://github.com/rust-random/rand) | `0.9.3` | `0.10.2` |
| [rand_distr](https://github.com/rust-random/rand_distr) | `0.5.1` | `0.6.0` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.50.0` | `1.53.1` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.29.0` | `0.30.0` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.33` |
| [candle-core](https://github.com/huggingface/candle) | `0.9.2` | `0.11.0` |
| [candle-nn](https://github.com/huggingface/candle) | `0.9.2` | `0.11.0` |
| [safetensors](https://github.com/huggingface/safetensors) | `0.6.2` | `0.8.0` |
| [tauri-build](https://github.com/tauri-apps/tauri) | `2.6.2` | `2.6.3` |


Updates `tauri` from 2.11.2 to 2.11.5
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](tauri-apps/tauri@tauri-v2.11.2...tauri-v2.11.5)

Updates `serde_json` from 1.0.149 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.149...v1.0.151)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `log` from 0.4.32 to 0.4.33
- [Release notes](https://github.com/rust-lang/log/releases)
- [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md)
- [Commits](rust-lang/log@0.4.32...0.4.33)

Updates `tauri-plugin-log` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@log-v2.8.0...log-v2.9.0)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `rand` from 0.9.3 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.9.3...0.10.2)

Updates `rand_distr` from 0.5.1 to 0.6.0
- [Release notes](https://github.com/rust-random/rand_distr/releases)
- [Changelog](https://github.com/rust-random/rand_distr/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand_distr@0.5.1...0.6.0)

Updates `tokio` from 1.50.0 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.53.1)

Updates `tokio-tungstenite` from 0.29.0 to 0.30.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.29.0...v0.30.0)

Updates `futures-util` from 0.3.32 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.33)

Updates `candle-core` from 0.9.2 to 0.11.0
- [Changelog](https://github.com/huggingface/candle/blob/main/CHANGELOG.md)
- [Commits](https://github.com/huggingface/candle/commits/0.11.0)

Updates `candle-nn` from 0.9.2 to 0.11.0
- [Changelog](https://github.com/huggingface/candle/blob/main/CHANGELOG.md)
- [Commits](https://github.com/huggingface/candle/commits/0.11.0)

Updates `safetensors` from 0.6.2 to 0.8.0
- [Release notes](https://github.com/huggingface/safetensors/releases)
- [Changelog](https://github.com/safetensors/safetensors/blob/main/RELEASE.md)
- [Commits](safetensors/safetensors@v0.6.2...v0.8.0)

Updates `tauri-build` from 2.6.2 to 2.6.3
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](tauri-apps/tauri@tauri-build-v2.6.2...tauri-build-v2.6.3)

---
updated-dependencies:
- dependency-name: tauri
  dependency-version: 2.11.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: log
  dependency-version: 0.4.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tauri-plugin-log
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rand_distr
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: tokio-tungstenite
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: futures-util
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: candle-core
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: candle-nn
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: safetensors
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: tauri-build
  dependency-version: 2.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 21, 2026
@dependabot
dependabot Bot requested a review from sepahead as a code owner July 21, 2026 00:00
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 21, 2026
@sepahead

sepahead commented Jul 24, 2026

Copy link
Copy Markdown
Owner

Main now contains the compatible Rust updates, including sha2 0.11, rand 0.10, rand_distr 0.6, tokio-tungstenite 0.30, the refreshed lockfile, and the required API compatibility fixes. Candle and safetensors remain on 0.9 and 0.6 because Candle 0.11 requires unstable ARM f16 features on the pinned stable Rust 1.91.1 toolchain. Default and NCP all-target tests, strict Clippy, and cargo-deny pass. Closing as superseded by validated main.

@sepahead sepahead closed this Jul 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/src-tauri/rust-dependencies-f5b2e840df branch July 24, 2026 18:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sepahead sepahead Awaiting requested review from sepahead sepahead is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sepahead