)]}'
{
  "log": [
    {
      "commit": "3a5613fef0a911d43e5c63b4591fe40877a90f36",
      "tree": "639b7ef5adec80d957c10950aa2298cff0b4b2d7",
      "parents": [
        "dbbefa41e8ab480024b33b78bf8e6b5ae6db33fa"
      ],
      "author": {
        "name": "Gustavo Schneiter",
        "email": "gustavomalleths@gmail.com",
        "time": "Fri Jul 24 17:09:34 2026 -0300"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 22:09:34 2026 +0200"
      },
      "message": "feat: add history metadata table (#2825)\n\n## Which issue does this PR close?\n\nPart of #823 (metadata tables tracking issue). Follows the pattern of\nthe existing `snapshots` and `manifests` tables.\n\n## What changes are included in this PR?\n\nAdds the `history` metadata table, mirroring Java\u0027s `HistoryTable`:\n\n- `HistoryTable` in `iceberg::inspect` with the Java schema exactly\n(field ids 1–4: `made_current_at` timestamptz, `snapshot_id`, nullable\n`parent_id`, `is_current_ancestor`).\n- One row per snapshot-log entry. `is_current_ancestor` is computed by\nwalking the current snapshot\u0027s parent chain — rolled-back snapshots stay\nvisible in the log but are flagged `false`, matching\n`SnapshotUtil.currentAncestorIds` semantics.\n- `parent_id` is null when the entry\u0027s snapshot has been expired,\nmatching Java\u0027s null guard.\n- The ancestor walk carries a cycle guard, so corrupt metadata with a\nparent cycle cannot hang the scan.\n- Registered in `MetadataTableType` and the DataFusion provider\n(`table$history`).\n\n## Are these changes tested?\n\n- `test_history_table_with_rolled_back_snapshot`: a table rolled back\nfrom S2 and re-committed as S3 (parent S1) — asserts S2 remains in\nhistory with `is_current_ancestor \u003d false` while S1/S3 stay `true`. This\nlineage divergence is what distinguishes `history` from `snapshots`.\n- The same test also covers expired-snapshot log entries (null\n`parent_id`, `false` ancestor flag) and a snapshot appearing twice in\nthe log (one row per entry).\n- `test_history_table`: schema + full-row assertions over the shared\nfixture.\n- DataFusion table listing and `SHOW TABLES` sqllogictest updated;\n`public-api.txt` regenerated."
    },
    {
      "commit": "dbbefa41e8ab480024b33b78bf8e6b5ae6db33fa",
      "tree": "305ac720f1f3a6b6f68efd110e727d74e8a9c61d",
      "parents": [
        "ccf44a2bb1cf5aa1a3694b125a8fc48735899eb1"
      ],
      "author": {
        "name": "Dhruv Arya",
        "email": "dhruv.arya@databricks.com",
        "time": "Fri Jul 24 07:36:32 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 16:36:32 2026 +0200"
      },
      "message": "fix: avoid lost-wakeup hang when waiting for a positional delete load (#2859)\n\n## Which issue does this PR close?\n\n\u003c!-- No issue; concurrency bug found while reviewing the delete-file\nloading paths. --\u003e\n\nN/A — a latent concurrency bug in the positional-delete loading path.\n\n## What changes are included in this PR?\n\nFixes a lost-wakeup hang on the positional-delete wait path\n(`PosDelLoadAction::WaitFor` in `arrow/delete_filter.rs`, awaited in\n`arrow/caching_delete_file_loader.rs`).\n\n`tokio::sync::Notify::notify_waiters()` stores no permit and only wakes\n`Notified` futures that already exist. Previously `WaitFor` carried a\nraw `Arc\u003cNotify\u003e`, and the waiter turned it into a `Notified` only\nlater, at `.notified().await` — after releasing the state lock. The\nexact losing interleaving:\n\n1. Loader calls `try_start_pos_del_load(path)` → `Load` (claims the\nload).\n2. Waiter calls `try_start_pos_del_load(path)` → `WaitFor(Arc\u003cNotify\u003e)`\n— a raw notifier, **not yet a `Notified`**. The lock is released as the\ncall returns.\n3. Loader calls `finish_pos_del_load(path)` → sets `Loaded`, fires\n`notify_waiters()`. No `Notified` exists yet, so the wakeup is dropped.\n4. Waiter calls `notify.notified().await`, creating its `Notified`\n**after** step 3.\n5. That `Notified` waits for the next `notify_waiters()`, which never\ncomes → hangs forever. Since positional-delete retrieval\n(`get_delete_vector`) is synchronous, this waiter must not proceed\nearly, so the hang is on the critical path.\n\n**Fix:** create the `Notified` under the state lock in\n`try_start_pos_del_load` and carry it in `WaitFor(OwnedNotified)`. The\nloader cannot fire `notify_waiters()` until it takes the write lock, so\nthe waiter\u0027s `Notified` is guaranteed to exist before the signal.\n\nThis is latent today (the loader does real parquet I/O before signaling,\nso the window is rarely hit), but is one scheduling hiccup from a\npermanent hang. It is the same bug class as the `DeleteFileIndex` site\nin #2696.\n\n## Are these changes tested?\n\nYes — adds a unit test\n(`wait_for_completes_when_load_finishes_before_await`) that drives the\nexact interleaving above through the real API and asserts the waiter\ncompletes after `finish_pos_del_load`. It passes with this change and\nhangs (times out) on the old `WaitFor(Arc\u003cNotify\u003e)` contract. No test\nseam is needed because `WaitFor` hands the notifier to the caller.\n\nSigned-off-by: Dhruv Arya \u003caryadhruv@gmail.com\u003e\nCo-authored-by: Dhruv Arya \u003caryadhruv@gmail.com\u003e"
    },
    {
      "commit": "ccf44a2bb1cf5aa1a3694b125a8fc48735899eb1",
      "tree": "89501be30c9ef4d897e99a12a377acaeafe20c61",
      "parents": [
        "d82481f96dd04d42eaf66d10f480d42131d8d4c3"
      ],
      "author": {
        "name": "Anoop Johnson",
        "email": "anoop@apache.org",
        "time": "Fri Jul 24 05:05:32 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 14:05:32 2026 +0200"
      },
      "message": "Cache partition-type resolvability and cover dropped-source-column skip (#2869)\n\n## Which issue does this PR close?\n\nCloses #2844\n\n## What changes are included in this PR?\n\nFollow-up to #2845. The stopgap there computed partition_type once per\nmanifest file in get_partition_filter to decide resolvability,\nduplicating the computation the partition filter cache already does on a\nmiss. Move the fallback into the cache\u0027s miss path so an unresolvable\nspec yields a cached always-true filter keyed by spec id, and drop the\nper-manifest pre-check.\n\nAlso add a unit test for the constants_map skip on a dropped identity\npartition source column.\n\n## Are these changes tested?\n\nYes, added a unit test"
    },
    {
      "commit": "d82481f96dd04d42eaf66d10f480d42131d8d4c3",
      "tree": "dd688db50e6e3ab78a3b76580b92ee7d25b90ca4",
      "parents": [
        "3d6ebbfef837c47a8d67db0c3c01857b6f1b1c4a"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Fri Jul 24 03:21:39 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 24 10:21:39 2026 +0800"
      },
      "message": "feat(encryption) [13/N] Write encrypted manifest files (#2821)\n\n## Which issue does this PR close?\n* Working towards https://github.com/apache/iceberg-rust/issues/2034\n\n## What changes are included in this PR?\n\nToday it is possible to read encrypted manifest files but not write\nthem.\n\nhttps://github.com/apache/iceberg-rust/pull/2568/ adds the foundations\nof what\u0027s needed to be able to do these writes but it wasn\u0027t wired into\nthe actual write path.\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\nYes - added round-trip write path test.\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "3d6ebbfef837c47a8d67db0c3c01857b6f1b1c4a",
      "tree": "15b11298095a1e090df6ad0e7c86e9e2a1c13ba0",
      "parents": [
        "7decfb22961475965d00bbce6f0eb071e1ad7961"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Fri Jul 24 00:12:06 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 16:12:06 2026 -0700"
      },
      "message": "chore(ci) fix ruff lints failing in CI (#2885)\n\n## Which issue does this PR close?\n\nCI is currently failing because ruff\nhttps://github.com/astral-sh/ruff/releases/tag/0.16.0 released two hours\nago\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "7decfb22961475965d00bbce6f0eb071e1ad7961",
      "tree": "1cb6d7eaed8b260434368e7d2e946cb55a1dbd52",
      "parents": [
        "4532da80f3930cdbda1cf2effe05b50165da9875"
      ],
      "author": {
        "name": "YangJie",
        "email": "yangjie01@baidu.com",
        "time": "Fri Jul 24 07:04:35 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 16:04:35 2026 -0700"
      },
      "message": "fix(scan): don\u0027t treat data columns named pos or file_path as metadata columns (#2865)\n\n## Which issue does this PR close?\n\n- Closes #2837.\n\n## What changes are included in this PR?\n\nA user data column named `pos` or `file_path` can\u0027t be scanned:\nprojecting it fails with `field not found`, and renaming the column\nmakes it work again. This bites VCF → Iceberg pipelines, where `pos` is\na common column name.\n\n`pos` and `file_path` are the internal columns of a position-delete\nfile, but they were registered in the same reserved name→field-id map\n(`get_metadata_field_id`) that a data-table scan consults through\n`is_metadata_column_name`. Scan planning checks that map first and never\nfalls back to the data schema, so a real `pos` column gets mapped to a\nreserved delete-file id and is never looked up in the actual schema.\n\nThe Iceberg spec reserves only `_`-prefixed names as metadata columns,\nso they can\u0027t collide with user columns. This guards\n`is_metadata_column_name` with a `starts_with(\u0027_\u0027)` check, and the two\nbare names stop shadowing data columns. `get_metadata_field_id` still\nmaps them to their reserved ids, which the delete read path needs via\nthe id→field direction; its doc now says it isn\u0027t a membership test. No\npublic API signature changes.\n\n## Are these changes tested?\n\nUnit tests, no infrastructure needed:\n\n- `metadata_columns`: `is_metadata_column_name` accepts the `_`-prefixed\nnames and rejects the bare `pos`/`file_path`, while\n`get_metadata_field_id` still maps them to reserved ids.\n- `scan`: projecting `pos`/`file_path`, both explicitly and via the\ndefault projection, resolves to the real field id; an absent column\nstill fails with `DataInvalid` / \"not found\". Both fail before the fix\nand pass after.\n\n`cargo test -p iceberg --lib`, `cargo fmt --check`, and `cargo clippy -D\nwarnings` all pass.\n\n## One open question for reviewers\n\nThis is the minimal fix, on the scan side. The bare names still live in\nthe shared name→id map, so `get_metadata_field_id(\"pos\").is_ok()` stays\ntrue and the two public predicates now disagree\n(`is_metadata_column_name(\"pos\")` is false). Removing the two names from\nthat map would be the deeper fix and looks safe in-repo (the delete read\npath uses the untouched id→field direction), but it changes a second\npublic function\u0027s behavior, so I left it out. Happy to fold it in if\nyou\u0027d rather go deeper."
    },
    {
      "commit": "4532da80f3930cdbda1cf2effe05b50165da9875",
      "tree": "a2f233206fd89cf0a2e7768219ea246f0dbe273f",
      "parents": [
        "69609201a08b4defa96e2fd9b6e47218e1065c34"
      ],
      "author": {
        "name": "Matt Butrovich",
        "email": "mbutrovich@users.noreply.github.com",
        "time": "Thu Jul 23 05:23:23 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 17:23:23 2026 +0800"
      },
      "message": "feat(encryption): support AES-256 keys for reading Parquet data files (#2878)\n\n## Which issue does this PR close?\n\n- Closes #.\n\nDepends on the arrow-rs 58.4.0 release tracked in apache/arrow-rs#10349.\n\n## What changes are included in this PR?\n\n- Bump `arrow`/`parquet` deps from `58` to `58.4`. arrow-rs 58.4.0 adds\nAES-256 for Parquet modular encryption (58.3.0 was AES-128 only), landed\nvia apache/arrow-rs#9203.\n- Add an AES-256 encrypted-Parquet read test. Refactored the existing\n128-bit test into a shared `assert_encrypted_parquet_roundtrip(key)`\nhelper with `_aes_128` and `_aes_256` callers.\n\nNote: 192-bit is not supported for data files. arrow-rs uses `ring`,\nwhich has no AES-192-GCM. Can revisit later.\n\n## Are these changes tested?\n\nYes. Unit test `test_read_encrypted_parquet_aes_256` writes and reads\nback a 256-bit encrypted Parquet file. It fails on arrow-rs 58.3.0\n(`ring` rejects the 32-byte key) and passes on 58.4.0."
    },
    {
      "commit": "69609201a08b4defa96e2fd9b6e47218e1065c34",
      "tree": "4a159a3208e52d3ecf7f826eb40649b0408b371f",
      "parents": [
        "252bb601f71491aad6a716c57348935da44214c3"
      ],
      "author": {
        "name": "Matt Faltyn",
        "email": "76570855+mattfaltyn@users.noreply.github.com",
        "time": "Thu Jul 23 10:16:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 23 16:16:42 2026 +0800"
      },
      "message": "fix(sql): return errors for invalid pool properties (#2847)\n\n## Which issue does this PR close?\n\n- Closes #2846.\n\n## What changes are included in this PR?\n\n- Parse SQL catalog connection-pool properties without panicking.\n- Return `ErrorKind::DataInvalid` with the invalid property, value, and\nparse error.\n- Add regression coverage for `pool.max-connections`,\n`pool.idle-timeout`, and `pool.test-before-acquire`.\n\n## Are these changes tested?\n\n- `cargo test -p iceberg-catalog-sql --all-features --lib`\n- `cargo fmt --all -- --check`\n- `cargo clippy -p iceberg-catalog-sql --all-targets --all-features --\n-D warnings`\n- Re-ran the issue reproducer and confirmed the malformed value returns\na structured error while a valid value still initializes the catalog."
    },
    {
      "commit": "252bb601f71491aad6a716c57348935da44214c3",
      "tree": "ab071bf45ec8e08a4876c846ac33b20469f87088",
      "parents": [
        "577e51c3c8d01fe802052420a42c8ab0f9249373"
      ],
      "author": {
        "name": "Sreeram Garlapati",
        "email": "SreeramGarlapati@users.noreply.github.com",
        "time": "Wed Jul 22 01:04:13 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 22 16:04:13 2026 +0800"
      },
      "message": "fix(transaction): de-duplicate file paths within a FastAppend batch (#2509)\n\nCloses #2507.\n\nA FastAppend batch carrying the same file path twice writes both entries\ninto the manifest today, so scans double-count rows and the snapshot\nsummary is inflated.\n\nThis drops the duplicates and keeps the first occurrence, matching\nIceberg Java, which de-duplicates by file location via\n[`DataFileSet`](https://github.com/apache/iceberg/blob/main/core/src/main/java/org/apache/iceberg/DataFileSet.java)\n(used in\n[`FastAppend`](https://github.com/apache/iceberg/blob/main/core/src/main/java/org/apache/iceberg/FastAppend.java)).\nThe dedupe is in-memory and always runs, independent of\n`check_duplicate` (which only gates the I/O-bound cross-snapshot check).\n\nTested: a batch with repeated paths now commits a single manifest entry,\nwith and without `check_duplicate`.\n\nCo-authored-by: Aman Rawat \u003crawataaryan09@gmail.com\u003e"
    },
    {
      "commit": "577e51c3c8d01fe802052420a42c8ab0f9249373",
      "tree": "8862c81774c87139e7da4c3122c4a20bd70939fd",
      "parents": [
        "e8460eee8725c7f66d53e26b89b3fef578f90ce5"
      ],
      "author": {
        "name": "Zakariya Stasa",
        "email": "zakariyastasa@gmail.com",
        "time": "Tue Jul 21 23:01:29 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 15:01:29 2026 -0700"
      },
      "message": "feat: Honor write.metadata.path for metadata file locations (#2776)\n\n## Which issue does this PR close?\n\n- Closes #2775.\n\n## What changes are included in this PR?\n\nMetadata files were always written under `\u003ctable-location\u003e/metadata`,\nignoring the `write.metadata.path` table property. Iceberg Java honors\nit (via `BaseMetastoreTableOperations.metadataFileLocation`); this\nbrings iceberg-rust in line and mirrors the existing `write.data.path`\nhandling for data files.\n\n- Add `TableMetadata::metadata_location_root()`, returning\n`write.metadata.path` (trailing slash trimmed) when set, otherwise\n`\u003clocation\u003e/metadata`.\n- Use it in `SnapshotProducer` for the manifest and manifest-list paths,\nand in `MetadataLocation` for the table metadata JSON.\n- `MetadataLocation` now stores the resolved metadata directory rather\nthan the table location. On commit, the directory is re-derived from the\nmetadata being committed (the version is still parsed from the previous\nfile name), matching Iceberg Java. As a result\n`MetadataLocation::from_str` no longer requires the file to live under a\n`/metadata` directory (a custom `write.metadata.path` does not have to);\nfile-name validation is unchanged.\n\n## Are these changes tested?\n\nUnit tests:\n\n- `TableMetadata::metadata_location_root()`: default, configured\n`write.metadata.path`, and trailing-slash trimming.\n- `MetadataLocation`: create (`new_with_metadata`) and commit\n(`with_new_metadata`) honor `write.metadata.path`; `from_str` round-trip\ncases updated for arbitrary metadata dirs.\n- A `fast_append` transaction test asserting the manifest list and\nmanifests are written under a configured `write.metadata.path`.\n- Updated `catalog::tests::test_table_commit` to reflect the new\nmetadata file following the updated table location."
    },
    {
      "commit": "e8460eee8725c7f66d53e26b89b3fef578f90ce5",
      "tree": "a0d00c00d6ce1581be33617289adaefadec7255f",
      "parents": [
        "f019ee147c42283580f9533db13a8a62a322666a"
      ],
      "author": {
        "name": "Matt Butrovich",
        "email": "mbutrovich@users.noreply.github.com",
        "time": "Tue Jul 21 17:14:55 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 14:14:55 2026 -0700"
      },
      "message": "deps: bump to DataFusion 54.1.0 (#2872)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\nBump cargo deps to DataFusion minor version released today (54.1.0).\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e\n\nExisting tests."
    },
    {
      "commit": "f019ee147c42283580f9533db13a8a62a322666a",
      "tree": "f5c26def81c1dfc79c640c92baad02d5e7da205d",
      "parents": [
        "633b8e0485e6ad6fa7afc2acf4cff19216cebdb2"
      ],
      "author": {
        "name": "Anoop Johnson",
        "email": "anoop@apache.org",
        "time": "Tue Jul 21 09:53:06 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 21 18:53:06 2026 +0200"
      },
      "message": "Skip partition pruning for manifests whose spec references a dropped source column (#2845)\n\n## Which issue does this PR close?\n\nCloses #2844.\n\n## What changes are included in this PR?\n\nWhen a scan has a predicate, planning resolves every manifest\u0027s spec\npartition type against the snapshot schema. Manifests written under a\nhistorical spec whose source column was later dropped (which is a legit\npossibility in v2+) fail that resolution, so one such manifest fails the\nwhole scan, even when the predicate only references live columns.\n\nThis PR is the stopgap described in #2844. The longer-term fix is\nderiving partition types from transforms where possible (as iceberg-java\ndoes in apache/iceberg#17262), which would also restore pruning on a\nhistorical spec\u0027s still-live partition fields.\n\n## Are these changes tested?\n\nyes. added tests"
    },
    {
      "commit": "633b8e0485e6ad6fa7afc2acf4cff19216cebdb2",
      "tree": "3b273bac77e65fd07f0546650acfb1512fd45ea7",
      "parents": [
        "7c1e0fa22fb20508894f1eabd176fe206078e9b3"
      ],
      "author": {
        "name": "Xin Huang",
        "email": "42597328+huan233usc@users.noreply.github.com",
        "time": "Mon Jul 20 16:17:38 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 16:17:38 2026 -0700"
      },
      "message": "feat(catalog-rest): enforce negotiated endpoints for exists checks (#2794)\n\n## Which issue does this PR close?\n\nFollow-up to #2692.\n\n## What changes are included in this PR?\n\n#2692 parsed the server-advertised `endpoints` from `GET /v1/config` but\ndid not\nyet use them. This PR wires the negotiated set into the catalog and\nstarts\nenforcing it:\n\n- **`DEFAULT_ENDPOINTS`** — the base set of namespace/table operations\nassumed\nwhen a server omits the `endpoints` field or sends an empty list (the\ntwo are\n  treated alike), mirroring Java\u0027s `RESTSessionCatalog`.\n- **Named per-route constants** (`V1_LIST_NAMESPACES`,\n`V1_TABLE_EXISTS`, …) via\nan `endpoints!` macro, so routes are easy to reference without\nrebuilding\n  `Endpoint` values per call.\n- **`RestContext`** stores the negotiated set (advertised list, or the\ndefault\n  base set); **`RestCatalog::supports_endpoint`** queries it.\n- **`table_exists` / `namespace_exists`** now issue the cheap `HEAD`\nonly when\nthe server advertises the corresponding endpoint, and otherwise fall\nback to a\n`GET` load (treating not-found as `false`), so they keep working against\n  servers that don\u0027t advertise the `HEAD` routes. This mirrors Java\u0027s\n  `RESTSessionCatalog.{tableExists,namespaceExists}`.\n\n`supports_endpoint` is intentionally `pub(crate)` — its only consumers\nso far are\nthe exists checks inside this crate, so there\u0027s no need to expose it\npublicly yet\n(it can be made `pub` when a cross-crate consumer such as scan planning\nneeds it).\n**As a result this PR makes no public-API change** (no `public-api.txt`\nupdate).\n\nEnforcing the negotiated set across the remaining operations can follow\nin\nsubsequent PRs.\n\n## Are these changes tested?\n\nYes — unit tests for negotiation (advertised list, absent field,\nexplicit empty\nlist) and for `{table,namespace}_exists` on both the HEAD and\nGET-fallback paths."
    },
    {
      "commit": "7c1e0fa22fb20508894f1eabd176fe206078e9b3",
      "tree": "ec1ec137200087aceb88cf27ac82c91e6c35afe4",
      "parents": [
        "8b76dbef86b47417b73e3c3a937f519d586782b9"
      ],
      "author": {
        "name": "Christian",
        "email": "christian@vakamo.com",
        "time": "Tue Jul 21 00:57:42 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 15:57:42 2026 -0700"
      },
      "message": "feat(arrow): recognize arrow.parquet.variant on schema import (#2840)\n\nTeach arrow_schema_to_schema to fold a field tagged with the canonical\narrow.parquet.variant extension into an atomic Type::Variant, the\ninverse of the export path added in #2188. Previously such a schema\nerrored with \"Field id not found in metadata\" because the variant\u0027s\nmetadata/value storage sub-fields carry no field id.\n\n## Which issue does this PR close?\n\nPR 1 of 2 for Variant read support.\n\n## What changes are included in this PR?\n\nAdd a defaulted `ArrowSchemaVisitor::variant` dispatched via a new\n`visit_field` helper at each field-dispatch site. The default re-enters\nnormal traversal, so the reconstructing visitors (Int96Coercion,\nMetadataStrip) are unchanged; `ArrowSchemaConverter` overrides it to\nfold the struct without descending, guarding that the extension sits on\nStruct storage. Mirrors Java\u0027s Parquet reader, which recovers a variant\nfrom its group-level annotation without visiting the group\u0027s children.\n\nCovers top-level, struct-nested, list-element and map-value positions\nplus auto-assigned ids; regenerates the iceberg public-api baseline.\n\n## Are these changes tested?\n\nunit-tested yes."
    },
    {
      "commit": "8b76dbef86b47417b73e3c3a937f519d586782b9",
      "tree": "2a9ab244b65e2d95f865c41082523b24df92b5dc",
      "parents": [
        "3f163f25d5a0afeb8433481780da624f3103db89"
      ],
      "author": {
        "name": "hsiang-c",
        "email": "137842490+hsiang-c@users.noreply.github.com",
        "time": "Mon Jul 20 15:00:22 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 15:00:22 2026 -0700"
      },
      "message": "feat: add support for `_pos` metadata column (#2746)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Partially closes https://github.com/apache/iceberg-rust/issues/2607\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n- Support `_pos` metadata column by delegating it to the Parquet\nreader\u0027s `RowNumber` virtual column, inspired by\nhttps://github.com/apache/datafusion/pull/22026.\n- Refactor the `compare_schemas` function b/c `_pos` field id exists in\nboth `source_schema` and `target_schema` and the original implementation\nmight result in `SchemaComparison::NameChangesOnly`, which produces a\n`RecordBatch` with correct content but incorrect column order.\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e\n\n - Yes, unit tests.\n - Iceberg Spark: https://github.com/apache/datafusion-comet/pull/4752\n\nSample plan\n\n```shell\n\u003d\u003d Physical Plan \u003d\u003d\nAdaptiveSparkPlan isFinalPlan\u003dfalse\n+- CometSort [id#863L, data#864, _pos#868L], [id#863L ASC NULLS FIRST]\n   +- CometExchange rangepartitioning(id#863L ASC NULLS FIRST, 200), ENSURE_REQUIREMENTS, CometNativeShuffle, [plan_id\u003d2634]\n      +- CometFilter [id#863L, data#864, _pos#868L], (id#863L \u003e\u003d 10)\n         +- CometIcebergNativeScan [id#863L, data#864, _pos#868L], file:/var/folders/d2/b93h6k7174ddqxltrxgb51040000gn/T/hive2622216829356851627/table/metadata/00004-95932e2b-bbe6-444e-81b8-069c5e748a20.metadata.json, spark_catalog.default.table (branch\u003dnull) [filters\u003did IS NOT NULL, id \u003e\u003d 10, groupedBy\u003d], 1\n```"
    },
    {
      "commit": "3f163f25d5a0afeb8433481780da624f3103db89",
      "tree": "f5f72f30e49e6725a2a9ac03f7a52a3159ec42e3",
      "parents": [
        "b6d7fce2ce20ceca2bcb7cadeedb945d6f6fb96e"
      ],
      "author": {
        "name": "aarushigupta132",
        "email": "aarushig132@gmail.com",
        "time": "Mon Jul 20 09:10:01 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 16:10:01 2026 +0800"
      },
      "message": "feat(encryption) [12/N] write encrypted manifest list (#2677)\n\n## Which issue does this PR close?\n- Working towards: #2034\n\n## What changes are included in this PR?\nAdds encrypted manifest-list writing and wires it into\nSnapshotProducer::commit. When the table has an EncryptionManager, the\nmanifest list is encrypted, its key is KEK-wrapped, the wrapped key id\nis stored on the snapshot.\n\n## Are these changes tested?\nEncrypted round-trip unit test on the manifest-list writer"
    },
    {
      "commit": "b6d7fce2ce20ceca2bcb7cadeedb945d6f6fb96e",
      "tree": "2e678c519108f1089da9dbaaa79486a468ab18df",
      "parents": [
        "86f35ee5893adcbbcabca60a9d44ed72697a6d26"
      ],
      "author": {
        "name": "Kevin Liu",
        "email": "kevinjqliu@users.noreply.github.com",
        "time": "Mon Jul 20 02:17:20 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 14:17:20 2026 +0800"
      },
      "message": "Add Python environment paths to .licenserc.yaml (#2849)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n\nhttps://rust.iceberg.apache.org/release.html#validate-manually\nThe verification step runs both rust build/test and python build/test.\nPython build/test will create these folders which will be picked up when\nrunning license check, and fail.\n\nThis PR will allows license check to run successfully after building\npyiceberg-core\n```\ndocker run --rm -v $(pwd):/github/workspace apache/skywalking-eyes header check\n```\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "86f35ee5893adcbbcabca60a9d44ed72697a6d26",
      "tree": "f1eae9c9f4638d0eb9075faffdc215eb5fb86228",
      "parents": [
        "9bb53a3a6b13c79b96028145686f5056e3fb6051"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:51:56 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:51:56 2026 +0800"
      },
      "message": "chore(deps): Bump regex from 1.12.4 to 1.13.0 (#2856)\n\nBumps [regex](https://github.com/rust-lang/regex) from 1.12.4 to 1.13.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/rust-lang/regex/blob/master/CHANGELOG.md\"\u003eregex\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e1.13.0 (2026-07-09)\u003c/h1\u003e\n\u003cp\u003eThis release includes a new API, a \u003ccode\u003eregex!\u003c/code\u003e macro, for\nlazy compilation of\na regex from a string literal. If you use regexes a lot, it\u0027s likely\nyou\u0027ve\nalready written one exactly like it. The new macro can be used like\nthis:\u003c/p\u003e\n\u003cpre lang\u003d\"rust\"\u003e\u003ccode\u003euse regex::regex;\n\u003cp\u003efn is_match(line: \u0026amp;str) -\u0026gt; bool {\u003cbr /\u003e\n// The regex will be compiled approximately once and reused\nautomatically.\u003cbr /\u003e\n// This avoids the footgun of using \u003ccode\u003eRegex::new\u003c/code\u003e here, which\nwould\u003cbr /\u003e\n// guarantee that it would be compiled every time this routine is\ncalled.\u003cbr /\u003e\n// This would likely make this routine much slower than it needs to\nbe.\u003cbr /\u003e\nregex!(r\u0026quot;bar|baz\u0026quot;).is_match(line)\u003cbr /\u003e\n}\u003c/p\u003e\n\u003cp\u003elet hay \u003d \u0026quot;\u003cbr /\u003e\npath/to/foo:54:Blue Harvest\u003cbr /\u003e\npath/to/bar:90:Something, Something, Something, Dark Side\u003cbr /\u003e\npath/to/baz:3:It\u0027s a Trap!\u003cbr /\u003e\n\u0026quot;;\u003c/p\u003e\n\u003cp\u003elet matches \u003d hay.lines().filter(|line| is_match(line)).count();\u003cbr\n/\u003e\nassert_eq!(matches, 2);\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eImprovements:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/regex/issues/709\"\u003e#709\u003c/a\u003e:\nAdd a new \u003ccode\u003eregex!\u003c/code\u003e macro for efficient and automatic reuse of\na compiled regex.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/926af2e68eca3ce089815790541cf50759ba2c59\"\u003e\u003ccode\u003e926af2e\u003c/code\u003e\u003c/a\u003e\n1.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/7d941a93561430cd259bb9ceb84cc66f33ae7be8\"\u003e\u003ccode\u003e7d941a9\u003c/code\u003e\u003c/a\u003e\nregex-automata-0.4.15\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/e358341229ebd5feb9a78d8cc85b459c3c7b6600\"\u003e\u003ccode\u003ee358341\u003c/code\u003e\u003c/a\u003e\napi: add \u003ccode\u003eregex!\u003c/code\u003e macro for lazy compilation\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/c42033379c8760105ef90287f319de73d1572242\"\u003e\u003ccode\u003ec420333\u003c/code\u003e\u003c/a\u003e\nautomata: disable miri on a couple doc tests\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/b9d2cf724f89754ea879b6c223d2292c4d3e2dd3\"\u003e\u003ccode\u003eb9d2cf7\u003c/code\u003e\u003c/a\u003e\ngithub: add FUNDING link\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/0858006b1460ba781deda54b8d2b01b3f9f949f7\"\u003e\u003ccode\u003e0858006\u003c/code\u003e\u003c/a\u003e\ndocs: add AI policy for contributors\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/regex/commit/468fc64ecd6493caaca40dbe8319c31c5c08a83d\"\u003e\u003ccode\u003e468fc64\u003c/code\u003e\u003c/a\u003e\nautomata: reject dense DFA start states that are match states\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/rust-lang/regex/compare/1.12.4...1.13.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dregex\u0026package-manager\u003dcargo\u0026previous-version\u003d1.12.4\u0026new-version\u003d1.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "9bb53a3a6b13c79b96028145686f5056e3fb6051",
      "tree": "c38b1b42f6987e403dc40d31252a8b5016dbb864",
      "parents": [
        "31be42d1fec174fe6b70edf9aeb147fa4d72d2f7"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:51:06 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:51:06 2026 +0800"
      },
      "message": "chore(deps-dev): Bump pyarrow from 24.0.0 to 25.0.0 in /bindings/python (#2850)\n\nBumps [pyarrow](https://github.com/apache/arrow) from 24.0.0 to 25.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/apache/arrow/releases\"\u003epyarrow\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 25.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca\nhref\u003d\"https://arrow.apache.org/release/25.0.0.html\"\u003ehttps://arrow.apache.org/release/25.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 25.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 25.0.0 RC1\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/59bea6ec485e7fe351d1aa6753f964f6a6bc353a\"\u003e\u003ccode\u003e59bea6e\u003c/code\u003e\u003c/a\u003e\nMINOR: [Release] Update versions for 25.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/381fab63a8428c2c0eff90a1d66d7f9f0cb3be07\"\u003e\u003ccode\u003e381fab6\u003c/code\u003e\u003c/a\u003e\nMINOR: [Release] Update .deb/.rpm changelogs for 25.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/7f72d5bc814b2c5bbd3eec0c9c66379508ad2d2e\"\u003e\u003ccode\u003e7f72d5b\u003c/code\u003e\u003c/a\u003e\nMINOR: [Release] Update CHANGELOG.md for 25.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/fe2f85c7521da2e62320cc25d7e55a50304f4893\"\u003e\u003ccode\u003efe2f85c\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50336\"\u003eGH-50336\u003c/a\u003e:\n[Release][Archery] Fix archery GitHub integration for release\nscrip...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/c658548ff58d48a378f83998eccd0a8c30adf0f0\"\u003e\u003ccode\u003ec658548\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50293\"\u003eGH-50293\u003c/a\u003e:\n[CI] Run check-labels for all triggers to avoid cancelling further\n...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/f83c8ca541aec922ea590e712a0616dc7f931a95\"\u003e\u003ccode\u003ef83c8ca\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50330\"\u003eGH-50330\u003c/a\u003e:\n[C++][R][Parquet] Add missing typename in\nRleBitPackedDecoderGetRun...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/35e0f631fa8363f243771177b3ef9d6886e897ed\"\u003e\u003ccode\u003e35e0f63\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50318\"\u003eGH-50318\u003c/a\u003e:\n[R][CI] Install missing libpng-dev for test-r-linux-as-cran (\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50328\"\u003e#50328\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/61ca7a99796b31c96dfd3a934d1d0de7e812d7f8\"\u003e\u003ccode\u003e61ca7a9\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50295\"\u003eGH-50295\u003c/a\u003e:\n[C++][R] #include \u0026lt;ranges\u0026gt; in vector_select_k.cc breaks macOS CRAN\n...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/1b6edb8a16c081873c493f44829ebf3066fc854e\"\u003e\u003ccode\u003e1b6edb8\u003c/code\u003e\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/apache/arrow/issues/50291\"\u003eGH-50291\u003c/a\u003e:\n[Python][Packaging] Stop using nightly build dependencies for\nbuild...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/apache/arrow/commit/e183ea96bf5cea34382be7fb50a016e482a633b5\"\u003e\u003ccode\u003ee183ea9\u003c/code\u003e\u003c/a\u003e\nMINOR: [Docs] Add Timestamp With Offset to canonical extension types\nstatus (...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/apache/arrow/compare/apache-arrow-24.0.0...apache-arrow-25.0.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dpyarrow\u0026package-manager\u003duv\u0026previous-version\u003d24.0.0\u0026new-version\u003d25.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "31be42d1fec174fe6b70edf9aeb147fa4d72d2f7",
      "tree": "f913fd202b4ed484c3e290fc9089686faf2dd4e2",
      "parents": [
        "c5ef8302c9898128ad45ac91f2cb65ce91152be2"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:50:36 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:50:36 2026 +0800"
      },
      "message": "chore(deps): Bump the codeql-action group with 2 updates (#2852)\n\nBumps the codeql-action group with 2 updates:\n[github/codeql-action/init](https://github.com/github/codeql-action) and\n[github/codeql-action/analyze](https://github.com/github/codeql-action).\n\nUpdates `github/codeql-action/init` from 4.36.3 to 4.37.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9\"\u003e\u003ccode\u003e99df26d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3996\"\u003e#3996\u003c/a\u003e\nfrom github/update-v4.37.0-c7c896d71\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0\"\u003e\u003ccode\u003e31c2707\u003c/code\u003e\u003c/a\u003e\nAdd changenote for \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6\"\u003e\u003ccode\u003e72df218\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.37.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91\"\u003e\u003ccode\u003ec7c896d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3995\"\u003e#3995\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.26.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146\"\u003e\u003ccode\u003e3f34ff0\u003c/code\u003e\u003c/a\u003e\nAdd changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1\"\u003e\u003ccode\u003e43bec09\u003c/code\u003e\u003c/a\u003e\nUpdate default bundle to codeql-bundle-v2.26.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46\"\u003e\u003ccode\u003ef58f0d1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3973\"\u003e#3973\u003c/a\u003e\nfrom github/mbg/repo-props/config-file-shorthands\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8\"\u003e\u003ccode\u003e7dc37cb\u003c/code\u003e\u003c/a\u003e\nMerge remote-tracking branch \u0027origin/main\u0027 into\nmbg/repo-props/config-file-sh...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f\"\u003e\u003ccode\u003e8e22350\u003c/code\u003e\u003c/a\u003e\nThread \u003ccode\u003eActionState\u003c/code\u003e to \u003ccode\u003einitConfig\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b\"\u003e\u003ccode\u003e69c9e8c\u003c/code\u003e\u003c/a\u003e\nMark some \u003ccode\u003estatus-report\u003c/code\u003e imports as \u003ccode\u003etype\u003c/code\u003e-only\nto avoid circular dependencies\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.36.3 to 4.37.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.37.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.37.1 - 16 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1\"\u003e2.26.1\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/4019\"\u003e#4019\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/99df26d4f13ea111d4ec1a7dddef6063f76b97e9\"\u003e\u003ccode\u003e99df26d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3996\"\u003e#3996\u003c/a\u003e\nfrom github/update-v4.37.0-c7c896d71\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/31c27074fda95256cda077009907f8a6022dd7c0\"\u003e\u003ccode\u003e31c2707\u003c/code\u003e\u003c/a\u003e\nAdd changenote for \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/72df2181aac054d1f4b44264399d2aac12cf11c6\"\u003e\u003ccode\u003e72df218\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.37.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/c7c896d71b3055d36f2aff93b16bcc6c69923b91\"\u003e\u003ccode\u003ec7c896d\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3995\"\u003e#3995\u003c/a\u003e\nfrom github/update-bundle/codeql-bundle-v2.26.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/3f34ff0ea3f5153c96071437b7cbf71ea3757146\"\u003e\u003ccode\u003e3f34ff0\u003c/code\u003e\u003c/a\u003e\nAdd changelog note\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/43bec09f1dc368b430cab4b5d69799bc904079d1\"\u003e\u003ccode\u003e43bec09\u003c/code\u003e\u003c/a\u003e\nUpdate default bundle to codeql-bundle-v2.26.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f58f0d11ebf5dedd870fab2f999275f7602cfa46\"\u003e\u003ccode\u003ef58f0d1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3973\"\u003e#3973\u003c/a\u003e\nfrom github/mbg/repo-props/config-file-shorthands\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/7dc37cbb5b3e37f0e1cd1f18b61e0ea849898fb8\"\u003e\u003ccode\u003e7dc37cb\u003c/code\u003e\u003c/a\u003e\nMerge remote-tracking branch \u0027origin/main\u0027 into\nmbg/repo-props/config-file-sh...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/8e22350a7e28c34c82a5a499fc241923301c2c4f\"\u003e\u003ccode\u003e8e22350\u003c/code\u003e\u003c/a\u003e\nThread \u003ccode\u003eActionState\u003c/code\u003e to \u003ccode\u003einitConfig\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/69c9e8c7d918cf2fee13b8b72fdde15883ff155b\"\u003e\u003ccode\u003e69c9e8c\u003c/code\u003e\u003c/a\u003e\nMark some \u003ccode\u003estatus-report\u003c/code\u003e imports as \u003ccode\u003etype\u003c/code\u003e-only\nto avoid circular dependencies\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a...99df26d4f13ea111d4ec1a7dddef6063f76b97e9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c5ef8302c9898128ad45ac91f2cb65ce91152be2",
      "tree": "c34a8c59978839b23eb2f72083c55c824bdb4a33",
      "parents": [
        "94129dff3cad6449ea714340285ef3c4065655cc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:49:54 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:49:54 2026 +0800"
      },
