[dependabot]

Bumps the rust-dependencies group with 3 updates in the / directory: ignore, trash and tract-onnx.

Updates ignore from 0.4.33 to 0.4.34

Commits

• 91f5d22 ignore-0.4.34
• 55f2f69 globset-0.4.21
• 65e072f ignore: respect linked worktree excludes without requiring Git
• d19650f globset: match filename-only regexes against basenames
• 9d07a92 ignore: reuse incremental matchers for directories without rules
• 6892bc2 ignore: use byte keys for incremental parent lookups
• 1752fb7 globset: reject impossible literal lengths before hashing
• 2d4fa85 ignore: skip empty absolute parent matchers (#3557)
• b5611fc ignore: reuse parent repository detection
• c5e744c ignore: avoid scratch pools for empty matchers
• Additional commits viewable in compare view

Updates trash from 5.2.9 to 5.3.0

Release notes

Sourced from trash's releases.

v5.3.0

Documentation

• configure docs.rs platform targets

  I reduced the target list to the 3 common ones. Let's see if it works.

  Recent docs.rs releases only expose Linux documentation. Explicitly request the five standard docs.rs targets so macOS and Windows documentation are included, keeping Linux first as the default landing page.

  A Cargo metadata assertion failed before the change because the docs.rs target list was absent, and passes with the configured targets.

New Features

• add Portal backend This only adds the basic functionality to make it work.

Bug Fixes

• preserve path prefixes when decoding slashes

  Decode the complete path byte string instead of collecting decoded components into a PathBuf. A component beginning with %2F previously discarded the prefix, redirected restoration to the filesystem root, and could erase relative parent traversal before validation.

  Add relative and absolute encoded-separator regressions, traversal rejection, and restoration coverage. The relative separator case fails before the fix.

• reject original paths without filenames

  Validate the decoded path before joining the trash base so dot paths cannot resolve to the base directory. Route roots and paths ending in parent components through the invalid-original-path warning as well.

  Add literal and encoded dot and parent regression cases. The dot-path case fails before the fix; the listing regression passes with and without chrono afterward.

• trim surrounding trashinfo path whitespace

  Trim both ends of the encoded Path value before decoding so trailing spaces and tabs do not become filename bytes. Extend the whitespace fixture while retaining encoded filename space coverage.

• report why the shell refused to recycle an item delete answered every item the shell skipped with Error::Unknown { "Some operations were aborted" }. With FOF_NO_UI a refused item is skipped, not asked about: PerformOperations and FinishOperations both report success, and only GetAnyOperationsAborted says that something

... (truncated)

Changelog

Sourced from trash's changelog.

5.3.0 (2026-11-05)

Documentation

• configure docs.rs platform targets

  I reduced the target list to the 3 common ones. Let's see if it works.

  Recent docs.rs releases only expose Linux documentation. Explicitly request the five standard docs.rs targets so macOS and Windows documentation are included, keeping Linux first as the default landing page.

  A Cargo metadata assertion failed before the change because the docs.rs target list was absent, and passes with the configured targets.

New Features

• add Portal backend This only adds the basic functionality to make it work.

Bug Fixes

• preserve path prefixes when decoding slashes

  Decode the complete path byte string instead of collecting decoded components into a PathBuf. A component beginning with %2F previously discarded the prefix, redirected restoration to the filesystem root, and could erase relative parent traversal before validation.

  Add relative and absolute encoded-separator regressions, traversal rejection, and restoration coverage. The relative separator case fails before the fix.

• reject original paths without filenames

  Validate the decoded path before joining the trash base so dot paths cannot resolve to the base directory. Route roots and paths ending in parent components through the invalid-original-path warning as well.

  Add literal and encoded dot and parent regression cases. The dot-path case fails before the fix; the listing regression passes with and without chrono afterward.

• trim surrounding trashinfo path whitespace

  Trim both ends of the encoded Path value before decoding so trailing spaces and tabs do not become filename bytes. Extend the whitespace fixture while retaining encoded filename space coverage.

