[dependabot]

Bumps the cargo-minor-and-patch group with 2 updates in the / directory: tokio and mongodb.

Updates tokio from 1.53.1 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)
• runtime: add Builder::max_io_events_per_busy_tick (#8410)
• runtime: stabilize tokio::runtime::worker_index() (#8431)
• sync: add SemaphorePermit::semaphore() (#8482)
• sync: add blocking_acquire methods to Semaphore (#8269)
• sync: add watch::Receiver::is_closed (#8481)
• wasm: support JSPI for Emscripten target (#8285, #8627)
• wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

• fs: reject zero in File::set_max_buf_size (#8449)
• io: make copy_buf cooperative (#8459)
• io: panic when BufReader or BufStream is created with zero capacity (#8494)
• io: panic when in-memory pipe is created with zero capacity (#8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)
• io: support vectored writes in Sink (#8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)
• net: start accepted sockets as readable and writable (#8435)
• net: support UCred on Fuchsia (#8257)
• process: use mio::unix::pipe for Unix child stdio (#8603)
• runtime: cache-pad the shared injection queue and idle state (#8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)
• runtime: make enable_io available whenever rt is enabled (#8387)
• runtime: move block_in_place setup into a non-generic function (#8315)
• runtime: move the multi-thread inject queue to its own mutex (#8382)
• runtime: panic when max_io_events_per_tick is zero (#8476)
• runtime: suggest .await in nested block_on panic message (#8501)
• sync: avoid atomic reader count in broadcast slots (#8357)
• sync: use acquire/release orderings in Notify (#8325)
• time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

• b53b200 chore: prepare Tokio v1.54.1 (#8693)
• 5ed619b time: revert "remove the runtime handle from timers" (#8692)
• 66d34e4 chore: prepare Tokio v1.54.0 (#8667)
• 0d322ce io: support vectored writes in sink (#8663)
• 4167c56 codec: expose I/O sources from codec errors (#8665)
• cdd9dae fs: propagate iouring stress test failures (#8644)
• 52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
• 4890d02 stream: implement FusedStream for JoinSetStream (#8629)
• a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
• 9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
• Additional commits viewable in compare view

Updates mongodb from 3.9.1 to 3.10.0

Release notes

Sourced from mongodb's releases.

v3.10.0

The MongoDB Rust driver team is pleased to announce the v3.10.0 release of the mongodb crate, now available for download from crates.io.

[!IMPORTANT] This is a security patch release for CVE-2026-120673. Upgrading is recommended for all users.

Highlighted Changes

Fix: plaintext in Opentelemetry db.query.text attribute

This release fixes a bug that caused query documents to be recorded in Opentelemetry before automatic encryption was applied, potentially exposing the message plaintext.

Required version-to-name mapping in client metadata

Previous versions of the driver would allow the character '|' in client metadata; in order to preserve the mapping between versions and names in the final message, this is now not allowed and attempting to set or add metadata containing this character will result in an error.

MSRV increase to 1.94.1

This version of the driver now requires a minimum Rust compiler version of 1.94.1.

Full Release Notes

Impactful changes are listed below; for a complete list of changes see this GitHub query.

New Features

• RUST-2497 Add a validator callback for SRV DNS queries (#1818)

Improvements

• RUST-2453 Remove unnecessary dependencies (#1798)
• RUST-2517 Reduce buffer usage in OP_MSG parsing (#1801)
• RUST-2478 Enforce version-to-name mapping in client metadata (#1806)
• RUST-2468 Update getMore span nesting and cursor id recording (#1804)
• RUST-2480 Add the 'error.type' attribute to opentelemetry spans (#1811)
• Update to edition 2024 (#1824) (thanks @​FalkWoldmann!)
• minor: avoid allocating unused buffers on connection check-in (#1830) (thanks @​tomerab1!)
• minor: bump MSRV to 1.94.1 (#1839)
• Fix cancelled connection checkouts delaying queued requests (#1838) (thanks @​janvotava!)
• RUST-2535 Implement Clone for InsertManyResult (#1848) (thanks @​connorsmacd!)

Bugfixes

• RUST-2525 encrypt before recording span
• RUST-2479 Report write concern errors for dropIndexes (#1817)
• RUST-2523 Percent-encode URI string components (#1825)
• Fix SCRAM short server nonce panic and cap iteration count (#1833) (thanks @​cozyGarage!)
• RUST-2526 Fix invalid extended JSON deserialization in errInfo field (#1832)
• RUST-2523 Fix more discrepancies between ConnectionString::parse and ::to_string (#1836)

Commits

• 454e128 RUST-2525 encrypt before recording span (#1856)
• 5740cdd RUST-2496 Bump version number to 3.10.0 (#1854)
• 1342ea4 RUST-2528 Update evergreen tasks to macos-15 (#1851)
• 58dffc9 minor: bump clippy to 1.99.1 (#1849)
• 73a08fe RUST-2535 Implement Clone for InsertManyResult (#1848)
• f6a6d1d RUST-2460 Drop prefixPreview / suffixPreview / substringPreview (#1847)
• 17f40ec RUST-2413 remove pre-4.2 references in tests (#1844)
• f4ab4e1 RUST-2527 Test write concern error reporting (#1840)
• 4d4964d RUST-2509 Fix flaky retryable handshake tests (#1845)
• 3beed21 minor: update dependencies past advisories (#1846)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5f932ba-11ba-441f-9643-d70eef56919c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts