chore(deps)(deps): bump the production-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: toml, ureq and cc.

Updates toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0

Commits

• e93ed4e chore: Release
• d23436d docs: Update changelog
• 151afcd fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat (#1211)
• 26a4050 fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat
• 232f136 chore(deps): Update Prek to v0.5.1 (#1209)
• 9ee4b4e chore(deps): Update crate-ci/typos digest to 4d9c206 (#1208)
• 525f352 chore(deps): Update crate-ci/committed digest to 800a04e (#1207)
• 46043ed chore(deps): Update crate-ci/typos digest to 4d9c206
• c00e894 chore(deps): Update crate-ci/committed digest to 800a04e
• 1ae0158 chore(deps): Update Prek to v0.5.0 (#1205)
• Additional commits viewable in compare view

Updates ureq from 3.4.0 to 3.4.1

Changelog

Sourced from ureq's changelog.

3.4.1

• Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199
• Do not pool connections with unconsumed buffered input #1198
• Fix timeout budgets restarting and applying to later phases #1194
• Complete TLS handshake during connect so timeout_connect covers it #1193
• Speed up read_json for responses with a known, small body size #1191

Commits

• cf4a3cd 3.4.1
• 9559d7b Bump ureq-proto to 0.6.2 (#1199)
• 9eb654c Do not pool a connection with unconsumed input (#1198)
• 5b81318 Anchor timeout budgets to phase boundaries (#1194)
• d480543 Complete TLS handshakes while connecting (#1193)
• 662410b Buffer read_json into memory when Content-Length is below the limit (#1191)
• See full diff in compare view

Updates cc from 1.4.4 to 1.4.5

Release notes

Sourced from cc's releases.

cc-v1.4.5

Fixed

• probe flag support without OUT_DIR via tempfile (#1875)

Other

• simplify conditional logic using then method (#1860)

Fixed

• Probe flag support without OUT_DIR via tempfile, so flag_if_supported no longer silently drops flags outside Cargo build scripts (#1875)

Changelog

Sourced from cc's changelog.

1.4.5 - 2026-09-04

Fixed

• probe flag support without OUT_DIR via tempfile (#1875)

Other

• simplify conditional logic using then method (#1860)

Fixed

• Probe flag support without OUT_DIR via tempfile, so flag_if_supported no longer silently drops flags outside Cargo build scripts (#1875)

Commits

• 171f8f6 chore: release (#1874)
• 754c1a0 fix: probe flag support without OUT_DIR via tempfile (#1875)
• b1c1794 refactor: simplify conditional logic using then method (#1860)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 85a9b365-0f5b-4076-a1e2-fb7a182801f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​ureq@​3.4.0 ⏵ 3.4.1
	cargo/​cc@​1.4.4 ⏵ 1.4.5
	cargo/​toml@​1.1.4%2Bspec-1.1.0 ⏵ 1.1.6+spec-1.1.0

View full report

[github-actions]

Antigravity review (Gemini via Ultra)

This PR updates minor and patch versions of several dependencies (cc, find-msvc-tools, toml, ureq, and ureq-proto) in Cargo.lock.

Blocking issues

None found.

Suggestions

This is a trivial lockfile update. Ensure CI passes to verify these dependency bumps do not introduce regressions or break existing builds.

Nitpicks

None.

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}

[doublegate]

Superseded by #508, which lands this bump together with the rest of the refresh.

Consolidated deliberately rather than merged one at a time: three of these pins are coupled and a per-artifact merge desyncs them. com.android.application 9.4.0 (#502) shares AGP's version coordinate with com.android.test, which no Dependabot PR touches; benchmark-macro-junit4 1.5.0-rc02 (#498) is tracked by androidx.baselineprofile, likewise untouched; and the cargo group (#504) pulls wasm-bindgen 0.2.128, whose CLI version is pinned separately in web/Trunk.toml and must match exactly or the Pages deploy fails while every clippy gate still passes.

#508 also carries toml one version further than proposed (1.1.6 rather than 1.1.5) and taiki-e/install-action to 2.87.11 rather than 2.87.5.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml