chore: bump the patch group with 2 updates

[dependabot]

Bumps the patch group with 4 updates: futures, mdbook-core, mdbook-preprocessor and pulldown-cmark-to-cmark.

Updates futures from 0.3.33 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

Commits

• 705e6b5 Release 0.3.34
• 616dac7 compat: Inline RawWaker clone function
• 4176369 Inline remaining RawWaker clone functions
• f17a895 Fix cloned FuturesUnordered waker identity
• 51d62ad macro: bump syn to v3 (#3028)
• 9e26177 ci: Reduce timeout-minutes
• b2d0983 tsan: Enable Adaptive Delay
• f733d0e Miri: Ignore compat tests
• e5def2f Rename default branch to main
• See full diff in compare view

Updates mdbook-core from 0.5.2 to 0.5.4

Release notes

Sourced from mdbook-core's releases.

v0.5.4

See https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-054 for a complete list of changes.

v0.5.3

See https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-053 for a complete list of changes.

Changelog

Sourced from mdbook-core's changelog.

mdBook 0.5.4

v0.5.3...v0.5.4

Added

• Added zoomable images feature. #3127

Changed

• Updated dependencies. #3149 #3152 #3129 #3130

Fixed

• Fixed layout bug with images in links. #3142
• Fixed previous-chapter nav hover overlapping sidebar resize handle. #3134
• Fixed missing LICENSE files in published crates. #3135
• Switched recommendation to linkcheck2 fork. #3132
• Fixed version in CI source install docs. #3154

mdBook 0.5.3

v0.5.2...v0.5.3

Changed

• Improve spacing in sidebar section headings. #3122
• Updated cargo dependencies. #3083 #3077 #3058 #3057 #3042 #3045 #3044 #3036 #3022 #3017 #3018 #3019 #2998

... (truncated)

Commits

• 2ea30c0 Merge pull request #3155 from ehuss/bump-version
• a08ba2b Bump version to 0.5.4
• 0e5ddf6 Merge pull request #3154 from ehuss/ci-version-string
• f4ddbff Show the correct version in CI install docs
• 8b53f1b Merge pull request #3127 from GuillaumeGomez/zoom-in
• beab2fa Mention zoom-in feature in mdbook guide
• 588066c Make the "zoom in" feature work with keyboard and simplify DOM
• f526b18 Only enable "zoom-in" feature on images not inside links
• 73d6edf Add possibility to "zoom out" using the escape key
• 6a7ef4d Add regression test for the "zoom-in" feature
• Additional commits viewable in compare view

Updates mdbook-preprocessor from 0.5.2 to 0.5.4

Release notes

Sourced from mdbook-preprocessor's releases.

v0.5.4

See https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-054 for a complete list of changes.

v0.5.3

See https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-053 for a complete list of changes.

Changelog

Sourced from mdbook-preprocessor's changelog.

mdBook 0.5.4

v0.5.3...v0.5.4

Added

• Added zoomable images feature. #3127

Changed

• Updated dependencies. #3149 #3152 #3129 #3130

Fixed

• Fixed layout bug with images in links. #3142
• Fixed previous-chapter nav hover overlapping sidebar resize handle. #3134
• Fixed missing LICENSE files in published crates. #3135
• Switched recommendation to linkcheck2 fork. #3132
• Fixed version in CI source install docs. #3154

mdBook 0.5.3

v0.5.2...v0.5.3

Changed

• Improve spacing in sidebar section headings. #3122
• Updated cargo dependencies. #3083 #3077 #3058 #3057 #3042 #3045 #3044 #3036 #3022 #3017 #3018 #3019 #2998

... (truncated)

Commits

• 2ea30c0 Merge pull request #3155 from ehuss/bump-version
• a08ba2b Bump version to 0.5.4
• 0e5ddf6 Merge pull request #3154 from ehuss/ci-version-string
• f4ddbff Show the correct version in CI install docs
• 8b53f1b Merge pull request #3127 from GuillaumeGomez/zoom-in
• beab2fa Mention zoom-in feature in mdbook guide
• 588066c Make the "zoom in" feature work with keyboard and simplify DOM
• f526b18 Only enable "zoom-in" feature on images not inside links
• 73d6edf Add possibility to "zoom out" using the escape key
• 6a7ef4d Add regression test for the "zoom-in" feature
• Additional commits viewable in compare view

Updates pulldown-cmark-to-cmark from 22.0.0 to 22.0.1

Release notes

Sourced from pulldown-cmark-to-cmark's releases.

v22.0.1

Bug Fixes

• escape brackets in generated link labels

  Shortcut and collapsed link labels are reconstructed from decoded text, so bracket escapes were lost when their reference definitions were emitted. This made the generated Markdown invalid for labels containing brackets.

