chore(deps): bump the patch group across 1 directory with 10 updates

[dependabot]

Bumps the patch group with 10 updates in the / directory:

Package	From	To
anyhow	1.0.102	1.0.103
serde_json	1.0.149	1.0.150
clap_complete	4.6.3	4.6.5
tokio	1.52.1	1.52.3
rustls	0.23.40	0.23.41
tokio-socks	0.5.2	0.5.3
lettre	0.11.21	0.11.22
rpassword	7.5.1	7.5.4
which	8.0.2	8.0.4
smallvec	1.15.1	1.15.2

Updates anyhow from 1.0.102 to 1.0.103

Release notes

Sourced from anyhow's releases.

1.0.103

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

Commits

• 5bdb0e2 Release 1.0.103
• e621bd3 Merge pull request #452 from dtolnay/downcast
• 6e8c000 Eliminate pointer->reference->pointer during downcast
• 67c4abd Add regression test for issue 451
• 917a169 Update actions/upload-artifact@v6 -> v7
• d9dc3fa Update actions/checkout@v6 -> v7
• 841522b Raise minimum tested compiler to rust 1.85
• See full diff in compare view

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• dc8003a Raise required compiler for preserve_order feature to 1.85
• a42fa98 Unpin CI miri toolchain
• 684a60e Pin CI miri to nightly-2026-02-11
• 7c7da33 Raise required compiler to Rust 1.71
• acf4850 Simplify Number::is_f64
• 6b8ceab Resolve unnecessary_map_or clippy lint
• Additional commits viewable in compare view

Updates clap_complete from 4.6.3 to 4.6.5

Commits

• c8c9355 chore: Release
• af74def docs: Update changelog
• c96f222 Merge pull request #6368 from truffle-dev/fix/fish-env-escaping
• 49a05cd fix(complete): Two-pass quote fish env-completer
• e791004 test(complete): Snapshot fish env quoting cases
• 87ec1ad chore: Release
• 78f2529 docs: Update changelog
• b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
• 74c6666 fix(complete): Keep zsh candidate order
• d142d8f Merge pull request #6360 from epage/string
• Additional commits viewable in compare view

Updates tokio from 1.52.1 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• sync: require that an RwLock has max_readers != 0 (#8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Commits

• d875691 chore: prepare Tokio v1.52.3 (#8130)
• e1aebb0 Merge 'tokio-1.51.3' into 'tokio-1.52.x' (#8129)
• fd63094 chore: prepare Tokio v1.51.3 (#8127)
• 8c600d0 Merge 'tokio-1.47.5' into 'tokio-1.51.x' (#8123)
• 11bfc13 chore: prepare Tokio v1.47.5 (#8122)
• f085b62 sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• 30d25cc sync: require that an RwLock has max_readers != 0 (#8076)
• 9fccf53 sync: return Empty from try_recv() when mpsc is closed with outstanding p...
• ebf61b4 sync: fix underflow in mpsc channel len() (#8062)
• 4abe9d7 chore: prepare Tokio v1.52.2 (#8115)
• Additional commits viewable in compare view

Updates rustls from 0.23.40 to 0.23.41

Commits

• 642a103 ci: drop Taplo job
• 752c144 Drop nightly clippy tests
• 8d8611a Fix new clippy::useless-borrows-in-formatting
• ebf3297 Fix new clippy::manual_clear
• 46808e7 ci: sync cargo-check-external-types nightly
• 041a8d2 Cargo deny: allow RUSTSEC-2026-0173
• 62e220e Take semver-compatible dependency updates
• 3c14696 Upgrade to hickory-resolver 0.26
• 848a2cc connect-tests: delete ech.rs
• 5ce9cac Bump version to 0.23.41
• Additional commits viewable in compare view

Updates tokio-socks from 0.5.2 to 0.5.3

Release notes

Sourced from tokio-socks's releases.

v0.5.3

• Fallback to the next resolved proxy address when connecting to a SOCKS proxy. (#67)
• Added to_string and Display methods for TargetAddr. (#63)

Changelog

Sourced from tokio-socks's changelog.

0.5.3

• Fallback to the next resolved proxy address when connecting to a SOCKS proxy. (#67)
• Added to_string and Display methods for TargetAddr (#63).

