chore(deps): bump the patch-and-minor group across 1 directory with 12 updates

[dependabot]

Bumps the patch-and-minor group with 10 updates in the / directory:

Package	From	To
async-trait	0.1.91	0.1.92
base64	0.23.0	0.23.1
futures-core	0.3.33	0.3.34
thiserror	2.0.19	2.0.20
uuid	1.24.0	1.24.1
aws-config	1.10.1	1.11.0
aws-smithy-http-client	1.2.0	1.4.0
ort	2.0.0-rc.10	2.0.0-rc.13
tract-onnx	0.23.4	0.23.5
http-body-util	0.1.4	0.1.5

Updates async-trait from 0.1.91 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

• Resolve double_must_use clippy lint in generated code (#303)

Commits

• 82e7e9e Release 0.1.92
• 9a35cb8 Merge pull request #303 from dtolnay/mustuse
• 875ceec Resolve double_must_use clippy lint
• 62993a5 Raise minimum tested compiler to rust 1.88
• See full diff in compare view

Updates base64 from 0.23.0 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• See full diff in compare view

Updates futures-core from 0.3.33 to 0.3.34

Release notes

Sourced from futures-core's releases.

0.3.34

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Changelog

Sourced from futures-core's changelog.

0.3.34 - 2026-08-11

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Commits

• 705e6b5 Release 0.3.34
• 616dac7 compat: Inline RawWaker clone function
• 4176369 Inline remaining RawWaker clone functions
• f17a895 Fix cloned FuturesUnordered waker identity
• 51d62ad macro: bump syn to v3 (#3028)
• 9e26177 ci: Reduce timeout-minutes
• b2d0983 tsan: Enable Adaptive Delay
• f733d0e Miri: Ignore compat tests
• e5def2f Rename default branch to main
• See full diff in compare view

Updates thiserror from 2.0.19 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

• Suppress redundant_field_names clippy lint in generated code (#454)

Commits

• b1d5db5 Release 2.0.20
• c4c3ebd Merge pull request #454 from dtolnay/clippy
• 2266152 Suppress redundant_field_names clippy lint
• 2901cfd Raise minimum tested compiler to rust 1.88
• aa9d91f Update ui tests for version 2.0.19
• See full diff in compare view

Updates uuid from 1.24.0 to 1.24.1

Release notes

Sourced from uuid's releases.

v1.24.1

What's Changed

• Fix non-ASCII character handling in parse diagnostics by @​questfever in uuid-rs/uuid#899
• Prepare for 1.24.1 release by @​KodrAus in uuid-rs/uuid#900

New Contributors

• @​questfever made their first contribution in uuid-rs/uuid#899

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

Commits

• 2ea38af Merge pull request #900 from uuid-rs/cargo/v1.24.1
• 9dbeb04 prepare for 1.24.1 release
• e113df8 Merge pull request #899 from questfever/main
• b017765 Fix non-ASCII character handling in parse diagnostics
• See full diff in compare view

Updates aws-config from 1.10.1 to 1.11.0

Commits

• See full diff in compare view

Updates aws-smithy-http-client from 1.2.0 to 1.4.0

Commits

• See full diff in compare view

Updates aws-smithy-runtime-api from 1.14.0 to 1.15.0

Commits

• See full diff in compare view

Updates aws-smithy-types from 1.6.1 to 1.6.2

Commits

• See full diff in compare view

Updates ort from 2.0.0-rc.10 to 2.0.0-rc.13

Release notes

Sourced from ort's releases.

v2.0.0-rc.13

2.0.0-rc.13

💖 If you find ort useful, please consider sponsoring us on Open Collective 💖

🤔 Need help upgrading? Ask questions in GitHub Discussions or in the pyke.io Discord server!

---

🎯 Execution provider clarity

EP structs like ep::CUDA are now compile-time gated behind their respective Cargo feature flags. The EP feature flags only modifying runtime behavior was a common pain point, and this change brings ort in line with, like, every other Rust crate in existence.

⚠️ ort will now throw an error at link time if download-binaries is enabled and no binaries contain all of the requested EPs. Previously, if you enabled a nonsensical combination like cuda + coreml, ort would silently fall back to a CPU-only build. This caused great confusion as the only indicator of what went wrong was in log messages that don't show by default. A new lax-feature-matching Cargo feature will fallback to the closest fit instead of erroring.

🍎 ONNX Runtime 1.28

rc.13 skips ahead 4 ONNX Runtime versions to v1.28, bringing new operator support, bug & security fixes, and performance improvements.

✖️ No CUDA 12

rc.13 only ships CUDA 13 binaries, as ONNX Runtime has deprecated CUDA 12.

🧩 Custom operator ergonomics

Custom operators have been reworked to have a more Rusty interface:

 struct MyOperator;
impl Operator for MyOperator {


type Kernel<'attr> = ort::operator::BoxedKernel<'attr>;
fn name(&self) -> &str {
"MyOperator"
}



fn inputs(&self) -> Vec<OperatorInput> {

  vec![OperatorInput::required(TensorElementType::Float32), OperatorInput::required(TensorElementType::Float32)]




fn inputs(&self) -> impl IntoIterator<Item = OperatorInput> {

  [OperatorInput::required(TensorElementType::Float32), OperatorInput::required(TensorElementType::Float32)]

}


fn outputs(&self) -> Vec<OperatorOutput> {

  vec![OperatorOutput::required(TensorElementType::Float32)]




fn outputs(&self) -> impl IntoIterator<Item = OperatorOutput> {

  [OperatorOutput::required(TensorElementType::Float32)]

}


fn create_kernel(&self, _: &KernelAttributes) -> ort::Result<Box<dyn Kernel>> {

  Ok(Box::new(|ctx: &amp;KernelContext| {



</tr></table>

... (truncated)

Commits

• 002f41a 2.0.0-rc.13
• d5dc28f chore(tract): update tract to v0.23
• 62ad710 chore(candle): update to candle v0.11.0
• 66ffef6 docs: update
• 58ebfd8 chore(tools): update api-coverage
• 71c1c84 refactor!: separate Device and HardwareDevice
• 85f4893 chore(sys): update ONNX Runtime to v1.28.0
• d7d924e refactor!: move environment::current to an associated function
• db48c03 feat: Tensor::size
• 2c6652b feat: per-run profiling
• Additional commits viewable in compare view

Updates tract-onnx from 0.23.4 to 0.23.5

Changelog

Sourced from tract-onnx's changelog.

0.23.5 - 2026-08-19

GPU

• Metal Sdpa: fused attention via ported MLX kernels.
• Metal pooling: max/average pooling kernels, including channels-first tensors.
• Metal Resize runs on GPU; multi-axis Reduce split into single-axis reduces; reduce_nd3 threadgroups sized from the reduced axis; missing bool BitAnd/BitOr/BitXor kernel instantiations added.
• CUDA Gated DeltaNet. Recurrent decode kernels for Qwen3.5, shared with the Metal implementation; legacy Qwen3.5 primitive names accepted on import; example decoder runner in examples.
• Fix: CudaGgmlGemm's contraction-dim check relaxed from strict equality to compatible_with.
• Fix: cuDNN conv scratch kept off the Send boundary (State/OpState are now Send + Clone directly).

CPU / linalg

• Matmul kernel picker replaced with a per-architecture LinearCostModel, fit with non-negative least squares from on-device measurements — x86 vendor cohorts, per-Apple-chip models, and small/large seed classes for cortex-a53/a55/a7/a9. The old MLP picker is retired. New cost-model gather/fit/regen and hwbench CLI subcommands support calibrating and auditing kernel choice on new hardware; matrix-vector (n=1) dispatch gets its own dedicated cost model.
• New kernels: AVX-512 and AVX2+FMA SiLU; a full AVX (no-FMA/no-AVX2) f32 tile family plus sigmoid/tanh, covering Sandy/Ivy Bridge and Bulldozer-era x86_64 (1.9–2.6x over the generic fallback); a 128-bit VEX int8 kernel for that same no-FMA tier; ARMv7 NEON fused SiLU; ARMv7 NEON int8 matmul kernels wired into the picker; NEON/generic silu_f16 and sigmoid_f16 fallbacks for non-fp16 aarch64; Q4_0::w4a8_gemv (int8-dot decode GEMV).
• ARMv7 NEON pack transpose for k-contiguous tiles (skipped below a small-block threshold to avoid regressing tiny shapes).
• Row-major output store tile, opt-in for aligned bulk stores and used by the Apple AMX f16 kernel.
• Squeeze/reshape ops fuse directly into OptMatMul's store instead of running as separate ops.
• Cache-block budgets for the L2/L3 tiers now account for cluster-shared caches and are decoupled from parallel chunking; parallelized OptBin* binary fast paths.
• Fix: activation range bugs across every backend. Tanh, Sigmoid, and the fused SiLU/GELU kernels could produce values outside their mathematical range on saturating tails — fixed on x86_64 (AVX, AVX-no-FMA), ARM32/ARM64 NEON, WASM, and the scalar generic path, with new range-assertion tests.

