chore(deps): bump the rust-deps group across 1 directory with 5 updates

[dependabot]

Bumps the rust-deps group with 5 updates in the / directory:

Package	From	To
tree-sitter	0.26.11	0.26.12
base64	0.22.1	0.23.1
futures	0.3.33	0.3.34
tower-http	0.6.11	0.7.0
mockall	0.14.0	0.15.0

Updates tree-sitter from 0.26.11 to 0.26.12

Release notes

Sourced from tree-sitter's releases.

v0.26.12

What's Changed

• fix(generate): fold case-insensitive patterns ourselves by @​WillLillis in tree-sitter/tree-sitter#5761
• fix(query): keep the trailing anchor when a zero-matched quantifier is anchored on both sides by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5764
• fix(templates): add C source files to Python sdist by @​WillLillis in tree-sitter/tree-sitter#5765
• fix(init): don't lowercase repository url by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5768
• fix(highlight): use std::sync::OnceCell for various loader fields by @​WillLillis in tree-sitter/tree-sitter#5785
• fix(parser): restart recovery for invalid tokens in the error state by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5792
• Fix associativity resolution with mixed shift precedences by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5796
• fix(parser): fix parsing bug repeat operator by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5829
• release v0.26.12 by @​clason in tree-sitter/tree-sitter#5831

Full Changelog: tree-sitter/tree-sitter@v0.26.11...v0.26.12

Commits

• 808e4b1 release v0.26.12
• 7566ffa fix(lib): continue search for later named siblings in
• 4b7e2c9 fix(generate): honor right associativity despite a lower-precedence shift
• 3ee7c63 fix(parser): restart recovery for invalid tokens in the error state
• fd0ccd6 fix(highlight): use std::sync::OnceCell for various loader fields
• 8df22e6 fix(init): don't lowercase repository url
• c02f324 fix(cli): init --update should not update setup.py after replacing it (#5...
• f9b9b39 fix(templates): replace deprecated method in Package.swift
• 0938423 fix(templates): add C source files to Python sdist
• 5ccdbb6 fix(query): transfer a leading boundary anchor across a zero-matched quantifier
• Additional commits viewable in compare view

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

Updates futures from 0.3.33 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Commits

• 705e6b5 Release 0.3.34
• 616dac7 compat: Inline RawWaker clone function
• 4176369 Inline remaining RawWaker clone functions
• f17a895 Fix cloned FuturesUnordered waker identity
• 51d62ad macro: bump syn to v3 (#3028)
• 9e26177 ci: Reduce timeout-minutes
• b2d0983 tsan: Enable Adaptive Delay
• f733d0e Miri: Ignore compat tests
• e5def2f Rename default branch to main
• See full diff in compare view

Updates tower-http from 0.6.11 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Updates mockall from 0.14.0 to 0.15.0

Changelog

Sourced from mockall's changelog.

[ 0.15.0 ] - 2026-06-28

Added

• Compatibility with the #[auto_impl] macro. (#686)

Commits

• fc2c853 chore: Release
• 551fadd Merge pull request #688 from asomers/audit-job-lockfile
• 21529e3 Fix the audit CI job
• 2270cdb Merge pull request #686 from Kranzes/automock-auto_impl-compat
• d3b041d Add compatibility with the #[auto_impl] macro
• 055886e Merge pull request #687 from asomers/clippy-june-2026
• ed4bf07 Clippy cleanup
• f7a4d6f Merge pull request #685 from asomers/clippy=may-2026
• ba15180 Clippy cleanup: useless_borrows_in_formatting
• de22d57 Merge pull request #684 from asomers/github-workflows
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.