  Escape backslashes and square brackets while capturing generated link and image labels, while leaving parser-provided explicit reference IDs unchanged to avoid double escaping. Add regression coverage for shortcut, explicit, and image references and update the CommonMark conformance count from 585 to 586.

Commit Statistics

• 2 commits contributed to the release.
• 230 days passed between releases.
• 1 commit was understood as conventional.
• 1 unique issue was worked on: #109

Commit Details

• #109
  • Escape brackets in generated link labels (e446742)
• Uncategorized
  • Merge pull request #110 from Byron/escape-in-links (41f854b)

Changelog

Sourced from pulldown-cmark-to-cmark's changelog.

22.0.1 (2026-08-10)

Bug Fixes

• escape brackets in generated link labels

  Shortcut and collapsed link labels are reconstructed from decoded text, so bracket escapes were lost when their reference definitions were emitted. This made the generated Markdown invalid for labels containing brackets.

  Escape backslashes and square brackets while capturing generated link and image labels, while leaving parser-provided explicit reference IDs unchanged to avoid double escaping. Add regression coverage for shortcut, explicit, and image references and update the CommonMark conformance count from 585 to 586.

Commit Statistics

• 2 commits contributed to the release.
• 230 days passed between releases.
• 1 commit was understood as conventional.
• 1 unique issue was worked on: #109

Commit Details

• #109
  • Escape brackets in generated link labels (e446742)
• Uncategorized
  • Merge pull request #110 from Byron/escape-in-links (41f854b)

Commits

• 66f7c5d Release pulldown-cmark-to-cmark v22.0.1
• 41f854b Merge pull request #110 from Byron/escape-in-links
• e446742 fix: escape brackets in generated link labels (#109)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
pulldown-cmark-to-cmark	[>= 15.0.a, < 15.1]
pulldown-cmark-to-cmark	[>= 16.a, < 17]
pulldown-cmark-to-cmark	[>= 17.a, < 18]
pulldown-cmark-to-cmark	[>= 18.a, < 19]
pulldown-cmark-to-cmark	[>= 19.a, < 20]
pulldown-cmark-to-cmark	[>= 20.a, < 21]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[prql-bot]

Lockfile-only bump; all 16 changed/added checksums verify against the crates.io sparse index, and the lockfile is internally consistent (toml_datetime correctly disambiguated between 0.7.5+spec-1.1.0 for toml_edit and 1.1.1+spec-1.1.0 for toml; no orphaned entries — hashbrown 0.15.5 still has consumers after indexmap moved to 0.17.1). None of the churned crates (toml, indexmap, hashbrown, syn) is a direct workspace dependency, and mdbook-core/mdbook-preprocessor stay within the "0.5.2" caret requirement in web/book/Cargo.toml, so no manifest change is needed.

Approving on the diff. check-ok-to-merge currently shows red, but that check run belongs to run 31891399745, whose own conclusion is cancelled — the concurrency group replaced it and its if: always() gate resolved to failure because its contributors were cancelled, not because anything failed. The replacement run is in flight and will re-register the gate.

Still unverified when I stopped polling (all required-or-relevant, none failing): test-msrv (queued — the one most worth watching here, since toml 1.1.4, indexmap 2.14.0 and hashbrown 0.17.1 are new floors against the workspace's rust-version = "1.81.0"), test-rust, test-deps-min-versions, check-links-markdown, and the nightly/* matrix.

CI failed — test-msrv broke on the mdbook-core 0.5.4 -> toml 1.x -> indexmap 2.14 chain, which pushes prqlc past the 1.81.0 MSRV. Fix pushed as 73c8d0c.

[prql-bot]

test-msrv went red after I approved, so I've dismissed that approval and pushed a fix.

