[dependabot]

Bumps the cargo group with 4 updates in the / directory: open, self_update, sigstore-types and sigstore-crypto.

Updates open from 5.4.4 to 5.4.5

Release notes

Sourced from open's releases.

v5.4.5

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior; the earlier implementation retried unsuccessful operations.

... (truncated)

Changelog

Sourced from open's changelog.

5.4.5 (2026-10-22)

Bug Fixes

• check that_detached launchers for immediate failures that_detached() returned as soon as a launcher spawned, so a launcher that failed right after starting was reported as success and no fallback ran.

  Observe each launcher for 250 ms by delegating to that_detached_with_timeout(). A launcher that exits unsuccessfully within that window falls through to the next candidate; one still running is treated as handed off. The macOS and shellexecute-on-windows paths are unchanged.

  Extend the fixture tests to call that_detached() directly.

• restore launcher fallback and support Plasma 6

  When xdg-open starts but exits unsuccessfully, that() and the CLI previously stopped before trying another installed opener. On Plasma 6, the fallback list also omitted the versioned KDE launchers.

  Launcher behavior

  • Retry reported failures from UNIX desktop launchers and retain the first unsuccessful exit when later candidates are missing.
  • Add kde-open6 and kde-open5 before the existing kde-open fallback.
  • Keep launcher ordering, argument boundaries, and exit-status policy together so compatibility decisions are explicit.
  • Preserve Windows' stop-on-failure policy and the existing protections for option-shaped and non-UTF-8 paths.

  Bounded detached checks

  Add that_detached_with_timeout(path, timeout) to opt into checking the actual launcher status for a configurable interval per candidate. Retry confirmed UNIX launcher failures; consider successful exits or launchers still running at the deadline handed off. A zero timeout polls once.

  On UNIX, use setsid() while retaining the launcher as a child. Reserve a background waiter before spawning and transfer ownership after a timeout so the launcher can outlive its caller and is eventually reaped. Stop fallback if observing an already-started launcher fails, avoiding a second launch based only on a wait error. Existing detached calls retain their timing behavior. The new API uses command-based launchers on Windows, including when shellexecute-on-windows is enabled.

  Historical constraints

  55dc10d relaxed exit checks for argumentless availability probes, where usage errors are expected. It did not establish that failed real opening operations should stop fallback. 245c95e introduced that behavior;

... (truncated)

Commits

• a60a9d5 Release open v5.4.5
• 4e64f6b Merge pull request #135 from Byron/fix-linux-launchers
• c88759b auto-review
• 42a34b0 fix(unix): check that_detached launchers for immediate failures
• 279c1b2 fix(unix): restore launcher fallback and support Plasma 6
• See full diff in compare view

Updates self_update from 1.3.1 to 1.3.3

Changelog

Sourced from self_update's changelog.

[1.3.3]

Bug fix over 1.3.2. No migration needed.

Fixed

• restart() / restart_with() failed on linux after an update with No such file or directory (#217). Once the running binary is replaced, current_exe() returns "<path> (deleted)". The restart now targets the path the update replaced, which is recorded before the replace. When nothing was recorded, it strips the " (deleted)" suffix as long as the stripped path exists.

[1.3.2]

Dependency update over 1.3.1. No migration needed.

Changed

• Bump quick-xml to 0.42. It is only used internally by the s3 backend's listing parser and is not part of the public API.

Commits

• 1524279 release: bump version to 1.3.3 (#219)
• 4c500f3 fix: restart the replaced exe path, not current_exe() with " (deleted)" (#218)
• 858c04b bump quick-xml to 0.42, release 1.3.2 (#216)
• See full diff in compare view

Updates sigstore-types from 0.15.0 to 0.15.1

Release notes

Sourced from sigstore-types's releases.

sigstore-types-v0.15.1

Added

• (sign) attestation subjects with any in-toto digest (#268)

Other

• [breaking] final API naming polish before 1.0 (#325)
• (types) remove duplicated constructor doc lines (#318)
• [breaking] document every public item, enforce missing_docs (#271)

Commits

• fc308a2 chore: release v0.15.1 (#339)
• ff9ee68 trust-root: refresh embedded TUF data (#342)
• 362bee1 chore(deps): update webpki-root-certs to 1.0.10 (#341)
• b188022 fix(tsa): verify response messageImprint matches request (#340)
• ab59bb5 chore(deps): update rust to v1.99.1 (#334)
• 6654f7f chore(deps): update rust crate rstest to 0.28 (#335)
• be1c932 chore(deps): update github-actions (#336)
• 7ee1e2c chore(deps): lock file maintenance (#338)
• See full diff in compare view

Updates sigstore-crypto from 0.15.0 to 0.15.1

Release notes

Sourced from sigstore-crypto's releases.

sigstore-crypto-v0.15.1

Other

• (crypto) fix boring_provider build after sha384 returns Sha384Hash (#332)
• [breaking] final API naming polish before 1.0 (#325)
• Crypto agility (#326)
• [breaking] document every public item, enforce missing_docs (#271)

Commits

• fc308a2 chore: release v0.15.1 (#339)
• ff9ee68 trust-root: refresh embedded TUF data (#342)
• 362bee1 chore(deps): update webpki-root-certs to 1.0.10 (#341)
• b188022 fix(tsa): verify response messageImprint matches request (#340)
• ab59bb5 chore(deps): update rust to v1.99.1 (#334)
• 6654f7f chore(deps): update rust crate rstest to 0.28 (#335)
• be1c932 chore(deps): update github-actions (#336)
• 7ee1e2c chore(deps): lock file maintenance (#338)
• See full diff in compare view