[dependabot]

Bumps the cargo group with 4 updates: tokio, ureq, fastembed and libc.

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates ureq from 3.4.2 to 3.5.0

Changelog

Sourced from ureq's changelog.

3.5.0

• Prepare 3.5.0 and fix dependency advisories and warnings - #1217
• Add Agent::shutdown() to interrupt requests in flight and close all connections #1211
• Preserve validated request header casing with RequestBuilder::header_raw #1214
• Decode proxy URL credentials once; literal percent signs must be escaped as %25 #1215
• Encode ProxyBuilder credentials and preserve colons in proxy passwords #1215
• Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #1209
• Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #1209
• Clarify timeout budgets, phase boundaries, and proxy DNS #1213
• Bound TLS handshake I/O by the remaining connect/global timeout #1208
• Retry socket reads interrupted by EINTR when timeout (technically breaking) #1205
• Fix native-tls-no-default enabling dependencies without enabling the TLS connector
• Add timeout_per_read and timeout_per_write independently of total phase budgets

3.4.3

• Update TLS dependencies for security fixes #1218

Commits

• 1bd534e Fix changelog
• fee0ad2 Prepare 3.5.0 and fix dependency advisories and warnings
• 7de0ab7 Remove realtime dependencies from tests
• 3f18f90 Add Agent::shutdown() for active and pooled connections
• 04572f2 Expose validated request header casing
• 6b1c275 Fix proxy credential encoding and decoding
• 6a609b4 Apply the connect timeout to the SOCKS handshake and check NO_PROXY first
• 3c818f4 Clarify timeout budgets and phase boundaries
• af3e959 Bound TLS handshake I/O by remaining timeout budgets
• 0ebb046 Retry socket reads interrupted by a signal when a timeout applies (#1205)
• Additional commits viewable in compare view

Updates fastembed from 7.1.1 to 7.3.0

Release notes

Sourced from fastembed's releases.

v7.3.0

7.3.0 (2026-10-22)

🍕 Features

• Qwen3-Reranker in the Candle backend (#331) (1293c26) - By @​dhkts1
• Pooled Qwen3 vectors of chosen layers from one pass (#328) (4e07bfa) - By @​dhkts1
• Shorter Qwen3 embedding vectors with an output size option (#327) (1e0fbb1) - By @​dhkts1
• Embed Qwen3 texts in equal-length groups without padding (#326) (41306c7) - By @​dhkts1

v7.2.0

7.2.0 (2026-10-21)

🍕 Features

• Load Qwen3 embedding models from GGUF files in the Candle backend (#325) (287fa9d) - By @​dhkts1, @​anush008

🚀 Performance

• Three Qwen3 Metal speedups: one q/k norm-and-rope kernel, attention output in o_proj's order, and the last layer for the pooled position (#324) (73035d3) - By @​dhkts1
• Hand Qwen3's q, k and v to the fused SDPA as strided views (#321) (1d5f16e) - By @​dhkts1
• Run Qwen3's RMSNorm and RoPE through Candle's fused kernels (#320) (dc44316) - By @​dhkts1
• Run padded Qwen3 batches through the fused SDPA kernel on Metal (#319) (8c1b457) - By @​dhkts1
• Run Qwen3 attention through the fused SDPA kernel on Metal when nothing is padded (#318) (9c80de7) - By @​dhkts1
• Use the fused softmax in Qwen3 attention, nearly halving peak memory on long texts. (#317) (e669409) - By @​dhkts1

v7.1.6

7.1.6 (2026-10-21)

🚀 Performance

• Hand Qwen3's q, k and v to the fused SDPA as strided views (#321) (1d5f16e) - By @​dhkts1
• Run Qwen3's RMSNorm and RoPE through Candle's fused kernels (#320) (dc44316) - By @​dhkts1
• Run padded Qwen3 batches through the fused SDPA kernel on Metal (#319) (8c1b457) - By @​dhkts1
• Run Qwen3 attention through the fused SDPA kernel on Metal when nothing is padded (#318) (9c80de7) - By @​dhkts1
• Use the fused softmax in Qwen3 attention, nearly halving peak memory on long texts. (#317) (e669409) - By @​dhkts1

v7.1.5

7.1.5 (2026-10-21)

🚀 Performance

• Run Qwen3's RMSNorm and RoPE through Candle's fused kernels (#320) (dc44316) - By @​dhkts1
• Run padded Qwen3 batches through the fused SDPA kernel on Metal (#319) (8c1b457) - By @​dhkts1
• Run Qwen3 attention through the fused SDPA kernel on Metal when nothing is padded (#318) (9c80de7) - By @​dhkts1
• Use the fused softmax in Qwen3 attention, nearly halving peak memory on long texts. (#317) (e669409) - By @​dhkts1

v7.1.4

7.1.4 (2026-10-20)

... (truncated)

Commits

• 699f4c4 chore(release): 7.3.0 [skip ci]
• 4e07bfa feat: pooled Qwen3 vectors of chosen layers from one pass (#328)
• 1293c26 feat: Qwen3-Reranker in the candle backend (#331)
• 1e0fbb1 feat: shorter Qwen3 embedding vectors with an output size option (#327)
• 1e0b9f9 test: download one Qwen3 test model at a time (#329)
• 41306c7 feat: embed Qwen3 texts in equal-length groups without padding (#326)
• ce2d648 chore(release): 7.2.0 [skip ci]
• 287fa9d feat: load Qwen3 embedding models from GGUF files in the candle backend (#325)
• 73035d3 fix: three Qwen3 Metal speedups: one q/k norm-and-rope kernel, attention outp...
• 4b3ea90 ci: Shard the text model test and drop the disk cleanup step (#323)
• Additional commits viewable in compare view

Updates libc from 0.2.190 to 0.2.191

Release notes

Sourced from libc's releases.

0.2.191

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Changelog

Sourced from libc's changelog.

0.2.191 - 2026-10-16

Support

• Emscripten: Support v4.0.12 to v6.0.11 (#5610)

Added

• Apple: Add F_SETNOSIGPIPE and F_GETNOSIGPIPE (#5609)
• Apple: add ifaliasreq and in6_aliasreq (#5557)
• FreeBSD: Add PT_* constants (#5625)
• Haiku: Add AI_* and NI_* constants from netdb.h (#5585)
• Hurd: Add POSIX_SPAWN_* flags (#5578)
• NuttX: Add AT_SYMLINK_NOFOLLOW (#5614)
• OpenBSD: Add sensordev (#5534)
• QuRT: Add isatty (#5618)
• WASI: Add pthread_condattr_{get,set}clock (#5626)

Fixed

• FreeBSD-aarch64: Fix gpregs and fpregs (#5603)

Changed

• AIX: Restore 'c_ulong' as the type of 'statvfs.f_fsid'. (#5616)
• Android: Make prop_info an extern type (#5561)
• Apple: Mach API is now available on non-MacOS targets again. This should resolve some issues building ecosystem crates. (#5612), (#5636)
• FreeBSD: Add back NOTE_PCTRLMASK with a deprecation warning (#5600)

Commits

• ccc2ff4 libc: Release 0.2.191
• bce6efb apple: Add mach_task_self and mach_task_self_ to semver checks
• ecf4fd4 apple: Re-restrict mach_vm_map to MacOS-only
• b0e0423 Revert "apple: Disable mach.h API on Apple mobile OSs"
• 9c7f568 apple: add ifaliasreq and in6_aliasreq
• 018c7e9 wasi: Add pthread_condattr_{get,set}clock
• 2c77185 openbsd: add sensordev structure
• e10813c hurd: Add missing POSIX_SPAWN_* flags
• 2ea4bc1 Fix FreeBSD/aarch64
• 6d666fd dragonfly: Parse version from headers rather than CLI
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: cargo. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0dda4fff-33e4-4bf5-af77-92e41d0b90e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}