• report why the shell refused to recycle an item delete answered every item the shell skipped with Error::Unknown { "Some operations were aborted" }. With FOF_NO_UI a refused item is skipped, not asked about: PerformOperations and FinishOperations both

... (truncated)

Commits

• 0fdaf8d Release trash v5.3.0
• dd2b8f7 Merge pull request #161 from Byron/fix/freedesktop-trashinfo-reviewed
• b6e2624 fix(freedesktop): preserve path prefixes when decoding slashes
• 4ee80bd fix(freedesktop): reject original paths without filenames
• 6fcae5b fix(freedesktop): trim surrounding trashinfo path whitespace
• e00d049 Merge pull request #158 from stefan-siebert/fix/windows-list-file-name
• b8f46cc Merge pull request #159 from stefan-siebert/fix/windows-report-hresult
• 0d0a038 review
• 8afaa34 fix(windows): report why the shell refused to recycle an item (#96)
• 7f63659 fix(windows): list items under their file name, extension included
• Additional commits viewable in compare view

Updates tract-onnx from 0.23.9 to 0.23.10

Changelog

Sourced from tract-onnx's changelog.

0.23.10 - 2026-11-05

Web demos

• demo.tract.rs runs tract in the browser, on the public tract crate only, with weights fetched from Hugging Face at pinned revisions into the browser's storage. Five demos, each under examples/<example>/web: Stable Diffusion 1.5 and Nemotron streaming speech recognition on WebGPU, Pixel Lab live background replacement on WebGPU (contributed by Ckristian Zoli), PP-OCRv6 on the CPU or WebGPU (contributed by Ckristian Zoli), and the Hey Snips wake word on the CPU as one pulsed graph that resamples and featurizes in-graph.

WebGPU (wgpu)

• The public crate reaches WebGPU. An opt-in wgpu feature links tract-wgpu natively and on wasm32. unstable-wgpu-async adds tract::wgpu::init().await and Tensor::to_host_async().await for the browser, where the device can only be requested asynchronously; a blocking read of a GPU-resident tensor on wasm32 fails with a pointer to them. On wasm, Tensor can also ingest a canvas (optionally normalizing channels in the same pass), NV12 and RGB565 frames on the GPU, share the device with a page, and write a mask texture. (Contributed by Ckristian Zoli.) The backend requires core WebGPU: OpenGL ES 3.1 and Direct3D 11 devices cannot run it.
• Tiled GEMM core shared by the matmul and an implicit-GEMM dense convolution: f16 tiles in the tensor type, vec4 staging along k, 8x4 blocks per thread, row tiles sized to the rows, and split-K for convolutions that fill too few tiles. Dedicated GEMV kernels for m = 1 and n = 1, a register-blocked direct 3x3 kernel for decoder convolutions, Winograd F(4,3) for wide dense 3x3 convolutions (f16 and named-weight kernels included, weights broadcast over the batch), and a flash attention kernel for unmasked Sdpa with head dims up to 48. (Largely contributed by Ckristian Zoli.)
• Many more ops stay on the device: GroupNorm, LayerNorm, RmsNorm (with the residual add fused), ScaledMaskedSoftmax with float and bool masks, ApplyRope and RotateHalf, Gather by i64 indices, GatherNd for deformable convolutions, DiagGather, Mean reduce, Leaky ReLU, exact and approximate GELU, 1D convolutions (as 2D), channels-last depthwise convolutions, global average pooling, large 1D transposed convolutions (as a matmul and an overlap-add), and Q4_0/Q2_0_T matmuls dequantized in the shader with a word-aligned upload layout. (Contributions by Ckristian Zoli and Evan Carroll.)
• Memory: a model with known shapes runs on tract-gpu's memory plan, one buffer per partition, small tensors in partitions of their own; a run past TRACT_WGPU_FRAME_BUDGET_MB (256 by default) is submitted in frames so buffers are reused (an SD f32 UNet went from 12.8 GB to 7 GB); bind groups are evicted with the buffers they bind. (Contributions by Evan Carroll.)

Named weights and lazy loading

• A graph can refer to weights it does not carry. NamedStorage is a weight known by its name, read from a WeightSource the first time its bytes are needed, and kept out of constant folding. ONNX can load external tensors that way (lazy_external_data, --onnx-lazy-external-data), NNEF writes them as tract_core_named_weight(label, shape, datum_type), and LinkWeights / SafetensorsSource link them to a safetensors file read on demand (--link-safetensors in the CLI, Model::link_weights and link_safetensors under unstable-named-weights in the API).
• The NNEF safetensors loader streams tensor by tensor instead of holding the file twice, handles every integer and float dtype, and no longer depends on the safetensors crate.
• The ONNX data resolver receives external locations as the model names them, so a resolver with no file system behind it can serve them.

