[renovate]

This PR contains the following updates:

Package	Type	Update	Change
ed25519-zebra	dev-dependencies	major	4.2 → 5.0
ed25519-zebra	dependencies	major	4.2 → 5.0
granit-parser	workspace.dependencies	major	=1.3.0 → =2.0.0
serde-saphyr	workspace.dependencies	major	1 → 2
zip	dependencies	major	8.0 → 9.0

---

Release Notes

ZcashFoundation/ed25519-zebra (ed25519-zebra)

v5.0.0

Compare Source

This release contains breaking changes, since the types of these
dependencies are part of the public API. The MSRV is unchanged (1.85).

• Bump rand_core from 0.6 to 0.10 (and the rand dev-dependency from 0.8 to
  0.10). SigningKey::new() and batch::Verifier::verify() now require an RNG
  implementing the rand_core 0.10 CryptoRng trait, e.g. rand::rng() from
  rand 0.10 (which replaces rand::thread_rng()).
• Bump curve25519-dalek from 4 to 5.
• Bump ed25519 from 2 to 3 (and thus signature from 2 to 3). The re-exported
  ed25519 crate no longer has a std feature.
• Bump sha2 from 0.10 to 0.11.
• Bump pkcs8 from 0.10 to 0.11 and der from 0.7 to 0.8 (pkcs8/pem
  features). pkcs8::Error::KeyMalformed errors now carry a
  pkcs8::KeyError::Invalid, and SigningKey implements
  TryFrom<pkcs8::PrivateKeyInfoRef> instead of TryFrom<pkcs8::PrivateKeyInfo>.
• The serde encoding of Signature changed (via ed25519 3): it now uses
  serdect, serializing as bytes in binary formats (bincode adds a length
  prefix) and as an uppercase hex string in human-readable formats. Signatures
  serialized with 4.x cannot be deserialized with 5.0.

bourumir-wyngs/granit-parser (granit-parser)

v2.0.0

Compare Source

• Added the default-enabled comments feature. Disabling it compiles out scanner comment capture,
  parser and stack comment state, and the public comment types, variants, and
  Options::max_buffered_comment_events, improving parsing performance by about 13%.
  YAML comments are still skipped and validated. Applications using default-features = false
  must enable comments to access
  Comment, Placement, comment token/event variants, or Options::max_buffered_comment_events.
  Options::emit_comments remains available and defaults to true with the feature enabled and
  false without it. Setting it to true has no effect without the feature.
• Made Span non-exhaustive so future releases can add source metadata. Construct spans with
  Span::new, Span::empty, or Span::default, use the metadata builders or field assignment,
  and include .. when destructuring. External struct literals and struct-update syntax are
  no longer supported.
• Split the input whitespace API into the SkipTabs::{Yes, No} policy and WhitespaceResult
  output. Custom Input implementations must return (usize, Result<WhitespaceResult, ErrorKind>)
  from skip_ws_to_eol and (usize, WhitespaceResult) from skip_ws_to_eol_blanks.
  Replace SkipTabs::Result(found_tabs, has_valid_yaml_ws) with
  WhitespaceResult::new(found_tabs, has_valid_yaml_ws); its result accessors are unchanged.
  Consumed-character counts, comment separation errors, and tab behavior are preserved.
• Added Options::strict_indentation (default false) to require strict YAML-compliant indentation
  for flow entries, delimiters, and scalar continuations (compliant with case 9C9N). Default behavior
  is compatible with PyYAML and ruamel.yaml.
• Accept an explicit key indicator ? as the last character of the input (it was rejected with
  "expected whitespace", while ? followed by a line break was accepted).
• Accept quoted scalar continuation lines indented one column past the enclosing block
  (a: "one\n two"). They were rejected with "invalid indentation in multiline quoted scalar".
• A block scalar ending in an indentation-only line with no line break at the end of input
  (|\n a\n ) no longer gains an extra line break ("a\n\n", now "a\n").
• The SequenceEnd span of an indentless sequence (key:\n- a) is empty at the next token,
  instead of covering that token (? of the next key).
• Accept tabs as separation after an explicit key indicator ? in flow collections
  ({?\ta: b}) and before block mapping scalar keys (?\tkey\n: value\n and
  ? \tkey\n: value\n), as permitted by YAML 1.2.2. Tabs used as required indentation,
  including before compact block collections (?\t- and ?\tkey:), remain invalid.
• With strict_indentation enabled, keep explicit-key tab indentation checks active across anchor
  and tag properties, including intervening comments. A key such as ?\t&a\n\tkey\n: value\n
  is rejected in strict mode because its content line lacks the required space indentation after
  the anchor. The default relaxed mode preserves its acceptance of this input.
• Preserve the physical end-of-input line and column for stream-end and block-end spans when
  the last line has no line break, instead of moving them to column zero of a nonexistent next line.
• Report the physical source-error position when fallible input fails during a suppressed trailing
  comment without a final line break. Comment emission no longer changes these error coordinates.
• strict_indentation also checks the line after an escaped line break (\ at the end of a
  line) in a double-quoted scalar in block context (key: "a\ then b" at column 0).

bourumir-wyngs/serde-saphyr (serde-saphyr)

v2.0.0

Compare Source

YAML changes

• Tags selecting unit enum variants now reject non-null payloads instead of silently
  discarding them (#​236). Use a bare variant name, a tag with empty content, or a
  tag followed by ~ or null; quoted strings and collections are rejected.
• Composite mapping keys are not compared regardless of entry order (thanks @​yuxi-liu-wired) .
• Commented now writes its output replacing characters not allowed in comments (non printable) by spaces.

Added

• Added public path_map::PathKind, PathKey::segments(), and PathMap::locations_for()
  for inspecting validation paths and resolving their YAML use/definition locations,
  including best-effort spelling matches and recorded ancestor/root fallback.
• Added RenderOptions::line_offset and RenderOptions::source_name for displaying
  embedded YAML diagnostics at their containing document's line numbers and naming
  the root source in snippet headers, including the new
  miette::to_miette_report_with_options entry point. Included files retain their own
  names and coordinates, and stored error locations and spans are unchanged.
• Added PropertySyntax::DockerCompose for Compose-compatible property interpolation.
• Added the default-enabled comments feature, forwarding to granit-parser's matching
  feature. Builds with default-features = false must enable it to use Commented<T>,
  CommentPosition, comment options, or comment budget fields and reports. Without it,
  YAML comments are still accepted and validated, but their text is not retained.
• Added Options::non_finite_float_policy with NonFiniteFloatPolicy::{PassThrough, Reject, AsString}
  to configure non-finite floats delivered through deserialize_any. Explicit policies override
  the legacy boolean; leaving the field unconfigured preserves its behavior.
• Added the borrowed_context example showing recursive Serialize adapters that borrow
  an existing value tree and per-call formatting context, composing with Tagged<T> and
  style wrappers without building a second container tree or using thread-local state.
• Added SerializerOptions::no_lang_directive (default false) to suppress the
  %YAML 1.2 directive and its leading --- marker independently of yaml_12's quoting.
• Added from_str_multiple, from_bytes_multiple, and their _with_options variants to
  deserialize multiple YAML documents into any C: Default + Extend<T>, including vectors,
  queues, sets, and custom accumulators. Values can borrow from the input string or UTF-8 byte
  slice. Explicit type arguments specify both the document and collection types, for example
  from_str_multiple::<String, Vec<_>>(input).
• Added an error: Box<Error> field to Error::AliasError, which keeps the original error
  when an aliased value fails to deserialize. A custom MessageFormatter or Localizer
  now applies to that error, and std::error::Error::source returns it
  (#​199).

Changed

• Breaking: from_multiple, from_multiple_with_options, from_slice_multiple, and
  from_slice_multiple_with_options now accept T: Deserialize<'de> so values can borrow from
  the input. They retain their names, single type parameter, and Vec<T> returns and are not
  deprecated. Ordinary calls, including from_multiple::<Config>(input) and generic callers
  with T: DeserializeOwned, continue to work. Function pointers or callbacks accepting arbitrary
  input lifetimes may need forwarding closures, such as |input| from_multiple::<String>(input).
• Updated to granit-parser 2.0.0 and disabled its default features so comment support follows
  serde-saphyr's comments feature. Serialization-only builds remain independent of
  granit-parser, including when comment emission is enabled.
• Non-finite floats remain rejected by default in deserialize_any, including overflowing
  literals such as 1e999. Opt into PassThrough to preserve them in float-capable visitors,
  untagged enums, and flattened float fields, or AsString to receive canonical strings.
  With PassThrough, serde_json::Value converts them to Null without an error.
  Direct f32/f64 deserialization is unchanged.
• Breaking: Error::AliasError has a new mandatory error: Box<Error> field.
  Manual constructors must supply it, and patterns listing every field must add error or ...
  The variant name is unchanged. Rendering and source() use the original error; the
  deserializer still populates msg with an error.to_string() snapshot for existing handlers.

Deprecated

• Deprecated Options::reject_non_finite_typeless_float in favor of non_finite_float_policy.
  When the new field is unconfigured, the boolean retains its original behavior: true
  (the default) rejects and false converts to strings. Use Reject or AsString, respectively,
  when migrating. Explicit policies override the boolean. Serialized options that omit both
  fields retain the 1.3.0 behavior of converting non-finite floats to strings;
  Options::default() continues to reject them.
• Deprecated the msg field of Error::AliasError in favor of its structured error field.
  Existing Error::AliasError { msg, .. } patterns still work with a deprecation warning.

Fixed

• Recognize only the standard plain null spellings: empty, ~, null, Null, and NULL.
  Other capitalization such as NulL remains a string instead of being rejected, converted
  to an empty value, or skipped as a document (#​234).
• Buffered LastWins values and inline merges no longer produce alias errors when no
  alias was used. Replay preserves per-node origins, including genuine nested aliases,
  ordinary value locations, and merge use-sites for Spanned<T>.
• strict_booleans: true now recognizes only the six YAML 1.2 Core boolean spellings.
  Other capitalization such as tRuE remains a string during inference, is accepted
  as unquoted text with no_schema, and is rejected for boolean targets.
• Plain alias diagnostics explicitly label the use location with (used at line X, column Y).
  The new Localizer::alias_used_at hook controls this suffix independently of failure and
  definition locations. Custom localizers that previously used attach_location to format
  or suppress alias-use coordinates should override alias_used_at as well.
• Miette diagnostics now localize alias labels, validation messages and summaries, and
  include context. Validation messages honor external-message overrides, and multi-document
  summaries honor custom message formatters. English defaults are unchanged.
  Custom Localizer implementations migrating from 1.x must also override
  anchor_defined_here to translate the alias anchor-definition label.
• Validation snippet headers now show the actual source name instead of (defined) or
  (defined here), including errors in included YAML files.
• Serde invalid-length failures now return Error::SerdeInvalidLength with separate
  len, expected, and location fields, allowing custom formatters to inspect them.
  Default diagnostic wording is preserved (#​205, item 6).
• Root validation paths honor Localizer::root_path_label in plain, snippet, and
  miette diagnostics (#​205, item 5c).
• Plain validation diagnostics separate issues with real newlines while escaping control
  characters inside each issue. Built-in formatters use the new optional
  MessageFormatter::format_validation_issue_lines hook; existing custom whole-message
  overrides retain their behavior (#​205, item 5a).
• Nested containers reuse the alias error wrapper for the same use site, preserving the
  outer anchor location while exposing the original error directly through error, source(),
  and the legacy msg field (#​205, item 1).
• Alias diagnostics preserve the precise location of a failing value inside an anchored mapping,
  including fields outside the anchor's snippet window. Plain messages, snippets, and miette
  reports include the distinct failing location; equal locations are not repeated.
• Alias error rendering passes the original error to the active MessageFormatter, including
  formatters that delegate other variants to the built-in formatter. Plain messages report
  the alias definition and use locations once through the active Localizer; snippet and
  miette diagnostics use location labels without embedding plain-text location suffixes.
  Custom location formatting and suppression now apply throughout aliased values
  (#​199).
• std::error::Error::source exposes the inner error for both Error::AliasError and
  Error::WithSnippet, preserving the source chain through the default snippet wrapper.
• Made huge_documents and serde_derived_types enable deserialize, fixing isolated feature
  builds with --no-default-features, including autopkgtests of Debian team (as observed).

Documentation

• Documented the serde_yaml migration caveat for null values in String fields,
  including when to use Option<String>, quoted strings, or !!str
  (#​229).

zip-rs/zip2 (zip)

v9.1.3

Compare Source

🚀 Features

• (extra_fields) support 0xd935 Android ZIP alignment extra field (#​928) (#​1198)

🐛 Bug Fixes

• (format) record correct 32-bit EOCD offset in ZIP64 archives (#​1205)
• (aes) wipe AES round keys when the cipher is dropped (#​1204)
• (fuzz) treat a comment change in a merged sub-writer as non-streamable (#​1188)
• (aes) zeroize AesCtrZipKeyStream buffer and counter on drop (#​1196)
• (extract) prevent symlink-follow truncation via FILE_FLAG_OPEN_REPARSE_POINT (#​1195)
• (write) drop a stale Unicode Path extra field when copying an entry (#​1187)
• (write) don't leave a stale tail that completes a fake EOCD in the comment (#​1186)
• (write) reject deflate levels below 10 when only zopfli is enabled (#​1182)

⚡ Performance

• (read) accelerate extraction with 64 KiB reusable buffer (#​1206)
• (aes) encrypt AES-CTR counter blocks in batches (#​1203)
• (read) eliminate double allocation by populating IndexMap directly (#​1200)
• (read) preallocate files vector in read_central_header (#​1199)

v9.1.2

Compare Source

🐛 Bug Fixes

• preserve the file kind (normal/directory/symlink) in raw_copy_file_touch (#​1179)
• (write) reject a Unicode Path extra field that would rename the entry (#​1177)
• (extract) prevent following symbolic links during file creation (#​1116)

v9.1.1

Compare Source

🐛 Bug Fixes

• store the raw count instead of a bool (#​1174)
• preserve extra fields in raw_copy_file_touch (#​1172)
• (write) flag a non-ASCII file comment as UTF-8 when writing it (#​1160)
• (write) reject duplicate names in merge_archive, blank stale footers, and add opt-in extra-field validation (#​1159)

v9.1.0

Compare Source

🚀 Features

• (read) enforce header consistency on extract_with_options and expose duplicate name detection (#​1109)
• Add borrowing inner method to reader wrappers (#​1050)
• add with_size_limit to ExtractOptions to limit total declared uncompressed size (#​1019)
• add file_names_raw iterator (#​1082)

🐛 Bug Fixes

• raw_copy_file keeps an entry's name bytes and UTF-8 flag as stored (#​1124)
• (write) prevent seek panic on streaming writer with comment (#​1151)
• Accept bounded central directory digital signature record when enforcing header consistency in ZipStreamReader (#​1134)
• apply unix permissions at creation (#​1104)
• raw_copy_file should work with any extra fields (#​1120)
• (read) avoid full-file forward scans and redundant allocations in central directory (#​1142)
• don't enable typed-path's default std feature (#​1112)
• ZIP64 size fields were being deep-copied incorrectly (via Copilot gpt-6-luna) (#​1107)
• resolve decoded CP437 member names (#​1080) (#​1085)
• Debug assertion doesn't account for length of archive comment (#​1097)

🚜 Refactor

• Lazy instantiation for all decompressors (#​1046) (#​1047)

⚡ Performance

• (write) reuse the DEFLATE compressor across entries (#​1119)

⚙️ Miscellaneous Tasks

• Fix reference to nonexistent variable on #[cfg(not(any(unix, windows)))] (#​1138)
• target lzma-rust2 v0.23 (#​1096)

Bench

• add Criterion benchmarks (#​754)
• add deflate_many_small_files bench for #​633 (#​964)

v9.0.5

Compare Source

🐛 Bug Fixes

• use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#​1076)
• (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#​1078)