Transformers / LLM

• Quantized KV-cache storage (QuantizedDynKeyValueCache, int8/int4 packed) with cache-cost reporting; attention-sink tokens stay unquantized.
• Flash Sdpa (f16-accumulator) now also covers grouped-query attention, and the GQA broadcast fusion looks through cache-read Cast/ApplyRope ops instead of requiring the KV cache directly under the repeat-interleave chain.
• examples: nemotron-3.5 multilingual streaming ASR example (batch encoder support, t2n>=0.24 exports)

Core / NNEF / ONNX

• ONNX Resize: opset 18/19 completed, opset-10 asymmetric coordinates, and the tf_half_pixel_for_nn coordinate mode; nearest-mode now only lowers to Tile when that actually replicates pixels.
• NonZero moved to onnx-opl with NNEF serialization.
• GatherElements gets a last-axis fast path; ScatterNd and Gather block-copy paths now handle a non-trivial outer dimension.
• nnef patch transforms can rewire any named wire, not just graph inputs.
• Const-fold memory budget halved to 4 MiB and is now bounded by memory rather than element count.
• Fix: DequantizeLinearF32 no longer leaks the input's integer constant onto the F32 output fact, which tripped the outlet fact-consistency check inside a Scan body.
• Fix: quantized pointwise (1x1) convs on the Metal/CUDA exec path keep their bias — the einsum→PrefixMatMul fusion dropped it, so that fold is now skipped there in favour of the standard requant chain.
• Fix: DatumType::with_qparams no longer flips QU8 to QI8; a requantized unsigned tensor stays unsigned.
• Fix: quantized Sign returns 0 at the zero point.
• Fix: malformed ONNX TensorProto/GraphProto attributes return an error instead of panicking; minimum-arity checks for Concat/Squeeze/Gemm; shape inference no longer panics when operands are missing; raw tensor data whose length doesn't match its declared shape is rejected.

CLI / diagnostics

• hwbench: M,K,N[,dt] matmul shape probing, --json output, an --assert gate for CI, a curated default battery, and real memory-bandwidth measurement.
• cost-model gather / fit / regen subcommands for the new LinearCostModel (see CPU/linalg above).
• bench-diff subcommand and bench-compare.sh for comparing two bench runs.

Commits

• c835b20 release 0.23.5
• 7afcbe4 cli: package cost-model seed files with tract-cli
• 77f1dd7 gpu: keep AffineChunkTrim on-device during pulsified encoder translation (#2676)
• 47d35dc Merge pull request #2672 from keevin-xu/fix-quantize-rounding-mode
• 6843fde Merge pull request #2674 from sonos/nemotron-3.5-ci-harness
• 0946eab wasm: SIMD f16 reductions, and drop unsafe from the file
• 01ccb95 wasm: SIMD rms_norm
• 32fb735 wasm: SIMD reduction kernels
• 1cd16d9 Update core/src/ops/math/mod.rs
• b77f6f6 fix(core): Sign returns +0 for -0.0
• Additional commits viewable in compare view

Updates http-body-util from 0.1.4 to 0.1.5

Commits

• 07838bd http-body-util v0.1.5
• 612118c docs: migrate from doc_auto_cfg to doc_cfg (#175)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions