chore: bump the cargo-minor-patch group across 1 directory with 2 updates

[dependabot]

Bumps the cargo-minor-patch group with 2 updates in the / directory: open and rust-i18n.

Updates open from 5.3.6 to 5.4.0

Release notes

Sourced from open's releases.

v5.4.0

New Features

• cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

• Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

  This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

  Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

• prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

  Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

  Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

  Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

• 5 commits contributed to the release.
• 3 commits were understood as conventional.
• 1 unique issue was worked on: #124

Commit Details

... (truncated)

Changelog

Sourced from open's changelog.

5.4.0 (2026-07-12)

New Features

• cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

• Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

  This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

  Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

• prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

  Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

  Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

  Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

• 5 commits contributed to the release.
• 3 commits were understood as conventional.

... (truncated)

Commits

• b5c12bd Release open v5.4.0
• bdc3397 Merge pull request #126 from Byron/fix-wsl
• 7265cae fix: Align WSL PowerShell invocation with Windows
• 407b058 Merge pull request #125 from Byron/open-with-dash-dash
• fd29861 fix: prevent launcher option and shell injection (#124)
• 7c19c0a feat: cargo run now shows the exact commands that were tried when opening.
• See full diff in compare view

Updates rust-i18n from 4.1.0 to 4.2.0

Release notes

Sourced from rust-i18n's releases.

v4.2.0

What's Changed

• Add extend! macro to extend crate's translations by @​huacnlee in longbridge/rust-i18n#143

Full Changelog: longbridge/rust-i18n@v4.1.0...v4.2.0

Commits

• 0ac6f61 Version 4.2.0
• a8aadf7 Add extend! macro to extend crate's translations (#143)
• bd315ec Update versions in README (#142)
• See full diff in compare view