[lockfile-maintenance]

Update selected lockfiles with a minimum release age of 3 days.

Package managers retain their native exceptions. Actions pins use dated releases within existing refs, retaining pins without eligible candidates. Validate updates with the repository's PR CI.

Version changes

Versions are grouped by package name. — means the package was not present.

Cargo.lock

Package	Before	After	Change	History
itoa	1.0.18	1.0.19	patch	Release history
minijinja	3.0.5	3.1.0	minor	Release history
syn	3.0.9	3.0.10	patch	Release history
winnow	1.0.4	1.0.5	patch	Release history

Rebase

Rebase requests are not configured for this report. Rebase setup

itoa — 1.0.18 → 1.0.19 (1 release)

Back to version changes · Compare · Releases

1.0.19

• Fix no-panic link failure for non-constant u32/u64/u128 (Update github actions #72, thanks @​patrick-immometrica)

minijinja — 3.0.5 → 3.1.0 (1 release)

Back to version changes · Compare · CHANGELOG.md · Releases

3.1.0

Release Notes

This release adds output spans and memory limits through fuel, and fixes many differences to Jinja2 in both Rust and Go. Fuel now also accounts for memory and work done in filters and operators, so templates consume more fuel than before and fuel budgets might need adjusting. In Go, maps created by templates now keep the type of their keys and their insertion order; Value.Raw returns a *value.Map for them and Value.AsMap returns a copy with keys converted to strings.

• Fuel now also limits memory and the work done inside filters and operators, not just the number of instructions. Templates consume somewhat more fuel than before, so budgets might need adjusting. #483
• Added State::consume_fuel in Rust and State.ConsumeFuel in Go so that custom filters and functions can charge fuel. #483
• Added Template::render_with_spans in Rust and Template.RenderWithSpans in Go to map rendered output back to the template source. #1004
• Added the count argument to the replace filter for Jinja2 compatibility in Rust. #1013
• The datetime filters in minijinja-contrib now fall back to jiff's bundled time zone database for names missing from the system database. #1008
• Fixed booleans sorting separately from numbers. They now compare, sort and hash like 0 and 1 in Rust and Go.
• Fixed max and groupby returning the last of multiple equal items instead of the first for Jinja2 compatibility in Rust and Go.
• Fixed ~ and + double escaping safe strings or not escaping unsafe ones when combining them with auto escaping enabled in Rust and Go.
• Fixed first, last, length, count, items, reverse, join and groupby handling none and undefined values differently from Jinja2 in Rust and Go.
• Fixed final sigma, titlecase and special case mappings in the upper, lower, capitalize and title filters in Rust and Go.
• Fixed reverse and last not reversing maps and other reversible iterables. last now also works on maps.
• Fixed repeating strings and sequences a negative number of times failing instead of producing an empty result, and repeating safe strings losing their safety.
• Fixed integer math between 2**127 and 2**128, negating the smallest 128-bit integer and divisibleby with a zero divisor in Rust and Go.
• Fixed the even and odd tests for big integers and floats with an integer value.
• Fixed super() panicking at the top level of an included template and loop(...) misbehaving in included templates, blocks and macros.
• Fixed slicing with a negative step panicking on empty values and returning wrong items for some bounds.
• Fixed split(none, n) returning trailing whitespace as an extra item.
• Errors raised while writing the value of {{ ... }} now point to the whole expression.
• Constant folding no longer creates strings or sequences larger than 1KB at compile time.
• Improved the performance of string slicing, string concatenation and the title filter.
• Go: maps now keep the type of their keys and their insertion order like in Rust. The new value.Map type gives access to such maps; Value.AsMap converts their keys to strings.
• Go: added support for integers outside the 64-bit range to arithmetic, comparisons, tojson, the int, float and round filters and the even, odd and integer tests.
• Go: maps can now be compared and sorted, and == no longer rounds integers to floats.
• Go: fixed caller, super(), loop(x), macro auto escaping, blocks of included templates, the template reported for code in blocks and macros and filter chains in {% filter %} blocks to behave like in Rust.
• Go: fixed operators and the string, safe, sum and indent filters accepting undefined values with strict undefined behavior.
• Go: fixed many filters (batch, slice, length, first, last, abs, items, split, attr and others) silently accepting invalid values or arguments instead of failing like in Rust.
• Go: fixed in on strings, + on iterables, chain results, groupby groups, namespaces, unsigned 64-bit integers and float literals such as 1e400 to behave like in Rust.

Install minijinja-cli 3.1.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitsuhiko/minijinja/releases/download/3.1.0/minijinja-cli-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/mitsuhiko/minijinja/releases/download/3.1.0/minijinja-cli-installer.ps1 | iex"

Download minijinja-cli 3.1.0

File	Platform	Checksum
minijinja-cli-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
minijinja-cli-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
minijinja-cli-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
minijinja-cli-i686-pc-windows-msvc.zip	x86 Windows	checksum
minijinja-cli-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
minijinja-cli-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
minijinja-cli-i686-unknown-linux-gnu.tar.xz	x86 Linux	checksum
minijinja-cli-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
minijinja-cli-armv7-unknown-linux-gnueabihf.tar.xz	ARMv7 Linux	checksum
minijinja-cli-aarch64-unknown-linux-musl.tar.xz	ARM64 MUSL Linux	checksum
minijinja-cli-i686-unknown-linux-musl.tar.xz	x86 MUSL Linux	checksum
minijinja-cli-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

syn — 3.0.9 → 3.0.10 (1 release)

Back to version changes · Compare · Releases

3.0.10

• Skip rescanning operands whose scan already failed (#2090, thanks @​LucaCappelletti94)

winnow — 1.0.4 → 1.0.5 (0 releases)

Back to version changes · Compare · CHANGELOG.md · Releases

No published release notes found. See the links above.

Rebase setup

For PRs created by the Lockfile Maintenance App, add this to .github/lockfile-maintenance-auth.yml on the default branch:

rebase: true

Keep workflow_dispatch in the maintenance workflow. Existing App installations must approve the Actions and Issues write permissions.

Alternatively, configure an Actions request-rebase job with pull_request_target: types: [edited] for checkboxes or issue_comment: types: [created] for comments. Keep workflow_dispatch for the maintenance run.

Configuration and custom branches

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue). If it does not match the queue conditions yet, it enters the queue once it does.

• Queue this pull request