Commits

• 3f2c090 Bump version to 0.5.3
• 80c68a6 Retry proxy addresses when connecting
• 8737caf followed clippy suggestions
• 5f6fa7f Added clone for targetAddr
• 7be4289 cargo
• cbfe22f cargo
• 17ef8f4 shadowed impl for to_string
• ab1b377 Added to_string and display methods for TargetAddr
• See full diff in compare view

Updates lettre from 0.11.21 to 0.11.22

Release notes

Sourced from lettre's releases.

v0.11.22 - update now if you're using Boring TLS

Security

• Fix inverted TLS hostname verification flag in boring-tls backend that silently disabled hostname verification f5efffc

Bug Fixes

• Cap read_response buffer to prevent unbounded memory growth #1143

Misc

• Upgrade rustls-platform-verifier to v0.7 #1136

Changelog

Sourced from lettre's changelog.

v0.11.22 (2026-05-14)

Security

• Fix inverted TLS hostname verification flag in boring-tls backend that silently disabled hostname verification (f5efffc)

Bug Fixes

• Cap read_response buffer to prevent unbounded memory growth (#1143)

Misc

• Upgrade rustls-platform-verifier to v0.7 (#1136)

#1136: lettre/lettre#1136 #1143: lettre/lettre#1143

Commits

• 9b88c4f Prepare v0.11.22
• f5efffc fix(transport-smtp): negate hostname-verify flag for boring-tls
• f62f304 fix(transport-smtp): cap read_response buffer
• fa402db build(deps): upgrade rustls-platform-verifier to v0.7
• See full diff in compare view

Updates rpassword from 7.5.1 to 7.5.4

Release notes

Sourced from rpassword's releases.

v7.5.4

No functional changes.

I've added license checks with Cargo Deny to ensure that the Apache 2.0 license is compatible with dependencies.

This release also updates the description to make it clear this library is cross-platform on crates.io.

v7.5.3

Fixes compile errors with Rust 1.85. Thanks @​nwalfield for reporting in conradkleinespel/rpassword#130.

Backwards compatible. No breaking change.

v7.5.2

Fixes a Unicode parsing bug which could lead to unwarranted panic (conradkleinespel/rpassword@6c19a1e).

Backwards compatible. No breaking change.

Commits

• 1151510 add license checks
• 3ca2ece bump to 7.5.3
• ed863bf remove cargo-tarpaulin build incompatible with rust 1.85 from ci
• 479012d fixes compile errors with rust 1.85
• 6ee4708 update nix config to use rust 1.85
• 6d3518d run ci with rust 1.85
• e176edc bump to 7.5.2
• 6c19a1e make reading utf8 chars more reliable
• See full diff in compare view

Updates which from 8.0.2 to 8.0.4

Release notes

Sourced from which's releases.

8.0.4

What's Changed

• feat: emit NonFatalError on Windows if PATHEXT not populated by @​Xaeroxe in harryfei/which-rs#125

Full Changelog: harryfei/which-rs@8.0.3...8.0.4

8.0.3

What's Changed

• feat: use catch-all cfg for is_valid_executable on unsupported targets by @​pmikolajczyk41 in harryfei/which-rs#124

New Contributors

• @​pmikolajczyk41 made their first contribution in harryfei/which-rs#124

Full Changelog: harryfei/which-rs@8.0.2...8.0.3

Changelog

Sourced from which's changelog.

8.0.4

• On Windows we now emit a NonFatalError if the PATHEXT environment variable is not populated, and the query did not specify a file extension.

8.0.3

• Add fallback implementation of is_valid_executable allowing which-rs to compile on targets which are not Unix, Windows, WASI, or Redox. Thanks @​pmikolajczyk41 for your contribution to which!

Commits

• c9df5ef feat: emit NonFatalError on Windows if PATHEXT not populated (#125)
• 9b1ec59 bump version number, update changelog
• 6ddf6cf Implement is_valid_executable for other configurations (#124)
• See full diff in compare view

Updates smallvec from 1.15.1 to 1.15.2

Release notes

Sourced from smallvec's releases.

v1.15.2

What's Changed

• Exclude development script from cargo packaging by @​weiznich in servo/rust-smallvec#397
• Fix use-after-free in DrainFilter::keep_rest for SmallVec with capacity 0 by @​Shnatsel in servo/rust-smallvec#407
• Work around rustc 1.93 perf regression with MaybeUninit by @​glandium in servo/rust-smallvec#410

New Contributors

• @​Shnatsel made their first contribution in servo/rust-smallvec#407
• @​glandium made their first contribution in servo/rust-smallvec#410

Full Changelog: servo/rust-smallvec@v1.15.1...v1.15.2

Commits

• c469051 Bump version.
• 9fe422b Fix Windows CI.
• 51b965f Work around rustc 1.93 perf regression with MaybeUninit
• 9da26a5 Fix use-after-free in DrainFilter::keep_rest for zero-capacity SmallVecs
• 79184f1 Add Miri test for use-after-free in DrainFilter::keep_rest
• f59fb36 Merge pull request #397 from GiGainfosystems/exclude_scripts
• 28b6ed7 Exclude development script
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.