Bump the cargo group across 1 directory with 7 updates

[dependabot]

Bumps the cargo group with 7 updates in the / directory:

Package	From	To
commonwl	0.8.4	0.10.0
fancy-regex	0.18.0	0.19.0
toml	1.1.3+spec-1.1.0	1.1.4+spec-1.1.0
serial_test	3.5.0	4.0.1
clap	4.6.3	4.6.4
clap_complete	4.6.7	4.6.8
dioxus	0.7.9	0.7.10

Updates commonwl from 0.8.4 to 0.10.0

Release notes

Sourced from commonwl's releases.

v0.10.0

Full Changelog: fairagro/commonwl@v0.9.0...v0.10.0

v0.9.0

0.9.0

Added

• CWL documents are now validated against the spec when loaded. Documents with duplicate ids among inputs/outputs/steps, duplicate requirement classes in one requirements list, or missing required fields on workflow step inputs/outputs are now rejected with a clear error at load time instead of being accepted and potentially causing a crash later during execution.
• .dev/tes_env.sh created that operates on a local Funnel TES server with rustfs S3 compatible storage

Fixed

• Local backend: a document with scatter: [] (scattering over an empty list) no longer panics.
• Local backend: fixed a case where copying inputs/outputs could silently produce an empty (0-byte) file instead of the real content.
• InitialWorkDirRequirement listings now reject more ..-based path traversal attempts in entryname (previously only a leading ../ was caught; embedded .. segments now are too).
• Local backend: output files are no longer left as broken/dangling references if the run's working directory and the requested output directory live on different filesystems or drives.
• Documents that reference themselves in a cycle are now rejected with a clear error instead of crashing: a workflow whose step (directly or transitively) runs itself, a packed CWL file where $imports form a loop, or a Directory input containing a symlink loop.
• A DockerRequirement specifying only dockerFile (no dockerImageId) no longer crashes the local backend; an image tag is now generated automatically.
• The TES backend now reports a clear error for a DockerRequirement that needs building from a dockerFile, instead of silently ignoring it and using the wrong container image.
• TES backend conformance raised from 24% to 99%, now matching Docker's own conformance ceiling exactly, via a series of fixes:
  • secondaryFiles handling is now storage-aware instead of assuming a local file path.
  • File metadata (size/checksum/contents) is now computed correctly once a value's location becomes remote, e.g. after crossing a workflow step boundary.
  • The TES backend no longer wires the GA4GH stdin executor field, which some TES servers (e.g. Funnel) truncate to zero bytes as soon as the task starts; the resolved stdin path remains reachable via the existing trailing positional command argument.
  • runtime.outdir/runtime.tmpdir no longer crash after a task runs on remote storage.
  • Empty directories - both ones staged via InitialWorkDirRequirement and ones a tool creates itself (e.g. mkdir -p) - are now represented correctly on S3, which has no native concept of an empty directory.
  • Fixed every InitialWorkDirRequirement-staged file/directory upload silently landing at the S3 bucket root instead of the run's own prefix, which could also cause an unrelated object elsewhere in the bucket to be swept up as if it belonged to the current run.
  • Fixed cwl.output.json-declared outputs (path/location) resolving to the same wrong, unprefixed S3 location.
  • Directory-typed outputBinding: {glob: ...} now matches a directory-shaped S3 prefix; previously it only ever matched individual object keys.

... (truncated)

Changelog

Sourced from commonwl's changelog.

0.10.0

Added

• Ergonomic functions for all CWLDocument types

0.9.0

Added

• CWL documents are now validated against the spec when loaded. Documents with duplicate ids among inputs/outputs/steps, duplicate requirement classes in one requirements list, or missing required fields on workflow step inputs/outputs are now rejected with a clear error at load time instead of being accepted and potentially causing a crash later during execution.
• .dev/tes_env.sh created that operates on a local Funnel TES server with rustfs S3 compatible storage