⚙️ Miscellaneous Tasks

• Enable release-plz on backport branches in future (#​1079)

v9.0.4

Compare Source

🐛 Bug Fixes

• enclosed_name rejects a separator inside one verbatim path component (#​1066)
• return Ok(None) when read_zipfile_from_stream is called on an empty archive (#​1063)

⚙️ Miscellaneous Tasks

• Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#​1065)
• update lzma-rust2 and ppmd-rust dependencies (#​1060)

v9.0.3

Compare Source

🐛 Bug Fixes

• Preserve directories' read-only status when extracting on non-Unix systems (#​1054)

v9.0.2

Compare Source

🐛 Bug Fixes

• additional bug fixes for symlink extraction

v9.0.1

Compare Source

🐛 Bug Fixes

• set_permissions was still following symlinks in non-streaming extraction (#​1038)
• two arithmetic overflows in the implode decoder (#​1028)
• reject an empty archive whose central directory offset is past the EOCD (#​1025)
• don't panic when two entries extract to the same path (#​1023)
• fail reads that exceed the declared uncompressed size (#​1022)
• shrink decoder skipped LZW code 8191 (#​1029)
• write only the sentinel-marked values in a central ZIP64 field (#​1027)

v9.0.0

Compare Source

🚀 Features

• add ZipFileBuilder for parallelizing compression (#​911)
• add method by_index_with_data_descriptor (#​994)
• add len, is_empty and entry to ZipArchiveMetadata (#​1015)
• read data descriptor from binary (#​990)
• add comment and test for ZipStreamReader and symlinks (#​985)
• (write) add ZipWriter::hide_file for in-place entry deletion (#​924)
• add compression (#​948)
• add test to in place modification (#​945)
• move CustomExtraField to own file (#​941)
• add a test on enum size (#​939)
• use ZipFileEntry instead of ZipStreamFileMetadata (#​935)
• add ZipFileEntry with no Reader (#​933)
• change aes_mode to aes_settings() in ZipFileData (#​925)
• cleanup and harmonize extra fields (#​923)
• Rewrite zip64 extra (#​913)

🐛 Bug Fixes

• reading an empty AES entry again at EOF returns Ok(0) (#​1024)
• reject ZIP64 sizes that overflow u64 when computing data end offsets (#​1036)
• apply central directory metadata in ZipStreamReader, only to written entries (#​1030)
• consume the whole extended timestamp field in the central header (#​1016)
• parse the central header of the extended timestamp (#​1002)
• don't pre-allocate the declared size in the legacy decoders (#​991)
• Symlink with very large declared size could lead to out-of-memory panic (#​984)
• copy extra fields in raw_copy_file (#​955) (#​982)
• add unix_mode when copy_raw_file (#​981)
• rewrite documentation of add_symlink_from_path (#​979)
• ignore a ZIP64 extra field that no sentinel asked for (#​962)
• do not set data descriptor if directory (#​973)
• expose flags function for easier access (#​972)
• preserve unix permission in raw_copy_file (#​956)
• clippy warning on nightly (#​960)
• remove extra alloc used to copy (#​938)
• lazy allocation on error case (#​937)
• fix data alignment (#​929)

🚜 Refactor

• move extract to own file (#​1009)
• cleanup permissions related code (#​961)
• remove feature gate (#​949)
• create ZipFileFlags to wrap flags (#​947)
• remove unused trait (#​946)
• access crate::format with zip::unstable::format (#​944)
• harmonize functions to format/functions.rs (#​943)
• rewrite make_reader() function (#​936)
• simplify initialize_local_block (#​934)
• move write options to write/options.rs (#​931)
• move spec to format (#​932)
• move Magic to format (#​930)
• [breaking] Remove ZipFileData::extra_data_start field that is never read (#​926)

⚙️ Miscellaneous Tasks

• Fix high-level symlink extraction logic, disable some tests in miri, and fix some typos (#​1035)

Fix

• some permissions tests can only run on Unix (#​1000)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.