build(deps): Bump the cargo-minor-patch group across 1 directory with 7 updates

[dependabot]

Bumps the cargo-minor-patch group with 7 updates in the / directory:

Package	From	To
napi	3.14.0	3.14.2
napi-derive	3.6.11	3.6.12
rmcp	3.5.0	3.5.1
signal-hook	0.4.4	0.4.5
tokio	1.53.1	1.53.2
tree-sitter	0.27.0	0.27.1
zeroize	1.9.0	1.9.1

Updates napi from 3.14.0 to 3.14.2

Release notes

Sourced from napi's releases.

napi-v3.14.2

Fixed

• (napi) register the wasm cleanup through the env cleanup hook (#3571)
• (napi) own NativeBorrowScope storage via NonNull to fix aliasing violation (#3573)
• (napi) bound serde_json::Value conversion depth at 128 levels (#3568)

napi-v3.14.1

Fixed

• (napi) create objects with napi_define_properties on every Node version (#3560)

Commits

• 8bab46e chore: release (#3567)
• 9c49b6c chore(release): publish
• e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
• 44e7911 chore(deps): update dependency @​oxc-node/core to v0.1.3 (#3564)
• 962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
• 469b861 chore(deps): update dependency webdriverio to v10 (#3566)
• 9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
• 8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
• 125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
• a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
• Additional commits viewable in compare view

Updates napi-derive from 3.6.11 to 3.6.12

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.6.12

Other

• update Cargo.toml dependencies

Commits

• 8bab46e chore: release (#3567)
• 9c49b6c chore(release): publish
• e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
• 44e7911 chore(deps): update dependency @​oxc-node/core to v0.1.3 (#3564)
• 962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
• 469b861 chore(deps): update dependency webdriverio to v10 (#3566)
• 9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
• 8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
• 125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
• a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
• See full diff in compare view

Updates rmcp from 3.5.0 to 3.5.1

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.5.1

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.1

Fixed

• (server) keep discover lifecycle bootstrap-neutral (#1248)
• keep handler-generated invalid params errors in-band (#1322)
• (model) export object! macro without macros feature (#1318)
• (server) default missing cache hints for 2026-07-28 peers (#1308)

Other

• [rmcp] Notify credential stores when a refresh token is rejected (#1285)

Commits

• 79437f2 chore: release v3.5.1 (#1307)
• 4a226c7 fix(server): keep discover lifecycle bootstrap-neutral (#1248)
• 931d471 chore(deps): bump the github-actions group with 6 updates (#1313)
• cf1e9aa fix: keep handler-generated invalid params errors in-band (#1322)
• deef9bb fix(model): export object! macro without macros feature (#1318)
• c0d667e fix(server): default missing cache hints for 2026-07-28 peers (#1308)
• 94c5c03 fix: use MSRV-aware dependency resolver (#1316)
• 8f9a28e fix(examples): fix complex auth server discovery (#1309)
• ae2f9c9 [rmcp] Notify credential stores when a refresh token is rejected (#1285)
• bdd93dc ci: reject multi-line codex auth secret (#1306)
• Additional commits viewable in compare view

Updates signal-hook from 0.4.4 to 0.4.5

Changelog

Sourced from signal-hook's changelog.

0.4.5

• pipe::register_raw now really sets close-on-exec (FD_CLOEXEC) on the file descriptor, for both pipes and sockets (#206).
• Removed the 32-bit Android sigemptyset/sigaddset fallback, which panicked in emulate_default_handler (#207). Android below API 21 is no longer supported.

Commits

• 1ee5faa Release 0.4.5
• 2003e57 CI: Check only mio 1.x support on the BSDs
• 5eaf084 signal-hook-mio: Drop redundant mio 0.7 dev-dependency
• f7ceb8a Use square brackets for vec! in tests
• 4c1f6f1 CI: Leave out mio 0.6 from BSD checks and doc link check
• e52500e CI: Make the registry manifest parseable by old cargo
• d3f9239 Allow deprecated std::isize in the registry
• 5e09118 Drop hand-rolled sigset fallback on 32-bit Android
• d12e7d9 Set close-on-exec correctly
• See full diff in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates tree-sitter from 0.27.0 to 0.27.1

Release notes

Sourced from tree-sitter's releases.

v0.27.1

What's Changed

• fix: decode UTF-16 surrogate pairs with input endianness by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5913
• fix(cli)!: fix query test capture range matching across lines by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5918
• fix(rust): address new nightly lints by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5921
• fix(generate): resolve token names in debug output by @​WillLillis in tree-sitter/tree-sitter#5941
• fix(generate): keep GCC jump tables enabled for large lexers by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5985
• fix(generate): exclude external word tokens from keyword extraction by @​WillLillis in tree-sitter/tree-sitter#5989
• fix(lib): check shifted stack versions during error recovery by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5998
• fix(generate): detect indirect recursion in flattened productions by @​WillLillis in tree-sitter/tree-sitter#6003
• fix: preserve column dependency when balancing repeat nodes by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6006
• perf(lib): acquire capture lists from a free stack instead of scanning by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6012
• fix(build): don't compile the Wasm stdlib into Emscripten builds by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6015
• fix: various query issues by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6017
• fix(rust): ban std::fs::canonicalize by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6018
• fix(bindings): load Node bindings under Bun again by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6021
• release v0.27.1 by @​clason in tree-sitter/tree-sitter#6024

Full Changelog: tree-sitter/tree-sitter@v0.27.0...v0.27.1

Commits

• 10eb5ac release v0.27.1
• 1bf93c4 fix(bindings): embed queries in Bun standalone executables
• 2173ca8 fix(bindings): await the load check in the Node binding test
• a89d5b8 fix(bindings): load Node bindings under Bun again
• 17d6c94 fix(bindings): load node-types.json on Windows
• 825b3e4 fix(rust): ban std::fs::canonicalize
• 4eb3973 fix(web): pass the progress callback to the cursor in Query.captures
• 60cdb55 fix(test): give the query timeout tests room to time out
• bdf4e7e fix(lib): charge query cursor work for the states it visits
• dc21d38 fix(lib): halt the query cursor when the progress callback asks to stop
• Additional commits viewable in compare view

Updates zeroize from 1.9.0 to 1.9.1

Commits

• 34a6ebc zeroize v1.9.1 (#1553)
• e68c684 zeroize: test under cargo miri in CI (#1552)
• 4a53d7d Update Cargo.lock (#1545)
• a2b1713 zeroize: fix fallback code used by optimization_barrier (#1551)
• 3c5aa70 ctutils v0.4.3 (#1550)
• 6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
• 29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
• f09945d ci: allow triggering workflows manually (#1543)
• 53493df dit v0.0.1-alpha (#1540)
• c89949d Rename aarch64-dit to dit (#1539)
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T23:08:29.816101Z	23fc72a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.