build(deps): bump the cargo group across 1 directory with 5 updates

[dependabot]

Bumps the cargo group with 5 updates in the / directory:

Package	From	To
clap	4.5.40	4.5.41
quick-xml	0.37.5	0.38.0
reqwest	0.12.20	0.12.22
tokio	1.45.1	1.46.1
napi-build	2.2.1	2.2.2

Updates clap from 4.5.40 to 4.5.41

Changelog

Sourced from clap's changelog.

[4.5.41] - 2025-07-09

Features

• Add Styles::context and Styles::context_value to customize the styling of [default: value] like notes in the --help

Commits

• 92fcd83 chore: Release
• aca91b9 docs: Update changelog
• 8434510 Merge pull request #5869 from tw4452852/patch-1
• 33b1fc3 fix(complete): Fix env leakage in elvish dynamic completion
• e5f1f48 chore: Release
• 9466a55 docs: Update changelog
• d74b793 Merge pull request #5865 from gifnksm/nushell-completion-value-types
• ecbc775 fix(nu): Set argument type based on ValueHint
• 6784054 Merge pull request #5857 from epage/empty
• cca5f32 test(complete): Show empty option-value behavior
• Additional commits viewable in compare view

Updates quick-xml from 0.37.5 to 0.38.0

Changelog

Sourced from quick-xml's changelog.

0.38.0 -- 2025-06-28

Significant changes

Now references to entities (as predefined, such as <, as user-defined) reported as a new Event::GeneralRef. Caller can parse the content of the entity and stream events from it as it is required by the XML specification. See the updated custom_entities example!

Implement whitespace behavior in the standard in Deserializer, which says string primitive types should preserve whitespace, while all other primitives have collapse behavior.

New Features

• #863: Add Attributes::into_map_access(&str) and Attributes::into_deserializer() when serialize feature is enabled. This will allow do deserialize serde types right from attributes. Both methods returns the same type which implements serde's Deserializer and MapAccess traits.
• #766: Allow to parse resolved entities as XML fragments and stream events from them.
• #766: Added new event Event::GeneralRef with content of [general entity].
• #766: Added new configuration option allow_dangling_amp which allows to have a & not followed by ; in the textual data which is required for some applications for compatibility reasons.
• #285: Add ability to quick_xml::de::Text to access text with trimmed spaces

Bug Fixes

• #868: Allow to have both $text and $value special fields in one struct. Previously any text will be recognized as $value field even when $text field is also presented.
• #868: Skip text events when deserialize a sequence of items overlapped with text (including CDATA).
• #841: Do not strip xml prefix from the attributes when map them to struct fields in Deserializer.

Misc Changes

• #863: Remove From<QName<'a>> for BytesStart<'a> because now BytesStart stores the encoding in which its data is encoded, but QName is a simple wrapper around byte slice.
• #766: BytesText::unescape and BytesText::unescape_with replaced by BytesText::decode. Now Text events does not contain escaped parts which are reported as Event::GeneralRef.

#285: tafia/quick-xml#285 #766: tafia/quick-xml#766 #841: tafia/quick-xml#841 #863: tafia/quick-xml#863 #868: tafia/quick-xml#868 [general entity]: https://www.w3.org/TR/xml11/#gen-entity

Commits

• e8806e0 Release 0.38.0
• 7c4b702 Fix incorrect references in the documentation
• 2cbb2b8 Merge pull request #873 from curatorsigma/serde_roundtrip_xml_attrs
• bc18c57 serde: allow xml: attributes to roundtrip
• 899d573 Skip unwanted text events in sequences
• 5942a13 Add regression test for #868
• f152aec Allow both &text and $value fields in the same struct
• d6dfeed Merge pull request #872 from Mingun/update-compare
• 6017acf Merge pull request #865 from ggodlewski/untrim
• 15a3e86 compare: Put each group into its own file to be able to run them independentl...
• Additional commits viewable in compare view

Updates reqwest from 0.12.20 to 0.12.22

Release notes

Sourced from reqwest's releases.

v0.12.22

tl;dr

• Fix socks proxies when resolving IPv6 destinations.

What's Changed

• fix(socks): bracket IPv6 addresses when formatting destination host by @​0x676e67 in seanmonstar/reqwest#2753
• Prepare v0.12.22 by @​seanmonstar in seanmonstar/reqwest#2754

Full Changelog: seanmonstar/reqwest@v0.12.21...v0.12.22

v0.12.21

tl;dr

• Fix socks proxy to use socks4a:// instead of socks4h://.
• Fix Error::is_timeout() to check for hyper and IO timeouts too.
• Fix request Error to again include URLs when possible.
• Fix socks connect error to include more context.
• (wasm) implement Default for Body.

What's Changed

• chore: remove unused slab dep by @​seanmonstar in seanmonstar/reqwest#2729
• docs: mention requiring Tokio by @​seanmonstar in seanmonstar/reqwest#2731
• Fix Typos in Comments for Multipart and Redirect Tests by @​leopardracer in seanmonstar/reqwest#2738
• fix: request errors should include url by @​seanmonstar in seanmonstar/reqwest#2741
• fix: consider timeout from hyper::Error by @​flisky in seanmonstar/reqwest#2742
• feat: add Default impl for wasm::Body by @​jpopesculian in seanmonstar/reqwest#2746
• fix: Fix SOCKS4a proxy protocol matching by @​0x676e67 in seanmonstar/reqwest#2732
• fix: add more context and description to SOCKS errors by @​seanmonstar in seanmonstar/reqwest#2750
• Prepare v0.12.21 by @​seanmonstar in seanmonstar/reqwest#2751

New Contributors

• @​leopardracer made their first contribution in seanmonstar/reqwest#2738
• @​jpopesculian made their first contribution in seanmonstar/reqwest#2746

Full Changelog: seanmonstar/reqwest@v0.12.20...v0.12.21

Changelog

Sourced from reqwest's changelog.

v0.12.22

• Fix socks proxies when resolving IPv6 destinations.

v0.12.21

• Fix socks proxy to use socks4a:// instead of socks4h://.
• Fix Error::is_timeout() to check for hyper and IO timeouts too.
• Fix request Error to again include URLs when possible.
• Fix socks connect error to include more context.
• (wasm) implement Default for Body.

Commits

• e6e2d8a v0.12.22
• a9ab0fa fix(socks): bracket IPv6 addresses when formatting destination host (#2753)
• b739726 v0.12.21
• d9ecdc1 fix: add more context and description to SOCKS errors (#2750)
• d4c9eec fix: look for socks4a instead of socks4h (#2732)
• d793ed2 (wasm) feat: add Default impl for wasm::Body (#2746)
• 4cb2866 fix: Error::is_timeout() checks for hyper::Error::is_timeout() (#2742)
• 1794d99 fix: request errors should include url (#2741)
• 9edbd2e tests: fix typos in multipart and redirect tests (#2738)
• e03d6f4 docs: mention requiring Tokio (#2731)
• Additional commits viewable in compare view

Updates tokio from 1.45.1 to 1.46.1

Release notes

Sourced from tokio's releases.

Tokio v1.46.1

1.46.1 (July 4th, 2025)

This release fixes incorrect spawn locations in runtime task hooks for tasks spawned using tokio::spawn rather than Runtime::spawn. This issue only effected the spawn location in TaskMeta::spawned_at, and did not effect task locations in Tracing events.

Unstable

• runtime: add TaskMeta::spawn_location tracking where a task was spawned (#7440)

#7440: tokio-rs/tokio#7440

Tokio v1.46.0

1.46.0 (July 2nd, 2025)

Fixed

• net: fixed TcpStream::shutdown incorrectly returning an error on macOS (#7290)

Added

• sync: mpsc::OwnedPermit::{same_channel, same_channel_as_sender} methods (#7389)
• macros: biased option for join! and try_join!, similar to select! (#7307)
• net: support for cygwin (#7393)
• net: support pope::OpenOptions::read_write on Android (#7426)
• net: add Clone implementation for net::unix::SocketAddr (#7422)

Changed

• runtime: eliminate unnecessary lfence while operating on queue::Local<T> (#7340)
• task: disallow blocking in LocalSet::{poll,drop} (#7372)

Unstable

• runtime: add TaskMeta::spawn_location tracking where a task was spawned (#7417)
• runtime: removed borrow from LocalOptions parameter to runtime::Builder::build_local (#7346)

Documented

• io: clarify behavior of seeking when start_seek is not used (#7366)
• io: document cancellation safety of AsyncWriteExt::flush (#7364)
• net: fix docs for recv_buffer_size method (#7336)
• net: fix broken link of RawFd in TcpSocket docs (#7416)
• net: update AsRawFd doc link to current Rust stdlib location (#7429)
• readme: fix double period in reactor description (#7363)
• runtime: add doc note that on_*_task_poll is unstable (#7311)
• sync: update broadcast docs on allocation failure (#7352)
• time: add a missing panic scenario of time::advance (#7394)

#7290: tokio-rs/tokio#7290 #7307: tokio-rs/tokio#7307

... (truncated)

Commits

• ab3ff69 chore: prepare to release v1.46.1 (#7444)
• a0d5b8a runtime(unstable): fix task hook spawn locations for tokio::spawn (#7440)
• a1ee3ef chore: fix some minor typos in the comments (#7442)
• 171cd14 changelog: fix typo in pipe::OpenOptions for 1.46.0 (#7439)
• 3f1f268 chore: prepare Tokio v1.46.0 (#7437)
• 3e890cc rt(unstable): add spawn Location to TaskMeta (#7417)
• 69290a6 net: derive Clone for net::unix::SocketAddr (#7422)
• e2b1758 fuzz: cfg fuzz tests under cfg(test) (#7428)
• b7a75b5 net: update AsRawFd doc link to current Rust stdlib location (#7429)
• 6b705b3 net: allow pipe::OpenOptions::read_write on Android (#7426)
• Additional commits viewable in compare view

Updates napi-build from 2.2.1 to 2.2.2

Release notes

Sourced from napi-build's releases.

[email protected]

What's Changed

• fix(build): increase wasi stack size by @​CPunisher in napi-rs/napi-rs#2748

Full Changelog: https://github.com/napi-rs/napi-rs/compare/[email protected]@2.2.2

Commits

• 0a8de79 Release independent packages
• caf0400 Release independent packages
• 092f887 fix(napi-derive): generate object key types properly (#2752)
• b5e9c41 fix(napi): remove DerefMut impl for all TypedArray types (#2750)
• 56998d5 fix(napi): callback should be Fn rather than FnOnce (#2749)
• b25c5de fix(build): increase wasi stack size (#2748)
• 2273031 test(napi): add fixture for #2746 (#2747)
• 3898211 Release independent packages
• 9a376fe test(cli): prevent path error on Windows (#2745)
• 8c3db48 style: run clippy on nightly Rust (#2744)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.90%. Comparing base (ada1fbc) to head (0a9e763).
⚠️ Report is 21 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #160      +/-   ##
==========================================
- Coverage   97.53%   96.90%   -0.64%     
==========================================
  Files          14       14              
  Lines        3406     3132     -274     
==========================================
- Hits         3322     3035     -287     
- Misses         84       97      +13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codspeed-hq]

CodSpeed Performance Report

Merging #160 will not alter performance

_{Comparing dependabot/cargo/cargo-7ce4a2c669 (0a9e763) with main (ada1fbc)}

Summary

✅ 1 untouched benchmarks

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.