      "message": "chore(deps-dev): Bump huggingface-hub from 1.22.0 to 1.23.0 in /bindings/python (#2851)\n\nBumps [huggingface-hub](https://github.com/huggingface/huggingface_hub)\nfrom 1.22.0 to 1.23.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/releases\"\u003ehuggingface-hub\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[v1.23.0] Space templates, CLI extension updates \u0026amp; smoother Xet\ndownloads\u003c/h2\u003e\n\u003ch2\u003e🚀 Create Spaces from templates\u003c/h2\u003e\n\u003cp\u003eYou can now seed a new Space from one of the official Hub templates\n(JupyterLab, a Gradio chatbot, a Streamlit app, etc.) instead of\nstarting from an empty repo. List what\u0027s available with the new\n\u003ccode\u003elist_space_templates()\u003c/code\u003e API or the \u003ccode\u003ehf spaces\ntemplates\u003c/code\u003e CLI command, then pass a template\u0027s\n\u003ccode\u003erepo_id\u003c/code\u003e (or its short name) to \u003ccode\u003ecreate_repo(...,\nspace_template\u003d...)\u003c/code\u003e or \u003ccode\u003ehf repos create --type space\n--template\u003c/code\u003e. The Space SDK is inferred from the template, and\ntemplates recommended as private (like JupyterLab) are created privately\nby default unless you explicitly choose a visibility.\u003c/p\u003e\n\u003cpre lang\u003d\"bash\"\u003e\u003ccode\u003e# List available templates\n$ hf spaces templates\nNAME REPO_ID SDK PREFERRED_PRIVATE\n----------- ----------------------------------- -------\n-----------------\nStreamlit   streamlit/streamlit-template-space  docker\nJupyterLab  SpacesExamples/jupyterlab           docker  ✔\n\u003ch1\u003eCreate a Space from a template\u003c/h1\u003e\n\u003cp\u003e$ hf repos create my-jupyterlab --type space --template jupyterlab\n✓ Repo created\nrepo_id: Wauplin/my-jupyterlab\nurl: \u003ca\nhref\u003d\"https://huggingface.co/spaces/Wauplin/my-jupyterlab\"\u003ehttps://huggingface.co/spaces/Wauplin/my-jupyterlab\u003c/a\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cpre lang\u003d\"python\"\u003e\u003ccode\u003e\u0026gt;\u0026gt;\u0026gt; from huggingface_hub import\ncreate_repo\n\u0026gt;\u0026gt;\u0026gt; create_repo(\u0026quot;my-jupyterlab\u0026quot;,\nrepo_type\u003d\u0026quot;space\u0026quot;, space_template\u003d\u0026quot;jupyterlab\u0026quot;)\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eSupport creating a Space from a template by \u003ca\nhref\u003d\"https://github.com/moon-bot-app\"\u003e\u003ccode\u003e@​moon-bot-app\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4504\"\u003e#4504\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🔌 Update installed CLI extensions\u003c/h2\u003e\n\u003cp\u003eA new \u003ccode\u003ehf extensions update\u003c/code\u003e command brings your installed\nCLI extensions to their latest published version on GitHub. Pass a name\nto update a single extension, or run it with no argument to check every\ninstalled extension and update the ones that are behind. Updates are\napplied in place — Python extensions reuse their existing venv and\nbinary extensions are overwritten — so a failed update no longer leaves\nthe extension uninstalled, and extensions that are already up to date\nare simply skipped.\u003c/p\u003e\n\u003cpre lang\u003d\"bash\"\u003e\u003ccode\u003e# Update a single extension (accepts\n\u0026lt;name\u0026gt;, hf-\u0026lt;name\u0026gt; or OWNER/hf-\u0026lt;name\u0026gt;)\nhf extensions update hf-claude\n\u003ch1\u003eCheck every installed extension and update the outdated ones\u003c/h1\u003e\n\u003cp\u003ehf extensions update\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e[CLI] Add \u003ccode\u003ehf extensions update\u003c/code\u003e command by \u003ca\nhref\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4496\"\u003e#4496\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📶 Smoother Xet download progress with dual bars\u003c/h2\u003e\n\u003cp\u003eXet downloads now show two progress bars so you can tell a transfer\nis alive even on a slow connection. The \u003cstrong\u003etransfer\u003c/strong\u003e bar\nadvances as bytes arrive over the network, while the\n\u003cstrong\u003ereconstruction\u003c/strong\u003e bar tracks real progress as buffered\nchunks are written to disk — previously the single bar could sit at 0%\nfor a long time while data was actually arriving. The dual bars are\nwired into single-file downloads (\u003ccode\u003ehf_hub_download\u003c/code\u003e),\n\u003ccode\u003esnapshot_download\u003c/code\u003e (where parallel file downloads feed the\nrepo-level transfer and reconstruction bars), the \u003ccode\u003ehf\ndownload\u003c/code\u003e CLI, and bucket downloads.\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003ebig.bin: downloading bytes:   |  52.4MB     1.2MB/s\nbig.bin: reconstructing file: |  52.4MB / 105MB     800kB/s\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/0c92853b8e07bc50ee0817e307e9fd88194dd4f3\"\u003e\u003ccode\u003e0c92853\u003c/code\u003e\u003c/a\u003e\nRelease: v1.23.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/6bc5aa0d39159fb6e20897bff913950a613b5c27\"\u003e\u003ccode\u003e6bc5aa0\u003c/code\u003e\u003c/a\u003e\nRelease: v1.23.0.rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/0815693a9b8138ecde13e98d5ba02bed38499054\"\u003e\u003ccode\u003e0815693\u003c/code\u003e\u003c/a\u003e\n[CLI] Generate hf-cli skill locally instead of downloading from bucket\n(\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4199\"\u003e#4199\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/923acb0da7bc54f9385fddca2dbc524e0e13ce0a\"\u003e\u003ccode\u003e923acb0\u003c/code\u003e\u003c/a\u003e\n[Utils] Add \u003ccode\u003eget_cached_repo_tree\u003c/code\u003e utility (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4513\"\u003e#4513\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/7625ea300442a879ca9958054c41f5318c28404f\"\u003e\u003ccode\u003e7625ea3\u003c/code\u003e\u003c/a\u003e\nExpose snapshot_path on IncompleteSnapshotError (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4500\"\u003e#4500\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/c5a110d6ca389355b369ec94ff17573824b09709\"\u003e\u003ccode\u003ec5a110d\u003c/code\u003e\u003c/a\u003e\n[CLI] Add --pipeline-tag, --gated, --apps filters to hf models ls (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4512\"\u003e#4512\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/b63ed5b972cae11c831733ce3575fd1bfba7f158\"\u003e\u003ccode\u003eb63ed5b\u003c/code\u003e\u003c/a\u003e\n[Utils] Treat backslashes as path separators in filter_repo_objects (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4506\"\u003e#4506\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/6d40d9c52a65d70c7f83b9cb5bc00d1ddca670b8\"\u003e\u003ccode\u003e6d40d9c\u003c/code\u003e\u003c/a\u003e\ndocs: drop /new from Inference Endpoints web interface links (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4509\"\u003e#4509\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/ed48426b53fa6d34ec68b8a5c7d58ec54b852385\"\u003e\u003ccode\u003eed48426\u003c/code\u003e\u003c/a\u003e\n[CI] Fix expand property type tests (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4510\"\u003e#4510\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/790120be43c8f35f1988e14e8379e14ccda6c409\"\u003e\u003ccode\u003e790120b\u003c/code\u003e\u003c/a\u003e\nSupport creating a Space from a template (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4504\"\u003e#4504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/compare/v1.22.0...v1.23.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dhuggingface-hub\u0026package-manager\u003duv\u0026previous-version\u003d1.22.0\u0026new-version\u003d1.23.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "94129dff3cad6449ea714340285ef3c4065655cc",
      "tree": "ee01f2406bae31d91e295cc3d34265279cf2521a",
      "parents": [
        "e7a1f357d1918c5fc7f32e80ee0ad36ed7c91169"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:49:12 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:49:12 2026 +0800"
      },
      "message": "chore(deps): Bump astral-sh/setup-uv from 8.3.0 to 8.3.2 (#2853)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n8.3.0 to 8.3.2.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/11f9893b081a58869d3b5fccaea48c9e9e46f990\"\u003e\u003ccode\u003e11f9893\u003c/code\u003e\u003c/a\u003e\nchore: roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/948\"\u003e#948\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f79855603231e1609d02bec6956bd0e05cbc46b5\"\u003e\u003ccode\u003ef798556\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.3.1 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/946\"\u003e#946\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/e80544d808267c93733c3fd1e2c8c65e0c8707d6\"\u003e\u003ccode\u003ee80544d\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.28 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/947\"\u003e#947\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/f98e06938123ccabd21905ea5d0069192241f9f1\"\u003e\u003ccode\u003ef98e069\u003c/code\u003e\u003c/a\u003e\nChange update-docs PR labels from \u0027update-docs\u0027 to \u0027documentation\u0027 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/945\"\u003e#945\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/cd462639a967553a16241af35461402a96978d48\"\u003e\u003ccode\u003ecd46263\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.27 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/944\"\u003e#944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/11245c7e122cd1c2297e8115d1e43fe1570f6270\"\u003e\u003ccode\u003e11245c7\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.3.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/939\"\u003e#939\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/d31148d669074a8d0a63714ba94f3201e7020bc3...11f9893b081a58869d3b5fccaea48c9e9e46f990\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d8.3.0\u0026new-version\u003d8.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "e7a1f357d1918c5fc7f32e80ee0ad36ed7c91169",
      "tree": "9189bb704af77b564c99f6ce1c027a1cd019526a",
      "parents": [
        "82ba660d48fb4b450d93047483037aabe8b71209"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:48:44 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:48:44 2026 +0800"
      },
      "message": "chore(deps): Bump actions/stale from 10.3.0 to 10.4.0 (#2854)\n\nBumps [actions/stale](https://github.com/actions/stale) from 10.3.0 to\n10.4.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/stale/releases\"\u003eactions/stale\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev10.4.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eBug Fix\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFixed \u003ccode\u003eonly-issue-types\u003c/code\u003e validation by \u003ca\nhref\u003d\"https://github.com/trueberryless\"\u003e\u003ccode\u003e@​trueberryless\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/stale/pull/1338\"\u003eactions/stale#1338\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency Updates\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump undici to 6.27.0 via override, clean up stale license files,\nand version to 10.4.0. by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/stale/pull/1342\"\u003eactions/stale#1342\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/trueberryless\"\u003e\u003ccode\u003e@​trueberryless\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/stale/pull/1338\"\u003eactions/stale#1338\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/stale/compare/v10.3.0...v10.4.0\"\u003ehttps://github.com/actions/stale/compare/v10.3.0...v10.4.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/stale/commit/1e223db275d687790206a7acac4d1a11bd6fe629\"\u003e\u003ccode\u003e1e223db\u003c/code\u003e\u003c/a\u003e\nBump undici to 6.27.0 via override, clean up stale license files, and\nversion...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/stale/commit/9461cb10066d1553762bac6a02599ab8c26b14dd\"\u003e\u003ccode\u003e9461cb1\u003c/code\u003e\u003c/a\u003e\nfix: \u003ccode\u003eonly-issue-types\u003c/code\u003e does not affect PRs (\u003ca\nhref\u003d\"https://redirect.github.com/actions/stale/issues/1338\"\u003e#1338\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/stale/compare/eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899...1e223db275d687790206a7acac4d1a11bd6fe629\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/stale\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d10.3.0\u0026new-version\u003d10.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "82ba660d48fb4b450d93047483037aabe8b71209",
      "tree": "687af05b0722c865775cd4ee54682fe522f224c7",
      "parents": [
        "a8de62b11723ced8cd511e849f97b6c6a8473558"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:47:40 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:47:40 2026 +0800"
      },
      "message": "chore(deps): Bump taiki-e/install-action from 2.82.9 to 2.83.2 (#2855)\n\nBumps\n[taiki-e/install-action](https://github.com/taiki-e/install-action) from\n2.82.9 to 2.83.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/releases\"\u003etaiki-e/install-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.83.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eparse-dockerfile@latest\u003c/code\u003e to 0.1.8.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.56.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003egungraun-runner@latest\u003c/code\u003e to 0.19.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-neat@latest\u003c/code\u003e to 0.4.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.83.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erclone@latest\u003c/code\u003e to 1.74.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-deny@latest\u003c/code\u003e to 0.20.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.83.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport \u003ccode\u003ecargo-about\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/taiki-e/install-action/pull/1924\"\u003e#1924\u003c/a\u003e,\nthanks \u003ca\nhref\u003d\"https://github.com/ruffsl\"\u003e\u003ccode\u003e@​ruffsl\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.28.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emartin@latest\u003c/code\u003e to 1.12.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.106.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.11\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.253.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.27.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emdbook@latest\u003c/code\u003e to 0.5.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.10\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.2.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-nextest@latest\u003c/code\u003e to 0.9.140.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md\"\u003etaiki-e/install-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this\nfile.\u003c/p\u003e\n\u003cp\u003eThis project adheres to \u003ca href\u003d\"https://semver.org\"\u003eSemantic\nVersioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.2.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecosign@latest\u003c/code\u003e to 3.1.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.83.4] - 2026-07-17\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.10.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.29.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003esyft@latest\u003c/code\u003e to 1.48.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.10.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-shear@latest\u003c/code\u003e to 1.13.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.83.3] - 2026-07-16\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erelease-plz@latest\u003c/code\u003e to 0.3.160.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.55.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-dinghy@latest\u003c/code\u003e to 0.8.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-binstall@latest\u003c/code\u003e to 1.21.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.83.2] - 2026-07-12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003eparse-dockerfile@latest\u003c/code\u003e to 0.1.8.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/43aecc8d72668fbcfe75c31400bc4f890f1c5853\"\u003e\u003ccode\u003e43aecc8\u003c/code\u003e\u003c/a\u003e\nRelease 2.83.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/fca47892c74f4dffa1e86ad93eca31cf898c2541\"\u003e\u003ccode\u003efca4789\u003c/code\u003e\u003c/a\u003e\nUpdate prek manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/b41cc1f9ab348b9db341d8597853df93b08652f0\"\u003e\u003ccode\u003eb41cc1f\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003eparse-dockerfile@latest\u003c/code\u003e to 0.1.8\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/8d866f8ca86db77044d7d29639e24660d0b37b88\"\u003e\u003ccode\u003e8d866f8\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/7ebe462223a33af951eed3c3ab1f754ddf2992e2\"\u003e\u003ccode\u003e7ebe462\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.56.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/01ab5633b01b19988c158b5366d64947fd6cacce\"\u003e\u003ccode\u003e01ab563\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003egungraun-runner@latest\u003c/code\u003e to 0.19.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/f164a682e7e0033cf72f1d5722d079fe82275c1e\"\u003e\u003ccode\u003ef164a68\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ecargo-neat@latest\u003c/code\u003e to 0.4.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/2ca9b94c269419b7b0c711c09d0b21c4e1d51145\"\u003e\u003ccode\u003e2ca9b94\u003c/code\u003e\u003c/a\u003e\nRelease 2.83.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/8598f86981150fb7f6511798af658bbf80a8ea46\"\u003e\u003ccode\u003e8598f86\u003c/code\u003e\u003c/a\u003e\nUpdate parse-dockerfile manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/76cfe4de2d710e12bae93580164f20dff9fd96e9\"\u003e\u003ccode\u003e76cfe4d\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003erclone@latest\u003c/code\u003e to 1.74.4\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/compare/4684b8405694ae9dd42c9f39ba901a70ae83f4a3...43aecc8d72668fbcfe75c31400bc4f890f1c5853\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dtaiki-e/install-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d2.82.9\u0026new-version\u003d2.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "a8de62b11723ced8cd511e849f97b6c6a8473558",
      "tree": "0a67f2cc756ebe4dd7c7d8357ac56aae9f7fa4e9",
      "parents": [
        "db4f6091850814b83989721afe12aa9e4406d6b3"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 20 09:45:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 20 09:45:09 2026 +0800"
      },
      "message": "chore(deps): Bump reqwest from 0.12.28 to 0.13.4 (#2857)\n\nBumps [reqwest](https://github.com/seanmonstar/reqwest) from 0.12.28 to\n0.13.4.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/releases\"\u003ereqwest\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.13.4\u003c/h2\u003e\n\u003ch2\u003etl;dr\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::tls_sslkeylogfile(bool)\u003c/code\u003e option to\nallow using the related environment variable.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::http2_keep_alive_*\u003c/code\u003e options for the\n\u003ccode\u003eblocking\u003c/code\u003e client.\u003c/li\u003e\n\u003cli\u003eAdd TLS 1.3 support when using \u003ccode\u003enative-tls\u003c/code\u003e backend.\u003c/li\u003e\n\u003cli\u003eFix redirect handling to strip sensitive headers when the scheme\nchanges.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 happy-eyeball connection creation.\u003c/li\u003e\n\u003cli\u003eUpgrade hickory-resolver to 0.26.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix(tls): improve rustls-no-provider panic message and add module\ndocs by \u003ca href\u003d\"https://github.com/smythg4\"\u003e\u003ccode\u003e@​smythg4\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3021\"\u003eseanmonstar/reqwest#3021\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: do not lose the url in error when decoding json by \u003ca\nhref\u003d\"https://github.com/Dushistov\"\u003e\u003ccode\u003e@​Dushistov\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3026\"\u003eseanmonstar/reqwest#3026\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd tls_sslkeylogfile builder method by \u003ca\nhref\u003d\"https://github.com/passcod\"\u003e\u003ccode\u003e@​passcod\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2923\"\u003eseanmonstar/reqwest#2923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(redirect): strip sensitive headers on scheme change across\nredirects by \u003ca href\u003d\"https://github.com/SAY-5\"\u003e\u003ccode\u003e@​SAY-5\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3034\"\u003eseanmonstar/reqwest#3034\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: upgrade MSRV to 1.85 by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3038\"\u003eseanmonstar/reqwest#3038\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: clean up minimal-versions CI job by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3039\"\u003eseanmonstar/reqwest#3039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(http3): use happy eyeballs for h3 connect by \u003ca\nhref\u003d\"https://github.com/lyuzichong\"\u003e\u003ccode\u003e@​lyuzichong\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3030\"\u003eseanmonstar/reqwest#3030\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update hickory-resolver to 0.26 and adjust code accordingly by\n\u003ca href\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3040\"\u003eseanmonstar/reqwest#3040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: remove unwrap in hickory initialization by \u003ca\nhref\u003d\"https://github.com/mat813\"\u003e\u003ccode\u003e@​mat813\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3041\"\u003eseanmonstar/reqwest#3041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(https): support TLS 1.3 as min version under native-tls 🎉 by \u003ca\nhref\u003d\"https://github.com/AverageHelper\"\u003e\u003ccode\u003e@​AverageHelper\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2975\"\u003eseanmonstar/reqwest#2975\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpose keep alive configurations in blocking client by \u003ca\nhref\u003d\"https://github.com/aeb-dev\"\u003e\u003ccode\u003e@​aeb-dev\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3043\"\u003eseanmonstar/reqwest#3043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v0.13.4 by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3046\"\u003eseanmonstar/reqwest#3046\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/smythg4\"\u003e\u003ccode\u003e@​smythg4\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3021\"\u003eseanmonstar/reqwest#3021\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dushistov\"\u003e\u003ccode\u003e@​Dushistov\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3026\"\u003eseanmonstar/reqwest#3026\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/SAY-5\"\u003e\u003ccode\u003e@​SAY-5\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3034\"\u003eseanmonstar/reqwest#3034\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mat813\"\u003e\u003ccode\u003e@​mat813\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3041\"\u003eseanmonstar/reqwest#3041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/AverageHelper\"\u003e\u003ccode\u003e@​AverageHelper\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2975\"\u003eseanmonstar/reqwest#2975\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aeb-dev\"\u003e\u003ccode\u003e@​aeb-dev\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3043\"\u003eseanmonstar/reqwest#3043\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/compare/v0.13.3...v0.13.4\"\u003ehttps://github.com/seanmonstar/reqwest/compare/v0.13.3...v0.13.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.13.3\u003c/h2\u003e\n\u003ch2\u003etl;dr\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CertificateRevocationList parsing of PEM values.\u003c/li\u003e\n\u003cli\u003eFix logging in resolver to only show host, not full URL.\u003c/li\u003e\n\u003cli\u003eFix hickory-dns to fallback to a default if\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e fails.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to handle \u003ccode\u003eSTOP_SENDING\u003c/code\u003e as not an error.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 pool to remove timed out QUIC connections.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 connection establishment picking IPv4 and IPv6.\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier.\u003c/li\u003e\n\u003cli\u003e(wasm) Only use wasm-bindgen on unknown-* targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate docs.rs Features by \u003ca\nhref\u003d\"https://github.com/JamesWiresmith\"\u003e\u003ccode\u003e@​JamesWiresmith\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2961\"\u003eseanmonstar/reqwest#2961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: fallback to hickory_resolver\u0027s default config if reading\n/etc/resolv.conf fails by \u003ca\nhref\u003d\"https://github.com/monosans\"\u003e\u003ccode\u003e@​monosans\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2797\"\u003eseanmonstar/reqwest#2797\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: remove timeout con by \u003ca\nhref\u003d\"https://github.com/cuiweixie\"\u003e\u003ccode\u003e@​cuiweixie\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2967\"\u003eseanmonstar/reqwest#2967\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ehttp3: handle stop_sending without error by \u003ca\nhref\u003d\"https://github.com/anuraaga\"\u003e\u003ccode\u003e@​anuraaga\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2978\"\u003eseanmonstar/reqwest#2978\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md\"\u003ereqwest\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.13.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::tls_sslkeylogfile(bool)\u003c/code\u003e option to\nallow using the related environment variable.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::http2_keep_alive_*\u003c/code\u003e options for the\n\u003ccode\u003eblocking\u003c/code\u003e client.\u003c/li\u003e\n\u003cli\u003eAdd TLS 1.3 support when using \u003ccode\u003enative-tls\u003c/code\u003e backend.\u003c/li\u003e\n\u003cli\u003eFix redirect handling to strip sensitive headers when the scheme\nchanges.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 happy-eyeball connection creation.\u003c/li\u003e\n\u003cli\u003eUpgrade hickory-resolver to 0.26.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CertificateRevocationList parsing of PEM values.\u003c/li\u003e\n\u003cli\u003eFix logging in resolver to only show host, not full URL.\u003c/li\u003e\n\u003cli\u003eFix hickory-dns to fallback to a default if\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e fails.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to handle \u003ccode\u003eSTOP_SENDING\u003c/code\u003e as not an error.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 pool to remove timed out QUIC connections.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 connection establishment picking IPv4 and IPv6.\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier.\u003c/li\u003e\n\u003cli\u003e(wasm) Only use wasm-bindgen on unknown-* targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix HTTP/2 and native-tls ALPN feature combinations.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to send h3 ALPN.\u003c/li\u003e\n\u003cli\u003e(wasm) fix \u003ccode\u003eRequestBuilder::json()\u003c/code\u003e from override\npreviously set content-type.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixes compiling with rustls on Android targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003ev0.13.0\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eBreaking changes\u003c/strong\u003e:\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003erustls\u003c/code\u003e is now the default TLS backend, instead of\n\u003ccode\u003enative-tls\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erustls\u003c/code\u003e crypto provider defaults to aws-lc instead of\n\u003cem\u003ering\u003c/em\u003e. (\u003ccode\u003erustls-no-provider\u003c/code\u003e exists if you want a\ndifferent crypto provider)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erustls-tls\u003c/code\u003e has been renamed to\n\u003ccode\u003erustls\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003erustls roots features removed, \u003ccode\u003erustls-platform-verifier\u003c/code\u003e\nis used by default.\n\u003cul\u003e\n\u003cli\u003eTo use different roots, call\n\u003ccode\u003etls_certs_only(your_roots)\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003enative-tls\u003c/code\u003e now includes ALPN. To disable, use\n\u003ccode\u003enative-tls-no-alpn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003equery\u003c/code\u003e and \u003ccode\u003eform\u003c/code\u003e are now crate features,\ndisabled by default.\u003c/li\u003e\n\u003cli\u003eLong-deprecated methods and crate features have been removed (such\nas \u003ccode\u003etrust-dns\u003c/code\u003e, which was renamed \u003ccode\u003ehickory-dns\u003c/code\u003e a\nwhile ago).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMany TLS-related methods renamed to improve autocompletion and\ndiscovery, but previous name left in place with a \u0026quot;soft\u0026quot;\ndeprecation. (just documented, no warnings)\n\u003cul\u003e\n\u003cli\u003eFor example, prefer \u003ccode\u003etls_backend_rustls()\u003c/code\u003e over\n\u003ccode\u003euse_rustls_tls()\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/11489b34eda6d32b15ad4033e62beba2ee401350\"\u003e\u003ccode\u003e11489b3\u003c/code\u003e\u003c/a\u003e\nv0.13.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/d31ffbbf84ee718eb543fa203f25b9f78d02b5cd\"\u003e\u003ccode\u003ed31ffbb\u003c/code\u003e\u003c/a\u003e\nfeat: Expose HTTP2 keep alive configurations in blocking client (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3043\"\u003e#3043\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/79ed0d712b4f9f00ffecb5103593cbf460f5bfa5\"\u003e\u003ccode\u003e79ed0d7\u003c/code\u003e\u003c/a\u003e\nfeat: support TLS 1.3 as min version under native-tls 🎉 (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2975\"\u003e#2975\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/fb7bf6ae6dace30613b964425cf2b6039e9d388f\"\u003e\u003ccode\u003efb7bf6a\u003c/code\u003e\u003c/a\u003e\nfix: remove unwrap in hickory initialization (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3041\"\u003e#3041\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/3da616fd4b5987e5b1f5f7e9f07d14b2cd603254\"\u003e\u003ccode\u003e3da616f\u003c/code\u003e\u003c/a\u003e\nfix: update hickory-resolver to 0.26 and adjust code accordingly (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3040\"\u003e#3040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/c77e7b2de5b706ec35629e0302feff8e82969d7d\"\u003e\u003ccode\u003ec77e7b2\u003c/code\u003e\u003c/a\u003e\nfix(http3): use happy eyeballs for h3 connect (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3030\"\u003e#3030\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/9cbb65b3d3cd4ab05a859366bbb70e47bec7dc8c\"\u003e\u003ccode\u003e9cbb65b\u003c/code\u003e\u003c/a\u003e\nchore: clean up minimal-versions CI job (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3039\"\u003e#3039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/17a7dc5a893b64509ed2d539892fe35f5feee255\"\u003e\u003ccode\u003e17a7dc5\u003c/code\u003e\u003c/a\u003e\nchore: upgrade MSRV to 1.85 (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3038\"\u003e#3038\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/03db63a48f35135c2f2c8b7aaa578217d5f678fe\"\u003e\u003ccode\u003e03db63a\u003c/code\u003e\u003c/a\u003e\nfix(redirect): strip sensitive headers on scheme change across redirects\n(\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3034\"\u003e#3034\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/4b813a89dcd97a4b283fda02bd458d44339850c7\"\u003e\u003ccode\u003e4b813a8\u003c/code\u003e\u003c/a\u003e\nfeat: add tls_sslkeylogfile builder method (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2923\"\u003e#2923\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/compare/v0.12.28...v0.13.4\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dreqwest\u0026package-manager\u003dcargo\u0026previous-version\u003d0.12.28\u0026new-version\u003d0.13.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "db4f6091850814b83989721afe12aa9e4406d6b3",
      "tree": "bb28d57e35608592f6e96a6eaf6744446a97accf",
      "parents": [
        "d472b1948af76446c85a0245085d2d55aa5a0a58"
      ],
      "author": {
        "name": "Anoop Johnson",
        "email": "git@anoopjohnson.com",
        "time": "Fri Jul 17 16:34:10 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 16:34:10 2026 -0700"
      },
      "message": "Return an error instead of panicking in inspect().manifests() when a partition source column was dropped (#2843)\n\n## Which issue does this PR close?\n\n- Closes #2842.\n\n## What changes are included in this PR?\n\n`ManifestsTable::scan` panicked when building the `partition_summaries`\ncolumn for tables whose manifests reference a historical partition spec\nwith a source column that has since been dropped from the current\nschema. This is a legal table state in v2+: once a partition field is\nremoved from the default spec, its source column may be dropped.\n\n`PartitionSpec::partition_type` returns an error for such specs, and the\n`.unwrap()` turned it into a panic.\n\nThe fix makes the failure a clean error rather than a crash. Making the\nmanifests table render successfully for such tables (e.g. by resolving\neach spec against a compatible schema, as Java does) is left as a\nfollow-up.\n\n## Are these changes tested?\n\nYes. A new unit test\n(`test_manifests_table_with_dropped_partition_source_column`)"
    },
    {
      "commit": "d472b1948af76446c85a0245085d2d55aa5a0a58",
      "tree": "edabf579ca1ad44c81ad81b64abcbb45dd4a9344",
      "parents": [
        "1d499438fd567f29578b000b4111672d19643ca5"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Fri Jul 17 09:30:05 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 16:30:05 2026 +0800"
      },
      "message": "chore(lint) check unused_qualifications (#2839)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\nWe have inconsistency across the repo when it comes to using\n`used_qualifications` which makes code harder to read and maintain in a\nconsistent style.\n\nI did an audit of some popular crate to see if other folks enforce this\nlint and I found that our friends in the Datafusion community do use\nthis https://github.com/apache/datafusion/pull/13086. But also aware\nthat repos like tokio choose not to.\n\n- Closes #.\n\n## What changes are included in this PR?\n\nThis PR adds `unused_qualifications \u003d \"deny\"` to the root `Cargo.toml` \n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "1d499438fd567f29578b000b4111672d19643ca5",
      "tree": "65b15ef0cef08a4318ddd5c63aeb3def3bc8df5d",
      "parents": [
        "743d098e4a2d99a3f65df0c2beca37494de46760"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Fri Jul 17 07:02:42 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 17 14:02:42 2026 +0800"
      },
      "message": "refactor(encryption) standard encryption metadata should store `SecureKey` (#2834)\n\n## Which issue does this PR close?\nFollow up from https://github.com/apache/iceberg-rust/pull/2584\n\n`StandardKeyMetadata` must include encryption keys which have a valid\nsize according to the spec. Changing `StandardKeyMetadata` to store\n`SecureKey` rather than just `SecureBytes` means a `StandardKeyMetadata`\ncan never exist without it being validated.\n\n## What changes are included in this PR?\n```\npub struct StandardKeyMetadata {\n    - encryption_key: SensitiveBytes,\n    + encryption_key: SecureKey,\n    aad_prefix: Option\u003cBox\u003c[u8]\u003e\u003e,\n    file_length: Option\u003cu64\u003e,\n}\n```\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "743d098e4a2d99a3f65df0c2beca37494de46760",
      "tree": "64ac1d03b5a4f5a62161f6343060f7e6ef6ad923",
      "parents": [
        "ababe65912158c8f47ed895e073616ed5b29bc9a"
      ],
      "author": {
        "name": "Christian",
        "email": "christian@vakamo.com",
        "time": "Thu Jul 16 12:17:06 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 18:17:06 2026 +0800"
      },
      "message": "feat(spec): read timestamp_ns/timestamptz_ns default values in the Literal JSON codec (#2832)\n\n## Which issue does this PR close?\nWe don\u0027t have an issue for this. Deserializing Timestamp NS default\nvalues failed.\n\n## What changes are included in this PR?\n\n`try_into_json` serialized TimestampNs/TimestamptzNs but `try_from_json`\nhad no matching arms, so a nanosecond-timestamp single value (e.g. a\ncolumn default) failed to deserialize (fell to the DataInvalid\ncatch-all). Add the read arms\nmirroring the microsecond ones, plus `datetime_to_nanoseconds` /\n`datetimetz_to_nanoseconds` helpers. Also adds json_timestamp_ns /\njson_timestamptz_ns tests.\n\n## Are these changes tested?\n\nYes"
    },
    {
      "commit": "ababe65912158c8f47ed895e073616ed5b29bc9a",
      "tree": "057679776add8dcdf8d26cead2f7b55030c44f4c",
      "parents": [
        "64cb19a4f798634c717773f81afeaead9ef7f757"
      ],
      "author": {
        "name": "Christian",
        "email": "christian@vakamo.com",
        "time": "Thu Jul 16 11:20:32 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 17:20:32 2026 +0800"
      },
      "message": "feat: Variant Support (#2188)\n\n## Which issue does this PR close?\nVariant Support.\nArrow value support is currently missing as I am unsure how we want to\nextend `Literal`\n\n## What changes are included in this PR?\n### Core: Variant Type\n- `crates/iceberg/src/spec/datatypes.rs` — new `Variant` type\n- `crates/iceberg/src/spec/values/literal.rs` — `Variant` literal value\n- `crates/iceberg/src/spec/schema/` — visitor, index, pruning, mod, id\nreassigner all handle `Variant`\n- `crates/iceberg/src/spec/table_metadata.rs` — metadata support\n\n### Avro\n- `crates/iceberg/src/avro/schema.rs` — read/write `Variant` in Avro\n\n### Arrow\n- `crates/iceberg/src/arrow/schema.rs` — map `Variant` to Arrow type\n- `crates/iceberg/src/arrow/reader.rs` — read `Variant` from Arrow\n- `crates/iceberg/src/arrow/value.rs` — Arrow value conversion\n- Minor fixes in `caching_delete_file_loader.rs` and\n`nan_val_cnt_visitor.rs`\n\n### Parquet\n- `crates/iceberg/src/writer/file_writer/parquet_writer.rs` — write\n`Variant` columns\n\n### Tests \u0026 Dev\n- `crates/integration_tests/tests/read_variant.rs` — new integration\ntest for reading Variant data\n- `dev/spark/provision.py` — Spark provisioning to generate Variant test\ndata\n\n\n## Are these changes tested?\nSure! Even integration tested :)\n\n---------\n\nCo-authored-by: Shawn Chang \u003cyxchang@amazon.com\u003e"
    },
    {
      "commit": "64cb19a4f798634c717773f81afeaead9ef7f757",
      "tree": "8742685109b1a8f3ba838ca0c8f3ce2b26b431bf",
      "parents": [
        "4f912a796fb5df5765187ecbce1051fe9e072c84"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Thu Jul 16 02:56:47 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 16 09:56:47 2026 +0800"
      },
      "message": "feat(encryption) [9/N] Read encrypted parquet data-files (#2584)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Working towards https://github.com/apache/iceberg-rust/issues/2034\n\nWe\u0027re currently not able to decrypt PME encrypted files, all that\u0027s\nneeded for this PR is to wire through the key_metadata from the manifest\nentries into the scan tasks and then configure the parquet reader with\nthe correct encryption key and aad.\n\nIt\u0027s important to note that no encryption manager is needed here since\nthe key_metadata on the manifest files contain the plaintext keys.\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\nTests follow the pattern on manually writing an encrypted parquet file\nusing the raw arrow-rs writer and then using the FileScanTask and\niceberg reader to read that tmp file.\n\nI looked at using the [parquet testing\nrepo](https://github.com/apache/parquet-testing) but the encrypted files\nthere all use column based encryption which isn\u0027t supported by the spec.\nI\u0027ll separately track adding some files there that we can use here but\nthe testing strategy here is consistent with how Java does things so I\nthink this should be sufficient for us to continue.\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "4f912a796fb5df5765187ecbce1051fe9e072c84",
      "tree": "48c105f485a91ca86a3cd752f2dfaa9f45b59d35",
      "parents": [
        "b80ebbf22f7319f62e21a981f05edbec4783e45e"
      ],
      "author": {
        "name": "hsiang-c",
        "email": "137842490+hsiang-c@users.noreply.github.com",
        "time": "Wed Jul 15 17:50:22 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 15 17:50:22 2026 -0700"
      },
      "message": "feat: add support for `_spec_id` metadata column (#2695)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Partially closes https://github.com/apache/iceberg-rust/issues/2607\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n- If a projection includes `_spec_id`, which is a constant like the\n`_file` metadata column for all rows, add it to\n`RecordBatchTransformerBuilder`\n\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e\n\n - Yes, unit tests.\n - Iceberg Spark: https://github.com/apache/datafusion-comet/pull/4752\n \nSample plan\n\n```shell\n\u003d\u003d Physical Plan \u003d\u003d\nAdaptiveSparkPlan isFinalPlan\u003dfalse\n+- CometSort [id#1247L, data#1248, _spec_id#1249], [id#1247L ASC NULLS FIRST]\n   +- CometExchange rangepartitioning(id#1247L ASC NULLS FIRST, 200), ENSURE_REQUIREMENTS, CometNativeShuffle, [plan_id\u003d3533]\n      +- CometFilter [id#1247L, data#1248, _spec_id#1249], (id#1247L \u003e\u003d 10)\n         +- CometIcebergNativeScan [id#1247L, data#1248, _spec_id#1249], /var/folders/d2/b93h6k7174ddqxltrxgb51040000gn/T/iceberg_warehouse16657344237870771906/iceberg_data/default/table/metadata/00004-70b616c5-1bbe-4e1d-bdd6-e9ac4910674a.metadata.json, testrest.default.table (branch\u003dnull) [filters\u003did IS NOT NULL, id \u003e\u003d 10, groupedBy\u003d], 1\n```"
    },
    {
      "commit": "b80ebbf22f7319f62e21a981f05edbec4783e45e",
      "tree": "b275723446cec275c854ba81231860fe6beb4e49",
      "parents": [
        "5627a31eb1cc9837d6a4c02d0fdf91ae5638a3c7"
      ],
      "author": {
        "name": "kid",
        "email": "19265318+u70b3@users.noreply.github.com",
        "time": "Wed Jul 15 17:54:18 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 15 17:54:18 2026 +0800"
      },
      "message": "fix(writer): validate equality delete field ids (#2723)\n\n## Which issue does this PR close?\n\n- Closes #2722.\n\n## What changes are included in this PR?\n\n- Add writer config validation for equality delete field IDs.\n- Reject empty equality ID lists, duplicate equality field IDs, and\nfield IDs that are missing from the table schema.\n- Keep the existing `RecordBatchProjector` behavior for unsupported\nfield types and map/list reachability.\n- Fix a stale comment: equality delete fields may be optional, unlike\nidentifier fields.\n\n## Are these changes tested?\n\n- `cargo test -p iceberg test_equality_delete_rejects_empty_equality_ids\n--lib`\n- `cargo test -p iceberg\ntest_equality_delete_rejects_duplicate_equality_ids --lib`\n- `cargo test -p iceberg\ntest_equality_delete_rejects_missing_equality_id --lib`\n- `cargo test -p iceberg test_equality_delete_unreachable_column --lib`\n- `cargo test -p iceberg test_equality_delete_with_nullable_field --lib`\n- `cargo test -p iceberg equality_delete --lib`\n- `cargo fmt --check`\n- `cargo test -p iceberg --lib`\n- `cargo clippy -p iceberg --all-features --lib --tests -- -D warnings`\n- `make check`\n- `make unit-test`\n- Docker-backed integration path:\n  - `docker compose -f dev/docker-compose.yaml up -d --build --wait`\n  - `make nextest` (1832 passed, 0 skipped)"
    },
    {
      "commit": "5627a31eb1cc9837d6a4c02d0fdf91ae5638a3c7",
      "tree": "5f5725380905164b279aa8d39afb28816ec4c4a9",
      "parents": [
        "d844a1e090f8f7e6c2895a1359b990526669aecc"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Tue Jul 14 19:01:53 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 11:01:53 2026 -0700"
      },
      "message": "fix(license): Add missing LICENSE and NOTICE symlinks for iceberg-cache-moka and iceberg-catalog-loader (#2828)\n\n## Which issue does this PR close?\n\nFollow-up from #2823.\n\n## What changes are included in this PR?\n\nAdd symlinks from the crate roots to the project root\u0027s LICENSE and\nNOTICE files.\n\n## Are these changes tested?\n\nTested using the following script provided by @kevinjqliu. Introducing\nthis in CI is left as a follow-up (#2827)."
