[dependabot]

Bumps the cargo group with 3 updates in the / directory: schemars, serde_json and suppaftp.

Updates schemars from 1.2.2 to 1.2.3

Release notes

Sourced from schemars's releases.

v1.2.3

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Changelog

Sourced from schemars's changelog.

[1.2.3] - 2026-10-12

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Commits

• 4791bb7 v1.2.3
• c6a89b7 Put the tag of an internally tagged enum first in properties
• c5cd8b5 fix: schema creation panics with arbitrary precision JSON numbers
• 766d70b Resolve unused_qualifications lint in crate and generated code - #541 (#541)
• d07655e Resolve clippy error
• See full diff in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates suppaftp from 12.1.1 to 12.2.1

Release notes

Sourced from suppaftp's releases.

v12.2.1

12.2.1

Released on 2026-10-15

Fixed

• send REST right before the transfer command (#194)

resume_transfer sent REST immediately, and the transfer command then sent PASV/EPSV/PORT/EPRT before RETR/STOR. RFC 3659 §5.3 requires REST to be the command immediately preceding the transfer command, and servers that follow this strictly drop the offset when another command comes in between, without any error. With FileZilla Server 1.12.6 a read from byte 100 returned the whole file; a resumed upload (REST + STOR) makes such a server replace the file with the tail.

resume_transfer now only stores the offset in the control channel; it is sent as REST right before the next RETR, STOR or APPE, after the data connection has been negotiated (sync, tokio and smol). An offset of 0 clears it. A server rejecting the offset is now reported by the transfer command. The new tests use a scripted server that forgets the offset like FileZilla Server, in passive and active mode.

---

• list: accept fractional seconds and keep the whole name in MLSx lines (#196)

RFC 3659 allows a fraction of a second in a time-val (modify=20201019151930.123). parse_mlsx_time only accepted %Y%m%d%H%M%S, so the whole line failed with InvalidDate; FileZilla Server always sends milliseconds, which left every MLSD listing from it empty. The fraction is now parsed with chrono's %.f into the sub-second part; digits beyond nanoseconds are ignored.

The name was taken as the last token after splitting the whole line on ';', so a;b c.txt became b c.txt. A fact value cannot contain ';' or SP, so the facts end at the first "; " and everything after it is the pathname, as RFC 3659 §7.2 defines the entry. Lines without "; " keep the previous behaviour.

Every entry line of an MLST reply starts with a single SP. parse_mlst now skips it, so both the raw reply line and the trimmed line returned by mlst() parse, and File::try_from uses parse_mlst instead of parse_mlsd, which would read that SP as an entry without facts.

• listen on the control connection's address in active mode (#198)

active() bound its listener to 0.0.0.0 but announced the local address of the control connection in PORT/EPRT. The data port was therefore open on every interface for the time of the transfer (on Windows this also brings up the firewall prompt on first use, even for a control connection to 127.0.0.1), and with an IPv6 control connection the IPv4-only listener announced via EPRT could never be reached. The listener is now bound to the control connection's local address, which is the one announced to the server.

... (truncated)

Changelog

Sourced from suppaftp's changelog.

12.2.1

Released on 2026-10-15

Fixed

• send REST right before the transfer command (#194)

resume_transfer sent REST immediately, and the transfer command then sent PASV/EPSV/PORT/EPRT before RETR/STOR. RFC 3659 §5.3 requires REST to be the command immediately preceding the transfer command, and servers that follow this strictly drop the offset when another command comes in between, without any error. With FileZilla Server 1.12.6 a read from byte 100 returned the whole file; a resumed upload (REST + STOR) makes such a server replace the file with the tail.

resume_transfer now only stores the offset in the control channel; it is sent as REST right before the next RETR, STOR or APPE, after the data connection has been negotiated (sync, tokio and smol). An offset of 0 clears it. A server rejecting the offset is now reported by the transfer command. The new tests use a scripted server that forgets the offset like FileZilla Server, in passive and active mode.

---

• list: accept fractional seconds and keep the whole name in MLSx lines (#196)

RFC 3659 allows a fraction of a second in a time-val (modify=20201019151930.123). parse_mlsx_time only accepted %Y%m%d%H%M%S, so the whole line failed with InvalidDate; FileZilla Server always sends milliseconds, which left every MLSD listing from it empty. The fraction is now parsed with chrono's %.f into the sub-second part; digits beyond nanoseconds are ignored.

The name was taken as the last token after splitting the whole line on ';', so a;b c.txt became b c.txt. A fact value cannot contain ';' or SP, so the facts end at the first "; " and everything after it is the pathname, as RFC 3659 §7.2 defines the entry. Lines without "; " keep the previous behaviour.

Every entry line of an MLST reply starts with a single SP. parse_mlst now skips it, so both the raw reply line and the trimmed line returned by mlst() parse, and File::try_from uses parse_mlst instead of parse_mlsd, which would read that SP as an entry without facts.

• listen on the control connection's address in active mode (#198)

active() bound its listener to 0.0.0.0 but announced the local address of the control connection in PORT/EPRT. The data port was therefore open on every interface for the time of the transfer (on Windows this also brings up the firewall prompt on first use, even for a control connection to 127.0.0.1), and with an IPv6 control connection the IPv4-only listener announced via EPRT could

... (truncated)

Commits

• 18e0a88 chore: release 12.2.1 (#203)
• de94dcc fix: block on the accepted active mode data connection (#202)
• 1b9798f test: remove temporary vsftpd diagnostics
• 6b803ed fix: drain TLS upload data connection before closing it
• b84a8e9 test: temporary vsftpd diagnostics for flaky FTPS upload
• eded5d1 test: exclude container startup from FTPS rejection test timeout
• 2378cdf chore(AI_POLICY.md): forbid Co-Authored-By LLMs statements in commit message
• 75f63d5 fix: listen on the control connection's address in active mode (#198)
• ab5bf01 fix(list): accept fractional seconds and keep the whole name in MLSx lines (#...
• cc8ce72 fix: send REST right before the transfer command (#194)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions