build(deps): bump the all group across 1 directory with 5 updates

[dependabot]

Bumps the all group with 5 updates in the / directory:

Package	From	To
blake3	1.8.6	1.8.7
quick-xml	0.41.0	0.42.0
flate2	1.1.9	1.1.10
rmcp	3.1.2	3.1.4
mail-parser	0.11.6	0.11.8

Updates blake3 from 1.8.6 to 1.8.7

Release notes

Sourced from blake3's releases.

1.8.7

version 1.8.7

Changes since 1.8.6:

• Remove the arrayref dependency. Unfortunately the crates.io owner was compromised.

Commits

• f3149ec version 1.8.7
• b65bcb7 add #[allow(deprecated)] annotations to fix nightly/beta warnings
• 483a220 fix warnings related to not using MAX constants
• ba02549 Codex: remove arrayref
• See full diff in compare view

Updates quick-xml from 0.41.0 to 0.42.0

Release notes

Sourced from quick-xml's releases.

v0.42.0 - String Ergonomics

What's Changed

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

• #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
• #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
• #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
• #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
• #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
• #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
• #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
• #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
• #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
• #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.42.0 -- 2026-08-22

This is a large release. The primary change is an ergonomic improvement across the entire API - quick_xml now makes use of &str and String types where possible instead of &[u8] and Vec<u8>. This requires significant refactoring of downstream code, but should result in a net simplification as well as potential performance improvements, and opens up additional opportunities in future releases.

The MSRV has been raised to 1.86. We now use Rust 2024 Edition.

Breaking Changes

• #963: Reader now validates that input is valid UTF-8 when constructing events. Non-UTF-8 input passed to Reader::from_reader() without DecodingReader will now produce Error::Encoding instead of silently passing through invalid bytes. Use DecodingReader to transcode non-UTF-8 sources.
• #963: Name types (QName, LocalName, Prefix, Namespace, PrefixDeclaration) now wrap &str instead of &[u8]. into_inner() returns &str, and AsRef<str> is implemented (AsRef<[u8]> has been removed). ResolveResult::Unknown now contains String instead of Vec<u8>, and NamespaceError variants contain String instead of Vec<u8>.
• #963: Removed the decoder: Decoder field from event types (BytesStart, BytesText, BytesCData, BytesRef) and Attributes. The decoder() method is no longer available on these types. Decode methods on events now always assume UTF-8 input. Error::missed_end() no longer takes a Decoder parameter.
• #963: Event types (BytesStart, BytesEnd, BytesText, BytesCData, BytesPI, BytesRef) now store Cow<str> internally instead of Cow<[u8]>. into_inner() on BytesText, BytesCData, BytesPI, and BytesRef now returns Cow<str>. BytesStart::set_name() now takes &str instead of &[u8].
• #963: All event types and the Event enum now implement Deref<Target = str> instead of Deref<Target = [u8]>. Explicit AsRef<str> impls are provided to avoid ambiguity.
• #963: Removed decode() methods from BytesText, BytesCData, and BytesRef. Content is already available as &str via Deref. The xml10_content(), xml11_content(), xml_content(), and html_content() methods now return Cow<str> directly instead of Result<Cow<str>, EncodingError>.
• #963: Attribute::value is now Cow<'a, str> instead of Cow<'a, [u8]>. The From<(&[u8], &[u8])> impl has been removed.
• #963: BytesDecl::version(), encoding(), and standalone() now return Cow<'_, str> instead of Cow<'_, [u8]>.
• #963: Removed Reader::decoder() method. Use Reader::encoding() instead (available with the encoding feature). Removed decoder() from the XmlRead serde trait. Removed all methods from Decoder (the struct is kept only for backward compatibility with deprecated Attribute methods).
• #980: NamespaceError::TooManyDeclarations has been renamed to TooManyBindings, and NamespaceResolver::set_max_declarations_per_element has been renamed to NamespaceResolver::set_max_namespace_bindings, and the semantic behavior has changed slightly. The default maximum has also been reduced from 256 to 128.
• #1000: DeError::UnexpectedStart renamed to DeError::MixedContent. That error is emitted when you try to deserialize boolean, number or string field from something like <field>text <tag/> another text</field>.

... (truncated)

Commits

• 36a2c52 Release 0.42.0
• a4b9fca cargo fmt
• 22c99f5 Update Rust Edition to 2024
• 83351fb Add rename = $value to a table in serde example comments
• f4db767 Clarify documentation about lifetimes of the events and attributes
• 9f4c66a Fix formatting for correct assertions in read_nodes_serde
• 6950ef7 Add GHA job to execute examples
• dbf9e3f Show XML Decl tracking in examples
• aab9452 Add writing a Decl event to the writer example
• 1573e05 Avoid trim_text(true) in the in-depth examples
• Additional commits viewable in compare view

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

• feat: reuse zlib's decoder buffer by @​Vaiz in rust-lang/flate2-rs#532
• feat: add reset method for read::GzDecoder and buffered::GzDecoder by @​Vaiz in rust-lang/flate2-rs#534
• Drop cloudflare-zlib by @​kornelski in rust-lang/flate2-rs#539
• Add a wrapper for the Crc struct by @​MikkelPaulson in rust-lang/flate2-rs#540
• Bump miniz_oxide to 0.9 by @​oscargus in rust-lang/flate2-rs#543
• Upgrade miniz_oxide and add unit tests of the different flush kinds by @​fintelia in rust-lang/flate2-rs#498
• Fix infinite loop in writing gzip header/footer by @​Shnatsel in rust-lang/flate2-rs#547
• test: generate corrupt gzip fixture at runtime by @​nanookclaw in rust-lang/flate2-rs#550
• Reject oversized gzip extra fields by @​Byron in rust-lang/flate2-rs#553
• Reject incomplete deflate streams at EOF by @​Guflly in rust-lang/flate2-rs#556
• Include README.md in a private module by @​bushrat011899 in rust-lang/flate2-rs#562
• Add no_std support using nightly alloc_io by @​bushrat011899 in rust-lang/flate2-rs#559
• Update get_mut() documentation to make clear how 'inner` can be used by @​Byron in rust-lang/flate2-rs#558

New Contributors

• @​Vaiz made their first contribution in rust-lang/flate2-rs#532
• @​MikkelPaulson made their first contribution in rust-lang/flate2-rs#540
• @​oscargus made their first contribution in rust-lang/flate2-rs#543
• @​nanookclaw made their first contribution in rust-lang/flate2-rs#550
• @​Guflly made their first contribution in rust-lang/flate2-rs#556
• @​bushrat011899 made their first contribution in rust-lang/flate2-rs#562

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits

• ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
• fb5228d Merge pull request #559 from bushrat011899/no_std
• 6ed3ba3 Add executable no_std example
• faed8a0 Expand CI to test no_std compatibility and correctness
• 2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
• 3fe1126 Centralize usage of std for error and io
• 98e313a Add GzHeader::mtime_as_duration
• 0642965 Switch to core implicit prelude and only use std where required
• 454a63c Remove left-over dbg! statement
• 2a490b7 Add runtime_detection feature
• Additional commits viewable in compare view

Updates rmcp from 3.1.2 to 3.1.4

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.1.4

Fixed

• time out auto discovery probe (#1149)

rmcp-v3.1.4

Fixed

• (rmcp) preserve elicitation requestedSchema $schema dialect (#1176)
• harden signing key handling (#1166)
• report pre-init metadata errors (#1160)

rmcp-macros-v3.1.3

Fixed

• time out auto discovery probe (#1149)

rmcp-v3.1.3

Fixed

• (auth) ignore query parameters when matching resources (#1177)
• (auth) retain state until issuer validation (#1167)
• (model) preserve elicitation property order metadata (#1150)
• time out auto discovery probe (#1149)
• (client) classify discover outcome at source, not at the error type (#1133)

Other

• Fix typo in to_authorized_http_client doc comment (#1158)

Commits

• 4a738b9 chore: release v3.1.4 (#1185)
• 6f8dcde fix(rmcp): preserve elicitation requestedSchema $schema dialect (#1176)
• d5c46b3 fix: harden signing key handling (#1166)
• 38428f6 fix: report pre-init metadata errors (#1160)
• 018ab24 fix: handle declined MRTR elicitation (#1151)
• f9b39f3 chore(deps): bump taiki-e/install-action from 2.85.11 to 2.85.13 (#1183)
• 0f164cd chore(deps): bump github/codeql-action from 4.37.6 to 4.37.7 (#1182)
• fd14830 chore: release v3.1.3 (#1159)
• 0282172 docs: make ROADMAP status version-agnostic (#1181)
• 248cbca fix(auth): ignore query parameters when matching resources (#1177)
• Additional commits viewable in compare view

Updates mail-parser from 0.11.6 to 0.11.8

Changelog

Sourced from mail-parser's changelog.

mail-parser 0.11.8

• Fix: HeaderName breaks rkyv serialization from <= 0.11.6.

mail-parser 0.11.7

• Added more IANA headers.
• Fix: DateTime::to_timezone corrupting non-whole-hour offsets by storing leftover seconds in tz_minute (#158)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.