    },
    {
      "commit": "d844a1e090f8f7e6c2895a1359b990526669aecc",
      "tree": "57ff5d4357c092713fd179f1651f8ebb69112d74",
      "parents": [
        "85c365f5b06905dd72053accc23c9d2fb2fddfd9"
      ],
      "author": {
        "name": "Andrew Kane",
        "email": "andrew@ankane.org",
        "time": "Tue Jul 14 09:56:28 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 14 09:56:28 2026 -0700"
      },
      "message": "Include license and notice files in iceberg-storage-opendal crate (#2823)\n\n## Which issue does this PR close?\n\nNone\n\n## What changes are included in this PR?\n\nApplies #1601 to the `iceberg-storage-opendal` crate.\n\n## Are these changes tested?\n\nN/A"
    },
    {
      "commit": "85c365f5b06905dd72053accc23c9d2fb2fddfd9",
      "tree": "c5e2b9d73993fe7640b03a9b61f3e21d0db88eb3",
      "parents": [
        "f13bd41be3159df8fd42cee44fd2cb8f790d0390"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Mon Jul 13 23:16:21 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 15:16:21 2026 -0700"
      },
      "message": "docs: improve ancestors_between docs to make behaviour more clear (#2796)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\nTest here\nhttps://github.com/apache/iceberg-rust/blob/3253d1c02e1bba5c562a9044addc6eb507e7a387/crates/iceberg/src/util/snapshot.rs#L173-L180\nshows that if `oldest_snapshot_id` is not an ancestor of\n`latest_snapshot_id` then the whole chain is returned but this isn\u0027t\nclear to the caller without reading the implementation or the tests.\n\n## What changes are included in this PR?\n\nDocs changes\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "f13bd41be3159df8fd42cee44fd2cb8f790d0390",
      "tree": "be96373f54531e62a5ff9e755ff24a77505825a0",
      "parents": [
        "78df272cb1a4ca3dc668e45ea5588d136d6fa642"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 20:17:18 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 20:17:18 2026 +0800"
      },
      "message": "chore(deps-dev): Bump datafusion from 52.3.0 to 54.0.0 in /bindings/python (#2807)"
    },
    {
      "commit": "78df272cb1a4ca3dc668e45ea5588d136d6fa642",
      "tree": "a527c17154cad9fc5785021aa7700d1d9c4dd189",
      "parents": [
        "b8cfa9d8ad3c53c841131db7554f91118b5edea7"
      ],
      "author": {
        "name": "Matt Butrovich",
        "email": "mbutrovich@users.noreply.github.com",
        "time": "Mon Jul 13 04:57:29 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 16:57:29 2026 +0800"
      },
      "message": "fix(arrow): error on required field absent from data file with no default (#2797)\n\n## Which issue does this PR close?\n\n- Closes #2795.\n\n## What changes are included in this PR?\n\nWhen a projected field is not present in a data file,\n`RecordBatchTransformer` resolves it using the spec\u0027s Column Projection\nfallback rules. For a field with no `initial-default` it produced a null\ncolumn (rule #4) unconditionally. That is correct only for optional\nfields.\n\nPer the spec\u0027s Default values section, null is a valid default only for\nan optional field:\n\n\u003e If either default is not set for an optional field, then the default\nvalue is null for compatibility with older spec versions.\n\nSo a required field that is absent from a data file with no\n`initial-default` has no valid value, and producing a null column for it\nviolates the field\u0027s required (non-nullable) constraint. Previously this\nsurfaced later as a confusing Arrow error (`Column \u0027\u003cname\u003e\u0027 is declared\nas non-nullable but contains null values`) instead of a clear one.\n\nThis PR adds the required-field case to the \"not present\" fallback in\n`record_batch_transformer.rs`: if a field is absent from the data file,\nhas no `initial-default`, and is required, return `Missing required\nfield: \u003cname\u003e`. The resolution order now mirrors Iceberg-Java\u0027s Parquet\nreaders (`BaseParquetReaders` / `SparkParquetReaders.defaultReader`):\nfile value, then `initial-default`, then null if optional, otherwise\nerror.\n\n## Are these changes tested?\n\nYes, a unit test in `record_batch_transformer.rs`. Together with the\nexisting `test_all_four_spec_rules` and\n`schema_evolution_adds_date_column_with_nulls`, all combinations of a\nfield absent from the data file are covered:\n\n- absent + has `initial-default` returns the default value (rule #3) -\nexisting `test_all_four_spec_rules`.\n- absent + optional + no default returns null (rule #4) - existing\n`test_all_four_spec_rules` and\n`schema_evolution_adds_date_column_with_nulls`.\n- absent + required + no default now errors with `Missing required\nfield: \u003cname\u003e` - new\n`schema_evolution_required_field_absent_without_default_errors`."
    },
    {
      "commit": "b8cfa9d8ad3c53c841131db7554f91118b5edea7",
      "tree": "a2e96aab656cd5528e37c9437171dda135b1a867",
      "parents": [
        "c6103da8bedebe86c1b29569071d739d447e4633"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 14:11:42 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 14:11:42 2026 +0800"
      },
      "message": "chore(deps): Bump the codeql-action group with 2 updates (#2808)\n\nBumps the codeql-action group with 2 updates:\n[github/codeql-action/init](https://github.com/github/codeql-action) and\n[github/codeql-action/analyze](https://github.com/github/codeql-action).\n\nUpdates `github/codeql-action/init` from 4.36.2 to 4.36.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/init\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/init\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.19.3 and earlier. These versions of\nCodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise\nServer 3.15, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP\nOIDC are now accepted. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use\n\u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better\ncompatibility with various registry implementations. For NuGet feeds,\nthe test is now always performed against the service index. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same\nmillisecond could overwrite each other on disk, causing one of them to\nbe lost. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a\"\u003e\u003ccode\u003e54f647b\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3984\"\u003e#3984\u003c/a\u003e\nfrom github/update-v4.36.3-1f34ec164\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/e78819e05527766c3c5919e3177647e280c6cb83\"\u003e\u003ccode\u003ee78819e\u003c/code\u003e\u003c/a\u003e\nTrigger checks\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/2c9d3d63eb4941734e2d29468953529a56f5ff1c\"\u003e\u003ccode\u003e2c9d3d6\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.36.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/1f34ec16430d82636d18716acc7aaa6d843b35a9\"\u003e\u003ccode\u003e1f34ec1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3983\"\u003e#3983\u003c/a\u003e\nfrom github/mbg/repo-props/ff-for-config-file-prop\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/d5f0145480025b49d8b08c3f6b36e6ad41a68c90\"\u003e\u003ccode\u003ed5f0145\u003c/code\u003e\u003c/a\u003e\nLog when repository property has a value but is ignored\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f27f56386a3c745af8d7bbfb806098c714a5e32a\"\u003e\u003ccode\u003ef27f563\u003c/code\u003e\u003c/a\u003e\nAdd test for when the FF is off\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/0025d0f2b5676fde748a0be9725dcce18dd9f986\"\u003e\u003ccode\u003e0025d0f\u003c/code\u003e\u003c/a\u003e\nUse FF\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f7fa18f05d107ff6735857c3510fbff190c9a1eb\"\u003e\u003ccode\u003ef7fa18f\u003c/code\u003e\u003c/a\u003e\nAdd FF for config file repo property\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/628fc3f124e68b0151f0d2a5d81e864ee1e42335\"\u003e\u003ccode\u003e628fc3f\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3979\"\u003e#3979\u003c/a\u003e\nfrom github/henrymercer/overlay-db-cleanup-size-tele...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/9cfb67bab9b32441237f92d4ba29a7f3ccff259f\"\u003e\u003ccode\u003e9cfb67b\u003c/code\u003e\u003c/a\u003e\nAdd clarifying comments\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `github/codeql-action/analyze` from 4.36.2 to 4.36.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003egithub/codeql-action/analyze\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.36.3\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/github/codeql-action/blob/main/CHANGELOG.md\"\u003egithub/codeql-action/analyze\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eCodeQL Action Changelog\u003c/h1\u003e\n\u003cp\u003eSee the \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases\"\u003ereleases\npage\u003c/a\u003e for the relevant changes to the CodeQL CLI and language\npacks.\u003c/p\u003e\n\u003ch2\u003e[UNRELEASED]\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.20.6 and earlier. These versions of\nCodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise\nServer 3.16, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3956\"\u003e#3956\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.37.0 - 08 Jul 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0\"\u003e2.26.0\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3995\"\u003e#3995\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIn addition to the existing input format, the\n\u003ccode\u003econfig-file\u003c/code\u003e input for the \u003ccode\u003ecodeql-action/init\u003c/code\u003e\nstep will soon support a new \u003ccode\u003e[owner/]repo[@ref][:path]\u003c/code\u003e\nformat. All components except the repository name are optional. If\nomitted, \u003ccode\u003eowner\u003c/code\u003e defaults to the same owner as the repository\nthe analysis is running for, \u003ccode\u003eref\u003c/code\u003e to \u003ccode\u003emain\u003c/code\u003e, and\n\u003ccode\u003epath\u003c/code\u003e to \u003ccode\u003e.github/codeql-action.yaml\u003c/code\u003e. Support\nfor this format ships in this version of the CodeQL Action, but will\nonly be enabled over the coming weeks. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3973\"\u003e#3973\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.3 - 01 Jul 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.2 - 04 Jun 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCache CodeQL CLI version information across Actions steps. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3943\"\u003e#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReduce requests while waiting for analysis processing by using\nexponential backoff when polling SARIF processing status. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3937\"\u003e#3937\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6\"\u003e2.25.6\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3948\"\u003e#3948\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.36.1 - 02 Jun 2026\u003c/h2\u003e\n\u003cp\u003eNo user facing changes.\u003c/p\u003e\n\u003ch2\u003e4.36.0 - 22 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eBreaking change\u003c/em\u003e: Bump the minimum required CodeQL bundle\nversion to 2.19.4. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3894\"\u003e#3894\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for SHA-256 Git object IDs. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3893\"\u003e#3893\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5\"\u003e2.25.5\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3926\"\u003e#3926\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.5 - 15 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWe have improved how the JavaScript bundles for the CodeQL Action\nare generated to avoid duplication across bundles and reduce the size of\nthe repository by around 70%. This should have no effect on the runtime\nbehaviour of the CodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3899\"\u003e#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFor performance and accuracy reasons, \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e will now only be enabled on a pull request when\ndiff-informed analysis is also enabled for that run. If diff-informed\nanalysis is unavailable (for example, because the PR diff ranges could\nnot be computed), the action will fall back to a full analysis. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3791\"\u003e#3791\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIf multiple inputs are provided for the GitHub-internal\n\u003ccode\u003eanalysis-kinds\u003c/code\u003e input, only \u003ccode\u003ecode-scanning\u003c/code\u003e will\nbe enabled. The \u003ccode\u003eanalysis-kinds\u003c/code\u003e input is experimental, for\nGitHub-internal use only, and may change without notice at any time. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3892\"\u003e#3892\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdded an experimental change which, when running a Code Scanning\nanalysis for a PR with \u003ca\nhref\u003d\"https://redirect.github.com/github/roadmap/issues/1158\"\u003eimproved\nincremental analysis\u003c/a\u003e enabled, prefers CodeQL CLI versions that have\na cached overlay-base database for the configured languages. This speeds\nup analysis for a repository when there is not yet a cached overlay-base\ndatabase for the latest CLI version. We expect to roll this change out\nto everyone in May. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3880\"\u003e#3880\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.4 - 07 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate default CodeQL bundle version to \u003ca\nhref\u003d\"https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4\"\u003e2.25.4\u003c/a\u003e.\n\u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3881\"\u003e#3881\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.35.3 - 01 May 2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cem\u003eUpcoming breaking change\u003c/em\u003e: Add a deprecation warning for\ncustomers using CodeQL version 2.19.3 and earlier. These versions of\nCodeQL were discontinued on 9 April 2026 alongside GitHub Enterprise\nServer 3.15, and will be unsupported by the next minor release of the\nCodeQL Action. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3837\"\u003e#3837\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eConfigurations for private registries that use Cloudsmith or GCP\nOIDC are now accepted. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3850\"\u003e#3850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBest-effort connection tests for private registries now use\n\u003ccode\u003eGET\u003c/code\u003e requests instead of \u003ccode\u003eHEAD\u003c/code\u003e for better\ncompatibility with various registry implementations. For NuGet feeds,\nthe test is now always performed against the service index. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3853\"\u003e#3853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a bug where two diagnostics produced within the same\nmillisecond could overwrite each other on disk, causing one of them to\nbe lost. \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/pull/3852\"\u003e#3852\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/54f647b7e1bb85c95cddabcd46b0c578ec92bc1a\"\u003e\u003ccode\u003e54f647b\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3984\"\u003e#3984\u003c/a\u003e\nfrom github/update-v4.36.3-1f34ec164\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/e78819e05527766c3c5919e3177647e280c6cb83\"\u003e\u003ccode\u003ee78819e\u003c/code\u003e\u003c/a\u003e\nTrigger checks\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/2c9d3d63eb4941734e2d29468953529a56f5ff1c\"\u003e\u003ccode\u003e2c9d3d6\u003c/code\u003e\u003c/a\u003e\nUpdate changelog for v4.36.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/1f34ec16430d82636d18716acc7aaa6d843b35a9\"\u003e\u003ccode\u003e1f34ec1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3983\"\u003e#3983\u003c/a\u003e\nfrom github/mbg/repo-props/ff-for-config-file-prop\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/d5f0145480025b49d8b08c3f6b36e6ad41a68c90\"\u003e\u003ccode\u003ed5f0145\u003c/code\u003e\u003c/a\u003e\nLog when repository property has a value but is ignored\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f27f56386a3c745af8d7bbfb806098c714a5e32a\"\u003e\u003ccode\u003ef27f563\u003c/code\u003e\u003c/a\u003e\nAdd test for when the FF is off\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/0025d0f2b5676fde748a0be9725dcce18dd9f986\"\u003e\u003ccode\u003e0025d0f\u003c/code\u003e\u003c/a\u003e\nUse FF\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/f7fa18f05d107ff6735857c3510fbff190c9a1eb\"\u003e\u003ccode\u003ef7fa18f\u003c/code\u003e\u003c/a\u003e\nAdd FF for config file repo property\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/628fc3f124e68b0151f0d2a5d81e864ee1e42335\"\u003e\u003ccode\u003e628fc3f\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/github/codeql-action/issues/3979\"\u003e#3979\u003c/a\u003e\nfrom github/henrymercer/overlay-db-cleanup-size-tele...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/github/codeql-action/commit/9cfb67bab9b32441237f92d4ba29a7f3ccff259f\"\u003e\u003ccode\u003e9cfb67b\u003c/code\u003e\u003c/a\u003e\nAdd clarifying comments\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...54f647b7e1bb85c95cddabcd46b0c578ec92bc1a\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s major version (unless you unignore this specific\ndependency\u0027s major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this\ngroup update PR and stop Dependabot creating any more for the specific\ndependency\u0027s minor version (unless you unignore this specific\ndependency\u0027s minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR\nand stop Dependabot creating any more for the specific dependency\n(unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore\nconditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will\nremove the ignore condition of the specified dependency and ignore\nconditions\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "c6103da8bedebe86c1b29569071d739d447e4633",
      "tree": "42f3470b780a32ec1bf436048b09972630ab38bb",
      "parents": [
        "92be8fdf6956e3746e221067dbe64cb5031c3331"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 14:10:03 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 14:10:03 2026 +0800"
      },
      "message": "chore(deps): Bump crate-ci/typos from 1.47.2 to 1.48.0 (#2809)\n\nBumps [crate-ci/typos](https://github.com/crate-ci/typos) from 1.47.2 to\n1.48.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/crate-ci/typos/releases\"\u003ecrate-ci/typos\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.48.0\u003c/h2\u003e\n\u003ch2\u003e[1.48.0] - 2026-06-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca\nhref\u003d\"https://redirect.github.com/crate-ci/typos/issues/1562\"\u003eJune\n2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/crate-ci/typos/blob/master/CHANGELOG.md\"\u003ecrate-ci/typos\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChange Log\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this\nfile.\u003c/p\u003e\n\u003cp\u003eThe format is based on \u003ca href\u003d\"https://keepachangelog.com/\"\u003eKeep a\nChangelog\u003c/a\u003e\nand this project adheres to \u003ca href\u003d\"https://semver.org/\"\u003eSemantic\nVersioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased] - ReleaseDate\u003c/h2\u003e\n\u003ch2\u003e[1.48.0] - 2026-06-30\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca\nhref\u003d\"https://redirect.github.com/crate-ci/typos/issues/1562\"\u003eJune\n2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.47.2] - 2026-06-04\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon\u0027t correct \u003ccode\u003einferrable\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eCorrect unused \u003ccode\u003einferible\u003c/code\u003e variant\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.47.1] - 2026-06-03\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon\u0027t correct \u003ccode\u003erequestors\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.47.0] - 2026-05-29\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdated the dictionary with the \u003ca\nhref\u003d\"https://redirect.github.com/crate-ci/typos/issues/1545\"\u003eMay\n2026\u003c/a\u003e changes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.3] - 2026-05-23\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon\u0027t correct to \u003ccode\u003esequentials\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon\u0027t correct to \u003ccode\u003esubdolder\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.2] - 2026-05-16\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDon\u0027t correct to \u003ccode\u003ecriterias\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eDon\u0027t correct to \u003ccode\u003ereplaceables\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.46.1] - 2026-05-08\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/crate-ci/typos/commit/bee27e3a4fd1ea2111cf90ab89cd076c870fce14\"\u003e\u003ccode\u003ebee27e3\u003c/code\u003e\u003c/a\u003e\nchore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/crate-ci/typos/commit/4939ca9c90a49d78125c35a3376bc5ee5c8aa489\"\u003e\u003ccode\u003e4939ca9\u003c/code\u003e\u003c/a\u003e\nchore: Release\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/crate-ci/typos/commit/44b25bec760cf3e606f713cae5dd41978c1d8295\"\u003e\u003ccode\u003e44b25be\u003c/code\u003e\u003c/a\u003e\ndocs: Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/crate-ci/typos/commit/22edab389daa634b04b0971b2ed8180c3aba0963\"\u003e\u003ccode\u003e22edab3\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/crate-ci/typos/issues/1574\"\u003e#1574\u003c/a\u003e\nfrom epage/june\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/crate-ci/typos/commit/a73679cf8e45a62643936f55f94bd8eb8c1662c8\"\u003e\u003ccode\u003ea73679c\u003c/code\u003e\u003c/a\u003e\nfeat(dict): June updates\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/crate-ci/typos/compare/37bb98842b0d8c4ffebdb75301a13db0267cef89...bee27e3a4fd1ea2111cf90ab89cd076c870fce14\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dcrate-ci/typos\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d1.47.2\u0026new-version\u003d1.48.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "92be8fdf6956e3746e221067dbe64cb5031c3331",
      "tree": "7be27fe91f50ebbaa0958ab30a998eecc61853f5",
      "parents": [
        "0b694de1ee06fc9df763d09d5179e14db10eacd8"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 14:09:24 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 14:09:24 2026 +0800"
      },
      "message": "chore(deps-dev): Bump huggingface-hub from 1.21.0 to 1.22.0 in /bindings/python (#2806)\n\nBumps [huggingface-hub](https://github.com/huggingface/huggingface_hub)\nfrom 1.21.0 to 1.22.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/releases\"\u003ehuggingface-hub\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[v1.22.0] Sandboxes, faster downloads, and a rebuilt CLI\u003c/h2\u003e\n\u003ch2\u003e🖥️ Sandboxes: isolated cloud machines on top of Jobs\u003c/h2\u003e\n\u003cp\u003eSandboxes are isolated cloud machines you can spin up in seconds, run\ncommands in with live-streamed output, and move files in and out of —\nall from Python or the CLI. They are built entirely on top of Jobs:\nunder the hood a sandbox is just a Job running a tiny static server, so\nany Docker image with \u003ccode\u003e/bin/sh\u003c/code\u003e works and it inherits Jobs\u0027\nbilling, hardware flavors, and namespace permissions for free. Two\nflavors are available: \u003ccode\u003eSandbox.create\u003c/code\u003e for a dedicated VM\n(GPU workloads, untrusted code, full isolation) and\n\u003ccode\u003eSandboxPool\u003c/code\u003e to pack many cheap CPU sandboxes into a few\nshared host VMs for fan-out workloads like RL rollouts. This release\nalso adds background processes (\u003ccode\u003esbx.run(...,\nbackground\u003dTrue)\u003c/code\u003e / \u003ccode\u003ehf sandbox spawn\u003c/code\u003e) and a port\nproxy (\u003ccode\u003eSandbox.proxy_url_for\u003c/code\u003e) so you can reach a server\nrunning inside a sandbox from the outside over HTTP or WebSocket.\u003c/p\u003e\n\u003cpre lang\u003d\"python\"\u003e\u003ccode\u003efrom huggingface_hub import Sandbox\n\u003cp\u003ewith Sandbox.create(image\u003d\u0026quot;python:3.12\u0026quot;) as sbx: # ready in\n~6s\nsbx.files.write(\u0026quot;/app/main.py\u0026quot;, \u0026quot;print(40 + 2)\u0026quot;)\nprint(sbx.run(\u0026quot;python /app/main.py\u0026quot;).stdout)    # 42\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cpre lang\u003d\"bash\"\u003e\u003ccode\u003e# Create, run, copy files, and terminate from the\nterminal\nhf sandbox create\nhf sandbox exec \u0026lt;id\u0026gt; -- python -c \u0026quot;print(\u0027hi\u0027)\u0026quot;\nhf sandbox cp data.csv \u0026lt;id\u0026gt;:/data/data.csv\nhf sandbox kill \u0026lt;id\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003e[Sandbox] Add Sandbox API and \u003ccode\u003ehf sandbox\u003c/code\u003e CLI on top of\nJobs by \u003ca href\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4350\"\u003e#4350\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[Sandbox] Background processes + proxy to reach in-sandbox servers\nby \u003ca href\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4444\"\u003e#4444\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e📚 \u003cstrong\u003eDocumentation:\u003c/strong\u003e \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/sandbox\"\u003eSandboxes\nguide\u003c/a\u003e, \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/package_reference/sandbox\"\u003eSandbox\nreference\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e⚡ Faster snapshot downloads with a tree cache\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003esnapshot_download\u003c/code\u003e now caches a repository\u0027s file listing\non disk under a new \u003ccode\u003etrees/\u003c/code\u003e folder, so re-downloading a\ncommit that\u0027s already cached costs a single network call — resolving the\nbranch or tag to a commit hash — instead of one metadata request per\nfile. The listing is immutable per commit and shared by both\n\u003ccode\u003esnapshot_download\u003c/code\u003e and \u003ccode\u003ehf_hub_download\u003c/code\u003e; for\nXet-enabled files it also skips the per-file HEAD \u003ccode\u003e/resolve\u003c/code\u003e\nrequest entirely, rebuilding the metadata from the cached listing. As a\ndeliberate side effect of the completeness check, when the Hub can\u0027t be\nreached and the local snapshot is missing requested files,\n\u003ccode\u003esnapshot_download\u003c/code\u003e now raises\n\u003ccode\u003eIncompleteSnapshotError\u003c/code\u003e instead of silently returning a\npartial folder.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e[Download] Cache repo tree listing on disk in snapshot_download by\n\u003ca href\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4394\"\u003e#4394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e📚 \u003cstrong\u003eDocumentation:\u003c/strong\u003e \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/manage-cache\"\u003eManage\nyour cache\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e🛠️ CLI rebuilt on Click (drops Typer)\u003c/h2\u003e\n\u003cp\u003eThe entire \u003ccode\u003ehf\u003c/code\u003e CLI now runs on a small in-house layer\nover Click 8.x instead of Typer, which had vendored Click in a way that\nbroke the CLI\u0027s custom help rendering, error enrichment, and shell\ncompletion — and forced capping \u003ccode\u003etyper\u0026lt;0.26\u003c/code\u003e. The\nmigration preserves existing behavior: \u003ccode\u003e--help\u003c/code\u003e output is\nbyte-identical, the generated \u003ccode\u003ecli.md\u003c/code\u003e reference is unchanged\napart from a header comment, and shell completion now uses Click\u0027s\nnative completion. The public \u003ccode\u003etyper_factory\u003c/code\u003e helper is kept\nso downstream libraries like \u003ccode\u003etransformers\u003c/code\u003e that register\ntheir own commands keep working.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e[CLI] Add a minimal Click framework for the CLI by \u003ca\nhref\u003d\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4462\"\u003e#4462\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e💔 Breaking Change\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[Upload] Deprecate upload_large_folder (API + CLI) by \u003ca\nhref\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4414\"\u003e#4414\u003c/a\u003e\n— \u003ccode\u003eupload_large_folder\u003c/code\u003e and \u003ccode\u003ehf\nupload-large-folder\u003c/code\u003e are now deprecated in favor of\n\u003ccode\u003eupload_folder\u003c/code\u003e / \u003ccode\u003ehf upload\u003c/code\u003e, which handle very\nlarge and resumable uploads out of the box.\u003c/li\u003e\n\u003cli\u003eMake filter_repo_objects pattern matching case-sensitive on all\nplatforms by \u003ca\nhref\u003d\"https://github.com/Sreekant13\"\u003e\u003ccode\u003e@​Sreekant13\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4435\"\u003e#4435\u003c/a\u003e\n— \u003ccode\u003eallow_patterns\u003c/code\u003e/\u003ccode\u003eignore_patterns\u003c/code\u003e now match\ncase-sensitively on every OS (aligned with case-sensitive Hub paths). On\nWindows this is a behavior change: patterns like \u003ccode\u003e*.PDF\u003c/code\u003e no\nlonger match \u003ccode\u003efile.pdf\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e[Inference Providers] Remove dead inference providers by \u003ca\nhref\u003d\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4447\"\u003e#4447\u003c/a\u003e\n— removes six providers no longer routed by the Hub\n(\u003ccode\u003eblack-forest-labs\u003c/code\u003e, \u003ccode\u003eclarifai\u003c/code\u003e,\n\u003ccode\u003ehyperbolic\u003c/code\u003e, \u003ccode\u003enebius\u003c/code\u003e, \u003ccode\u003envidia\u003c/code\u003e,\n\u003ccode\u003esambanova\u003c/code\u003e) — \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/inference\"\u003edocs\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🖥️ CLI\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e[CLI] Add \u003ccode\u003ehf discussions edit\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4415\"\u003e#4415\u003c/a\u003e\n— \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/cli\"\u003edocs\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[CLI] hf cache: surface \u0026amp; prune incomplete downloads by \u003ca\nhref\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4416\"\u003e#4416\u003c/a\u003e\n— \u003ccode\u003ehf cache ls\u003c/code\u003e now flags leftover \u003ccode\u003e.incomplete\u003c/code\u003e\nfiles and \u003ccode\u003ehf cache prune\u003c/code\u003e removes them automatically — \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/manage-cache\"\u003edocs\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/5db966a5f52fcf9235508a46a855390f0b95d23a\"\u003e\u003ccode\u003e5db966a\u003c/code\u003e\u003c/a\u003e\nRelease: v1.22.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/1d6e7d0e6623f758d86bdbb244bd0aca2b286d7e\"\u003e\u003ccode\u003e1d6e7d0\u003c/code\u003e\u003c/a\u003e\nRelease: v1.22.0.rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/8f03d83624c624084fd1e1ee4d021612408421d5\"\u003e\u003ccode\u003e8f03d83\u003c/code\u003e\u003c/a\u003e\nExpose base_model filter param on get_dataset_leaderboard (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4474\"\u003e#4474\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/cc4e7cc67ae944d9e3d3e6dc3d44ef95be1f944f\"\u003e\u003ccode\u003ecc4e7cc\u003c/code\u003e\u003c/a\u003e\n[Http] Support standard Retry-After header in http_backoff (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4460\"\u003e#4460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/7b53d234c37aa0b6dbe28c6000c9cb9c38598f17\"\u003e\u003ccode\u003e7b53d23\u003c/code\u003e\u003c/a\u003e\n[CLI] Add a minimal Click framework for the CLI (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4462\"\u003e#4462\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/4db84d02cd2ceca9a27d694df264de9ce8ecbfb0\"\u003e\u003ccode\u003e4db84d0\u003c/code\u003e\u003c/a\u003e\nDocs: Jobs are no longer Pro-only — update availability note in jobs\nguide (#...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/a13927790106a76f6099179a366f334c4533e84b\"\u003e\u003ccode\u003ea139277\u003c/code\u003e\u003c/a\u003e\nAccept two-letter byte units (KB/MB/GB/TB/PB) in parse_size (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4468\"\u003e#4468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/28aecd91906a78888252c3254b69821ef0518122\"\u003e\u003ccode\u003e28aecd9\u003c/code\u003e\u003c/a\u003e\nFix KeyError in get_dataset_leaderboard when entry has no source (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4473\"\u003e#4473\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/f70f00d3f1d7ef0672065e2b8b8df9ee8123d50b\"\u003e\u003ccode\u003ef70f00d\u003c/code\u003e\u003c/a\u003e\nRemove Usage command lists from CLI module docstrings (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4472\"\u003e#4472\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/031d0020f59fabdf7a2feb09066e3e16afa3c3cc\"\u003e\u003ccode\u003e031d002\u003c/code\u003e\u003c/a\u003e\n[CLI] Expose \u003ccode\u003eout\u003c/code\u003e singleton publicly + add\n\u003ccode\u003eout.log\u003c/code\u003e method (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4471\"\u003e#4471\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/compare/v1.21.0...v1.22.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "0b694de1ee06fc9df763d09d5179e14db10eacd8",
      "tree": "67affaa14c9aba3dae60a6068ed826d0b3acfca9",
      "parents": [
        "25ba70a17f79ae53959f4240367bb99d36fe0b02"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 11:50:21 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 11:50:21 2026 +0800"
      },
      "message": "chore(deps): Bump astral-sh/setup-uv from 8.2.0 to 8.3.0 (#2817)\n\nBumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from\n8.2.0 to 8.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/d31148d669074a8d0a63714ba94f3201e7020bc3\"\u003e\u003ccode\u003ed31148d\u003c/code\u003e\u003c/a\u003e\nStrip environment markers from detected uv dependency pins (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/938\"\u003e#938\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/17c398959b4611a88929fabb5c563a8e43a0ff60\"\u003e\u003ccode\u003e17c3989\u003c/code\u003e\u003c/a\u003e\nFix cache keys for Python version ranges (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/937\"\u003e#937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/3cc3c11fdf511cab39136b7c946d973d4ad0df20\"\u003e\u003ccode\u003e3cc3c11\u003c/code\u003e\u003c/a\u003e\nchore(deps): roll up Dependabot updates (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/936\"\u003e#936\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/9225f843d7a9f80a757cf25ef48901fda69ba4bc\"\u003e\u003ccode\u003e9225f84\u003c/code\u003e\u003c/a\u003e\nchore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0\n(\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/924\"\u003e#924\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/fc16fa3bbf37d2816834f76a1fe25d33564eaa34\"\u003e\u003ccode\u003efc16fa3\u003c/code\u003e\u003c/a\u003e\nchore(deps): bump actions/checkout from 6.0.2 to 7.0.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/926\"\u003e#926\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/a1a7345c8ef5d6d3b18c6f1c247244c19f1d878c\"\u003e\u003ccode\u003ea1a7345\u003c/code\u003e\u003c/a\u003e\nci: call docs update workflow from release (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/933\"\u003e#933\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/a5e9cbfd5f946647f478460490fa497b0a732e63\"\u003e\u003ccode\u003ea5e9cbf\u003c/code\u003e\u003c/a\u003e\ndocs: update version references to v8.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/932\"\u003e#932\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/c5680ec91f7b9b91406fab4ded5d45245abf7b67\"\u003e\u003ccode\u003ec5680ec\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.26 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/930\"\u003e#930\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/c86fe4ef1f4a79845e6d465628d733650f6c41d8\"\u003e\u003ccode\u003ec86fe4e\u003c/code\u003e\u003c/a\u003e\nAdd a threat model for setup-uv (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/923\"\u003e#923\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/commit/224c887d488ab24d8a1b49f10416d6ad6b6ca71d\"\u003e\u003ccode\u003e224c887\u003c/code\u003e\u003c/a\u003e\nchore: update known checksums for 0.11.25 (\u003ca\nhref\u003d\"https://redirect.github.com/astral-sh/setup-uv/issues/929\"\u003e#929\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/astral-sh/setup-uv/compare/fac544c07dec837d0ccb6301d7b5580bf5edae39...d31148d669074a8d0a63714ba94f3201e7020bc3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dastral-sh/setup-uv\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d8.2.0\u0026new-version\u003d8.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "25ba70a17f79ae53959f4240367bb99d36fe0b02",
      "tree": "cdf22df50ae8c55cd4e5e636c812dd83c06cf52d",
      "parents": [
        "7453309ab810abbe943bab146c11a193a8884dd4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 11:49:44 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 11:49:44 2026 +0800"
      },