Fixed

• Local backend: a document with scatter: [] (scattering over an empty list) no longer panics.
• Local backend: fixed a case where copying inputs/outputs could silently produce an empty (0-byte) file instead of the real content.
• InitialWorkDirRequirement listings now reject more ..-based path traversal attempts in entryname (previously only a leading ../ was caught; embedded .. segments now are too).
• Local backend: output files are no longer left as broken/dangling references if the run's working directory and the requested output directory live on different filesystems or drives.
• Documents that reference themselves in a cycle are now rejected with a clear error instead of crashing: a workflow whose step (directly or transitively) runs itself, a packed CWL file where $imports form a loop, or a Directory input containing a symlink loop.
• A DockerRequirement specifying only dockerFile (no dockerImageId) no longer crashes the local backend; an image tag is now generated automatically.
• The TES backend now reports a clear error for a DockerRequirement that needs building from a dockerFile, instead of silently ignoring it and using the wrong container image.
• TES backend conformance raised from 24% to 99%, now matching Docker's own conformance ceiling exactly, via a series of fixes:
  • secondaryFiles handling is now storage-aware instead of assuming a local file path.
  • File metadata (size/checksum/contents) is now computed correctly once a value's location becomes remote, e.g. after crossing a workflow step boundary.
  • The TES backend no longer wires the GA4GH stdin executor field, which some TES servers (e.g. Funnel) truncate to zero bytes as soon as the task starts; the resolved stdin path remains reachable via the existing trailing positional command argument.
  • runtime.outdir/runtime.tmpdir no longer crash after a task runs on remote storage.
  • Empty directories - both ones staged via InitialWorkDirRequirement and ones a tool creates itself (e.g. mkdir -p) - are now represented correctly on S3, which has no native concept of an empty directory.
  • Fixed every InitialWorkDirRequirement-staged file/directory upload silently landing at the S3 bucket root instead of the run's own prefix, which could also cause an unrelated object elsewhere in the bucket to be swept up as if it belonged to the current run.
  • Fixed cwl.output.json-declared outputs (path/location) resolving to the same wrong, unprefixed S3 location.
  • Directory-typed outputBinding: {glob: ...} now matches a directory-shaped S3 prefix; previously it only ever matched individual object keys.

... (truncated)

Commits

• c45bc10 0.10.0
• 000553b requirements ergonomics
• 587b133 missing cmts
• 3fc968f updated version
• 1b31c28 improved workflow ergonomics
• 958beb9 updated workflow ergonomics
• 0e20a7a added workflow ergonomics
• 64fece4 iwdr from file createion
• 5b847db added append_requirement_mut
• acba707 added LICENSE files
• Additional commits viewable in compare view

Updates fancy-regex from 0.18.0 to 0.19.0

Release notes

Sourced from fancy-regex's releases.

0.19.0

Added

• Add BytesMode and the RegexInput trait so the matching and capture APIs can operate on strings or bytes, and allows to opt out of unicode handling if desired (#248)
  • Also allows searching within a range without slicing (#253)
  • Assertions can be overridden at runtime, if the regex builder allow_input_assertion_overrides option was used (#254)
  • Search can be performed in anchored mode, searching only at the start position specified (#263)
• Add experimental seek optimization to only invoke the VM at candidate positions where a match could occur (#246)
• Add RegexBuilder::disallow_empty_match_at_eof_after_newline to reject empty matches at the end of the haystack following a trailing newline, to match Oniguruma behavior (#247)
• Add RegexSet API for efficiently matching multiple patterns against the same text (#255)