The break is mdbook-core 0.5.4, not any of the crates the title names. mdbook-core 0.5.4 requires toml ^1.1.2; toml 1.1.4 requires indexmap ^2.13.0; and every indexmap from 2.12 on declares rust-version = 1.82 (2.14.0 declares 1.85, and it drags in hashbrown 0.17.1, also 1.85). Because the workspace shares one lockfile and indexmap reaches prqlc through serde_yaml — a normal dependency of both prqlc and prqlc-parser — a docs-toolchain bump raised the floor under the compiler crate, past the rust-version = "1.81.0" in Cargo.toml that test-msrv verifies.

I've rebuilt the lockfile with futures 0.3.34 and pulldown-cmark-to-cmark 22.0.1 only, holding mdbook-core/mdbook-preprocessor at 0.5.2. That drops the diff to 21 changed lines, all version/checksum pairs, and cargo +1.81.0 check --locked in prqlc/prqlc — the exact command cargo msrv verify runs — passes. I've retitled the PR to match what it now carries.

Worth a maintainer decision separately: mdBook is now permanently out of reach, not just this week. mdbook-core 0.5.3 and 0.5.4 both declare rust-version = 1.88.0 themselves, and there's no 0.5.x that both postdates 0.5.2 and stays under the current MSRV — so Dependabot will keep re-proposing this bump every week and it will keep failing test-msrv. The two ways out are raising the workspace MSRV (the note above update-rust-toolchain says that's bumped by hand as debian/winget catch up) or adding an ignore entry for mdbook-* in .github/dependabot.yaml alongside the existing max-sixty/tend one. I didn't do either — both are policy calls rather than mechanical fixes.

Evidence and verification notes

Resolver refusal that pins the chain, from cargo update -p indexmap --precise 2.11.4 on the original lockfile:

error: failed to select a version for the requirement `indexmap = "^2.13.0"`
candidate versions found which didn't match: 2.11.4
required by package `toml v1.1.4+spec-1.1.0`
    ... which satisfies dependency `toml = "^1.1.2"` (locked to 1.1.4+spec-1.1.0) of package `mdbook-core v0.5.4`
    ... which satisfies dependency `mdbook-core = "^0.5.2"` (locked to 0.5.4) of package `mdbook-prql v0.13.15 (web/book)`

Path from indexmap into the compiler crate (cargo tree -i indexmap -e normal, run in prqlc/prqlc):

indexmap v2.14.0
└── serde_yaml v0.9.34+deprecated
    ├── prqlc v0.13.15
    └── prqlc-parser v0.13.15
        └── prqlc v0.13.15

rust-version as declared on crates.io: indexmap 2.11.4 → 1.63, 2.12.0–2.13.1 → 1.82, 2.14.0 → 1.85; hashbrown 0.15.5 → 1.65, 0.17.1 → 1.85; mdbook-core 0.5.2 and 0.5.4 → 1.88.0. The futures 0.3.34 crates and pulldown-cmark-to-cmark 22.0.1 all stay at 1.71/1.71.1, which is why they're safe to keep. futures-macro 0.3.34 switches to syn 3, but syn 3.0.3 was already in the lockfile and declares 1.71.

Why the original lockfile got here at all: a plain cargo update -p futures -p pulldown-cmark-to-cmark reports Locking 10 packages to latest Rust 1.81.0 compatible versions — cargo's MSRV-aware resolver would not have selected these versions. Dependabot resolves with --precise per package, which bypasses that fallback, so it can propose a group that cargo itself would decline.

On the original head I also verified all 16 changed/added checksums against the crates.io sparse index (all matched) and confirmed the lockfile was internally consistent — toml_datetime correctly disambiguated between 0.7.5+spec-1.1.0 and 1.1.1+spec-1.1.0, no orphaned entries. The problem was never lockfile integrity.

[prql-bot]

test-msrv is green on 73c8d0ce, along with the rest of the rollup (66 success, 17 skipped, 0 failures). Re-approving; the diff is now futures 0.3.33 → 0.3.34 and pulldown-cmark-to-cmark 22.0.0 → 22.0.1, 21 lines of version/checksum pairs.

Note for whoever merges: the mdbook-core/mdbook-preprocessor 0.5.4 bump Dependabot originally grouped in here is held back, and will keep coming back weekly until the MSRV question above is settled.