      "message": "chore(deps): Bump taiki-e/install-action from 2.82.2 to 2.82.9 (#2816)\n\nBumps\n[taiki-e/install-action](https://github.com/taiki-e/install-action) from\n2.82.2 to 2.82.9.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/releases\"\u003etaiki-e/install-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.82.9\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.8.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-tarpaulin@latest\u003c/code\u003e to 0.37.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-leptos@latest\u003c/code\u003e to 0.3.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.8\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.8.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.26.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etypos@latest\u003c/code\u003e to 1.48.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.72.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.1.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.55.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.1.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.105.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003egungraun-runner@latest\u003c/code\u003e to 0.19.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eeditorconfig-checker@latest\u003c/code\u003e to 3.8.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.55.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-tarpaulin@latest\u003c/code\u003e to 0.36.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.6\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.25.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003esyft@latest\u003c/code\u003e to 1.46.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.55.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md\"\u003etaiki-e/install-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this\nfile.\u003c/p\u003e\n\u003cp\u003eThis project adheres to \u003ca href\u003d\"https://semver.org\"\u003eSemantic\nVersioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[2.83.2] - 2026-07-12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eparse-dockerfile@latest\u003c/code\u003e to 0.1.8.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.56.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003egungraun-runner@latest\u003c/code\u003e to 0.19.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-neat@latest\u003c/code\u003e to 0.4.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.83.1] - 2026-07-10\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003erclone@latest\u003c/code\u003e to 1.74.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-deny@latest\u003c/code\u003e to 0.20.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.83.0] - 2026-07-09\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport \u003ccode\u003ecargo-about\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/taiki-e/install-action/pull/1924\"\u003e#1924\u003c/a\u003e,\nthanks \u003ca\nhref\u003d\"https://github.com/ruffsl\"\u003e\u003ccode\u003e@​ruffsl\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.28.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emartin@latest\u003c/code\u003e to 1.12.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.106.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.82.11] - 2026-07-08\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.253.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.27.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/4684b8405694ae9dd42c9f39ba901a70ae83f4a3\"\u003e\u003ccode\u003e4684b84\u003c/code\u003e\u003c/a\u003e\nRelease 2.82.9\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/29fb1dbe52c0247f03f90f9dd43b08d3c603510b\"\u003e\u003ccode\u003e29fb1db\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.9\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/584230b16680bbb1ddef3c65a89568570fd36f69\"\u003e\u003ccode\u003e584230b\u003c/code\u003e\u003c/a\u003e\nUpdate tombi manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/1872019a1c4268421e4c2d5f230285190a08b258\"\u003e\u003ccode\u003e1872019\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.8\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/3e817d29dde43a866e242560569eb7f418035f1a\"\u003e\u003ccode\u003e3e817d2\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ecargo-tarpaulin@latest\u003c/code\u003e to 0.37.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/a71dd1a66df622ab4134f69df1b8c4b7a8889ddf\"\u003e\u003ccode\u003ea71dd1a\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ecargo-leptos@latest\u003c/code\u003e to 0.3.7\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/c93ccc03e00cd0e08e494f5fd058a6c55a6a1907\"\u003e\u003ccode\u003ec93ccc0\u003c/code\u003e\u003c/a\u003e\nRelease 2.82.8\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/5083f1886534d6d96c49df934ae7106b35fd488e\"\u003e\u003ccode\u003e5083f18\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.8\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/fdd68a857612ac3f29f4abaa6be9f4d379946632\"\u003e\u003ccode\u003efdd68a8\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.26\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/3b61d4b2086bc6aee10b8e58f1e6a25675e03da4\"\u003e\u003ccode\u003e3b61d4b\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003etypos@latest\u003c/code\u003e to 1.48.0\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/compare/v2.82.2...4684b8405694ae9dd42c9f39ba901a70ae83f4a3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dtaiki-e/install-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d2.82.2\u0026new-version\u003d2.82.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "7453309ab810abbe943bab146c11a193a8884dd4",
      "tree": "6fb7ed920a4a0360f93c3fb4486e985a221a209b",
      "parents": [
        "bc1b585237bf9c78600ca8318984ea913bf96a9b"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 11:48:57 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 11:48:57 2026 +0800"
      },
      "message": "chore(deps): Bump reqwest from 0.12.28 to 0.13.4 (#2810)\n\nBumps [reqwest](https://github.com/seanmonstar/reqwest) from 0.12.28 to\n0.13.4.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/releases\"\u003ereqwest\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.13.4\u003c/h2\u003e\n\u003ch2\u003etl;dr\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::tls_sslkeylogfile(bool)\u003c/code\u003e option to\nallow using the related environment variable.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::http2_keep_alive_*\u003c/code\u003e options for the\n\u003ccode\u003eblocking\u003c/code\u003e client.\u003c/li\u003e\n\u003cli\u003eAdd TLS 1.3 support when using \u003ccode\u003enative-tls\u003c/code\u003e backend.\u003c/li\u003e\n\u003cli\u003eFix redirect handling to strip sensitive headers when the scheme\nchanges.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 happy-eyeball connection creation.\u003c/li\u003e\n\u003cli\u003eUpgrade hickory-resolver to 0.26.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix(tls): improve rustls-no-provider panic message and add module\ndocs by \u003ca href\u003d\"https://github.com/smythg4\"\u003e\u003ccode\u003e@​smythg4\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3021\"\u003eseanmonstar/reqwest#3021\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: do not lose the url in error when decoding json by \u003ca\nhref\u003d\"https://github.com/Dushistov\"\u003e\u003ccode\u003e@​Dushistov\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3026\"\u003eseanmonstar/reqwest#3026\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd tls_sslkeylogfile builder method by \u003ca\nhref\u003d\"https://github.com/passcod\"\u003e\u003ccode\u003e@​passcod\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2923\"\u003eseanmonstar/reqwest#2923\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(redirect): strip sensitive headers on scheme change across\nredirects by \u003ca href\u003d\"https://github.com/SAY-5\"\u003e\u003ccode\u003e@​SAY-5\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3034\"\u003eseanmonstar/reqwest#3034\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: upgrade MSRV to 1.85 by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3038\"\u003eseanmonstar/reqwest#3038\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: clean up minimal-versions CI job by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3039\"\u003eseanmonstar/reqwest#3039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(http3): use happy eyeballs for h3 connect by \u003ca\nhref\u003d\"https://github.com/lyuzichong\"\u003e\u003ccode\u003e@​lyuzichong\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3030\"\u003eseanmonstar/reqwest#3030\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update hickory-resolver to 0.26 and adjust code accordingly by\n\u003ca href\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3040\"\u003eseanmonstar/reqwest#3040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: remove unwrap in hickory initialization by \u003ca\nhref\u003d\"https://github.com/mat813\"\u003e\u003ccode\u003e@​mat813\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3041\"\u003eseanmonstar/reqwest#3041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(https): support TLS 1.3 as min version under native-tls 🎉 by \u003ca\nhref\u003d\"https://github.com/AverageHelper\"\u003e\u003ccode\u003e@​AverageHelper\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2975\"\u003eseanmonstar/reqwest#2975\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpose keep alive configurations in blocking client by \u003ca\nhref\u003d\"https://github.com/aeb-dev\"\u003e\u003ccode\u003e@​aeb-dev\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3043\"\u003eseanmonstar/reqwest#3043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare v0.13.4 by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3046\"\u003eseanmonstar/reqwest#3046\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/smythg4\"\u003e\u003ccode\u003e@​smythg4\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3021\"\u003eseanmonstar/reqwest#3021\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dushistov\"\u003e\u003ccode\u003e@​Dushistov\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3026\"\u003eseanmonstar/reqwest#3026\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/SAY-5\"\u003e\u003ccode\u003e@​SAY-5\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3034\"\u003eseanmonstar/reqwest#3034\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/mat813\"\u003e\u003ccode\u003e@​mat813\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3041\"\u003eseanmonstar/reqwest#3041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/AverageHelper\"\u003e\u003ccode\u003e@​AverageHelper\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2975\"\u003eseanmonstar/reqwest#2975\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aeb-dev\"\u003e\u003ccode\u003e@​aeb-dev\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3043\"\u003eseanmonstar/reqwest#3043\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/compare/v0.13.3...v0.13.4\"\u003ehttps://github.com/seanmonstar/reqwest/compare/v0.13.3...v0.13.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.13.3\u003c/h2\u003e\n\u003ch2\u003etl;dr\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CertificateRevocationList parsing of PEM values.\u003c/li\u003e\n\u003cli\u003eFix logging in resolver to only show host, not full URL.\u003c/li\u003e\n\u003cli\u003eFix hickory-dns to fallback to a default if\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e fails.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to handle \u003ccode\u003eSTOP_SENDING\u003c/code\u003e as not an error.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 pool to remove timed out QUIC connections.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 connection establishment picking IPv4 and IPv6.\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier.\u003c/li\u003e\n\u003cli\u003e(wasm) Only use wasm-bindgen on unknown-* targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate docs.rs Features by \u003ca\nhref\u003d\"https://github.com/JamesWiresmith\"\u003e\u003ccode\u003e@​JamesWiresmith\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2961\"\u003eseanmonstar/reqwest#2961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: fallback to hickory_resolver\u0027s default config if reading\n/etc/resolv.conf fails by \u003ca\nhref\u003d\"https://github.com/monosans\"\u003e\u003ccode\u003e@​monosans\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2797\"\u003eseanmonstar/reqwest#2797\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: remove timeout con by \u003ca\nhref\u003d\"https://github.com/cuiweixie\"\u003e\u003ccode\u003e@​cuiweixie\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2967\"\u003eseanmonstar/reqwest#2967\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ehttp3: handle stop_sending without error by \u003ca\nhref\u003d\"https://github.com/anuraaga\"\u003e\u003ccode\u003e@​anuraaga\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2978\"\u003eseanmonstar/reqwest#2978\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md\"\u003ereqwest\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.13.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::tls_sslkeylogfile(bool)\u003c/code\u003e option to\nallow using the related environment variable.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eClientBuilder::http2_keep_alive_*\u003c/code\u003e options for the\n\u003ccode\u003eblocking\u003c/code\u003e client.\u003c/li\u003e\n\u003cli\u003eAdd TLS 1.3 support when using \u003ccode\u003enative-tls\u003c/code\u003e backend.\u003c/li\u003e\n\u003cli\u003eFix redirect handling to strip sensitive headers when the scheme\nchanges.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 happy-eyeball connection creation.\u003c/li\u003e\n\u003cli\u003eUpgrade hickory-resolver to 0.26.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CertificateRevocationList parsing of PEM values.\u003c/li\u003e\n\u003cli\u003eFix logging in resolver to only show host, not full URL.\u003c/li\u003e\n\u003cli\u003eFix hickory-dns to fallback to a default if\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e fails.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to handle \u003ccode\u003eSTOP_SENDING\u003c/code\u003e as not an error.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 pool to remove timed out QUIC connections.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 connection establishment picking IPv4 and IPv6.\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier.\u003c/li\u003e\n\u003cli\u003e(wasm) Only use wasm-bindgen on unknown-* targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix HTTP/2 and native-tls ALPN feature combinations.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to send h3 ALPN.\u003c/li\u003e\n\u003cli\u003e(wasm) fix \u003ccode\u003eRequestBuilder::json()\u003c/code\u003e from override\npreviously set content-type.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixes compiling with rustls on Android targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003ev0.13.0\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eBreaking changes\u003c/strong\u003e:\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003erustls\u003c/code\u003e is now the default TLS backend, instead of\n\u003ccode\u003enative-tls\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erustls\u003c/code\u003e crypto provider defaults to aws-lc instead of\n\u003cem\u003ering\u003c/em\u003e. (\u003ccode\u003erustls-no-provider\u003c/code\u003e exists if you want a\ndifferent crypto provider)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erustls-tls\u003c/code\u003e has been renamed to\n\u003ccode\u003erustls\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003erustls roots features removed, \u003ccode\u003erustls-platform-verifier\u003c/code\u003e\nis used by default.\n\u003cul\u003e\n\u003cli\u003eTo use different roots, call\n\u003ccode\u003etls_certs_only(your_roots)\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003enative-tls\u003c/code\u003e now includes ALPN. To disable, use\n\u003ccode\u003enative-tls-no-alpn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003equery\u003c/code\u003e and \u003ccode\u003eform\u003c/code\u003e are now crate features,\ndisabled by default.\u003c/li\u003e\n\u003cli\u003eLong-deprecated methods and crate features have been removed (such\nas \u003ccode\u003etrust-dns\u003c/code\u003e, which was renamed \u003ccode\u003ehickory-dns\u003c/code\u003e a\nwhile ago).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMany TLS-related methods renamed to improve autocompletion and\ndiscovery, but previous name left in place with a \u0026quot;soft\u0026quot;\ndeprecation. (just documented, no warnings)\n\u003cul\u003e\n\u003cli\u003eFor example, prefer \u003ccode\u003etls_backend_rustls()\u003c/code\u003e over\n\u003ccode\u003euse_rustls_tls()\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/11489b34eda6d32b15ad4033e62beba2ee401350\"\u003e\u003ccode\u003e11489b3\u003c/code\u003e\u003c/a\u003e\nv0.13.4\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/d31ffbbf84ee718eb543fa203f25b9f78d02b5cd\"\u003e\u003ccode\u003ed31ffbb\u003c/code\u003e\u003c/a\u003e\nfeat: Expose HTTP2 keep alive configurations in blocking client (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3043\"\u003e#3043\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/79ed0d712b4f9f00ffecb5103593cbf460f5bfa5\"\u003e\u003ccode\u003e79ed0d7\u003c/code\u003e\u003c/a\u003e\nfeat: support TLS 1.3 as min version under native-tls 🎉 (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2975\"\u003e#2975\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/fb7bf6ae6dace30613b964425cf2b6039e9d388f\"\u003e\u003ccode\u003efb7bf6a\u003c/code\u003e\u003c/a\u003e\nfix: remove unwrap in hickory initialization (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3041\"\u003e#3041\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/3da616fd4b5987e5b1f5f7e9f07d14b2cd603254\"\u003e\u003ccode\u003e3da616f\u003c/code\u003e\u003c/a\u003e\nfix: update hickory-resolver to 0.26 and adjust code accordingly (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3040\"\u003e#3040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/c77e7b2de5b706ec35629e0302feff8e82969d7d\"\u003e\u003ccode\u003ec77e7b2\u003c/code\u003e\u003c/a\u003e\nfix(http3): use happy eyeballs for h3 connect (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3030\"\u003e#3030\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/9cbb65b3d3cd4ab05a859366bbb70e47bec7dc8c\"\u003e\u003ccode\u003e9cbb65b\u003c/code\u003e\u003c/a\u003e\nchore: clean up minimal-versions CI job (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3039\"\u003e#3039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/17a7dc5a893b64509ed2d539892fe35f5feee255\"\u003e\u003ccode\u003e17a7dc5\u003c/code\u003e\u003c/a\u003e\nchore: upgrade MSRV to 1.85 (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3038\"\u003e#3038\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/03db63a48f35135c2f2c8b7aaa578217d5f678fe\"\u003e\u003ccode\u003e03db63a\u003c/code\u003e\u003c/a\u003e\nfix(redirect): strip sensitive headers on scheme change across redirects\n(\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3034\"\u003e#3034\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/4b813a89dcd97a4b283fda02bd458d44339850c7\"\u003e\u003ccode\u003e4b813a8\u003c/code\u003e\u003c/a\u003e\nfeat: add tls_sslkeylogfile builder method (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2923\"\u003e#2923\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/compare/v0.12.28...v0.13.4\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "bc1b585237bf9c78600ca8318984ea913bf96a9b",
      "tree": "faddd90156807f34371c229f827debf5d217cad3",
      "parents": [
        "d1b8eacd87e3601b9b5c59dfa21c3f2a925a7240"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 13 09:46:28 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 13 09:46:28 2026 +0800"
      },
      "message": "chore(deps): Bump rand from 0.9.4 to 0.10.2 (#2818)\n\nBumps [rand](https://github.com/rust-random/rand) from 0.9.4 to 0.10.2.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/rust-random/rand/blob/master/CHANGELOG.md\"\u003erand\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[0.10.2] — 2026-07-02\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix possible memory safety violation due to deserialization of\n\u003ccode\u003eUniformChar\u003c/code\u003e from bad source (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1790\"\u003e#1790\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocument required output order of fn \u003ccode\u003epartial_shuffle\u003c/code\u003e\nand apply \u003ccode\u003e#[must_use]\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1769\"\u003e#1769\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid usage of \u003ccode\u003eunsafe\u003c/code\u003e in contexts where non-local\nmemory corruption could invalidate contract (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1791\"\u003e#1791\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1769\"\u003e#1769\u003c/a\u003e:\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/pull/1769\"\u003erust-random/rand#1769\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1790\"\u003e#1790\u003c/a\u003e:\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/pull/1790\"\u003erust-random/rand#1790\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1791\"\u003e#1791\u003c/a\u003e:\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/pull/1791\"\u003erust-random/rand#1791\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e[0.10.1] — 2026-02-11\u003c/h2\u003e\n\u003cp\u003eThis release includes a fix for a soundness bug; see \u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1763\"\u003e#1763\u003c/a\u003e.\u003c/p\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocument panic behavior of \u003ccode\u003emake_rng\u003c/code\u003e and add\n\u003ccode\u003e#[track_caller]\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1761\"\u003e#1761\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDeprecate feature \u003ccode\u003elog\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1763\"\u003e#1763\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1761\"\u003e#1761\u003c/a\u003e:\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/pull/1761\"\u003erust-random/rand#1761\u003c/a\u003e\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1763\"\u003e#1763\u003c/a\u003e:\n\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/pull/1763\"\u003erust-random/rand#1763\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e[0.10.0] - 2026-02-08\u003c/h2\u003e\n\u003ch3\u003eChanges\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe dependency on \u003ccode\u003erand_chacha\u003c/code\u003e has been replaced with a\ndependency on \u003ccode\u003echacha20\u003c/code\u003e. This changes the implementation\nbehind \u003ccode\u003eStdRng\u003c/code\u003e, but the output remains the same. There may\nbe some API breakage when using the ChaCha-types directly as these are\nnow the ones in \u003ccode\u003echacha20\u003c/code\u003e instead of\n\u003ccode\u003erand_chacha\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1642\"\u003e#1642\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eRename fns \u003ccode\u003eIndexedRandom::choose_multiple\u003c/code\u003e -\u0026gt;\n\u003ccode\u003esample\u003c/code\u003e, \u003ccode\u003echoose_multiple_array\u003c/code\u003e -\u0026gt;\n\u003ccode\u003esample_array\u003c/code\u003e, \u003ccode\u003echoose_multiple_weighted\u003c/code\u003e -\u0026gt;\n\u003ccode\u003esample_weighted\u003c/code\u003e, struct \u003ccode\u003eSliceChooseIter\u003c/code\u003e -\u0026gt;\n\u003ccode\u003eIndexedSamples\u003c/code\u003e and fns\n\u003ccode\u003eIteratorRandom::choose_multiple\u003c/code\u003e -\u0026gt; \u003ccode\u003esample\u003c/code\u003e,\n\u003ccode\u003echoose_multiple_fill\u003c/code\u003e -\u0026gt; \u003ccode\u003esample_fill\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1632\"\u003e#1632\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse Edition 2024 and MSRV 1.85 (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1653\"\u003e#1653\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eLet \u003ccode\u003eFill\u003c/code\u003e be implemented for element types, not\nsliceable types (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1652\"\u003e#1652\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eOsError::raw_os_error\u003c/code\u003e on UEFI targets by returning\n\u003ccode\u003eOption\u0026lt;usize\u0026gt;\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1665\"\u003e#1665\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReplace fn \u003ccode\u003eTryRngCore::read_adapter(..) -\u0026gt;\nRngReadAdapter\u003c/code\u003e with simpler struct \u003ccode\u003eRngReader\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1669\"\u003e#1669\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemove fns \u003ccode\u003eSeedableRng::from_os_rng\u003c/code\u003e,\n\u003ccode\u003etry_from_os_rng\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1674\"\u003e#1674\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemove \u003ccode\u003eClone\u003c/code\u003e support for \u003ccode\u003eStdRng\u003c/code\u003e,\n\u003ccode\u003eReseedingRng\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1677\"\u003e#1677\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003epostcard\u003c/code\u003e instead of \u003ccode\u003ebincode\u003c/code\u003e to test\nthe serde feature (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1693\"\u003e#1693\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid excessive allocation in \u003ccode\u003eIteratorRandom::sample\u003c/code\u003e\nwhen \u003ccode\u003eamount\u003c/code\u003e is much larger than iterator size (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1695\"\u003e#1695\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRename \u003ccode\u003eos_rng\u003c/code\u003e -\u0026gt; \u003ccode\u003esys_rng\u003c/code\u003e,\n\u003ccode\u003eOsRng\u003c/code\u003e -\u0026gt; \u003ccode\u003eSysRng\u003c/code\u003e, \u003ccode\u003eOsError\u003c/code\u003e -\u0026gt;\n\u003ccode\u003eSysError\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1697\"\u003e#1697\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRename \u003ccode\u003eRng\u003c/code\u003e -\u0026gt; \u003ccode\u003eRngExt\u003c/code\u003e as upstream\n\u003ccode\u003erand_core\u003c/code\u003e has renamed \u003ccode\u003eRngCore\u003c/code\u003e -\u0026gt;\n\u003ccode\u003eRng\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1717\"\u003e#1717\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eAdditions\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd fns \u003ccode\u003eIndexedRandom::choose_iter\u003c/code\u003e,\n\u003ccode\u003echoose_weighted_iter\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1632\"\u003e#1632\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePub export \u003ccode\u003eXoshiro128PlusPlus\u003c/code\u003e,\n\u003ccode\u003eXoshiro256PlusPlus\u003c/code\u003e prngs (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1649\"\u003e#1649\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePub export \u003ccode\u003eChaCha8Rng\u003c/code\u003e, \u003ccode\u003eChaCha12Rng\u003c/code\u003e,\n\u003ccode\u003eChaCha20Rng\u003c/code\u003e behind \u003ccode\u003echacha\u003c/code\u003e feature (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1659\"\u003e#1659\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFn \u003ccode\u003erand::make_rng() -\u0026gt; R where R: SeedableRng\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1734\"\u003e#1734\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRemovals\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved \u003ccode\u003eReseedingRng\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1722\"\u003e#1722\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved unused feature \u0026quot;nightly\u0026quot; (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1732\"\u003e#1732\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved feature \u003ccode\u003esmall_rng\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1732\"\u003e#1732\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/1540ea327e8beaf0694ea64f6d9eb8eaadd47bd5\"\u003e\u003ccode\u003e1540ea3\u003c/code\u003e\u003c/a\u003e\nPrepare rand 0.10.2 (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1800\"\u003e#1800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/a29964ad94b54c25b3865626de6964ce0f796a29\"\u003e\u003ccode\u003ea29964a\u003c/code\u003e\u003c/a\u003e\nBump chacha20 from 0.10.0 to 0.10.1 in the all-deps group (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1801\"\u003e#1801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/ced94914cb75c93a1f19140a966a466345185fff\"\u003e\u003ccode\u003eced9491\u003c/code\u003e\u003c/a\u003e\nTweak docs for RngExt::random_range and SampleRange (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1798\"\u003e#1798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/db146647afaf002b866420d34e4501b0dd872163\"\u003e\u003ccode\u003edb14664\u003c/code\u003e\u003c/a\u003e\nCheck UniformChar validity on deser (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1790\"\u003e#1790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/bea8620204c7aeecdefc132b5cb0dec8134add4b\"\u003e\u003ccode\u003ebea8620\u003c/code\u003e\u003c/a\u003e\nBump the all-deps group with 2 updates (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1796\"\u003e#1796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/4f449322825498e4ec1f486119e5fd251ba97f8a\"\u003e\u003ccode\u003e4f44932\u003c/code\u003e\u003c/a\u003e\nBump actions/cache from 5 to 6 (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1795\"\u003e#1795\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/b999a130a990b30af01743021e8ea97f3b09a17e\"\u003e\u003ccode\u003eb999a13\u003c/code\u003e\u003c/a\u003e\nBump actions/checkout from 6 to 7 (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1794\"\u003e#1794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/aeab810bd9704a3b7666ba0a78e1ad5d1d5ad1ae\"\u003e\u003ccode\u003eaeab810\u003c/code\u003e\u003c/a\u003e\nAvoid unsafe where safety depends on non-local values (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1791\"\u003e#1791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/1896d7c660524a022b3dbc3a1e044e162d766b25\"\u003e\u003ccode\u003e1896d7c\u003c/code\u003e\u003c/a\u003e\nAdd typos CI job (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1789\"\u003e#1789\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-random/rand/commit/43eddee18c8cca2cebee929be3899cf183afe801\"\u003e\u003ccode\u003e43eddee\u003c/code\u003e\u003c/a\u003e\nBump the all-deps group with 2 updates (\u003ca\nhref\u003d\"https://redirect.github.com/rust-random/rand/issues/1788\"\u003e#1788\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/rust-random/rand/compare/0.9.4...0.10.2\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003drand\u0026package-manager\u003dcargo\u0026previous-version\u003d0.9.4\u0026new-version\u003d0.10.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "d1b8eacd87e3601b9b5c59dfa21c3f2a925a7240",
      "tree": "498d5d9345934ad429ff233d1bc20a8ad1c1d9de",
      "parents": [
        "a03e450c6f8afbbf01d35d46e58d263cbd34be5d"
      ],
      "author": {
        "name": "Yuya Ebihara",
        "email": "ebyhry@gmail.com",
        "time": "Sat Jul 11 16:34:47 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 11 09:34:47 2026 +0200"
      },
      "message": "Infra: Group github/codeql-action bumps into a single dependabot PR (#2800)\n\nThus, dependabot can update these two jobs in a single PR:\n\n\nhttps://github.com/apache/iceberg-rust/blob/6077a42ea061f73a561c26880993f84fafb1ba0f/.github/workflows/codeql.yml#L48-L54\n\n- https://github.com/apache/infrastructure-actions/pull/1028"
    },
    {
      "commit": "a03e450c6f8afbbf01d35d46e58d263cbd34be5d",
      "tree": "220f8e0a780590d80ca52524afce7d69dfc95de2",
      "parents": [
        "6077a42ea061f73a561c26880993f84fafb1ba0f"
      ],
      "author": {
        "name": "Abanoub Doss",
        "email": "abanoubdoss@gmail.com",
        "time": "Sat Jul 11 02:34:05 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Sat Jul 11 09:34:05 2026 +0200"
      },
      "message": "ci: drop unnecessary protoc installs (#2805)\n\n## Which issue does this PR close?\n\n- None. CI maintenance.\n\n## What changes are included in this PR?\n\nDeletes every `Install protoc` step: five in ci.yml, one in\npublic-api.yml, one in website.yml.\n\nThe installs were added with the datafusion 48 bump (#1501). That bump\npulled in the `substrait` crate, whose build script runs prost-build,\nand prost-build shells out to protoc. The DataFusion 54 bump (#2648)\ndropped `substrait` and `prost-build` from the tree, and prost-build was\nthe only thing that ever ran protoc. The remaining\n`prost`/`prost-derive` dependencies come from datafusion-proto, which\nships pregenerated code and has no build script. So nothing in `make\nbuild`, the test suite, or the `cargo doc` run in website.yml needs\nprotoc anymore.\n\nA side benefit of this simplification is that we remove a dependency on\narduino/setup-protoc, which hasn\u0027t seen a commit since September 2024\nand was printing a Node runtime deprecation warning on every run.\n\n## Are these changes tested?\n\n- Verified on a fork based past #2648: all ci.yml and public-api.yml\njobs run green without protoc, including the full docker-backed test\nsuite.\n- `cargo metadata` confirms datafusion-proto and datafusion-proto-common\nhave no build script. `prost-build` is absent from Cargo.lock and\nnothing in the workspace source references protoc.\n\nCo-authored-by: Abanoub Doss \u003cabanoub.doss@gmail.com\u003e"
    },
    {
      "commit": "6077a42ea061f73a561c26880993f84fafb1ba0f",
      "tree": "16bea31bca01af585d44cd04aa024ca959951662",
      "parents": [
        "facecafa4c2acbd64a98b67d138c3c2be3c84ce3"
      ],
      "author": {
        "name": "Abanoub Doss",
        "email": "abanoubdoss@gmail.com",
        "time": "Fri Jul 10 01:00:05 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 10 14:00:05 2026 +0800"
      },
      "message": "ci: fix the cargo-public-api double install (#2793)\n\n## Which issue does this PR close?\n\n- None. CI maintenance for the Public API job.\n\n## What changes are included in this PR?\n\nThe job installs cargo-public-api twice per run.\n`taiki-e/install-action` has no prebuilt binary for it, so that step\nfalls back to cargo-binstall and compiles the latest release from source\n(currently v0.52.0, ~76s). `make check-public-api` then compiles the\npinned v0.51.0 from source again (~72s) because the installed version\ndoesn\u0027t match the pin. And since the binary on disk never matches the\npin at cache-save time, rust-cache never shortcuts either install.\n\nThis deletes the install-action step. The Makefile\u0027s `cargo install\n--locked cargo-public-api@0.51.0` becomes the only install; on warm runs\nrust-cache restores the pinned binary and the install is a no-op. 0.51.0\nis the version the checked-in `public-api.txt` files were generated\nwith, so the check itself is unchanged.\n\nThe Makefile also stops computing `PUBLIC_API_CRATES` with `$(shell\ncargo metadata ...)` at parse time, which made every `make` invocation\npay a cargo metadata call. The list is now evaluated inside the two\nrecipes that use it, with identical command and output.\n\nWarm Public API job time on a fork: 4:03 to 1:36.\n\n## Are these changes tested?\n\n- Verified on a fork: warm runs skip the install and run the same\nchecks.\n- `make check-public-api` and `make generate-public-api` expand to the\nsame commands as before.\n\nCo-authored-by: Abanoub Doss \u003cabanoub.doss@gmail.com\u003e"
    },
    {
      "commit": "facecafa4c2acbd64a98b67d138c3c2be3c84ce3",
      "tree": "6eca35f4628b26a67e4e9fb1253c50d0a21f53ad",
      "parents": [
        "ff678ca6d1123d9d82902b34379ccba2caf172b6"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Thu Jul 09 15:57:13 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 09 22:57:13 2026 +0800"
      },
      "message": "feat(encryption): [11/N] KMS factory trait and catalog wiring (#2650)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Working towards: #2034 \n\n## What changes are included in this PR?\n\nAdds `KmsClientFactory` to the catalog builder to allow a catalog to\nbuild one KMS client per catalog, this mirrors [Java\u0027s implementation\n](https://github.com/apache/iceberg/blob/main/core/src/main/java/org/apache/iceberg/encryption/EncryptionUtil.java#L47).\nNote in rust we don\u0027t have reflection so using Java\u0027s\n`encryption.kms-impl` isn\u0027t an option for us. This is a very similar\npattern to what we do for the `StorageFactory` so I believe the pattern\nis idiomatic for us.\n\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "ff678ca6d1123d9d82902b34379ccba2caf172b6",
      "tree": "e12d9e5ce6a6192a2b1123279f24fdb51e5bfbd8",
      "parents": [
        "2454d64f8ee4fb351d0e917620e5dd1971f7eeb2"
      ],
      "author": {
        "name": "Matt Butrovich",
        "email": "mbutrovich@users.noreply.github.com",
        "time": "Thu Jul 09 05:13:15 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Thu Jul 09 17:13:15 2026 +0800"
      },
      "message": "fix(spec): support float/double conversion in Datum::to() (#2783)\n\n## Which issue does this PR close?\n\n- Closes #.\n\n## What changes are included in this PR?\n\n`Datum::to()` had no conversion between `float` and `double`, so binding\na predicate whose literal type differed from the column type failed with\n`Can\u0027t convert datum from double type to float type`. This is common\nbecause engines often carry a floating point literal as a double even\nwhen the column is a float.\n\nThis PR adds the two missing arms:\n\n- `Double -\u003e Float`: narrows through a new `f64_to_f32` helper that\nreturns `AboveMax` / `BelowMin` when the value is outside the finite\nfloat range, matching the existing integer narrowing helpers\n(`i64_to_i32`, `i128_to_i64`). A plain `as f32` cast would saturate to\n`+/-inf` and change comparison results, so the sentinels let predicate\nbinding resolve the comparison correctly.\n- `Float -\u003e Double`: widens losslessly.\n\n## Are these changes tested?\n\nYes. Four unit tests in `spec/values/tests.rs` cover the in range\nnarrowing, the above max and below min cases, and the widening. The\n`AboveMax` / `BelowMin` handling is already exercised by the existing\npredicate binding tests in `expr::predicate`.\n\n---------\n\nCo-authored-by: emkornfield \u003cemkornfield@gmail.com\u003e\nCo-authored-by: blackmwk \u003cliurenjie1024@outlook.com\u003e"
    },
    {
      "commit": "2454d64f8ee4fb351d0e917620e5dd1971f7eeb2",
      "tree": "43738d1914129db4feafb3ac2e8580b6d5d37593",
      "parents": [
        "22c256e985a68b3a71dd3890d3ebd6bedc3e7b0d"
      ],
      "author": {
        "name": "Xin Huang",
        "email": "42597328+huan233usc@users.noreply.github.com",
        "time": "Wed Jul 08 16:39:32 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 16:39:32 2026 -0700"
      },
      "message": "feat(catalog-rest): parse server-advertised endpoints from GET /v1/config (#2692)\n\n## Which issue does this PR close?\n\nRelated to #1690 (server-side scan planning), which relies on endpoint\nnegotiation. This PR lands the negotiation piece on its own so it can be\nreviewed independently.\n\n## What changes are included in this PR?\n\nThe REST spec lets a server advertise the routes it supports in the\n`endpoints`\nfield of its `GET /v1/config` response, so clients can negotiate\noptional\ncapabilities instead of assuming every server implements every\noperation. The\nRust client currently ignores this field.\n\nThis mirrors the capability negotiation the Java client gained in\napache/iceberg#10929 (the `endpoints` field in the config response, the\n`Endpoint` type, and the default-endpoint fallback when a server omits\nthe list).\n\nThis PR:\n- Adds an `Endpoint` type (HTTP method + path template) parsed from the\n`\"\u003cmethod\u003e \u003cpath\u003e\"` wire form via `FromStr` — which validates the\nsingle-space\nshape and the HTTP method — with serde delegating to it. The method is\nstored\nas a typed `http::Method` (kept out of the public API; `method()`\nreturns\n  `\u0026str`).\n- Parses the config response\u0027s `endpoints` into `Option\u003cVec\u003cEndpoint\u003e\u003e`\nso an\nabsent field and an explicit empty list are modelled distinctly, and\nstores\n  the negotiated set on the catalog\u0027s runtime context.\n- Resolves the set following the spec\u0027s optional-field semantics: an\nabsent\nfield → a standard base set of namespace/table operations is assumed (so\nan\nolder server still resolves its core operations as supported); a present\nlist\n— even an empty one — is used verbatim. Optional endpoints outside the\nbase\n  set stay unsupported unless explicitly advertised.\n- Exposes `RestCatalog::supports_endpoint(\u0026Endpoint)` to query the\nnegotiated\n  set.\n\nNo existing behaviour changes for callers that don\u0027t consult\n`supports_endpoint`.\n\n## Are these changes tested?\n\nYes:\n- Unit tests for `Endpoint`: `FromStr`/serde round-trip, rejection of\nmalformed\n  input (no / extra / leading / trailing space, empty), HTTP-method\n  normalization, and the default endpoint set.\n- `mockito` catalog tests: a server that advertises `endpoints`\n(asserting\n`supports_endpoint` is true/false for listed/unlisted routes), a server\nthat\nomits the field (base operations resolve as supported), and a server\nthat\n  sends an explicit empty list (nothing is supported)."
    },
    {
      "commit": "22c256e985a68b3a71dd3890d3ebd6bedc3e7b0d",
      "tree": "159f260e86bba9f5f0c01241a94ef4f3073b3f5b",
      "parents": [
        "875fdb7463f0a2d685fa3c61c70527469bcd4407"
      ],
      "author": {
        "name": "Matt Butrovich",
        "email": "mbutrovich@users.noreply.github.com",
        "time": "Wed Jul 08 03:10:59 2026 -0400"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 08 15:10:59 2026 +0800"
      },
      "message": "fix(reader): keep rows with a null equality-delete column value (#2781)\n\n## Which issue does this PR close?\n\n- Closes #2780.\n\n## What changes are included in this PR?\n\nEquality deletes are applied by building a predicate that keeps rows not\nmatched by any delete row. For each equality column the keep term was\n`col !\u003d v`, produced by negating the equality match. Applied as a row\nfilter, `null !\u003d v` evaluates to null, so a data row whose equality\ncolumn is null was dropped. Per the spec ([Equality Delete\nFiles](https://iceberg.apache.org/spec/#equality-delete-files)), a null\nvalue matches only a null delete value, so such rows should be kept.\n\nThis builds the keep predicate directly in\n`parse_equality_deletes_record_batch_stream`: `col IS NULL OR col !\u003d v`\nfor a non-null delete value, and `col IS NOT NULL` for a null delete\nvalue. Rows with a null value in an equality column are no longer\ndeleted.\n\n## Are these changes tested?\n\nYes, unit tests in `caching_delete_file_loader` covering the predicate\nconstruction:\n\n- `test_equality_delete_predicate_preserves_null_rows`: a non-null\ndelete value on a nullable column produces `(col IS NULL) OR (col !\u003d\nv)`.\n- `test_equality_delete_predicate_matches_null_delete_value`: a null\ndelete value produces `col IS NOT NULL`.\n- `test_equality_delete_predicate_multiple_columns`: per-column keep\nterms are OR-ed.\n- `test_equality_delete_predicate_multiple_delete_rows`: per-row keep\npredicates are AND-ed.\n- `test_delete_file_loader_parse_equality_deletes` (existing, updated):\nthe combined case with multiple columns, a required column, and null\ndelete values."
    },
    {
      "commit": "875fdb7463f0a2d685fa3c61c70527469bcd4407",
      "tree": "8bddf1c580dd8995be0666f632fc340ed76f2472",
      "parents": [
        "894108bd5eda51b4a6f164f7040c4ca4933b46de"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Wed Jul 08 00:02:50 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 16:02:50 2026 -0700"
      },
      "message": "chore(deps): Bump DataFusion to 54.0.0 (#2648)\n\n## Which issue does this PR close?\n\nDataFusion to 54.0.0 was recently released, we should try and track\nlatests releases.\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n\n[ExecutionPlan](https://github.com/apache/datafusion/pull/21263)\n[TableProvider, SchemaProvider, CatalogProvider,\nCatalogProviderList](https://github.com/apache/datafusion/pull/21346)\nand [PhysicalExpr](https://github.com/apache/datafusion/pull/21573) have\nall had their `as_any` removed from the trait. That\u0027s really the only\nchange needed here. [Upgrade guide documents\nthis](https://datafusion.apache.org/library-user-guide/upgrading/54.0.0.html#remove-as-any-from-physicalexpr-scalarudfimpl-aggregateudfimpl-windowudfimpl-executionplan-tableprovider-schemaprovider-catalogprovider-catalogproviderlist-tablesource-filesource-fileformat-fileformatfactory-datasource-and-datasink)\n\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "894108bd5eda51b4a6f164f7040c4ca4933b46de",
      "tree": "eda32010a11fd8683e1923bed628d17f6dfffba2",
      "parents": [
        "0d6ada1cea01455477e383c0911300553e81ba8f"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Tue Jul 07 21:48:14 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 13:48:14 2026 -0700"
      },
      "message": "chore(refactor): rename SnapshotProducer::manifest_file to produce_manifest_file_list (#2596)\n\n## Which issue does this PR close?\n\n- Closes #2529.\n\n## What changes are included in this PR?\n\nRenames the trait method and adds rustdoc.\n\nThe change is pretty small, although risks impacting open PRs. I would\nrecommend to either merge now or park for a while.\n\nOriginally suggested as the naming does not indicate what the purpose of\nthe method is.\n\n## Are these changes tested?\n\nN/A"
    },
    {
      "commit": "0d6ada1cea01455477e383c0911300553e81ba8f",
      "tree": "e88ae2da176d36795a402f4a0d367650b2a36998",
      "parents": [
        "f12772deed34b4181605d79b6dc20fb487684ae8"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Tue Jul 07 18:04:08 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 10:04:08 2026 -0700"
      },
      "message": "chore: Update changelog for 0.10.0 (#2782)\n\n## What changes are included in this PR?\n\nUpdate changelog and dependency files for 0.10.0 release (RC3).\n\n0.10.0 tracking: https://github.com/apache/iceberg-rust/issues/2527\n\n## Are these changes tested?\n\nN/A"
    },
    {
      "commit": "f12772deed34b4181605d79b6dc20fb487684ae8",
      "tree": "e048560220310cd7061e6425dfb549017204b717",
      "parents": [
        "c5448e707950e631e01c7a04cd01c5c4785371c1"
      ],
      "author": {
        "name": "Minh Vu",
        "email": "vuhoangminh97@gmail.com",
        "time": "Tue Jul 07 07:08:36 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 22:08:36 2026 -0700"
      },
      "message": "Reject negative positional delete positions (#2631)\n\n## Summary\n\n- Reject negative row positions while parsing positional delete files.\n- Return `ErrorKind::DataInvalid` instead of casting negative `i64`\nvalues to huge `u64` positions.\n- Add a focused regression test for `pos \u003d -1`.\n\n## Root cause\n\nThe positional-delete parser reads positions from an `Int64Array`, but\ninserted each value with `pos as u64`. That allowed malformed negative\npositions to wrap into very large row offsets instead of failing\nvalidation.\n\n## Tests\n\n- `cargo fmt --check`\n- `CARGO_REGISTRIES_CRATES_IO_PROTOCOL\u003dsparse cargo test -p iceberg\ntest_parse_positional_deletes_rejects_negative_positions --locked`\n- `CARGO_REGISTRIES_CRATES_IO_PROTOCOL\u003dsparse cargo test -p iceberg\narrow::caching_delete_file_loader::tests --locked`\n\n---------\n\nCo-authored-by: Kevin Liu \u003ckevinjqliu@users.noreply.github.com\u003e"
    },
    {
      "commit": "c5448e707950e631e01c7a04cd01c5c4785371c1",
      "tree": "1716bf6860312dba63d9e20d39c3135cb9696e4b",
      "parents": [
        "997db2d1371a98d8f9bf88be0db66ab2be58b52e"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Tue Jul 07 06:20:20 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jul 07 08:50:20 2026 +0800"
      },
      "message": "feat(encryption) [8/N] Read encrypted manifest file (#2586)"
    },
    {
      "commit": "997db2d1371a98d8f9bf88be0db66ab2be58b52e",
      "tree": "2f69a3a4931e437fde926e66dc2dbdd166356469",
      "parents": [
        "22e80a63dbb4e58e034672b4ff665a6eae82fa02"
      ],
      "author": {
        "name": "blackmwk",
        "email": "liurenjie1024@outlook.com",
        "time": "Tue Jul 07 05:52:51 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 14:52:51 2026 -0700"
      },
      "message": "Fix zizmor pin (#2762)\n\n## Which issue does this PR close?\n\n\n- Closes #.\n\n## What changes are included in this PR?\n\nFix the asf yml pin error in #2729 \n\n## Are these changes tested?\n\nci.\n\n---------\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "22e80a63dbb4e58e034672b4ff665a6eae82fa02",
      "tree": "fb9f05e85c7a39e5e1a399a81a095752baf759fb",
      "parents": [
        "e38ecf08ea9e40e1dd220f98e3949352b05de3b0"
      ],
      "author": {
        "name": "Abanoub Doss",
        "email": "abanoubdoss@gmail.com",
        "time": "Mon Jul 06 04:21:57 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 17:21:57 2026 +0800"
      },
      "message": "ci: split lint checks and slim clippy (#2771)\n\n## Which issue does this PR close?\n\n- None. Implements the `check` job split from discussion #2753.\n\n## What changes are included in this PR?\n\nSplits the old `check` job (ubuntu + macos) into two ubuntu jobs:\n\n- `lint`: the non-compiling checks (license header, toml format, cargo\nfmt, Cargo.lock, cargo-machete, typos). The standalone Typos workflow is\nfolded in, and taplo and cargo-machete come as prebuilt binaries.\n- `clippy`: `make check-clippy` only.\n\nAs suggested in #2753, the heavier jobs now have `needs: lint`, so a fmt\nor typo mistake fails fast without spinning up builds. The tradeoff is\nthat a lint failure blocks all downstream jobs.\n\nThis also removes the macOS clippy run. Nothing in the repo is gated on\n`target_os`, so clippy output is identical across platforms, and macOS\ncompile coverage stays in the build jobs. The macOS `check` job was CI\u0027s\nslowest at 10 to 12 minutes.\n\n## Are these changes tested?\n\nCI-only change, exercised by this PR\u0027s own CI run.\n\nCo-authored-by: Abanoub Doss \u003cabanoub.doss@gmail.com\u003e"
    },
    {
      "commit": "e38ecf08ea9e40e1dd220f98e3949352b05de3b0",
      "tree": "9b301a2d3f94da5f798602b029895b3e65fcea86",
      "parents": [
        "bfa22009d06f767affa494b2d6d08187a2a29b9e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 11:11:59 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 11:11:59 2026 +0800"
      },
      "message": "chore(deps-dev): Bump huggingface-hub from 1.20.1 to 1.21.0 in /bindings/python (#2766)\n\nBumps [huggingface-hub](https://github.com/huggingface/huggingface_hub)\nfrom 1.20.1 to 1.21.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/releases\"\u003ehuggingface-hub\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[v1.21.0] Jobs filtering \u0026amp; pagination\u003c/h2\u003e\n\u003ch2\u003e📊 Jobs listing revamped: filter, paginate, and \u003ccode\u003els\u003c/code\u003e\ninstead of \u003ccode\u003eps\u003c/code\u003e\u003c/h2\u003e\n\u003cp\u003eThe Jobs listing API and CLI have been overhauled with server-side\nfiltering, proper pagination, and a CLI rename that aligns with the rest\nof \u003ccode\u003ehf\u003c/code\u003e. \u003ccode\u003elist_jobs()\u003c/code\u003e now accepts\n\u003ccode\u003estatus\u003c/code\u003e and \u003ccode\u003elabels\u003c/code\u003e parameters that push\nfiltering to the server, and returns a lazy iterator (matching\n\u003ccode\u003elist_models\u003c/code\u003e, \u003ccode\u003elist_datasets\u003c/code\u003e, etc.) so large\nresult sets are fetched page by page. On the CLI side, \u003ccode\u003ehf jobs\nps\u003c/code\u003e has been renamed to \u003ccode\u003ehf jobs ls\u003c/code\u003e for consistency\nwith \u003ccode\u003ehf repos ls\u003c/code\u003e, \u003ccode\u003ehf models ls\u003c/code\u003e, and friends —\n\u003ccode\u003eps\u003c/code\u003e and \u003ccode\u003elist\u003c/code\u003e still work as aliases.\u003c/p\u003e\n\u003cp\u003e⚠️ \u003cstrong\u003eBreaking changes:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003elist_jobs()\u003c/code\u003e now returns an\n\u003ccode\u003eIterable[JobInfo]\u003c/code\u003e instead of \u003ccode\u003elist[JobInfo]\u003c/code\u003e. If\nyou indexed the result (\u003ccode\u003ejobs[0]\u003c/code\u003e), wrap it with\n\u003ccode\u003elist(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e-f\u003c/code\u003e/\u003ccode\u003e--filter\u003c/code\u003e in \u003ccode\u003ehf jobs ls\u003c/code\u003e is\ndeprecated. Use \u003ccode\u003e--status\u003c/code\u003e and \u003ccode\u003e--label\u003c/code\u003e instead.\nGlob patterns (\u003ccode\u003edata-*\u003c/code\u003e), negation (\u003ccode\u003ekey!\u003dvalue\u003c/code\u003e),\nand filtering by \u003ccode\u003eid\u003c/code\u003e/\u003ccode\u003eimage\u003c/code\u003e/\u003ccode\u003ecommand\u003c/code\u003e\nare no longer supported.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cpre lang\u003d\"python\"\u003e\u003ccode\u003efrom huggingface_hub import list_jobs\n\u003ch1\u003eFilter by status and labels\u003c/h1\u003e\n\u003cp\u003elist_jobs(status\u003d[\u0026quot;RUNNING\u0026quot;, \u0026quot;SCHEDULING\u0026quot;],\nlabels\u003d{\u0026quot;env\u0026quot;: \u0026quot;prod\u0026quot;})\u003c/p\u003e\n\u003ch1\u003eIterate lazily\u003c/h1\u003e\n\u003cp\u003efor job in list_jobs():\nprint(job.id)\u003c/p\u003e\n\u003ch1\u003eMaterialize all results\u003c/h1\u003e\n\u003cp\u003eall_jobs \u003d list(list_jobs())\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cpre lang\u003d\"bash\"\u003e\u003ccode\u003e# Filter by status and labels\nhf jobs ls --status running,scheduling --label env\u003dprod --label team\u003dml\n\n# Paginate with --limit\nhf jobs ls -a --limit 500\nhf jobs ls -a --limit 0  # no limit\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003e[Jobs] Add stage/label filtering to list_jobs API and CLI by \u003ca\nhref\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4395\"\u003e#4395\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[Jobs] Paginate list_jobs and add --limit to \u003ccode\u003ehf jobs ps\u003c/code\u003e\nby \u003ca href\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4403\"\u003e#4403\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[CLI] [Jobs] Rename job listing to \u0027hf jobs ls\u0027 (and keep \u0027hf jobs\nps\u0027 alias) by \u003ca\nhref\u003d\"https://github.com/Wauplin\"\u003e\u003ccode\u003e@​Wauplin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4409\"\u003e#4409\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e📚 \u003cstrong\u003eDocumentation:\u003c/strong\u003e \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/cli\"\u003eCLI\nguide\u003c/a\u003e, \u003ca\nhref\u003d\"https://huggingface.co/docs/huggingface_hub/main/en/guides/jobs\"\u003eJobs\nguide\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e🐛 Fix circular import on \u003ccode\u003efrom huggingface_hub import\nlogin\u003c/code\u003e\u003c/h2\u003e\n\u003cp\u003eA regression introduced in v1.20.0 caused \u003ccode\u003efrom huggingface_hub\nimport login\u003c/code\u003e to raise an \u003ccode\u003eImportError\u003c/code\u003e on a fresh\ninterpreter, due to a circular dependency between\n\u003ccode\u003e_oauth_device\u003c/code\u003e and \u003ccode\u003eutils._http\u003c/code\u003e. The fix moves\n\u003ccode\u003e_oauth_device.py\u003c/code\u003e into the \u003ccode\u003eutils\u003c/code\u003e layer so all\nimports resolve downward, eliminating the cycle. No lazy imports or\nworkarounds required.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix circular import on \u003ccode\u003efrom huggingface_hub import\nlogin\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4385\"\u003e#4385\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e🔧 Other QoL Improvements\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRetry requests on httpx.RemoteProtocolError by \u003ca\nhref\u003d\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4398\"\u003e#4398\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e📖 Documentation\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/aea9b9de1284f54862df99820f963d6030803860\"\u003e\u003ccode\u003eaea9b9d\u003c/code\u003e\u003c/a\u003e\nRelease: v1.21.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/2e2ed568a0d8e3841d2fe9d192f17cdb30ccf129\"\u003e\u003ccode\u003e2e2ed56\u003c/code\u003e\u003c/a\u003e\nRelease: v1.21.0.rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/4bd4c906cac546643ca5fe0ca08e301ce7a98b62\"\u003e\u003ccode\u003e4bd4c90\u003c/code\u003e\u003c/a\u003e\n[CLI] [Jobs] Rename job listing to \u0027hf jobs ls\u0027 (and keep \u0027hf jobs ps\u0027\nalias)...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/fa3eb459eb3fdf15347930d7dc70f0a7e413d6e5\"\u003e\u003ccode\u003efa3eb45\u003c/code\u003e\u003c/a\u003e\n[Jobs] Paginate list_jobs and add --limit to \u003ccode\u003ehf jobs ps\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4403\"\u003e#4403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/ecfd4c5e88acfa885fc9146bf5df61d4de7b46a9\"\u003e\u003ccode\u003eecfd4c5\u003c/code\u003e\u003c/a\u003e\n[CLI] Fix ty/mypy errors with click 8.4.2 (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4408\"\u003e#4408\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/341469f1f87fb9932410fde9bdb81ac269a64727\"\u003e\u003ccode\u003e341469f\u003c/code\u003e\u003c/a\u003e\nUpdate hardware flavor enums (automated commit) (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4406\"\u003e#4406\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/2fbcdfeec8a1bf689623ecb87afc7d5db4cd23bb\"\u003e\u003ccode\u003e2fbcdfe\u003c/code\u003e\u003c/a\u003e\n[i18n-HI] Add Hindi translation for guides overview (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4405\"\u003e#4405\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/5bc6bfa7df18752f1adfd649816be315937cfa6f\"\u003e\u003ccode\u003e5bc6bfa\u003c/code\u003e\u003c/a\u003e\n[Jobs] Add stage/label filtering to list_jobs API and CLI (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4395\"\u003e#4395\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/d991f099f53c7439edbf9432c5137d2069199e5a\"\u003e\u003ccode\u003ed991f09\u003c/code\u003e\u003c/a\u003e\nFix IndexError in filter_repo_objects on an empty pattern (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4402\"\u003e#4402\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/0df783fb8f3d1a37b00255007e9af78e4e9dca8f\"\u003e\u003ccode\u003e0df783f\u003c/code\u003e\u003c/a\u003e\nRetry requests on httpx.RemoteProtocolError (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4398\"\u003e#4398\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/compare/v1.20.1...v1.21.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "bfa22009d06f767affa494b2d6d08187a2a29b9e",
      "tree": "a194d6835f8956a3b58d448ab3336fde358c6cdb",
      "parents": [
        "390a7bb3276d053754a78aeea1db96b0dc84af8d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 10:51:09 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 10:51:09 2026 +0800"
      },
      "message": "chore(deps): Bump taiki-e/install-action from 2.82.2 to 2.82.5 (#2767)\n\nBumps\n[taiki-e/install-action](https://github.com/taiki-e/install-action) from\n2.82.2 to 2.82.5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/releases\"\u003etaiki-e/install-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.82.5\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 46.0.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-bindgen@latest\u003c/code\u003e to 0.2.126.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.14.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-rdme@latest\u003c/code\u003e to 2.1.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.4\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.24.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.13.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.54.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.26.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 46.0.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.1.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.12.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.104.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-tarpaulin@latest\u003c/code\u003e to 0.35.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-nextest@latest\u003c/code\u003e to 0.9.138.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-crap@latest\u003c/code\u003e to 0.3.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-binstall@latest\u003c/code\u003e to 1.20.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-rdme@latest\u003c/code\u003e to 2.0.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md\"\u003etaiki-e/install-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this\nfile.\u003c/p\u003e\n\u003cp\u003eThis project adheres to \u003ca href\u003d\"https://semver.org\"\u003eSemantic\nVersioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[2.82.8] - 2026-07-03\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.8.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.26.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etypos@latest\u003c/code\u003e to 1.48.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.72.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.1.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.7.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.55.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.82.7] - 2026-06-30\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.1.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.105.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003egungraun-runner@latest\u003c/code\u003e to 0.19.3.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eeditorconfig-checker@latest\u003c/code\u003e to 3.8.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003edprint@latest\u003c/code\u003e to 0.55.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-tarpaulin@latest\u003c/code\u003e to 0.36.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.82.6] - 2026-06-29\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.7.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/bffeee26d4db9be238a4ea78d8826604ebcb594d\"\u003e\u003ccode\u003ebffeee2\u003c/code\u003e\u003c/a\u003e\nRelease 2.82.5\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/5bafa69e5add729bd5cc9c0646ed12e1af612c99\"\u003e\u003ccode\u003e5bafa69\u003c/code\u003e\u003c/a\u003e\nci: Test GitHub-hosted ubuntu 26.04 runners\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/e7b7497213f2263bcf738032dcc69fd4c14b1813\"\u003e\u003ccode\u003ee7b7497\u003c/code\u003e\u003c/a\u003e\nUpdate wasmtime manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/e9838983e85b61bb8ceb03c66a676d5a37507462\"\u003e\u003ccode\u003ee983898\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 46.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/0cd66872025ce95e85d8831011a3d60693cb5b06\"\u003e\u003ccode\u003e0cd6687\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ewasm-bindgen@latest\u003c/code\u003e to 0.2.126\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/151275d7b873bc8f076b2e0addaaf908740405ca\"\u003e\u003ccode\u003e151275d\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.6\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/1a104bfb141e3d8faadbdc6c3306789dd461f1c9\"\u003e\u003ccode\u003e1a104bf\u003c/code\u003e\u003c/a\u003e\nUpdate syft manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/edab3a363f10f8d5af8efc8633ad982b899bfbde\"\u003e\u003ccode\u003eedab3a3\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.14\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/46c1ccf9e1e2e709f19c2846fb39337b5045c0f6\"\u003e\u003ccode\u003e46c1ccf\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003ecargo-rdme@latest\u003c/code\u003e to 2.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/682e7d9e49c5e653d371fc6adbda67653461378a\"\u003e\u003ccode\u003e682e7d9\u003c/code\u003e\u003c/a\u003e\nRelease 2.82.4\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/compare/9e1e5806d4a4822de933115878265be9aaa786d9...bffeee26d4db9be238a4ea78d8826604ebcb594d\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dtaiki-e/install-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d2.82.2\u0026new-version\u003d2.82.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "390a7bb3276d053754a78aeea1db96b0dc84af8d",
      "tree": "0253a441af161b19f247e7b8ada9f77a77f70156",
      "parents": [
        "21271fa82d88dc2727552392f81ed3f93b40ecf5"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 10:50:19 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 10:50:19 2026 +0800"
      },
      "message": "chore(deps): Bump actions/setup-python from 6.2.0 to 6.3.0 (#2768)\n\nBumps [actions/setup-python](https://github.com/actions/setup-python)\nfrom 6.2.0 to 6.3.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/setup-python/releases\"\u003eactions/setup-python\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev6.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003ch3\u003eEnhancement\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd RHEL support and include Linux distro in cache keys by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1323\"\u003eactions/setup-python#1323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix pip cache error handling on Windows by \u003ca\nhref\u003d\"https://github.com/priyagupta108\"\u003e\u003ccode\u003e@​priyagupta108\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1040\"\u003eactions/setup-python#1040\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDependency update\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade minimatch from 3.1.2 to 3.1.5 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1281\"\u003eactions/setup-python#1281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade actions dependencies by \u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write\ndenied by \u003ca\nhref\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade dependency versions and test workflow configuration by \u003ca\nhref\u003d\"https://github.com/HarithaVattikuti\"\u003e\u003ccode\u003e@​HarithaVattikuti\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1322\"\u003eactions/setup-python#1322\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate advanced-usage.md by \u003ca\nhref\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/gowridurgad\"\u003e\u003ccode\u003e@​gowridurgad\u003c/code\u003e\u003c/a\u003e\nwith \u003ca href\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1303\"\u003eactions/setup-python#1303\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/jasongin\"\u003e\u003ccode\u003e@​jasongin\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/1324\"\u003eactions/setup-python#1324\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Dunky-Z\"\u003e\u003ccode\u003e@​Dunky-Z\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/pull/811\"\u003eactions/setup-python#811\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/v6...v6.3.0\"\u003ehttps://github.com/actions/setup-python/compare/v6...v6.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1\"\u003e\u003ccode\u003eece7cb0\u003c/code\u003e\u003c/a\u003e\nFix pip cache error handling on Windows. (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1040\"\u003e#1040\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf\"\u003e\u003ccode\u003e1d18d7a\u003c/code\u003e\u003c/a\u003e\nUpdate advanced-usage.md (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/811\"\u003e#811\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/d2b357a6a3a3687dd6781a416c0d24fcfd68660e\"\u003e\u003ccode\u003ed2b357a\u003c/code\u003e\u003c/a\u003e\nUpdate dependency versions and test workflow configuration (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1322\"\u003e#1322\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/8f639b1e75c1048640734b2bb46e22cecf136982\"\u003e\u003ccode\u003e8f639b1\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1324\"\u003e#1324\u003c/a\u003e\nfrom jasongin/update-actions-cache-5.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/6731c2ba87f530c26324d128c8fdd53499a4d4b0\"\u003e\u003ccode\u003e6731c2b\u003c/code\u003e\u003c/a\u003e\nResolve high-severity audit issues\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/0cb1a84326b90186fcd211036c65b42819794c87\"\u003e\u003ccode\u003e0cb1a84\u003c/code\u003e\u003c/a\u003e\nAdd RHEL support and include Linux distro in cache keys (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1323\"\u003e#1323\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/dc6eab6194394e0119523369788b507096f923e2\"\u003e\u003ccode\u003edc6eab6\u003c/code\u003e\u003c/a\u003e\nUpdate dist\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/6f4b74bfa2f520a380a620de3615c0dac427f4d3\"\u003e\u003ccode\u003e6f4b74b\u003c/code\u003e\u003c/a\u003e\nStrict equality\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/fa8bde1a9cc6347d06948d66bcd68c598b79eaea\"\u003e\u003ccode\u003efa8bde1\u003c/code\u003e\u003c/a\u003e\nBump \u003ccode\u003e@​actions/cache\u003c/code\u003e to 5.1.0, log cache write denied\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/setup-python/commit/c8813ba1bc76ebf779b911ad8ffccbf2e449cb48\"\u003e\u003ccode\u003ec8813ba\u003c/code\u003e\u003c/a\u003e\nUpgrade \u003ca href\u003d\"https://github.com/actions\"\u003e\u003ccode\u003e@​actions\u003c/code\u003e\u003c/a\u003e\ndependencies and update licenses (\u003ca\nhref\u003d\"https://redirect.github.com/actions/setup-python/issues/1303\"\u003e#1303\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "21271fa82d88dc2727552392f81ed3f93b40ecf5",
      "tree": "250afa558a1f07609dc5d08f6dbef96c3584503f",
      "parents": [
        "7c88f1f8bce9b2d2748796ba5ab9998493d5de3a"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 10:25:02 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 10:25:02 2026 +0800"
      },
      "message": "chore(deps): Bump enum-ordinalize from 4.3.2 to 4.4.1 (#2769)\n\nBumps [enum-ordinalize](https://github.com/magiclen/enum-ordinalize)\nfrom 4.3.2 to 4.4.1.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/commit/7cccbc89fd2be1e1c27e7ba77c1aa58389557040\"\u003e\u003ccode\u003e7cccbc8\u003c/code\u003e\u003c/a\u003e\nfix min-dependencies\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/commit/fcb3109863bd58c60ad46cdaecbc71d82bccecdd\"\u003e\u003ccode\u003efcb3109\u003c/code\u003e\u003c/a\u003e\nimprove tests\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/commit/6e439f87e8c5118bf1a84556f7c783c119c546af\"\u003e\u003ccode\u003e6e439f8\u003c/code\u003e\u003c/a\u003e\nfix test warnings\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/commit/970a6901744a1e95bb0cb5a3442056829cabb273\"\u003e\u003ccode\u003e970a690\u003c/code\u003e\u003c/a\u003e\nimprove code\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/commit/9185e0265ac715725b5a7b724523d6bfb4458867\"\u003e\u003ccode\u003e9185e02\u003c/code\u003e\u003c/a\u003e\nuse Rust 2024\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/commit/18f0caf395f5b06d364e1ee316fcd6e2d99a272b\"\u003e\u003ccode\u003e18f0caf\u003c/code\u003e\u003c/a\u003e\nbump actions/checkout from 5 to 6\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/magiclen/enum-ordinalize/compare/v4.3.2...v4.4.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "7c88f1f8bce9b2d2748796ba5ab9998493d5de3a",
      "tree": "886bb284405670ee32f5c749c7d4b6a28fe5aa7d",
      "parents": [
        "0b45d614af89be40b4d96c95ded227a38e55a606"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jul 06 09:28:20 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jul 06 09:28:20 2026 +0800"
      },
      "message": "chore(deps): Bump reqwest from 0.12.28 to 0.13.3 (#2770)\n\nBumps [reqwest](https://github.com/seanmonstar/reqwest) from 0.12.28 to\n0.13.3.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/releases\"\u003ereqwest\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.13.3\u003c/h2\u003e\n\u003ch2\u003etl;dr\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CertificateRevocationList parsing of PEM values.\u003c/li\u003e\n\u003cli\u003eFix logging in resolver to only show host, not full URL.\u003c/li\u003e\n\u003cli\u003eFix hickory-dns to fallback to a default if\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e fails.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to handle \u003ccode\u003eSTOP_SENDING\u003c/code\u003e as not an error.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 pool to remove timed out QUIC connections.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 connection establishment picking IPv4 and IPv6.\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier.\u003c/li\u003e\n\u003cli\u003e(wasm) Only use wasm-bindgen on unknown-* targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate docs.rs Features by \u003ca\nhref\u003d\"https://github.com/JamesWiresmith\"\u003e\u003ccode\u003e@​JamesWiresmith\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2961\"\u003eseanmonstar/reqwest#2961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: fallback to hickory_resolver\u0027s default config if reading\n/etc/resolv.conf fails by \u003ca\nhref\u003d\"https://github.com/monosans\"\u003e\u003ccode\u003e@​monosans\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2797\"\u003eseanmonstar/reqwest#2797\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: remove timeout con by \u003ca\nhref\u003d\"https://github.com/cuiweixie\"\u003e\u003ccode\u003e@​cuiweixie\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2967\"\u003eseanmonstar/reqwest#2967\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ehttp3: handle stop_sending without error by \u003ca\nhref\u003d\"https://github.com/anuraaga\"\u003e\u003ccode\u003e@​anuraaga\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2978\"\u003eseanmonstar/reqwest#2978\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eresolve: debug log to change only host by \u003ca\nhref\u003d\"https://github.com/lms0806\"\u003e\u003ccode\u003e@​lms0806\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2992\"\u003eseanmonstar/reqwest#2992\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEdit reference link by \u003ca\nhref\u003d\"https://github.com/lms0806\"\u003e\u003ccode\u003e@​lms0806\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2996\"\u003eseanmonstar/reqwest#2996\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: more accurate about default HTTP2 window sizes by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3007\"\u003eseanmonstar/reqwest#3007\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[HTTP/3] Optimize IPv6 fallback and enforce HTTPS scheme \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2911\"\u003e#2911\u003c/a\u003e\nby \u003ca href\u003d\"https://github.com/lyuzichong\"\u003e\u003ccode\u003e@​lyuzichong\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3006\"\u003eseanmonstar/reqwest#3006\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier by \u003ca\nhref\u003d\"https://github.com/jplatte\"\u003e\u003ccode\u003e@​jplatte\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3010\"\u003eseanmonstar/reqwest#3010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003euse wasm-bindgen ecosystem only for wasm32-unknown-* target by \u003ca\nhref\u003d\"https://github.com/Ludea\"\u003e\u003ccode\u003e@​Ludea\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3000\"\u003eseanmonstar/reqwest#3000\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix rustls crl pem parsing by \u003ca\nhref\u003d\"https://github.com/Threated\"\u003e\u003ccode\u003e@​Threated\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3013\"\u003eseanmonstar/reqwest#3013\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs(retry): include ReqRep in docsrs by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3020\"\u003eseanmonstar/reqwest#3020\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/JamesWiresmith\"\u003e\u003ccode\u003e@​JamesWiresmith\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2961\"\u003eseanmonstar/reqwest#2961\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/monosans\"\u003e\u003ccode\u003e@​monosans\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2797\"\u003eseanmonstar/reqwest#2797\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/cuiweixie\"\u003e\u003ccode\u003e@​cuiweixie\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2967\"\u003eseanmonstar/reqwest#2967\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/anuraaga\"\u003e\u003ccode\u003e@​anuraaga\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2978\"\u003eseanmonstar/reqwest#2978\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/lms0806\"\u003e\u003ccode\u003e@​lms0806\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2992\"\u003eseanmonstar/reqwest#2992\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/lyuzichong\"\u003e\u003ccode\u003e@​lyuzichong\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3006\"\u003eseanmonstar/reqwest#3006\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/Ludea\"\u003e\u003ccode\u003e@​Ludea\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/3000\"\u003eseanmonstar/reqwest#3000\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/compare/v0.13.2...v0.13.3\"\u003ehttps://github.com/seanmonstar/reqwest/compare/v0.13.2...v0.13.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.13.2\u003c/h2\u003e\n\u003ch2\u003etl;dr\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix HTTP/2 and native-tls ALPN feature combinations.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to send h3 ALPN.\u003c/li\u003e\n\u003cli\u003e(wasm) fix \u003ccode\u003eRequestBuilder::json()\u003c/code\u003e from override\npreviously set content-type.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): bump actions/checkout from 5 to 6 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2921\"\u003eseanmonstar/reqwest#2921\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate readme for 0.13 by \u003ca\nhref\u003d\"https://github.com/VojtaStanek\"\u003e\u003ccode\u003e@​VojtaStanek\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2926\"\u003eseanmonstar/reqwest#2926\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix http2 feature is not enabled for \u0026quot;native-tls\u0026quot; by \u003ca\nhref\u003d\"https://github.com/fox0\"\u003e\u003ccode\u003e@​fox0\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2927\"\u003eseanmonstar/reqwest#2927\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): remove unused webpki-roots and rustls-native-certs by\n\u003ca href\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2932\"\u003eseanmonstar/reqwest#2932\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: native-tls-alpn has changed to native-tls-no-alpn by \u003ca\nhref\u003d\"https://github.com/seanmonstar\"\u003e\u003ccode\u003e@​seanmonstar\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/pull/2940\"\u003eseanmonstar/reqwest#2940\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md\"\u003ereqwest\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.13.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix CertificateRevocationList parsing of PEM values.\u003c/li\u003e\n\u003cli\u003eFix logging in resolver to only show host, not full URL.\u003c/li\u003e\n\u003cli\u003eFix hickory-dns to fallback to a default if\n\u003ccode\u003e/etc/resolv.conf\u003c/code\u003e fails.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to handle \u003ccode\u003eSTOP_SENDING\u003c/code\u003e as not an error.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 pool to remove timed out QUIC connections.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 connection establishment picking IPv4 and IPv6.\u003c/li\u003e\n\u003cli\u003eUpgrade rustls-platform-verifier.\u003c/li\u003e\n\u003cli\u003e(wasm) Only use wasm-bindgen on unknown-* targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix HTTP/2 and native-tls ALPN feature combinations.\u003c/li\u003e\n\u003cli\u003eFix HTTP/3 to send h3 ALPN.\u003c/li\u003e\n\u003cli\u003e(wasm) fix \u003ccode\u003eRequestBuilder::json()\u003c/code\u003e from override\npreviously set content-type.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev0.13.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixes compiling with rustls on Android targets.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003ev0.13.0\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eBreaking changes\u003c/strong\u003e:\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003erustls\u003c/code\u003e is now the default TLS backend, instead of\n\u003ccode\u003enative-tls\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erustls\u003c/code\u003e crypto provider defaults to aws-lc instead of\n\u003cem\u003ering\u003c/em\u003e. (\u003ccode\u003erustls-no-provider\u003c/code\u003e exists if you want a\ndifferent crypto provider)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003erustls-tls\u003c/code\u003e has been renamed to\n\u003ccode\u003erustls\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003erustls roots features removed, \u003ccode\u003erustls-platform-verifier\u003c/code\u003e\nis used by default.\n\u003cul\u003e\n\u003cli\u003eTo use different roots, call\n\u003ccode\u003etls_certs_only(your_roots)\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003enative-tls\u003c/code\u003e now includes ALPN. To disable, use\n\u003ccode\u003enative-tls-no-alpn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003equery\u003c/code\u003e and \u003ccode\u003eform\u003c/code\u003e are now crate features,\ndisabled by default.\u003c/li\u003e\n\u003cli\u003eLong-deprecated methods and crate features have been removed (such\nas \u003ccode\u003etrust-dns\u003c/code\u003e, which was renamed \u003ccode\u003ehickory-dns\u003c/code\u003e a\nwhile ago).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eMany TLS-related methods renamed to improve autocompletion and\ndiscovery, but previous name left in place with a \u0026quot;soft\u0026quot;\ndeprecation. (just documented, no warnings)\n\u003cul\u003e\n\u003cli\u003eFor example, prefer \u003ccode\u003etls_backend_rustls()\u003c/code\u003e over\n\u003ccode\u003euse_rustls_tls()\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/a9a88c4ee00a61b801f4f8e8cb643cdfb9a05b2b\"\u003e\u003ccode\u003ea9a88c4\u003c/code\u003e\u003c/a\u003e\nv0.13.3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/f3f6d9df166f447657d502fbaa9590e108a02d4b\"\u003e\u003ccode\u003ef3f6d9d\u003c/code\u003e\u003c/a\u003e\ndocs(retry): include ReqRep in docsrs (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3020\"\u003e#3020\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/5f9c231502d827bdd19864277187b133bb746f2f\"\u003e\u003ccode\u003e5f9c231\u003c/code\u003e\u003c/a\u003e\nfix rustls CRL PEM parsing (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3013\"\u003e#3013\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/11d835dcad9171f614343c714377f0fcc6638205\"\u003e\u003ccode\u003e11d835d\u003c/code\u003e\u003c/a\u003e\nuse wasm-bindgen ecosystem only for wasm32-unknown-* target (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3000\"\u003e#3000\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/1f72916f5cdc30f6cb6c63038c89063795294d50\"\u003e\u003ccode\u003e1f72916\u003c/code\u003e\u003c/a\u003e\nUpgrade rustls-platform-verifier (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3010\"\u003e#3010\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/5d5bf355744b181d31533501133ad9fbf99e8849\"\u003e\u003ccode\u003e5d5bf35\u003c/code\u003e\u003c/a\u003e\n[HTTP/3] Optimize IPv6 fallback and enforce HTTPS scheme \u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2911\"\u003e#2911\u003c/a\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3006\"\u003e#3006\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/93dc1b2dc4b3649d9b79b563cf4d3b41448fda0d\"\u003e\u003ccode\u003e93dc1b2\u003c/code\u003e\u003c/a\u003e\ndocs: more accurate about default HTTP2 window sizes (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/3007\"\u003e#3007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/c5e50f004de3ac0914369a08f3e7fd33c3ebc17e\"\u003e\u003ccode\u003ec5e50f0\u003c/code\u003e\u003c/a\u003e\ndocs: update outdated link in comments\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/b25611f7c976651e8c156809f781b939d1ef2b52\"\u003e\u003ccode\u003eb25611f\u003c/code\u003e\u003c/a\u003e\nresolve: debug log to change only host (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2992\"\u003e#2992\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/commit/ca1f479ab373c074e5fab5b35736de0c9cc46732\"\u003e\u003ccode\u003eca1f479\u003c/code\u003e\u003c/a\u003e\nhttp3: handle stop_sending without error (\u003ca\nhref\u003d\"https://redirect.github.com/seanmonstar/reqwest/issues/2978\"\u003e#2978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/seanmonstar/reqwest/compare/v0.12.28...v0.13.3\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dreqwest\u0026package-manager\u003dcargo\u0026previous-version\u003d0.12.28\u0026new-version\u003d0.13.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "0b45d614af89be40b4d96c95ded227a38e55a606",
      "tree": "e9e8e154362ecb761ddebde821b864ff13c88b1c",
      "parents": [
        "d3de0685bc5adc225993114a5afdeb02fd21da92"
      ],
      "author": {
        "name": "blackmwk",
        "email": "liurenjie1024@outlook.com",
        "time": "Sat Jul 04 13:36:43 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 22:36:43 2026 -0700"
      },
      "message": "Resolve RUSTSEC-2026-0190 (#2763)"
    },
    {
      "commit": "d3de0685bc5adc225993114a5afdeb02fd21da92",
      "tree": "79d5b3b390f3b8e67e710c44437d308e277320ce",
      "parents": [
        "46fd3171563d4abad2240fbdd063f882b896c8dd"
      ],
      "author": {
        "name": "Shawn Chang",
        "email": "schang@apache.org",
        "time": "Fri Jul 03 01:46:42 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 16:46:42 2026 +0800"
      },
      "message": "chore: update verify_rc script to verify tag against tarball (#2760)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n- Updated verify_rc.sh to verify tag against tarball on Apache dev repo\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\nManually tested against v0.10.0-rc.2, see results in the comment\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "46fd3171563d4abad2240fbdd063f882b896c8dd",
      "tree": "a76b1ed162616d5a0acb1723a83ee6f009d1c907",
      "parents": [
        "9a42426ffefefec404afadf3222c7636f3f5f598"
      ],
      "author": {
        "name": "Aurélien Pupier",
        "email": "apupier@ibm.com",
        "time": "Fri Jul 03 10:45:37 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 16:45:37 2026 +0800"
      },
      "message": "Restrict trigger push branch for GitHub Workflow (#2757)\n\nFeature branches rarely need their own CI runs: the code is already\ntested when a pull request is opened against a release branch. If the\npush trigger has no branch restriction and pull_request is also\nconfigured, every push to a branch with an open PR runs the workflow\ntwice: once for the push and once for the PR synchronisation.\n\nAlways give the push trigger an explicit list of branches: this stops\nbranches created from a release branch from inheriting its workflow\nruns.\n\nsee\nhttps://cwiki.apache.org/confluence/pages/viewpage.action?pageId\u003d430408443#GitHubActionsRecommendedPractices-Restrictthepushtriggertospecificbranches\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e\n\nSigned-off-by: Aurélien Pupier \u003capupier@ibm.com\u003e\nCo-authored-by: blackmwk \u003cliurenjie1024@outlook.com\u003e"
    },
    {
      "commit": "9a42426ffefefec404afadf3222c7636f3f5f598",
      "tree": "165f1d1b4aa04bf90478e94cf8f389a98d2e7079",
      "parents": [
        "713e2016230c46624f0debba23363430fc3715c4"
      ],
      "author": {
        "name": "blackmwk",
        "email": "liurenjie1024@outlook.com",
        "time": "Fri Jul 03 16:28:03 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jul 03 01:28:03 2026 -0700"
      },
      "message": "Resolve RUSTSEC-2026-0194 RUSTSEC-2026-0195 (#2761)\n\n## Which issue does this PR close?\n\n- Closes #2758.\n- Closes #2759.\n\n## What changes are included in this PR?\n\nAdd audit ignore to resolve RUSTSEC-2026-0194 RUSTSEC-2026-0195, since\nwe can\u0027t do anything now.\n\n## Are these changes tested?\n\nCI"
    },
    {
      "commit": "713e2016230c46624f0debba23363430fc3715c4",
      "tree": "5058423cfe129d2f63fa6ba870efd0651b2ff9fd",
      "parents": [
        "125822d610ecde61c6a82fc767ee7e7e8b22b3f3"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Wed Jul 01 15:31:24 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 18:01:24 2026 +0800"
      },
      "message": "refactor(encryption) use `StandardKeyMetadata` from `EncryptedOutputFile` in `ManifestWriterBuilder` (#2628)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\nIn https://github.com/apache/iceberg-rust/pull/2568 we introduced\n`new_from_encrypted` but the api isn\u0027t very ergonomic because\n`EncryptedOutputFile` has `StandardKeyMetadata` on it already so we\ndon\u0027t need to pass in `key_metadata` also.\n\nworking towards #2034 \n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "125822d610ecde61c6a82fc767ee7e7e8b22b3f3",
      "tree": "37457bc5b62dd8c9a770076578a13af9899624d6",
      "parents": [
        "7239a24538af0773722df74c2fb46b42031ef52d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 01 17:46:12 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 17:46:12 2026 +0800"
      },
      "message": "chore(deps): Bump zeroize from 1.8.2 to 1.9.0 (#2691)\n\nBumps [zeroize](https://github.com/RustCrypto/utils) from 1.8.2 to\n1.9.0.\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/0b715735a660a8566ccd240bf42489fe2ed98efb\"\u003e\u003ccode\u003e0b71573\u003c/code\u003e\u003c/a\u003e\nzeroize v1.9.0 (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1494\"\u003e#1494\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/3e3f18c273ec48c99ffca514ffd8bc91e1352a9a\"\u003e\u003ccode\u003e3e3f18c\u003c/code\u003e\u003c/a\u003e\nzeroize: always enable AVX-512 support (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1493\"\u003e#1493\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/1ea42bb68f560a2909c856b20aa3c62901f6305c\"\u003e\u003ccode\u003e1ea42bb\u003c/code\u003e\u003c/a\u003e\nzeroize_derive v1.5.0 (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1492\"\u003e#1492\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/8d785d1f9ddc6f8caeef1f4744fb93647f00a56d\"\u003e\u003ccode\u003e8d785d1\u003c/code\u003e\u003c/a\u003e\nzeroize: rustdoc improvements (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1491\"\u003e#1491\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/d844f3659d74b1461f9527ac31251d9800f49e55\"\u003e\u003ccode\u003ed844f36\u003c/code\u003e\u003c/a\u003e\nzeroize: incorporate README.md into rustdoc (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1490\"\u003e#1490\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/c65c09d0a1ca7ba1c27e568712934cb6893e2297\"\u003e\u003ccode\u003ec65c09d\u003c/code\u003e\u003c/a\u003e\nctutils: use \u003ccode\u003ereason\u003c/code\u003e instead of comment in\n\u003ccode\u003eforbid\u003c/code\u003e attribute (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1489\"\u003e#1489\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/cbd0963c685df025c42bed31f78c50d1bada3805\"\u003e\u003ccode\u003ecbd0963\u003c/code\u003e\u003c/a\u003e\nRelease block-buffer v0.12.1 (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1488\"\u003e#1488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/9aa541d55770f47bb1c50c1d476d167977e3de2a\"\u003e\u003ccode\u003e9aa541d\u003c/code\u003e\u003c/a\u003e\nblock-buffer: fix exception safety (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1487\"\u003e#1487\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/5c7e4f9bb31af81bf766360e836b6d633b84dbff\"\u003e\u003ccode\u003e5c7e4f9\u003c/code\u003e\u003c/a\u003e\ncmov v0.5.4 (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1485\"\u003e#1485\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/commit/87cadbce34655ac3c78efa7290f37d942d551b2c\"\u003e\u003ccode\u003e87cadbc\u003c/code\u003e\u003c/a\u003e\ncmov: fix clippy (\u003ca\nhref\u003d\"https://redirect.github.com/RustCrypto/utils/issues/1484\"\u003e#1484\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/RustCrypto/utils/compare/zeroize-v1.8.2...zeroize-v1.9.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "7239a24538af0773722df74c2fb46b42031ef52d",
      "tree": "f856b92802f34f436b8a920e0953be2d12ed4c5b",
      "parents": [
        "1016ace4700299307932e410376cd635c8b9c03e"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Wed Jul 01 17:16:27 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 17:16:27 2026 +0800"
      },
      "message": "chore(deps): Bump reqwest from 0.12.28 to 0.13.3 (#2690)"
    },
    {
      "commit": "1016ace4700299307932e410376cd635c8b9c03e",
      "tree": "b3d569ef56a64baffd34f6bc0ce4c72195e4236e",
      "parents": [
        "ed347f2eac82983e4060288dee04e8b42dd59f22"
      ],
      "author": {
        "name": "Xander",
        "email": "zander181@googlemail.com",
        "time": "Wed Jul 01 13:54:54 2026 +0530"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jul 01 16:24:54 2026 +0800"
      },
      "message": "refactor(encryption) remove key_metadata from the constructor of an unencrypted manifest writer (#2666)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- working towards https://github.com/apache/iceberg-rust/issues/2034\n\nFollow up for https://github.com/apache/iceberg-rust/pull/2628 \n\n## What changes are included in this PR?\nNow that we have two constructors for `ManifestWriterBuilder`, `new` and\n`new_from_encrypted`, it should never be the case that you want to\npresent `key_metadata` to an unencrypted `output`.\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "ed347f2eac82983e4060288dee04e8b42dd59f22",
      "tree": "44e981bbe9198dde9fdc50cf7536ba0e4c4bb63f",
      "parents": [
        "c915c31e495bb1ad211079a23bca9b63bae45460"
      ],
      "author": {
        "name": "Krisztián Szűcs",
        "email": "szucs.krisztian@gmail.com",
        "time": "Wed Jul 01 01:45:19 2026 +0200"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 16:45:19 2026 -0700"
      },
      "message": "feat(writer): honor write.parquet.* via ParquetWriterBuilder::from_table_properties (#2561)\n\n## Which issue does this PR close?\n\nN/A — no tracking issue.\n\n## What changes are included in this PR?\n\nOnly the DataFusion `INSERT INTO` path honored `write.parquet.*` table\nproperties, and only the content-defined-chunking (CDC) keys, via a\nhand-rolled translation inlined in `IcebergWriteExec`. Anything writing\nthrough the writer stack directly (`DataFileWriter` →\n`ParquetWriterBuilder`) silently fell back to parquet-rs defaults.\n\nThis PR moves that translation behind a reusable constructor:\n\n- Add `ParquetWriterBuilder::from_table_properties(\u0026TableProperties,\nschema)`, the single place that maps `write.parquet.*` into\n`WriterProperties`. It currently translates the CDC keys\n(`write.parquet.content-defined-chunking.*`); other keys still fall back\nto parquet-rs defaults and can be added here later.\n- Add a chainable `with_match_mode` setter so the field match mode can\nbe overridden — DataFusion needs name-based matching since its Arrow\nbatches carry no field-id metadata.\n- Refactor the DataFusion `insert_into` writer to build via\n`from_table_properties`, reusing the `TableProperties` it already parses\nand dropping the inline CDC translation.\n\nAdditive only: `new` and `new_with_match_mode` are unchanged; no\nbreaking changes.\n\n## Are these changes tested?\n\n- Unit tests in `parquet_writer.rs`: CDC is off by default, and CDC\nproperties propagate through `build()` to the writer\u0027s\n`WriterProperties` — asserted on the getter rather than by re-reading a\nwritten file, so future `write.parquet.*` options only need an assertion\non their corresponding getter.\n- Existing `test_insert_into*` DataFusion integration tests cover the\nrefactored path, which is behaviorally unchanged."
    },
    {
      "commit": "c915c31e495bb1ad211079a23bca9b63bae45460",
      "tree": "86d55b8ffbfc1055a15693053e9a07a3bfd9c5fd",
      "parents": [
        "4215bd378cdd997f364dea737fa154aee4f6b6e2"
      ],
      "author": {
        "name": "kid",
        "email": "lucian1412@outlook.com",
        "time": "Wed Jul 01 07:44:08 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 16:44:08 2026 -0700"
      },
      "message": "fix(datafusion): reject non-append insert operations (#2714)\n\n## Which issue does this PR close?\n\n- Closes #2711.\n\n## What changes are included in this PR?\n\nReject DataFusion `InsertOp::Overwrite` and `InsertOp::Replace` before\nconstructing an Iceberg write plan.\n\nPreviously, `IcebergTableProvider::insert_into` ignored the requested\ninsert operation while the commit executor always used `fast_append`.\nUnsupported overwrite or replace requests could therefore be silently\nexecuted with append semantics.\n\nThis patch keeps the existing append path unchanged and returns\n`DataFusionError::NotImplemented` for unsupported insert operations. It\npreserves the existing `_insert_op` parameter name to avoid changing the\ngenerated public API snapshot.\n\n## Are these changes tested?\n\nYes. Added unit tests verifying that:\n\n- `InsertOp::Overwrite` returns `DataFusionError::NotImplemented`.\n- `InsertOp::Replace` returns `DataFusionError::NotImplemented`.\n- Existing append-insert behavior remains unchanged.\n\nLocal verification:\n\n- `cargo test -p iceberg-datafusion test_catalog_backed_provider_rejects\n-- --nocapture`\n- `cargo fmt --all -- --check`\n- `git diff --check`"
    },
    {
      "commit": "4215bd378cdd997f364dea737fa154aee4f6b6e2",
      "tree": "abf858b49225776a2286b2b9c2ba6ce69fe59df8",
      "parents": [
        "6c3dec8fa9a9945453c8c10f9980b293880dad9b"
      ],
      "author": {
        "name": "kid",
        "email": "lucian1412@outlook.com",
        "time": "Wed Jul 01 07:43:15 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 16:43:15 2026 -0700"
      },
      "message": "fix(datafusion): return single row with count 0 for empty inserts (#2712)\n\nWhich issue does this PR close?\n-------------------------------\n\n* Closes #2713.\n\nWhat changes are included in this PR?\n-------------------------------------\n\nFix empty inserts in the DataFusion integration.\n\nWhen an `INSERT` produces no data files (e.g. `INSERT INTO ... SELECT\n... WHERE false`), `IcebergCommitExec` previously returned an empty\n`RecordBatch`. DataFusion expects a single-row count result for DML\nstatements, so this PR changes the empty-data path to return a batch\nwith count `0`.\n\nfor empty inserts, the code returns early when there are no data files,\nbefore it ever starts a transaction, so it will not create snapshot.\n\nAre these changes tested?\n-------------------------\n\nYes. Added tests verifying that:\n\n* Empty inserts return a single-row `UInt64` count batch with value `0`.\n* Existing insert tests continue to pass.\n\nLocal verification:\n\n* `cargo test -p iceberg-datafusion`\n* `cargo clippy -p iceberg-datafusion --all-targets -- -D warnings`\n* `cargo fmt --all -- --check`\n* `git diff --check`"
    },
    {
      "commit": "6c3dec8fa9a9945453c8c10f9980b293880dad9b",
      "tree": "ef0a9daf35cca3b0a13a1f905c723d01ff315c42",
      "parents": [
        "25197f46b54a559b3a543ef87bfa3445d5b15c3e"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Wed Jul 01 00:01:34 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 16:01:34 2026 -0700"
      },
      "message": "chore: Update changelog for 0.10.0 (#2751)\n\n## Which issue does this PR close?\n\nN/A\n\n## What changes are included in this PR?\n\nChangelog update for 0.10.0.\n\n## Are these changes tested?\n\nN/A"
    },
    {
      "commit": "25197f46b54a559b3a543ef87bfa3445d5b15c3e",
      "tree": "b63898cf1eca6708bb2929595be8ae8cccfa978a",
      "parents": [
        "be6cc96eaeb1cac4574cabb11ea6e1e92e0aad45"
      ],
      "author": {
        "name": "Abanoub Doss",
        "email": "abanoubdoss@gmail.com",
        "time": "Tue Jun 30 14:56:20 2026 -0500"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 12:56:20 2026 -0700"
      },
      "message": "ci: cache Python bindings Rust artifacts (#2679)\n\n## Which issue does this PR close?\n\n- None. This is a CI maintenance change for the Python bindings test\njob.\n\n## What changes are included in this PR?\n\nThis adds a real Rust artifact cache to the Python bindings CI test job\nfor host maturin builds on Windows and macOS.\n\nConcretely, this PR adds two steps before `PyO3/maturin-action`:\n\n- `Setup Rust toolchain`\n- `Cache Rust artifacts`\n\nLinux maturin builds may run inside the manylinux Docker container,\nwhere the host `target/` cache is not expected to help. Windows and\nmacOS build on the host, so `swatinem/rust-cache` can restore Cargo\nartifacts for the expensive maturin compile.\n\nThe cache uses a dedicated bindings key, and its `save-if` behavior\nmatches the existing CI cache discipline: PRs may restore cache entries,\nbut only `main` pushes create new ones.\n\n## Are these changes tested?\n\n  - Not run locally; this is a GitHub Actions workflow-only change.\n\nCo-authored-by: Abanoub Doss \u003cabanoub.doss@gmail.com\u003e"
    },
    {
      "commit": "be6cc96eaeb1cac4574cabb11ea6e1e92e0aad45",
      "tree": "e0c4c423ef8d1227ec21d46dd98cc66c5349e542",
      "parents": [
        "f903a19c2705850953859d52c6274efd8674ff90"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Tue Jun 30 16:45:59 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 30 08:45:59 2026 -0700"
      },
      "message": "chore(ci): Remove \u0027--locked\u0027 flag on toml-cli install (#2750)\n\n## Which issue does this PR close?\n\nN/A\n\n## What changes are included in this PR?\n\nWe moved all CLI installs to `--locked` in #2739. Unfortunately, this\ndoesn\u0027t work for `toml-cli` as it is not regularly updated and its lock\nfile refers to outdated dependencies. In particular, it points to crates\nwhich use nightly unstable features which no longer exist.\n\nThis change removes `--locked` and adds a comment to explain why.\n\nAlternatively, we could use the stable toolchain here although I think\nit\u0027s OK to use newer dependencies instead.\n\n## Are these changes tested?\n\nManually tested, the following command succeeds:\n\n```\ncargo +nightly-2026-03-05 install toml-cli --force\n```"
    },
    {
      "commit": "f903a19c2705850953859d52c6274efd8674ff90",
      "tree": "f327ad55ea60d093650ad5f173b343c800569164",
      "parents": [
        "77c5d7101a658d645c9ed9adbfb45005b3f31e9f"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Tue Jun 30 00:12:35 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 16:12:35 2026 -0700"
      },
      "message": "chore: Update changelog and dependency lists for 0.10.0 (#2745)\n\n## Which issue does this PR close?\n\nN/A\n\n## What changes are included in this PR?\n\nUpdate changelog for us to cut 0.10.0-rc2.\n\n## Are these changes tested?\n\nNo, changelog update only."
    },
    {
      "commit": "77c5d7101a658d645c9ed9adbfb45005b3f31e9f",
      "tree": "cc42f9aad9f4a2baf8f29a5cf838b547564e2e90",
      "parents": [
        "03799b1586841f839d46eebe441896f2a8cf7a36"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Mon Jun 29 23:15:26 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 15:15:26 2026 -0700"
      },
      "message": "fix: Update Python binding test fixtures to close catalogs (#2721)\n\n## Which issue does this PR close?\n\n- Closes #2720.\n\n## What changes are included in this PR?\n\nOn Python 3.13, the tests error with ResourceWarning: unclosed database\nat session teardown. This is because the SqlCatalog (and its underlying\nsqlite3 connections) are never explicitly closed. Python 3.13 began\nreporting this error:\nhttps://docs.python.org/3.13/whatsnew/3.13.html#sqlite3\n\nThis change adopts the PyTest fixture generator pattern, where the\nfixture yields some value and then after the test, the fixture function\nis resumed to perform cleanup.\n\n## Are these changes tested?\n\nYes, tests pass after the changes on Python 3.13 and Python 3.14."
    },
    {
      "commit": "03799b1586841f839d46eebe441896f2a8cf7a36",
      "tree": "ea16b1f29626c72c45385d7bb96208ff45d74038",
      "parents": [
        "ab27bba98f5f4f6c80aa518d0df2c1e1da95b802"
      ],
      "author": {
        "name": "Liang-Chi Hsieh",
        "email": "viirya@gmail.com",
        "time": "Tue Jun 30 05:32:42 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 14:32:42 2026 -0700"
      },
      "message": "fix(transaction): don\u0027t let user properties override computed summary metrics (#2726)\n\n## Which issue does this PR close?\n\n- Closes #2725.\n\n## What changes are included in this PR?\n\nBuilding a snapshot summary let a user-supplied snapshot property\noverwrite a computed metric key, and a non-integer value then panicked\ntotal computation. Both are fixed to match iceberg-java.\n\n**1. Computed metrics now win over user properties\n(`transaction/snapshot.rs`).** Previously:\n\n```rust\nlet mut additional_properties \u003d summary_collector.build();\nadditional_properties.extend(self.snapshot_properties.clone());   // user overwrites computed\n```\n\nNow the user properties are applied first and the computed metrics\noverwrite them:\n\n```rust\nlet mut additional_properties \u003d self.snapshot_properties.clone();\nadditional_properties.extend(summary_collector.build());          // computed overwrites user\n```\n\nThis matches `SnapshotSummary.Builder.build()` in iceberg-java, which\ndoes `builder.putAll(properties)` (custom props) first and then\n`metrics.addTo(builder)`, so computed metrics win on a key collision.\n\n**2. `update_totals` tolerates an unparseable delta instead of panicking\n(`spec/snapshot_summary.rs`).** The `added-*`/`removed-*` parses used\n`.expect(\"must be parsable as it was just serialized\")`. A non-integer\nvalue (which can also legitimately come from a previous snapshot\u0027s\nsummary) panicked the commit. It now skips that total, matching\niceberg-java\u0027s `SnapshotProducer.updateTotal`, which wraps the\n`Long.parseLong` calls in `try { … } catch (NumberFormatException e) {\n// ignore and do not add total }`.\n\nBoth Java behaviors verified against `apache/iceberg` `main`\n(`core/src/main/java/org/apache/iceberg/SnapshotProducer.java`,\n`SnapshotSummary.java`).\n\n## Are these changes tested?\n\nTwo new regression tests:\n\n-\n`transaction::append::test_snapshot_properties_cannot_override_computed_metrics`\n— a fast-append whose `snapshot_properties` set `added-data-files\u003d9999`\nand `added-records\u003d\u003cnon-integer\u003e` commits without panicking, and the\nresulting summary reports the real computed counts (`1`), not the user\nvalues.\n-\n`spec::snapshot_summary::test_update_totals_tolerates_unparseable_added_value`\n— an unparseable `added-*` value skips that one total while sibling\ntotals still compute, with no panic.\n\nBoth fail if the respective fix is reverted (verified). Full `iceberg`\nlib suite (1373 tests) passes, clippy + rustfmt clean."
    },
    {
      "commit": "ab27bba98f5f4f6c80aa518d0df2c1e1da95b802",
      "tree": "505aa82abe713df3e542c25473947d8dbba20172",
      "parents": [
        "229160259fe0b939fb99164d3c84e9fd0dd81ff8"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Mon Jun 29 21:59:58 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:59:58 2026 -0700"
      },
      "message": "chore: Update all cargo install references to use --locked (#2739)\n\n## Which issue does this PR close?\n\nAddresses follow-up item:\nhttps://github.com/apache/iceberg-rust/pull/2627#pullrequestreview-4484455091\n\n## What changes are included in this PR?\n\nThis change ensures that all CLI installs via Cargo will install using\nthe same dependency graph as the crate was published with, avoiding\ndependencies silently changing. Sometimes patch version updates are\nfine, although occasionally breaking changes can slip in. This change\nstandardizes all installs in the codebase to recommend using --locked.\n\n## Are these changes tested?\n\nTested by running the tools locally."
    },
    {
      "commit": "229160259fe0b939fb99164d3c84e9fd0dd81ff8",
      "tree": "7c19b0fc6c739c885ec095db6e8bc95d235ecb85",
      "parents": [
        "ca61fc820e25d535880caaa04bced27e3c9adf7d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 19:09:14 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 19:09:14 2026 +0800"
      },
      "message": "chore(deps): Bump bytes from 1.11.1 to 1.12.0 (#2734)"
    },
    {
      "commit": "ca61fc820e25d535880caaa04bced27e3c9adf7d",
      "tree": "d95513dd24d7aaa18d132cd4251a1bd674f8209a",
      "parents": [
        "83e777cfffb1a5a83bcd6c41c6b2c6e24ff36f6e"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Mon Jun 29 10:01:46 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 17:01:46 2026 +0800"
      },
      "message": "chore: Move dependency list generation back to release manager task (#2706)\n\n## Which issue does this PR close?\n\n- Closes https://github.com/apache/iceberg-rust/issues/2737.\n\n## What changes are included in this PR?\n\nReverts #2675. Reworks the guide a bit to make the steps clearer.\n\n## Are these changes tested?\n\nWe found that moving the dependency list generation was not a good idea\non balance with #2691.\n\nI\u0027ve checked that the dependency checks pass locally.\n\ncc @CTTY"
    },
    {
      "commit": "83e777cfffb1a5a83bcd6c41c6b2c6e24ff36f6e",
      "tree": "817dacd083d8f955d599a127dd803261f24f0d71",
      "parents": [
        "ee253b5b91fee47beaae88839bda31794293b9a4"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 14:55:30 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 14:55:30 2026 +0800"
      },
      "message": "chore(deps-dev): Bump maturin from 1.13.3 to 1.14.1 in /bindings/python (#2731)\n\nBumps [maturin](https://github.com/pyo3/maturin) from 1.13.3 to 1.14.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pyo3/maturin/releases\"\u003ematurin\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.14.1\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump uraimo/run-on-arch-action to v3 to fix pytest job by \u003ca\nhref\u003d\"https://github.com/matusf\"\u003e\u003ccode\u003e@​matusf\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3221\"\u003ePyO3/maturin#3221\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix platform tag logic to generate the same as cpython on AIX by \u003ca\nhref\u003d\"https://github.com/pgimalac\"\u003e\u003ccode\u003e@​pgimalac\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3220\"\u003ePyO3/maturin#3220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump pyo3-introspection by \u003ca\nhref\u003d\"https://github.com/Tpt\"\u003e\u003ccode\u003e@​Tpt\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3227\"\u003ePyO3/maturin#3227\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade cargo-zigbuild \u0026amp; cargo-xwin by \u003ca\nhref\u003d\"https://github.com/messense\"\u003e\u003ccode\u003e@​messense\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3228\"\u003ePyO3/maturin#3228\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix issues around crates enabling abi3 and abi3t features by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3226\"\u003ePyO3/maturin#3226\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd PEP 740 publish attestations to PyPI releases by \u003ca\nhref\u003d\"https://github.com/shaanmajid\"\u003e\u003ccode\u003e@​shaanmajid\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3230\"\u003ePyO3/maturin#3230\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSet PYO3_PYTHON to run scripts for stable ABI builds by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3233\"\u003ePyO3/maturin#3233\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix shell quoting in CI scripts by \u003ca\nhref\u003d\"https://github.com/nkgotcode\"\u003e\u003ccode\u003e@​nkgotcode\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3231\"\u003ePyO3/maturin#3231\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRelease v1.14.1 by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3234\"\u003ePyO3/maturin#3234\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/matusf\"\u003e\u003ccode\u003e@​matusf\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3221\"\u003ePyO3/maturin#3221\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/pgimalac\"\u003e\u003ccode\u003e@​pgimalac\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3220\"\u003ePyO3/maturin#3220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/shaanmajid\"\u003e\u003ccode\u003e@​shaanmajid\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3230\"\u003ePyO3/maturin#3230\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/nkgotcode\"\u003e\u003ccode\u003e@​nkgotcode\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3231\"\u003ePyO3/maturin#3231\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/PyO3/maturin/compare/v1.14.0...v1.14.1\"\u003ehttps://github.com/PyO3/maturin/compare/v1.14.0...v1.14.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.14.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport parent-relative pyproject metadata in sdists by \u003ca\nhref\u003d\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3182\"\u003ePyO3/maturin#3182\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate PyPI platform tag validation by \u003ca\nhref\u003d\"https://github.com/messense\"\u003e\u003ccode\u003e@​messense\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3187\"\u003ePyO3/maturin#3187\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003emaint: update setup emsdk action in generate-ci by \u003ca\nhref\u003d\"https://github.com/ManonMarchand\"\u003e\u003ccode\u003e@​ManonMarchand\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3194\"\u003ePyO3/maturin#3194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: only shim bin wheels during auditwheel repair by \u003ca\nhref\u003d\"https://github.com/messense\"\u003e\u003ccode\u003e@​messense\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3197\"\u003ePyO3/maturin#3197\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: avoid editable ELF truncation from stale hardlinks by \u003ca\nhref\u003d\"https://github.com/messense\"\u003e\u003ccode\u003e@​messense\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3199\"\u003ePyO3/maturin#3199\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix Pyodide Emscripten platform tags by \u003ca\nhref\u003d\"https://github.com/messense\"\u003e\u003ccode\u003e@​messense\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3191\"\u003ePyO3/maturin#3191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump openssl from 0.10.79 to 0.10.80 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3200\"\u003ePyO3/maturin#3200\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse pax instead of GNU headers for tar by \u003ca\nhref\u003d\"https://github.com/konstin\"\u003e\u003ccode\u003e@​konstin\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3203\"\u003ePyO3/maturin#3203\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: add default exclude \u003cstrong\u003epycache\u003c/strong\u003e and *.pyc files\nby \u003ca href\u003d\"https://github.com/GuYeying\"\u003e\u003ccode\u003e@​GuYeying\u003c/code\u003e\u003c/a\u003e in\n\u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3202\"\u003ePyO3/maturin#3202\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation: fix the update_readme script by \u003ca\nhref\u003d\"https://github.com/ManonMarchand\"\u003e\u003ccode\u003e@​ManonMarchand\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3186\"\u003ePyO3/maturin#3186\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix python versions used in integration_pyo3_mixed_conda by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3208\"\u003ePyO3/maturin#3208\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for finding free-threaded interpreters for\n--find-interpreters by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3206\"\u003ePyO3/maturin#3206\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump tar from 0.4.45 to 0.4.46 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3209\"\u003ePyO3/maturin#3209\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eStubs: also generate them for mixed PyO3 projects by \u003ca\nhref\u003d\"https://github.com/Tpt\"\u003e\u003ccode\u003e@​Tpt\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3211\"\u003ePyO3/maturin#3211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDon\u0027t depend on CFFI on PyPy by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3213\"\u003ePyO3/maturin#3213\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eresolve_platform_tags: remove a redundant case by \u003ca\nhref\u003d\"https://github.com/Tpt\"\u003e\u003ccode\u003e@​Tpt\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3214\"\u003ePyO3/maturin#3214\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eGeneratorOutput::additional_files remove Option by \u003ca\nhref\u003d\"https://github.com/Tpt\"\u003e\u003ccode\u003e@​Tpt\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3215\"\u003ePyO3/maturin#3215\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport pyo3 abi3t features on Python3.15 and PyO3 0.29 by \u003ca\nhref\u003d\"https://github.com/ngoldbaum\"\u003e\u003ccode\u003e@​ngoldbaum\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3113\"\u003ePyO3/maturin#3113\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/GuYeying\"\u003e\u003ccode\u003e@​GuYeying\u003c/code\u003e\u003c/a\u003e\nmade their first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/PyO3/maturin/pull/3202\"\u003ePyO3/maturin#3202\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/PyO3/maturin/compare/v1.13.3...v1.14.0\"\u003ehttps://github.com/PyO3/maturin/compare/v1.13.3...v1.14.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/PyO3/maturin/blob/main/Changelog.md\"\u003ematurin\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.14.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump uraimo/run-on-arch-action to v3 to fix pytest job (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3221\"\u003e#3221\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix platform tag logic to generate the same as cpython on AIX (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3220\"\u003e#3220\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump pyo3-introspection (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3227\"\u003e#3227\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpgrade cargo-zigbuild \u0026amp; cargo-xwin (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3228\"\u003e#3228\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix issues around crates enabling abi3 and abi3t features (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3226\"\u003e#3226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd PEP 740 publish attestations to PyPI releases (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3230\"\u003e#3230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSet PYO3_PYTHON to run scripts for stable ABI builds (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3233\"\u003e#3233\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix shell quoting in CI scripts (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3231\"\u003e#3231\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.14.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport parent-relative pyproject metadata in sdists (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3182\"\u003e#3182\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdate PyPI platform tag validation (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3187\"\u003e#3187\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMaint: update setup emsdk action in generate-ci (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3194\"\u003e#3194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix: only shim bin wheels during auditwheel repair (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3197\"\u003e#3197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix: avoid editable ELF truncation from stale hardlinks (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3199\"\u003e#3199\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix Pyodide Emscripten platform tags (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3191\"\u003e#3191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse pax instead of GNU headers for tar (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3203\"\u003e#3203\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFeat: add default exclude \u003ccode\u003e__pycache__\u003c/code\u003e and\n\u003ccode\u003e*.pyc\u003c/code\u003e files (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3202\"\u003e#3202\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd support for finding free-threaded interpreters for\n\u003ccode\u003e--find-interpreters\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3206\"\u003e#3206\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eStubs: also generate them for mixed PyO3 projects (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3211\"\u003e#3211\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDon\u0027t depend on CFFI on PyPy (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3213\"\u003e#3213\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSupport pyo3 abi3t features on Python3.15 and PyO3 0.29 (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/pull/3113\"\u003e#3113\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/6febbe20f0006e62299c6a88b49e3ede5e2e2318\"\u003e\u003ccode\u003e6febbe2\u003c/code\u003e\u003c/a\u003e\nRelease v1.14.1 (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3234\"\u003e#3234\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/6c9cd7f0f72fe72ec81ed671dbb66bc37636b403\"\u003e\u003ccode\u003e6c9cd7f\u003c/code\u003e\u003c/a\u003e\nFix shell quoting in CI scripts (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3231\"\u003e#3231\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/37cbb4a6f50cc14de59cde6c53d1340d3ca9d9b4\"\u003e\u003ccode\u003e37cbb4a\u003c/code\u003e\u003c/a\u003e\nSet PYO3_PYTHON to run scripts for stable ABI builds (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3233\"\u003e#3233\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/1a68d09d0ddfd40f9d179cd2d904f292bff13e59\"\u003e\u003ccode\u003e1a68d09\u003c/code\u003e\u003c/a\u003e\nAdd PEP 740 publish attestations to PyPI releases (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3230\"\u003e#3230\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/49defa4f83ef643c2a03090fa90ac88aca3898d0\"\u003e\u003ccode\u003e49defa4\u003c/code\u003e\u003c/a\u003e\nFix issues around crates enabling abi3 and abi3t features (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3226\"\u003e#3226\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/4a1b63ce4db30101ae6047e2e12d7a26c38db4f5\"\u003e\u003ccode\u003e4a1b63c\u003c/code\u003e\u003c/a\u003e\nUpgrade cargo-zigbuild \u0026amp; cargo-xwin (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3228\"\u003e#3228\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/5c369136e6e7bb60ea3064b53a02ecb9765f8b31\"\u003e\u003ccode\u003e5c36913\u003c/code\u003e\u003c/a\u003e\nBump pyo3-introspection (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3227\"\u003e#3227\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/6a7ab7f9a349ee9d3b3c0ca4c1639dd99e8a079f\"\u003e\u003ccode\u003e6a7ab7f\u003c/code\u003e\u003c/a\u003e\n[pre-commit.ci] pre-commit autoupdate (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3225\"\u003e#3225\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/43d7258ed4b55d0e830b8bf04d1ffd2de15c3020\"\u003e\u003ccode\u003e43d7258\u003c/code\u003e\u003c/a\u003e\nFix platform tag logic to generate the same as cpython on AIX (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3220\"\u003e#3220\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/PyO3/maturin/commit/5f3e44eac83dbdfeaba96b1a9a4b232849ed4a45\"\u003e\u003ccode\u003e5f3e44e\u003c/code\u003e\u003c/a\u003e\nBump uraimo/run-on-arch-action to v3 to fix pytest job (\u003ca\nhref\u003d\"https://redirect.github.com/pyo3/maturin/issues/3221\"\u003e#3221\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pyo3/maturin/compare/v1.13.3...v1.14.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dmaturin\u0026package-manager\u003duv\u0026previous-version\u003d1.13.3\u0026new-version\u003d1.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: blackmwk \u003cliurenjie1024@outlook.com\u003e"
    },
    {
      "commit": "ee253b5b91fee47beaae88839bda31794293b9a4",
      "tree": "8b1144ad287aed7305e7f018eea02ce9ce4cfa52",
      "parents": [
        "82c6bd5465b4509ca7a3ff29bcae250014287142"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 14:32:04 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 14:32:04 2026 +0800"
      },
      "message": "chore(deps-dev): Bump huggingface-hub from 1.18.0 to 1.20.1 in /bindings/python (#2730)\n\nBumps [huggingface-hub](https://github.com/huggingface/huggingface_hub)\nfrom 1.18.0 to 1.20.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/releases\"\u003ehuggingface-hub\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.20.1\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/compare/v1.20.0...v1.20.1\"\u003ehttps://github.com/huggingface/huggingface_hub/compare/v1.20.0...v1.20.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e[v1.20.0] Browser-based OAuth login, multi-commit folder uploads,\nand more\u003c/h2\u003e\n\u003ch2\u003e🔒 Browser-based OAuth login\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003ehf auth login\u003c/code\u003e now defaults to a browser-based OAuth\nDevice Code flow instead of asking you to copy-paste a token. The\ncommand prints a URL and a short code, you authorize in the browser, and\nthe CLI retrieves and saves the token for you. The same applies to\n\u003ccode\u003elogin()\u003c/code\u003e in Python. In an interactive terminal you still get\na \u003ccode\u003egh\u003c/code\u003e-style arrow-key menu to pick between browser login and\npasting a token, and \u003ccode\u003e--token\u003c/code\u003e works exactly as before.\u003c/p\u003e\n\u003cp\u003eOAuth tokens expire after 30 days, but they come with a refresh\ntoken: \u003ccode\u003eget_token()\u003c/code\u003e transparently refreshes them when less\nthan a day of validity remains, so long-running setups keep working\nwithout re-authenticating. \u003ccode\u003ehf auth list\u003c/code\u003e now shows the\nexpiry date for OAuth tokens.\u003c/p\u003e\n\u003cpre lang\u003d\"bash\"\u003e\u003ccode\u003e\u0026gt; hf auth login\n? How would you like to log in? Log in with your browser\n\u003cpre\u003e\u003ccode\u003eOpen this URL in your browser:\n    https://hf.co/oauth/device\n\nAnd enter the code: 52AT-FLYZ\n\nWaiting for authorization.\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eWhen the command is run by an AI agent, it never prompts. Instead it\nstreams structured events so the agent can surface the URL and code to\nits user, then blocks until a terminal \u003ccode\u003eauth_success\u003c/code\u003e /\n\u003ccode\u003eauth_error\u003c/code\u003e event:\u003c/p\u003e\n\u003cpre lang\u003d\"console\"\u003e\u003ccode\u003e$ hf auth login --format json\n{\u0026quot;event\u0026quot;: \u0026quot;device_code\u0026quot;,\n\u0026quot;verification_uri\u0026quot;: \u0026quot;https://hf.co/oauth/device\u0026quot;,\n\u0026quot;user_code\u0026quot;: \u0026quot;52AT-FLYZ\u0026quot;,\n\u0026quot;verification_uri_complete\u0026quot;:\n\u0026quot;https://hf.co/oauth/device\u0026quot;, \u0026quot;expires_in\u0026quot;: 300,\n\u0026quot;interval\u0026quot;: 5}\n{\u0026quot;event\u0026quot;: \u0026quot;auth_success\u0026quot;, \u0026quot;user\u0026quot;:\n\u0026quot;celinah\u0026quot;, \u0026quot;token_name\u0026quot;: \u0026quot;oauth-celinah\u0026quot;}\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003ccode\u003ehf auth list\u003c/code\u003e surfaces the new expiry column:\u003c/p\u003e\n\u003cpre lang\u003d\"console\"\u003e\u003ccode\u003e$ hf auth list\n  name          token       expires\n- ------------- ----------- -------------------\n  my-token      hf_****5678\n* oauth-user    hf_****1234 2026-07-09\n  oauth-old     hf_****9999 2026-06-09 (expired)\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eFinally, \u003ccode\u003enotebook_login()\u003c/code\u003e now renders the link and code\nwith plain \u003ccode\u003eIPython.display.HTML\u003c/code\u003e, dropping the\n\u003ccode\u003eipywidgets\u003c/code\u003e dependency.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e[Auth] Browser-based OAuth login by \u003ca\nhref\u003d\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4354\"\u003e#4354\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚡ Faster, more reliable \u003ccode\u003ehf upload\u003c/code\u003e for large\nfolders\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003ehf upload\u003c/code\u003e and the underlying \u003ccode\u003eupload_folder\u003c/code\u003e\nhave been revamped to be faster and far more robust on large folders.\nWhen \u003ccode\u003ehf_xet\u003c/code\u003e is installed (the default), uploads now run\nthrough a streamed, multi-commit pipeline built on the\n\u003ccode\u003eXetSession\u003c/code\u003e API: the folder is scanned and fed into a\nbackground Xet upload while previous batches are committed in parallel,\nand files are hashed in a single read pass while they are chunked (the\nold flow read every large file twice). Nothing changes in how you call\nit:\u003c/p\u003e\n\u003cpre lang\u003d\"bash\"\u003e\u003ccode\u003e\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/5efdca0b066740c911e59feba2f14e145ff3dbfb\"\u003e\u003ccode\u003e5efdca0\u003c/code\u003e\u003c/a\u003e\nRelease: v1.20.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/0c3a0622f413923853faced000b97446194a6fae\"\u003e\u003ccode\u003e0c3a062\u003c/code\u003e\u003c/a\u003e\n[Auth] Fix circular import on \u003ccode\u003efrom huggingface_hub import\nlogin\u003c/code\u003e (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4384\"\u003e#4384\u003c/a\u003e)\n(\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4\"\u003e#4\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/8d52526f5d44cf835b9c2a9fb2e4ac03d545c8ed\"\u003e\u003ccode\u003e8d52526\u003c/code\u003e\u003c/a\u003e\nRelease: v1.20.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/9379ae35ee840fdf889147c7f21fadb32c44db03\"\u003e\u003ccode\u003e9379ae3\u003c/code\u003e\u003c/a\u003e\nRelease: v1.20.0.rc0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/3b3abe38b7ae761eb1bebfb0676b5bd2b9f2a2c1\"\u003e\u003ccode\u003e3b3abe3\u003c/code\u003e\u003c/a\u003e\n[Spaces] Add \u003ccode\u003ewait_for_space\u003c/code\u003e API and \u003ccode\u003ehf spaces\nwait\u003c/code\u003e CLI (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4380\"\u003e#4380\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/e52fdef6100a9f3a5d08a146fe99910f297807e0\"\u003e\u003ccode\u003ee52fdef\u003c/code\u003e\u003c/a\u003e\n[CLI] Make \u003ccode\u003ehf jobs ssh\u003c/code\u003e wait for job to be running (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4379\"\u003e#4379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/a0c1dfeeb1ef7468e616012149b62fd3566915b2\"\u003e\u003ccode\u003ea0c1dfe\u003c/code\u003e\u003c/a\u003e\n[Jobs] Add \u003ccode\u003ehf jobs wait\u003c/code\u003e and \u003ccode\u003eHfApi.wait_for_job\u003c/code\u003e\n(\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4345\"\u003e#4345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/558987464c237d84cd1f6e3062feff420a39b7c5\"\u003e\u003ccode\u003e5589874\u003c/code\u003e\u003c/a\u003e\n[Inference Endpoints] Custom-container deploy CLI + deprecate protected\nendpo...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/462d09366e5d215b72b710769326c4c7baf26f9c\"\u003e\u003ccode\u003e462d093\u003c/code\u003e\u003c/a\u003e\n[CLI] Suggest creating repo/bucket on NotFound errors (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4372\"\u003e#4372\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/commit/ebe5315b56c53ad0a912d21ce9558ddc9e9f9be5\"\u003e\u003ccode\u003eebe5315\u003c/code\u003e\u003c/a\u003e\nAdd new JobNotFound error (\u003ca\nhref\u003d\"https://redirect.github.com/huggingface/huggingface_hub/issues/4367\"\u003e#4367\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/huggingface/huggingface_hub/compare/v1.18.0...v1.20.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dhuggingface-hub\u0026package-manager\u003duv\u0026previous-version\u003d1.18.0\u0026new-version\u003d1.20.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: blackmwk \u003cliurenjie1024@outlook.com\u003e"
    },
    {
      "commit": "82c6bd5465b4509ca7a3ff29bcae250014287142",
      "tree": "77ece623ccb1a6f5b22a9fd5fd8116ee121d64c6",
      "parents": [
        "cb99752574d74f36860a87b960548a972cf28251"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:52:04 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:52:04 2026 +0800"
      },
      "message": "chore(deps): Bump rust-lang/crates-io-auth-action from 1.0.4 to 1.0.5 (#2728)\n\nBumps\n[rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action)\nfrom 1.0.4 to 1.0.5.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/releases\"\u003erust-lang/crates-io-auth-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.0.5\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eupdate to tsdown 0.22 by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/239\"\u003erust-lang/crates-io-auth-action#239\u003c/a\u003e\nand \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/254\"\u003erust-lang/crates-io-auth-action#254\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate to typescript 6 by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/256\"\u003erust-lang/crates-io-auth-action#256\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eother dependency updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eInternal changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003erenovate: rename updateTypes field by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/219\"\u003erust-lang/crates-io-auth-action#219\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erenovate: don\u0027t raise individual PRs for crates non breaking changes\nby \u003ca href\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/220\"\u003erust-lang/crates-io-auth-action#220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003euse rust-lang renovate preset by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/235\"\u003erust-lang/crates-io-auth-action#235\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci(links): accept 403 as success by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/263\"\u003erust-lang/crates-io-auth-action#263\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/compare/v1.0.4...v1.0.5\"\u003ehttps://github.com/rust-lang/crates-io-auth-action/compare/v1.0.4...v1.0.5\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/c6f97d42243bad5fab37ca0427f495c86d5b1a18\"\u003e\u003ccode\u003ec6f97d4\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/259\"\u003e#259\u003c/a\u003e\nfrom rust-lang/renovate/lock-file-maintenance\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/b929a92a23966592174006fd5b96e64d1cd075df\"\u003e\u003ccode\u003eb929a92\u003c/code\u003e\u003c/a\u003e\npackage dist\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/9d23f3b135e2f6cca30b6009ba96b400571031c9\"\u003e\u003ccode\u003e9d23f3b\u003c/code\u003e\u003c/a\u003e\nchore(deps): lock file maintenance\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/2b6b194a918a46e109251a59b4ebbc1301217ebb\"\u003e\u003ccode\u003e2b6b194\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/263\"\u003e#263\u003c/a\u003e\nfrom rust-lang/ci-links-accept-403-as-failure\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/1a7afc2bc1530b81a443462a0bf0c991f6638eac\"\u003e\u003ccode\u003e1a7afc2\u003c/code\u003e\u003c/a\u003e\nci(links): accept 403 as success\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/701b15ca19185730da2d99d59d5ab21abc40c188\"\u003e\u003ccode\u003e701b15c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/260\"\u003e#260\u003c/a\u003e\nfrom rust-lang/renovate/tsdown-0.x-lockfile\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/cf898e1b39ff976b829787fb4df05671cd380fda\"\u003e\u003ccode\u003ecf898e1\u003c/code\u003e\u003c/a\u003e\npackage dist\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/1a6a6213fc40463948b2c5791665943b6f911792\"\u003e\u003ccode\u003e1a6a621\u003c/code\u003e\u003c/a\u003e\nchore(deps): update dependency tsdown to v0.22.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/9f93ac2286e4f1a6e86b5f77b890fda4566f5c03\"\u003e\u003ccode\u003e9f93ac2\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/261\"\u003e#261\u003c/a\u003e\nfrom rust-lang/renovate/github-actions\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/54634519e6897c380989f809cc0e8c9374f3342d\"\u003e\u003ccode\u003e5463451\u003c/code\u003e\u003c/a\u003e\nchore(deps): update github actions to v6.0.3\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/compare/bbd81622f20ce9e2dd9622e3218b975523e45bbe...c6f97d42243bad5fab37ca0427f495c86d5b1a18\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003drust-lang/crates-io-auth-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d1.0.4\u0026new-version\u003d1.0.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "cb99752574d74f36860a87b960548a972cf28251",
      "tree": "8de6e6b0ad36ac8dbf915cb072ab86579347d6a4",
      "parents": [
        "4faa49787516c2bec29ebbf62abfbe0f1ccde99d"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:50:55 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:50:55 2026 +0800"
      },
      "message": "chore(deps-dev): Bump pytest from 9.0.3 to 9.1.1 in /bindings/python (#2732)\n\nBumps [pytest](https://github.com/pytest-dev/pytest) from 9.0.3 to\n9.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/releases\"\u003epytest\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e9.1.1\u003c/h2\u003e\n\u003ch1\u003epytest 9.1.1 (2026-06-19)\u003c/h1\u003e\n\u003ch2\u003eBug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14220\"\u003e#14220\u003c/a\u003e:\nFixed a logic bug in \u003ccode\u003epytest.RaisesGroup\u003c/code\u003e which would might\ncause it to display incorrect \u0026quot;It matches \u003c!-- raw HTML omitted\n--\u003eFooError()\u003c!-- raw HTML omitted --\u003e which was paired with \u003c!-- raw\nHTML omitted --\u003eBarError\u003c!-- raw HTML omitted --\u003e\u0026quot; messages.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14591\"\u003e#14591\u003c/a\u003e:\nFixed a regression in pytest 9.1.0 which caused overriding a\nparametrized fixture with an indirect \u003c!-- raw HTML omitted --\u003e\u003ca\nhref\u003d\"https://github.com/pytest\"\u003e\u003ccode\u003e@​pytest\u003c/code\u003e\u003c/a\u003e.mark.parametrize\u003c!--\nraw HTML omitted --\u003e to fail with \u0026quot;duplicate parametrization of\n\u0027\u0026lt;fixture name\u0026gt;\u0027\u0026quot;.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14606\"\u003e#14606\u003c/a\u003e:\nFixed \u003ccode\u003elist-item\u003c/code\u003e typing errors from mypy in\n\u003ccode\u003e@pytest.mark.parametrize \u0026lt;pytest.mark.parametrize\nref\u0026gt;\u003c/code\u003e \u003ccode\u003eargvalues\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14608\"\u003e#14608\u003c/a\u003e:\nFixed a regression in pytest 9.1.0 where \u003ccode\u003econftest.py\u003c/code\u003e files\nlocated in \u003ccode\u003e\u0026lt;invocation dir\u0026gt;/test*\u003c/code\u003e were no longer\nloaded as initial conftests when invoked without arguments.\nThis could cause certain hooks (like \u003ccode\u003epytest_addoption\u003c/code\u003e) in\nthese files to not fire.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e9.1.0\u003c/h2\u003e\n\u003ch1\u003epytest 9.1.0 (2026-06-13)\u003c/h1\u003e\n\u003ch2\u003eRemovals and backward incompatible breaking changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14533\"\u003e#14533\u003c/a\u003e:\nWhen using \u003ccode\u003e--doctest-modules\u003c/code\u003e, autouse fixtures with\n\u003ccode\u003emodule\u003c/code\u003e, \u003ccode\u003epackage\u003c/code\u003e or \u003ccode\u003esession\u003c/code\u003e scope\nthat are defined inline in Python test modules (not plugins or\nconftests) will now possibly execute twice.\u003c/p\u003e\n\u003cp\u003eIf this is undesirable, move the fixture definition to a\n\u003ccode\u003econftest.py\u003c/code\u003e file if possible.\u003c/p\u003e\n\u003cp\u003eTechnical explanation for those interested:\nWhen using \u003c!-- raw HTML omitted --\u003e--doctest-modules\u003c!-- raw HTML\nomitted --\u003e, pytest possibly collects Python modules twice, once as\n\u003ccode\u003epytest.Module\u003c/code\u003e and once as a \u003ccode\u003eDoctestModule\u003c/code\u003e\n(depending on the configuration).\nDue to improvements in pytest\u0027s fixture implementation, if e.g. the\n\u003ccode\u003eDoctestModule\u003c/code\u003e collects a fixture, it is now visible to it\nonly, and not to the \u003ccode\u003eModule\u003c/code\u003e.\nThis means that both need to register the fixtures independently.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations (removal in next major release)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/10819\"\u003e#10819\u003c/a\u003e:\nAdded a deprecation warning for class-scoped fixtures defined as\ninstance methods (without \u003ccode\u003e@classmethod\u003c/code\u003e). Such fixtures set\nattributes on a different instance than the test methods use, leading to\nunexpected behavior. Use \u003ccode\u003e@classmethod\u003c/code\u003e decorator instead --\nby \u003ccode\u003eyastcher\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eSee \u003ccode\u003e10819\u003c/code\u003e and \u003ccode\u003e14011\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/12882\"\u003e#12882\u003c/a\u003e:\nCalling \u003ccode\u003erequest.getfixturevalue()\n\u0026lt;pytest.FixtureRequest.getfixturevalue\u0026gt;\u003c/code\u003e during teardown to\nrequest a fixture that was not already requested is now deprecated and\nwill become an error in pytest 10.\u003c/p\u003e\n\u003cp\u003eSee \u003ccode\u003edynamic-fixture-request-during-teardown\u003c/code\u003e for\ndetails.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/13409\"\u003e#13409\u003c/a\u003e:\nUsing non-\u003ccode\u003e~collections.abc.Collection\u003c/code\u003e iterables (such as\ngenerators, iterators, or custom iterable objects) for the\n\u003ccode\u003eargvalues\u003c/code\u003e parameter in \u003ccode\u003e@pytest.mark.parametrize\n\u0026lt;pytest.mark.parametrize ref\u0026gt;\u003c/code\u003e and\n\u003ccode\u003emetafunc.parametrize \u0026lt;pytest.Metafunc.parametrize\u0026gt;\u003c/code\u003e is\nnow deprecated.\u003c/p\u003e\n\u003cp\u003eThese iterables get exhausted after the first iteration,\nleading to tests getting unexpectedly skipped in cases such as running\n\u003ccode\u003epytest.main()\u003c/code\u003e multiple times,\nusing class-level parametrize decorators,\nor collecting tests multiple times.\u003c/p\u003e\n\u003cp\u003eSee \u003ccode\u003eparametrize-iterators\u003c/code\u003e for details and\nsuggestions.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/13946\"\u003e#13946\u003c/a\u003e:\nThe private \u003ccode\u003econfig.inicfg\u003c/code\u003e attribute is now deprecated.\nUse \u003ccode\u003econfig.getini() \u0026lt;pytest.Config.getini\u0026gt;\u003c/code\u003e to access\nconfiguration values instead.\u003c/p\u003e\n\u003cp\u003eSee \u003ccode\u003econfig-inicfg\u003c/code\u003e for more details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14004\"\u003e#14004\u003c/a\u003e:\nPassing \u003ccode\u003ebaseid\u003c/code\u003e to \u003ccode\u003e~pytest.FixtureDef\u003c/code\u003e or\n\u003ccode\u003enodeid\u003c/code\u003e strings to fixture registration APIs is now\ndeprecated. These are internal pytest APIs that are used by some\nplugins.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/cf470ec0bf7eb89cd97dd56df4859eae5db46447\"\u003e\u003ccode\u003ecf470ec\u003c/code\u003e\u003c/a\u003e\nPrepare release version 9.1.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/e0c8ce6cc5db1f08363be6f152c32e6838df2690\"\u003e\u003ccode\u003ee0c8ce6\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14625\"\u003e#14625\u003c/a\u003e\nfrom pytest-dev/patchback/backports/9.1.x/a07c31a97...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/1b82d1694fce22385ee7a4287917fbafbaf2e757\"\u003e\u003ccode\u003e1b82d16\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14624\"\u003e#14624\u003c/a\u003e\nfrom pytest-dev/patchback/backports/9.1.x/b375b79ec...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/501c4bc784da3b08bfcaa64858eba5d15dc59e53\"\u003e\u003ccode\u003e501c4bc\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14596\"\u003e#14596\u003c/a\u003e\nfrom bluetech/doc-classmethod\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/b61f588e36e9377c3d1d3f06bece1da0fc31d9ca\"\u003e\u003ccode\u003eb61f588\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14622\"\u003e#14622\u003c/a\u003e\nfrom chrisburr/fix-14608-initial-conftest-test-subdir\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/9a567e009f4d2da3ce1721c6db3109cb5744d40a\"\u003e\u003ccode\u003e9a567e0\u003c/code\u003e\u003c/a\u003e\n[automated] Update plugin list (\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14617\"\u003e#14617\u003c/a\u003e)\n(\u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14618\"\u003e#14618\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/ef8b2993e5b48639e4a3d97d0525df9760781384\"\u003e\u003ccode\u003eef8b299\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14620\"\u003e#14620\u003c/a\u003e\nfrom pytest-dev/patchback/backports/9.1.x/680f9f3ed...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/66abd0784d4cb7c1ba44ab9a8896506cd4985acc\"\u003e\u003ccode\u003e66abd07\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14220\"\u003e#14220\u003c/a\u003e\nfrom bysiber/fix-stale-iexp-raisesgroup\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/79fbf93b666cac5f27c9dad047943d47b766c8d5\"\u003e\u003ccode\u003e79fbf93\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14612\"\u003e#14612\u003c/a\u003e\nfrom pytest-dev/patchback/backports/9.1.x/974ed48b6...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/commit/0d312eb876177e9f1c04262b54060a41034ebf5c\"\u003e\u003ccode\u003e0d312eb\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/pytest-dev/pytest/issues/14611\"\u003e#14611\u003c/a\u003e\nfrom bluetech/parametrize-argvalues-typing\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/pytest-dev/pytest/compare/9.0.3...9.1.1\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dpytest\u0026package-manager\u003duv\u0026previous-version\u003d9.0.3\u0026new-version\u003d9.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "4faa49787516c2bec29ebbf62abfbe0f1ccde99d",
      "tree": "7fc0753f868d10d3610e54aafd07a5d095395b7a",
      "parents": [
        "4ab91fd03aee97e5438f8e6b7c120b65b5bce8ae"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 13:50:17 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 13:50:17 2026 +0800"
      },
      "message": "chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 (#2733)\n\nBumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3\nto 7.0.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/releases\"\u003eactions/checkout\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eblock checking out fork pr for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the\nminor-actions-dependencies group across 1 directory by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and\n\u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3\nupdates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003egetting ready for checkout v7 release by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2464\"\u003eactions/checkout#2464\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate error wording by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2467\"\u003eactions/checkout#2467\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e made\ntheir first contribution in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/v6.0.3...v7.0.0\"\u003ehttps://github.com/actions/checkout/compare/v6.0.3...v7.0.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/actions/checkout/blob/main/CHANGELOG.md\"\u003eactions/checkout\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003ch2\u003ev7.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBlock checking out fork PR for pull_request_target and workflow_run\nby \u003ca href\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2454\"\u003eactions/checkout#2454\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the\nminor-actions-dependencies group across 1 directory by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2458\"\u003eactions/checkout#2458\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump flatted from 3.3.1 to 3.4.2 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2460\"\u003eactions/checkout#2460\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump js-yaml from 4.1.0 to 4.2.0 by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2461\"\u003eactions/checkout#2461\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ccode\u003e@​actions/core\u003c/code\u003e and\n\u003ccode\u003e@​actions/tool-cache\u003c/code\u003e and Remove uuid by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2459\"\u003eactions/checkout#2459\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupgrade module to esm and update dependencies by \u003ca\nhref\u003d\"https://github.com/aiqiaoy\"\u003e\u003ccode\u003e@​aiqiaoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2463\"\u003eactions/checkout#2463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the minor-npm-dependencies group across 1 directory with 3\nupdates by \u003ca\nhref\u003d\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot]\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2462\"\u003eactions/checkout#2462\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.3\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix checkout init for SHA-256 repositories by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2439\"\u003eactions/checkout#2439\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: expand merge commit SHA regex and add SHA-256 test cases by \u003ca\nhref\u003d\"https://github.com/yaananth\"\u003e\u003ccode\u003e@​yaananth\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2414\"\u003eactions/checkout#2414\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix tag handling: preserve annotations and explicit fetch-tags by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2356\"\u003eactions/checkout#2356\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd worktree support for persist-credentials includeIf by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2327\"\u003eactions/checkout#2327\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev6.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePersist creds to a separate file by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2286\"\u003eactions/checkout#2286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README to include Node.js 24 support details and requirements\nby \u003ca href\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2248\"\u003eactions/checkout#2248\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v5 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2301\"\u003eactions/checkout#2301\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev5.0.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate actions checkout to use node 24 by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2226\"\u003eactions/checkout#2226\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePort v6 cleanup to v4 by \u003ca\nhref\u003d\"https://github.com/ericsciple\"\u003e\u003ccode\u003e@​ericsciple\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2305\"\u003eactions/checkout#2305\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.3.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003edocs: update README.md by \u003ca\nhref\u003d\"https://github.com/motss\"\u003e\u003ccode\u003e@​motss\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1971\"\u003eactions/checkout#1971\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd internal repos for checking out multiple repositories by \u003ca\nhref\u003d\"https://github.com/mouismail\"\u003e\u003ccode\u003e@​mouismail\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1977\"\u003eactions/checkout#1977\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocumentation update - add recommended permissions to Readme by \u003ca\nhref\u003d\"https://github.com/benwells\"\u003e\u003ccode\u003e@​benwells\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2043\"\u003eactions/checkout#2043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust positioning of user email note and permissions heading by \u003ca\nhref\u003d\"https://github.com/joshmgross\"\u003e\u003ccode\u003e@​joshmgross\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2044\"\u003eactions/checkout#2044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate README.md by \u003ca\nhref\u003d\"https://github.com/nebuk89\"\u003e\u003ccode\u003e@​nebuk89\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2194\"\u003eactions/checkout#2194\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate CODEOWNERS for actions by \u003ca\nhref\u003d\"https://github.com/TingluoHuang\"\u003e\u003ccode\u003e@​TingluoHuang\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2224\"\u003eactions/checkout#2224\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate package dependencies by \u003ca\nhref\u003d\"https://github.com/salmanmkc\"\u003e\u003ccode\u003e@​salmanmkc\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/2236\"\u003eactions/checkout#2236\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eurl-helper.ts\u003c/code\u003e now leverages well-known environment\nvariables by \u003ca href\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e\nin \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1941\"\u003eactions/checkout#1941\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpand unit test coverage for \u003ccode\u003eisGhes\u003c/code\u003e by \u003ca\nhref\u003d\"https://github.com/jww3\"\u003e\u003ccode\u003e@​jww3\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1946\"\u003eactions/checkout#1946\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev4.2.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck out other refs/* by commit if provided, fall back to ref by \u003ca\nhref\u003d\"https://github.com/orhantoy\"\u003e\u003ccode\u003e@​orhantoy\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/pull/1924\"\u003eactions/checkout#1924\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003e\u003ccode\u003e9c091bb\u003c/code\u003e\u003c/a\u003e\nupdate error wording (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2467\"\u003e#2467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a\"\u003e\u003ccode\u003e1044a6d\u003c/code\u003e\u003c/a\u003e\ngetting ready for checkout v7 release (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2464\"\u003e#2464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f\"\u003e\u003ccode\u003ef028218\u003c/code\u003e\u003c/a\u003e\nBump the minor-npm-dependencies group across 1 directory with 3 updates\n(\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2462\"\u003e#2462\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d\"\u003e\u003ccode\u003ed914b26\u003c/code\u003e\u003c/a\u003e\nupgrade module to esm and update dependencies (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2463\"\u003e#2463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d\"\u003e\u003ccode\u003e537c7ef\u003c/code\u003e\u003c/a\u003e\nBump \u003ccode\u003e@​actions/core\u003c/code\u003e and \u003ccode\u003e@​actions/tool-cache\u003c/code\u003e\nand Remove uuid (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2459\"\u003e#2459\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6\"\u003e\u003ccode\u003e130a169\u003c/code\u003e\u003c/a\u003e\nBump js-yaml from 4.1.0 to 4.2.0 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2461\"\u003e#2461\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3\"\u003e\u003ccode\u003e7d09575\u003c/code\u003e\u003c/a\u003e\nBump flatted from 3.3.1 to 3.4.2 (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2460\"\u003e#2460\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e\"\u003e\u003ccode\u003e0f9f3aa\u003c/code\u003e\u003c/a\u003e\nBump actions/publish-immutable-action (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2458\"\u003e#2458\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7\"\u003e\u003ccode\u003ef9e715a\u003c/code\u003e\u003c/a\u003e\nblock checking out fork pr for pull_request_target and workflow_run (\u003ca\nhref\u003d\"https://redirect.github.com/actions/checkout/issues/2454\"\u003e#2454\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dactions/checkout\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d6.0.3\u0026new-version\u003d7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "4ab91fd03aee97e5438f8e6b7c120b65b5bce8ae",
      "tree": "acaeff6e36c4c025e6c15e6f141c2bed76c551aa",
      "parents": [
        "b1b9644c7e6a905c5f6441431e2152a5f856bccc"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 11:31:31 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 11:31:31 2026 +0800"
      },
      "message": "chore(deps): Bump taiki-e/install-action from 2.81.7 to 2.82.2 (#2735)\n\nBumps\n[taiki-e/install-action](https://github.com/taiki-e/install-action) from\n2.81.7 to 2.82.2.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/releases\"\u003etaiki-e/install-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.82.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003exh@latest\u003c/code\u003e to 0.26.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.23.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.71.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003esccache@latest\u003c/code\u003e to 0.16.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.1\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.4.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.22.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eosv-scanner@latest\u003c/code\u003e to 2.4.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.11.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emartin@latest\u003c/code\u003e to 1.11.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.53.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-zigbuild@latest\u003c/code\u003e to 0.23.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.82.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport \u003ccode\u003ecargo-vet\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/taiki-e/install-action/pull/1908\"\u003e#1908\u003c/a\u003e,\nthanks \u003ca\nhref\u003d\"https://github.com/jakewimmer\"\u003e\u003ccode\u003e@​jakewimmer\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport \u003ccode\u003ecargo-crap\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/taiki-e/install-action/pull/1905\"\u003e#1905\u003c/a\u003e,\nthanks \u003ca\nhref\u003d\"https://github.com/BartoszCiesla\"\u003e\u003ccode\u003e@​BartoszCiesla\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport \u003ccode\u003ecargo-leptos\u003c/code\u003e. (\u003ca\nhref\u003d\"https://redirect.github.com/taiki-e/install-action/pull/1903\"\u003e#1903\u003c/a\u003e,\nthanks \u003ca\nhref\u003d\"https://github.com/404Simon\"\u003e\u003ccode\u003e@​404Simon\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.103.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-xwin@latest\u003c/code\u003e to 0.23.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 45.0.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-deny@latest\u003c/code\u003e to 0.19.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003eprek@latest\u003c/code\u003e to 0.4.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.71.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.10.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.81.11\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-tools@latest\u003c/code\u003e to 1.252.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-bindgen@latest\u003c/code\u003e to 0.2.125.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md\"\u003etaiki-e/install-action\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog\u003c/h1\u003e\n\u003cp\u003eAll notable changes to this project will be documented in this\nfile.\u003c/p\u003e\n\u003cp\u003eThis project adheres to \u003ca href\u003d\"https://semver.org\"\u003eSemantic\nVersioning\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e[Unreleased]\u003c/h2\u003e\n\u003ch2\u003e[2.82.5] - 2026-06-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 46.0.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasm-bindgen@latest\u003c/code\u003e to 0.2.126.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003evacuum@latest\u003c/code\u003e to 0.29.6.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.14.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-rdme@latest\u003c/code\u003e to 2.1.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.82.4] - 2026-06-25\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.24.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.13.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ejust@latest\u003c/code\u003e to 1.54.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ebiome@latest\u003c/code\u003e to 2.5.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[2.82.3] - 2026-06-24\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ezizmor@latest\u003c/code\u003e to 1.26.1.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ewasmtime@latest\u003c/code\u003e to 46.0.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003etombi@latest\u003c/code\u003e to 1.1.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003emise@latest\u003c/code\u003e to 2026.6.12.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ekingfisher@latest\u003c/code\u003e to 1.104.0.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-tarpaulin@latest\u003c/code\u003e to 0.35.5.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdate \u003ccode\u003ecargo-nextest@latest\u003c/code\u003e to 0.9.138.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/9e1e5806d4a4822de933115878265be9aaa786d9\"\u003e\u003ccode\u003e9e1e580\u003c/code\u003e\u003c/a\u003e\nRelease 2.82.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/788896b6163ee187bf02f51161e573dbc028dba0\"\u003e\u003ccode\u003e788896b\u003c/code\u003e\u003c/a\u003e\nUpdate zizmor manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/7631577b669c94d73e58cb9f217d0f56abd33a48\"\u003e\u003ccode\u003e7631577\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003exh@latest\u003c/code\u003e to 0.26.1\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/e0f1a05cc9f43f4fd57d15fe7ee20ca5b78f65fc\"\u003e\u003ccode\u003ee0f1a05\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003euv@latest\u003c/code\u003e to 0.11.23\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/3cda1e20d17fde3f9958653d219495e0591233ec\"\u003e\u003ccode\u003e3cda1e2\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003etrivy@latest\u003c/code\u003e to 0.71.2\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/11ac3210af3c20497864c3d27d4499b6a7108098\"\u003e\u003ccode\u003e11ac321\u003c/code\u003e\u003c/a\u003e\nUpdate tombi manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/b5f9e335d3eaba5117342d9d9fda485aea29c524\"\u003e\u003ccode\u003eb5f9e33\u003c/code\u003e\u003c/a\u003e\nUpdate \u003ccode\u003esccache@latest\u003c/code\u003e to 0.16.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/4e48cd5f5170589da6cad450be3e62ca61534cc1\"\u003e\u003ccode\u003e4e48cd5\u003c/code\u003e\u003c/a\u003e\nUpdate cargo-tarpaulin manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/e0a923573389b28b6cefdbe8309332b471f55583\"\u003e\u003ccode\u003ee0a9235\u003c/code\u003e\u003c/a\u003e\nUpdate cargo-rdme manifest\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/commit/8b3c737da4b541bf0fb5a3e0488ff20535badac9\"\u003e\u003ccode\u003e8b3c737\u003c/code\u003e\u003c/a\u003e\nRelease 2.82.1\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/taiki-e/install-action/compare/56545b37b57562edd73171cb6c62cc509db4c34e...9e1e5806d4a4822de933115878265be9aaa786d9\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dtaiki-e/install-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d2.81.7\u0026new-version\u003d2.82.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e\nCo-authored-by: blackmwk \u003cliurenjie1024@outlook.com\u003e"
    },
    {
      "commit": "b1b9644c7e6a905c5f6441431e2152a5f856bccc",
      "tree": "b3efe8ccec96f23b9e1af95e210641b32d8e628b",
      "parents": [
        "fc308a23079d2ad7d04d9900838909b58b26abb1"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 29 11:06:19 2026 +0800"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 29 11:06:19 2026 +0800"
      },
      "message": "chore(deps): Bump minijinja from 2.20.0 to 2.21.0 (#2736)\n\nBumps [minijinja](https://github.com/mitsuhiko/minijinja) from 2.20.0 to\n2.21.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/blob/main/CHANGELOG.md\"\u003eminijinja\u0027s\nchangelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.21.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a panic when comparing two numbers that have no common\nlossless representation, such as a float against an integer that cannot\nbe represented exactly as \u003ccode\u003ef64\u003c/code\u003e (for example \u003ccode\u003e1.0 \u0026lt;\n9007199254740993\u003c/code\u003e). \u003ca\nhref\u003d\"https://redirect.github.com/mitsuhiko/minijinja/issues/904\"\u003e#904\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFixed a stack overflow caused by repeated sequence concatenation. \u003ca\nhref\u003d\"https://redirect.github.com/mitsuhiko/minijinja/issues/907\"\u003e#907\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved performance of iteration over map items. \u003ca\nhref\u003d\"https://redirect.github.com/mitsuhiko/minijinja/issues/906\"\u003e#906\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/commit/1d3e73d39a7fd4a31c369209dbcb036fcf1a322c\"\u003e\u003ccode\u003e1d3e73d\u003c/code\u003e\u003c/a\u003e\nchore: bump version to 2.21.0\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/commit/002351e66910291da837b8b893c19f5a71f1530a\"\u003e\u003ccode\u003e002351e\u003c/code\u003e\u003c/a\u003e\ndocs(changelog): note stack overflow fix and map iteration perf\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/commit/1183321f92732796d4f5f5fed800eb30949e68c2\"\u003e\u003ccode\u003e1183321\u003c/code\u003e\u003c/a\u003e\nImprove performance of iteration over map items (\u003ca\nhref\u003d\"https://redirect.github.com/mitsuhiko/minijinja/issues/906\"\u003e#906\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/commit/3dd59369682742937ee9cbedbca8bff3dbc301d9\"\u003e\u003ccode\u003e3dd5936\u003c/code\u003e\u003c/a\u003e\nfix(value): avoid panic comparing numbers without a common lossless\nrepresent...\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/commit/f8d9cc792ce53c41ece13affd8f1ca779bb97518\"\u003e\u003ccode\u003ef8d9cc7\u003c/code\u003e\u003c/a\u003e\nfix: avoid stack overflow on repeated sequence concatenation (\u003ca\nhref\u003d\"https://redirect.github.com/mitsuhiko/minijinja/issues/907\"\u003e#907\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/commit/3018c2e122ace9070a1048496c97a7e46018bd31\"\u003e\u003ccode\u003e3018c2e\u003c/code\u003e\u003c/a\u003e\nchore(ci): use Node 24 for npm publishing\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca\nhref\u003d\"https://github.com/mitsuhiko/minijinja/compare/minijinja-go/v2.20.0...minijinja-go/v2.21.0\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003dminijinja\u0026package-manager\u003dcargo\u0026previous-version\u003d2.20.0\u0026new-version\u003d2.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    },
    {
      "commit": "fc308a23079d2ad7d04d9900838909b58b26abb1",
      "tree": "3b5cf721bb4c54c9af40f40e4c7d07ae29d77484",
      "parents": [
        "ac92ec9d4f6bf6ca8b7298e60d46130814b8f18f"
      ],
      "author": {
        "name": "Dhruv Arya",
        "email": "dhruv.arya@databricks.com",
        "time": "Fri Jun 26 14:25:49 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Fri Jun 26 23:25:49 2026 +0200"
      },
      "message": "fix: avoid lost-wakeup hang in DeleteFileIndex::get_deletes_for_data_file (#2696)\n\n## Which issue does this PR close?\n\nN/A — concurrency bug found while reviewing #2590.\n\n## What changes are included in this PR?\n\nFixes a lost-wakeup hang in\n`DeleteFileIndex::get_deletes_for_data_file`.\n\n## The bug\n\n`DeleteFileIndex` populates asynchronously on a background task that\nsignals completion with `tokio::sync::Notify::notify_waiters()`. Per the\ntokio docs, `notify_waiters()` stores no permit and only wakes\n`Notified` futures that have already been **created**.\n\n`get_deletes_for_data_file` observes the `Populating` state, **releases\nthe read lock**, and only *then* creates the `Notified` future. If the\npopulating task flips the state to `Populated` and calls\n`notify_waiters()` in that window, the wakeup is lost and the query\nawaits forever.\n\nThe window is normally only a few instructions wide and is effectively\nnever hit, because the querier usually registers before the populator is\neven scheduled. This is reachable from the `SnapshotValidator` commit\npath (apache/iceberg-rust#2590), which drops the channel sender\nimmediately before querying — making the populator finish right as the\nquery starts.\n\n## The fix\n\nCreate the `Notified` future (via `notified_owned`) **while still\nholding the read lock**. The populating task cannot call\n`notify_waiters()` until it acquires the write lock, which is blocked\nwhile the read lock is held — so the notification is guaranteed to\nhappen *after* the future has been created, and tokio guarantees such\nnotifications are delivered. No re-check needed.\n\nThe same latent pattern exists in `arrow/delete_filter.rs` and\n`arrow/caching_delete_file_loader.rs`; this PR fixes only the index\nsite, and I\u0027m happy to follow up on the others.\n\n## Are these changes tested?\n\nThis production change is intentionally minimal (no test), because a\ndeterministic regression test requires a small test-only seam to make\nthe otherwise nanosecond-wide race window reliable. To keep that out of\nthis PR, the seam + test live in companion PRs on my fork:\n\n- Reproduction only — the test **fails** (hangs → timeout),\ndemonstrating the bug:\nhttps://github.com/dhruvarya-db/iceberg-rust/pull/9\n- The same fix **with** the regression test — the test **passes**:\nhttps://github.com/dhruvarya-db/iceberg-rust/pull/10\n\nI\u0027m happy to fold the regression test into this PR if maintainers\nprefer.\n\n\n## How the race happens (before this fix)\n\n`get_deletes_for_data_file` releases the read lock at **(B)** and only\ncreates its `Notified` future at **(C)**. The populating task can flip\nthe state to `Populated` and call `notify_waiters()` in the window\nbetween (B) and (C). Because `notify_waiters()` stores no permit (unlike\n`notify_one()`) and only wakes `Notified` futures created *before* the\ncall, a notification fired before the future exists is lost — and the\nconsumer then awaits forever:\n\n```\n CONSUMER  get_deletes_for_data_file       PRODUCER  populating task\n ─────────────────────────────────         ──────────────────────────\n read lock: state \u003d\u003d Populating   (A)\n clone notifier (Arc\u003cNotify\u003e)\n drop read lock                   (B)\n        │\n        │  ◄═══════ WINDOW ═══════►         write lock: state \u003d Populated\n        │                                   drop write lock\n        │                                   notify_waiters()  ✗ no waiter registered yet\n        │                                           → wakeup lost (no permit stored)\n        ▼\n notifier.notified().await        (C)        (task has exited)\n        │\n        ▼\n   ░░░ awaits forever ░░░  ← never woken → commit/query hangs\n```\n\nThis is reachable in practice because observing `Populating` at (A) is\nthe common case: the consumer does only synchronous work between\ndropping the sender and the read at (A), while the populator must first\nbe woken from its parked `collect()`, scheduled, and acquire the write\nlock — so the consumer typically reaches (A) before the state flips.\n\n**The fix** creates the `Notified` future at **(A)**, while the read\nlock is still held. The populator cannot call `notify_waiters()` until\nit takes the write lock (blocked while the read lock is held), so the\nfuture always precedes any `notify_waiters()` and the notification is\nguaranteed to be delivered.\n\nSigned-off-by: Dhruv Arya \u003caryadhruv@gmail.com\u003e\nCo-authored-by: Dhruv Arya \u003caryadhruv@gmail.com\u003e"
    },
    {
      "commit": "ac92ec9d4f6bf6ca8b7298e60d46130814b8f18f",
      "tree": "e47ade15cf8ef5c72f11c50afb4e33d91bbb648c",
      "parents": [
        "148afc50ee950b2cd8d99c0243242ef45f3948c5"
      ],
      "author": {
        "name": "Shawn Chang",
        "email": "schang@apache.org",
        "time": "Wed Jun 24 19:31:20 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 24 19:31:20 2026 -0700"
      },
      "message": "chore: Bump version to 0.10.0, update changelog (#2700)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- release tracking issue: #2527 \n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "148afc50ee950b2cd8d99c0243242ef45f3948c5",
      "tree": "dd66ca1c9c6cecff19ef38f2339d2b36f1ae3d6d",
      "parents": [
        "71cef32e8224efc4027247517f0186f20c3a53a5"
      ],
      "author": {
        "name": "alexander domenti",
        "email": "141058955+sandugood@users.noreply.github.com",
        "time": "Wed Jun 24 12:57:26 2026 +0300"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Wed Jun 24 11:57:26 2026 +0200"
      },
      "message": "fix(reader): graceful handling of missing column index (#2693)\n\n## Which issue does this PR close?\n\n- Closes #2452 . Iterates over opened PR: #2464 \n\n## What changes are included in this PR?\n\nChanged the `get_row_selection_for_filter_predicate` to return\n`Ok(None)` on cases where indices were absent instead of throwing an\nerror.\n\n## Are these changes tested?\n\nUnit-tested the change in logic. As specified in the\nhttps://github.com/apache/iceberg-rust/pull/2464#discussion_r3395462759\n\n---------\n\nCo-authored-by: JD Williams \u003cjd@dashlx.com\u003e"
    },
    {
      "commit": "71cef32e8224efc4027247517f0186f20c3a53a5",
      "tree": "1b1d51ca4b36e6e4555da79ac0a4ddad033ec4a4",
      "parents": [
        "ac8edbb73711707a9346b41799b7a0a17d3a987e"
      ],
      "author": {
        "name": "Shawn Chang",
        "email": "schang@apache.org",
        "time": "Tue Jun 23 22:55:40 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 22:55:40 2026 -0700"
      },
      "message": "fix: fix RUSTSEC-2026-0185 (#2703)\n\n## Which issue does this PR close?\n\n\u003c!--\nWe generally require a GitHub issue to be filed for all bug fixes and\nenhancements and this helps us generate change logs for our releases.\nYou can link an issue to this PR using the GitHub syntax. For example\n`Closes #123` indicates that this PR will close issue #123.\n--\u003e\n\n- Closes #.\n\n## What changes are included in this PR?\n\n\u003c!--\nProvide a summary of the modifications in this PR. List the main changes\nsuch as new features, bug fixes, refactoring, or any other updates.\n--\u003e\n\n## Are these changes tested?\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "ac8edbb73711707a9346b41799b7a0a17d3a987e",
      "tree": "0a561c862d4482ec5f329986c9312ffcdc49958b",
      "parents": [
        "d811a232ea6afc9f35a20c2c8a38b228d3b847f4"
      ],
      "author": {
        "name": "Dhruv Arya",
        "email": "dhruv.arya@databricks.com",
        "time": "Tue Jun 23 16:43:06 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 17:43:06 2026 -0600"
      },
      "message": "feat(transaction): remove statistics file metadata for expired snapshots (#2667)\n\n## Which issue does this PR close?\n\nPart of #2145. Extends #2591 (the `ExpireSnapshotsAction`) and #2664\n(the `history.expire.*` defaults).\n\n## What changes are included in this PR?\n\nWhen `ExpireSnapshotsAction` expires snapshots, it now also drops the\nstatistics and partition-statistics metadata entries tied to each\nexpired snapshot, mirroring Java `RemoveSnapshots`\n(`TableMetadata.Builder.removeSnapshots`, which calls\n`removeStatistics`/`removePartitionStatistics` for each removed\nsnapshot). For every expired snapshot that has a statistics entry,\n`commit()` emits a `RemoveStatistics` update; likewise\n`RemovePartitionStatistics` for a partition-statistics entry. Only\nentries that actually exist produce an update, matching Java\u0027s behavior\nof recording a change only when an entry is present.\n\nThis is metadata-only, physical deletion of the puffin files those\nentries point at is part of the file-cleanup maintenance operation\n(mirroring Java\u0027s `FileCleanupStrategy`), not this PR.\n\n## Are these changes tested?\n\nYes. New unit tests cover: an expired snapshot\u0027s statistics and\npartition-statistics entries are removed while a retained snapshot keeps\nits own; an expired snapshot with no statistics emits no removal; and\nonly the statistics variant that is actually present is removed.\n\n---------\n\nCo-authored-by: Dhruv Arya \u003caryadhruv@gmail.com\u003e"
    },
    {
      "commit": "d811a232ea6afc9f35a20c2c8a38b228d3b847f4",
      "tree": "be42713fe6adf5e7e467a5657a91733e45a8e486",
      "parents": [
        "911af2eb180a63623210b505d2fc01cad810c72a"
      ],
      "author": {
        "name": "Daniel Carl Jones",
        "email": "djonesoa@amazon.com",
        "time": "Tue Jun 23 22:21:49 2026 +0100"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 14:21:49 2026 -0700"
      },
      "message": "chore: Update release runbook (#2674)\n\n## Which issue does this PR close?\n\nThere is no open issue for this PR.\n\n## What changes are included in this PR?\n\nThis change updates the release process to try and simplify some steps,\nand clarify what can be owned by non-committers.\n\nI\u0027ve purposely left the updates of dependency files out of the updates\nas I wish to tackle that in a separate PR.\n\n## Are these changes tested?\n\nI have tested the instructions using a GitHub repository I own however I\ncannot test properly with Iceberg Rust.\n\nI am coordinating with @CTTY for this release and we will review the\nrelease process and test it.\n\nI have tested building the site to check there\u0027s no rendering issues."
    },
    {
      "commit": "911af2eb180a63623210b505d2fc01cad810c72a",
      "tree": "24518da981609da24d78042b41308f337991334a",
      "parents": [
        "b6a8ae0155d457a2bb684a97fa68c03350858b8b"
      ],
      "author": {
        "name": "Rahul Shivu Mahadev",
        "email": "51690557+rahulsmahadev@users.noreply.github.com",
        "time": "Tue Jun 23 04:45:32 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Tue Jun 23 13:45:32 2026 +0200"
      },
      "message": "fix(rest): skip serializing unset optional fields in CreateTableRequest (#2610)\n\n## Summary\n\n`RestCatalog::create_table` serializes `CreateTableRequest` with\nexplicit `null` values for unset optional fields (e.g.\n`\"partition-spec\": null`, `\"write-order\": null`). Strict REST catalog\nimplementations such as Apache Polaris reject these requests with HTTP\n400 Bad Request. This change adds `#[serde(skip_serializing_if \u003d\n\"Option::is_none\")]` to the optional fields on the create-table wire\npath so unset fields are omitted from the JSON body.\n\nFixes #2135\n\n## Changes\n\n- `crates/catalog/rest/src/types.rs` — `CreateTableRequest`: skip\nserializing `location`, `partition_spec`, `write_order`, `stage_create`\nwhen `None` (`properties` was already skipped when empty).\n- `crates/iceberg/src/spec/partition.rs` — `UnboundPartitionSpec`: skip\nserializing `spec_id` when `None`; `UnboundPartitionField`: skip\nserializing `field_id` when `None`. These types are embedded in the\ncreate-table request body.\n\nDeserialization is unchanged: `skip_serializing_if` only affects\nserialization, and serde still accepts both missing fields and explicit\n`null` for these `Option` fields (covered by new tests).\n\n## Test plan\n\n- `test_create_table_request_minimal_serialization` — a request with\nonly required fields set serializes without the optional keys.\n- `test_create_table_request_full_serialization` — a fully-populated\nrequest still serializes all optional keys.\n- `test_create_table_request_deserialize_explicit_nulls` — payloads with\nexplicit `null`s still deserialize (backward compatibility).\n- `test_unbound_partition_spec_serialization_skips_none_fields` — unset\n`spec-id`/`field-id` are omitted, set values serialized, explicit\n`null`s still deserialize.\n\nNote: I was unable to compile or run tests locally in my environment (no\ncrates.io access); relying on CI to verify.\n\nSigned-off-by: rahulsmahadev \u003crahul.mahadev@databricks.com\u003e"
    },
    {
      "commit": "b6a8ae0155d457a2bb684a97fa68c03350858b8b",
      "tree": "ea17098ebacaac6153aa3fa5496601ecb9acb746",
      "parents": [
        "28cf83d6cf55909c52de90809aff107aa010e7af"
      ],
      "author": {
        "name": "Yuya Ebihara",
        "email": "ebyhry@gmail.com",
        "time": "Tue Jun 23 09:16:34 2026 +0900"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 22 17:16:34 2026 -0700"
      },
      "message": "CI: Check ASF action allowlist on every PR (#2694)\n\n## Which issue does this PR close?\n\n- https://github.com/apache/iceberg/issues/16934\n- https://github.com/apache/iceberg/pull/16926\n\n## What changes are included in this PR?\n\nCheck ASF action allowlist on every PR\n\n## Are these changes tested?\n\nN/A\n\n\u003c!--\nSpecify what test covers (unit test, integration test, etc.).\n\nIf tests are not included in your PR, please explain why (for example,\nare they covered by existing tests)?\n--\u003e"
    },
    {
      "commit": "28cf83d6cf55909c52de90809aff107aa010e7af",
      "tree": "7c6dbccb147e0aaee40d0ee7206e0e14b7db15d3",
      "parents": [
        "b4c73df7e96b00f1956fb0e482d6401430a5aaec"
      ],
      "author": {
        "name": "dependabot[bot]",
        "email": "49699333+dependabot[bot]@users.noreply.github.com",
        "time": "Mon Jun 22 15:06:54 2026 -0700"
      },
      "committer": {
        "name": "GitHub",
        "email": "noreply@github.com",
        "time": "Mon Jun 22 15:06:54 2026 -0700"
      },
      "message": "chore(deps): Bump rust-lang/crates-io-auth-action from 1.0.3 to 1.0.4 (#2688)\n\nBumps\n[rust-lang/crates-io-auth-action](https://github.com/rust-lang/crates-io-auth-action)\nfrom 1.0.3 to 1.0.4.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/releases\"\u003erust-lang/crates-io-auth-action\u0027s\nreleases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.0.4\u003c/h2\u003e\n\u003ch2\u003eWhat\u0027s Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Renovate GitHub Action digest pinning configuration by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/205\"\u003erust-lang/crates-io-auth-action#205\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate tsdown to v0.21 by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/211\"\u003erust-lang/crates-io-auth-action#211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate to node 24 by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/212\"\u003erust-lang/crates-io-auth-action#212\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eupdate to actions core 3 by \u003ca\nhref\u003d\"https://github.com/marcoieni\"\u003e\u003ccode\u003e@​marcoieni\u003c/code\u003e\u003c/a\u003e in \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/pull/213\"\u003erust-lang/crates-io-auth-action#213\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOther dependencies updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/compare/v1.0.3...v1.0.4\"\u003ehttps://github.com/rust-lang/crates-io-auth-action/compare/v1.0.3...v1.0.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/bbd81622f20ce9e2dd9622e3218b975523e45bbe\"\u003e\u003ccode\u003ebbd8162\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/213\"\u003e#213\u003c/a\u003e\nfrom rust-lang/update-to-actions-core-3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/8c12a02999d1f8c411b90a65a98dafeb68142c32\"\u003e\u003ccode\u003e8c12a02\u003c/code\u003e\u003c/a\u003e\nupdate to actions core 3\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/57ca10cb8bac8eb95ee86b410995653719b0129b\"\u003e\u003ccode\u003e57ca10c\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/212\"\u003e#212\u003c/a\u003e\nfrom rust-lang/update-to-node-24\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/03c291be8ada5bd51809df401e4d71021aec8607\"\u003e\u003ccode\u003e03c291b\u003c/code\u003e\u003c/a\u003e\nupdate to node 24\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/16020e98f2df74fc5974b51505de890f2d6964c9\"\u003e\u003ccode\u003e16020e9\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/192\"\u003e#192\u003c/a\u003e\nfrom rust-lang/renovate/lock-file-maintenance\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/eea9b151caff30c55b0d6b836d2dd14b7671f291\"\u003e\u003ccode\u003eeea9b15\u003c/code\u003e\u003c/a\u003e\nchore(deps): lock file maintenance\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/0beb7deb9125a14dfcf87d25da32c4a3bd672f07\"\u003e\u003ccode\u003e0beb7de\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/211\"\u003e#211\u003c/a\u003e\nfrom rust-lang/update-tsdown-to-v0-21\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/e143bce65e9a129fd9c0328931848f83e806206a\"\u003e\u003ccode\u003ee143bce\u003c/code\u003e\u003c/a\u003e\nfix deprecation\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/b1c82458ff64dd826dd2069706f902bdebe620c5\"\u003e\u003ccode\u003eb1c8245\u003c/code\u003e\u003c/a\u003e\nupdate tsdown to v0.21\u003c/li\u003e\n\u003cli\u003e\u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/commit/bec4b3948342aeb4fc7340db561bc703291bbda7\"\u003e\u003ccode\u003ebec4b39\u003c/code\u003e\u003c/a\u003e\nMerge pull request \u003ca\nhref\u003d\"https://redirect.github.com/rust-lang/crates-io-auth-action/issues/209\"\u003e#209\u003c/a\u003e\nfrom rust-lang/renovate/major-github-actions\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca\nhref\u003d\"https://github.com/rust-lang/crates-io-auth-action/compare/b7e9a28eded4986ec6b1fa40eeee8f8f165559ec...bbd81622f20ce9e2dd9622e3218b975523e45bbe\"\u003ecompare\nview\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name\u003drust-lang/crates-io-auth-action\u0026package-manager\u003dgithub_actions\u0026previous-version\u003d1.0.3\u0026new-version\u003d1.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don\u0027t\nalter it yourself. You can also trigger a rebase manually by commenting\n`@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits\nthat have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all\nof the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop\nDependabot creating any more for this major version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop\nDependabot creating any more for this minor version (unless you reopen\nthe PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop\nDependabot creating any more for this dependency (unless you reopen the\nPR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\nSigned-off-by: dependabot[bot] \u003csupport@github.com\u003e\nCo-authored-by: dependabot[bot] \u003c49699333+dependabot[bot]@users.noreply.github.com\u003e"
    }
  ],
  "next": "b4c73df7e96b00f1956fb0e482d6401430a5aaec"
}