Core

• GroupNorm and LayerNorm are core ops, detected from their ONNX decompositions (with LayerNorm's affine part folded in), with NNEF forms tract_core_group_norm, tract_core_layer_norm and tract_core_affine_layer_norm. ONNX InstanceNormalization loads as a GroupNorm with one group per channel. The CPU LayerNorm runs through the linalg sum and RmsNorm kernels, and a last-axis LayerNorm keeps its axis last.
• Reducer::Mean accumulates in f32: an f16 mean was a sum then a scale, which overflowed on SD-sized group norms. Sum followed by 1/N declutters into it, Mean(Square) into MeanOfSquares; hir's float Mean and tflite's float MEAN load as it.
• Axis ops move through the graph more freely: a Move commutes with a Reshape it leaves alone or jumps over, sink_axis_op / hoist_axis_op move an AxisOp or IntoShape past its neighbour through change_axes, replacing hand-written swaps in OptMatMul and MultiBroadcastTo. A MoveAxis that keeps memory order becomes an alias. (Contributions by Ckristian Zoli.)
• Exported attention (EinSum, Softmax, EinSum) is detected as Sdpa, and the unmasked fallback scales Q instead of the scores. GeluExact is detected in SD's spelling and serializes as tract_core_gelu_exact. A running-sum Scan folds into CumSum. A gather by a constant scalar index is a slice, and a resize to the input's own shape is dropped. (Contributions by Evan Carroll.)
• Packs kept between turns are bounded by TRACT_KEPT_PACK_BYTES (64 MiB by default), and the per-session caches of a session dropped on another thread are reaped. (Contributions by Evan Carroll and Ckristian Zoli.)
• f16/f32 casts and GroupNorm's conversions run across the executor's threads, f32/f16 tensor casts use half's slice conversion (F16C, aarch64 fp16), constant Pad copies contiguous runs, nearest upsample copies rows for every datum type, and an einsum with m == n keeps its constant operand on A. (Contributions by Evan Carroll and Ckristian Zoli.)

Streaming / pulse

• Blockify covers more attention masks: sliding-window masks, pulses finer than the mask chunk (as behind an upsample), and chained attention blocks sharing one mask.
• A Range whose slope is a fraction of the streaming symbol pulsifies when a pulse holds a whole number of its elements. Pulsed transposed convolutions keep DeconvDelay and PulseMask on CUDA, Metal and wgpu, and integer comparisons against NNEF literals no longer go through TDim on the host.

Transformers / LLM

• ggml block formats Q8_0, Q4_K, Q5_K, Q6_K and IQ2_S, with llama.cpp's reference quantizers and NNEF .dat item types; Q2_0_T gets its NNEF item type, and CUDA and Metal multiply it on their GGML kernels. Fix: Q8_1 blobs could not be read back. (Contributed by Ckristian Zoli.)
• DiagGather and RotateHalf serialize to NNEF (tract_transformers_diag_gather, tract_transformers_rotate_half).

Deployment

• The deploy runtime can pool a model behind TRACT_POOL_WORKERS worker threads with a bounded queue (TRACT_POOL_QUEUE), so a host on an unbounded thread pool no longer grows device memory with its concurrency. A full queue fails a call at once with tract::Overloaded (under unstable-autobatch), and a worker survives a panicking call.

CPU / linalg

• Direct spatial convolution: NEON conv_w4 with sixteen accumulators, strides up to 4 and one tap load for four channels, an AVX-512 conv_w4, and the op limited to 64 inputs and a W stride of 2 where it wins. (Contributed by Evan Carroll.)
• NEON depthwise_w vectorises any tap count at strides 1 to 4 (contributed by Evan Carroll), and the x86 depthwise kernel runs stride-two rows with AVX (contributed by Reza Sayar).
• Parallel launches size their chunks by the work, so a tensor barely over the threshold is no longer shredded and every thread gets a chunk. A packed operand's buffer is reused across turns. par_bin_chain no longer copies short operands every eval. mmm runs inline on a one-thread pool instead of the global pool (contributed by Dundy Pasupuleti). (Contributions by Ckristian Zoli.)

GPU

... (truncated)

Commits

• 38409dc release 0.23.10
• 6c392b8 web demos: show the tract version they were built with
• 9d00581 web demos: deploy through a script that purges Cloudflare
• a6884d4 log changes
• af883bf The wgpu docs never said the backend requires core WebGPU, so a compatibility...
• 11480bb wgpu read each Q4_0 and Q2_0_T block from the host interleave, so a 10- or 18...
• 8dd91d6 core: a single-kernel matmul strategy packs for its panel extractor
• 879652f metal: Q2_0_T matmul on the GGML kernels
• 9e9abd6 cuda: Q2_0_T matmul on the GGML quantized kernels
• ac77e6a test-rt: matmul_q20t suite for ternary block-quant weights
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.