Changed

• Case-insensitive backreference comparison of non-ASCII text now uses direct Unicode simple case folding instead of building a regex engine per comparison, which makes patterns like (?i)(\w+)\1 orders of magnitude faster on non-ASCII haystacks. The comparison is now strict fold equality over the captured text's byte-length window: a case-folded prefix of the window no longer counts as a match (previously a substring search could accept one and misalign the match end)
• Compilation performance: delegated regex-automata engines (including the whole pattern in the easy case) are now built from a directly-constructed Hir instead of a re-serialized pattern string, and RegexSet parses each pattern once for both of its set-wide engines instead of three times. This reduces compile time and peak compile memory, especially for RegexSet and small easy patterns
• Match performance: the backtracking VM's working memory (saves, backtrack stack, delegate slots) is pooled and reused across runs, making is_match/find/find_iter and RegexSet candidate verification allocation-free per call; RegexSet::find_input no longer allocates at failed candidate positions. Short and repeated matches improve substantially (up to ~30% for small patterns, ~10% for find_iter over many matches); single very long backtracking runs, where per-run setup is fully amortized anyway, can be a few percent slower
• Matches, CaptureMatches, Captures, and SubCaptureMatches are now generic over RegexInput, which is a breaking change for code that named these types explicitly (#248)
• Patterns no longer force Unicode mode during parsing, and inline (?u) / (?-u) flags are accepted when they agree with the builder configuration

Fixed

• Fix bug whereby inline flags were not overriding the builder options (#247)
• Fix bug whereby \G optimizations were applying where they shouldn't, giving wrong results (#256)
• Support Oniguruma quantifier parsing rules, whereby swapped ordering causes possessiveness, + only causes possessiveness after ?, * or + (#258)

Upgrade guide

If you previously stored i.e. Captures, you would need to change the type to Captures<str> to get the code to compile.

Changelog

Sourced from fancy-regex's changelog.

[0.19.0] - 2026-07-28

Added

• Add BytesMode and the RegexInput trait so the matching and capture APIs can operate on strings or bytes, and allows to opt out of unicode handling if desired (#248)
  • Also allows searching within a range without slicing (#253)
  • Assertions can be overridden at runtime, if the regex builder allow_input_assertion_overrides option was used (#254)
  • Search can be performed in anchored mode, searching only at the start position specified (#263)
• Add experimental seek optimization to only invoke the VM at candidate positions where a match could occur (#246)
• Add RegexBuilder::disallow_empty_match_at_eof_after_newline to reject empty matches at the end of the haystack following a trailing newline, to match Oniguruma behavior (#247)
• Add RegexSet API for efficiently matching multiple patterns against the same text (#255)

Changed

• Case-insensitive backreference comparison of non-ASCII text now uses direct Unicode simple case folding instead of building a regex engine per comparison, which makes patterns like (?i)(\w+)\1 orders of magnitude faster on non-ASCII haystacks. The comparison is now strict fold equality over the captured text's byte-length window: a case-folded prefix of the window no longer counts as a match (previously a substring search could accept one and misalign the match end)
• Compilation performance: delegated regex-automata engines (including the whole pattern in the easy case) are now built from a directly-constructed Hir instead of a re-serialized pattern string, and RegexSet parses each pattern once for both of its set-wide engines instead of three times. This reduces compile time and peak compile memory, especially for RegexSet and small easy patterns
• Match performance: the backtracking VM's working memory (saves, backtrack stack, delegate slots) is pooled and reused across runs, making is_match/find/find_iter and RegexSet candidate verification allocation-free per call; RegexSet::find_input no longer allocates at failed candidate positions. Short and repeated matches improve substantially (up to ~30% for small patterns, ~10% for find_iter over many matches); single very long backtracking runs, where per-run setup is fully amortized anyway, can be a few percent slower
• Matches, CaptureMatches, Captures, and SubCaptureMatches are now generic over RegexInput, which is a breaking change for code that named these types explicitly (#248)
• Patterns no longer force Unicode mode during parsing, and inline (?u) / (?-u) flags are accepted when they agree with the builder configuration

Fixed

• Fix bug whereby inline flags were not overriding the builder options (#247)
• Fix bug whereby \G optimizations were applying where they shouldn't, giving wrong results (#256)
• Support Oniguruma quantifier parsing rules, whereby swapped ordering causes possessiveness, + only causes possessiveness after ?, * or + (#258)

Upgrade guide

If you previously stored i.e. Captures, you would need to change the type to Captures<str> to get the code to compile.

Commits

• e8d6986 Version 0.19.0
• af79ee3 Merge pull request #267 from fancy-regex/regex-automata-bump
• 9d6b2db bump regex-automata to fix some seek bugs
• 3d04e3a Merge pull request #266 from fancy-regex/optimize_keepout
• f44e0a5 Merge pull request #265 from fancy-regex/reduce_catastrophic_backtracking
• e480dc4 Merge pull request #264 from fancy-regex/compilation_performance
• 35f8efa add note about optimizer
• 1f7a220 Address code review: fix spelling, add comment about has_descendant
• 4712936 Add \K (KeepOut) optimization: delegate root-level \K patterns to regex-automata
• 5496414 fix: correct asymmetric repeat optimization in build_concat_repeat_triplet
• Additional commits viewable in compare view

Updates toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits

• beee9fe chore: Release
• 16e2ac1 docs: Update changelog
• 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
• 534039c fix(serde): Deserialize Value datetimes into typed targets
• 6e45cef test(serde): Reproduce Value datetime deserialization error
• 4ec099f chore: Release
• 5a47a51 docs: Update changelog
• da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
• 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
• ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
• Additional commits viewable in compare view

Updates serial_test from 3.5.0 to 4.0.1

Release notes

Sourced from serial_test's releases.

v4.0.1

As per v4.0.0, but with the root MSRV correctly set to 1.93.1

v4.0.0

What's Changed

• MSRV is now 1.93.1
• refactor(derive)!: bump syn to v3 by @​AudaciousAxiom in palfrey/serial_test#159

New Contributors

• @​AudaciousAxiom made their first contribution in palfrey/serial_test#159

Full Changelog: palfrey/serial_test@v3.5.0...v4.0.0

Commits

• 383c894 4.0.1
• 4298adf MSRV is actually 1.93.1
• f25d56f 4.0.0
• 7984bdc Merge pull request #160 from palfrey/pre-release-fixes
• ec74212 Don't need to split build-all-features now
• 03cd910 Upgrade MSRV to 1.93.1
• 7cf8563 Add a "finish" CI job that depends on everything
• d7c4137 Upgrade actix-macros to reduce syn 1.x needs
• ae268b0 Merge pull request #159 from AudaciousAxiom/refactor/syn-v3
• 98b2c36 refactor(derive): bump syn to v3
• Additional commits viewable in compare view

Updates clap from 4.6.3 to 4.6.4

Release notes

Sourced from clap's releases.

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Changelog

Sourced from clap's changelog.

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Commits

• 87ec1ad chore: Release
• 78f2529 docs: Update changelog
• b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
• 74c6666 fix(complete): Keep zsh candidate order
• d142d8f Merge pull request #6360 from epage/string
• ba89563 style: Prefer explicit string operations
• bea966e Merge pull request #6359 from epage/man
• b811986 chore(man):Remove unused required-features
• 0010bf2 Merge pull request #6358 from clap-rs/renovate/crate-ci-typos-1.x
• bab9b24 chore(deps): Update compatible (dev) (#6357)
• Additional commits viewable in compare view

Updates clap_complete from 4.6.7 to 4.6.8

Commits

• d93a00d chore: Release
• 4709d1a docs(complete): Update changelog
• 2246e8b Merge pull request #6455 from epage/possible
• 2550f32 feat(complete): Expose possible value completers
• 9048857 refactor(complete): Pull out possible values candidate conversion
• 0607d66 refactor(complete): Remove unused allocation
• 943de73 refactor(complete): Move related functions next to each other
• 81b86a9 refactor(complete): Generalize value candidate handling
• ae09202 refactor(complete): Remove extra allocation
• 466b2be chore: Release
• Additional commits viewable in compare view

Updates dioxus from 0.7.9 to 0.7.10

Release notes

Sourced from dioxus's releases.

v0.7.10

What's Changed

• [v0.7] Fix hotpatching when the bin target's crate name differs from the package name by @​nicoburns in DioxusLabs/dioxus#5720

Full Changelog: DioxusLabs/dioxus@v0.7.9...v0.7.10

Commits

• 57d6794 release v0.7.10
• fda083b Fix hotpatching when the bin target's crate name differs from the package nam...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions