[dependabot]

Bumps the cargo group with 4 updates in the / directory: toml, toml_edit, zip and odoo-lint.

Updates toml from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0

Commits

• 8ffe3c5 chore: Release
• fa51878 docs: Update changelog
• f8ad91e perf(serde): Reuse key allocations (#1261)
• fe51467 perf(serde): Reuse key allocations
• 7024319 perf(writer): Expand coverage of the fast path (#1259)
• be196a8 perf(writer): Expand coverage of the fast path
• 932704c perf(serde): Pre-allocate serialization buffers (#1258)
• 52b563d perf(serde): Pre-allocate serialization buffers
• e346a79 perff(writer): Add key and string fast paths (#1257)
• ab695e6 perf(writer): Add a fast path for writing string types
• Additional commits viewable in compare view

Updates toml_edit from 0.25.17+spec-1.1.0 to 0.25.18+spec-1.1.0

Commits

• 22ef745 chore: Release
• 8ffe3c5 chore: Release
• fa51878 docs: Update changelog
• f8ad91e perf(serde): Reuse key allocations (#1261)
• fe51467 perf(serde): Reuse key allocations
• 7024319 perf(writer): Expand coverage of the fast path (#1259)
• be196a8 perf(writer): Expand coverage of the fast path
• 932704c perf(serde): Pre-allocate serialization buffers (#1258)
• 52b563d perf(serde): Pre-allocate serialization buffers
• e346a79 perff(writer): Add key and string fast paths (#1257)
• Additional commits viewable in compare view

Updates zip from 9.2.2 to 9.3.0

Release notes

Sourced from zip's releases.

v9.3.0

🚀 Features

• (write) implement TryFrom for PreparedZipFile (#1258)

v9.2.3

🐛 Bug Fixes

• (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

• Replace std:: with core:: where possible (#1253)

Changelog

Sourced from zip's changelog.

9.3.0 - 2026-11-03

🚀 Features

• (write) implement TryFrom<ZipFileBuilder> for PreparedZipFile (#1258)

9.2.3 - 2026-11-03

🚜 Refactor

• Replace most equivalent uses of std:: with core:: (#1253)

Commits

• dcd8d15 chore: release v9.3.0 (#1259)
• 1191ea5 feat(write): implement TryFrom<ZipFileBuilder> for PreparedZipFile (#1258)
• d1f1ed9 chore: release v9.2.3 (#1257)
• 2063fdf refactor: Replace std:: with core:: where possible (#1253)
• eb5373b Merge commit from fork
• f69f96a fix(ci): resolve typos false-positive, fix upath smuggling test, and add Turk...
• e3825a1 Merge commit from fork
• efcf8d0 test: condition tempfile use on cfg(not(miri)) (#1254)
• f73f311 Merge commit from fork
• eac649a chore(deps): update lzma-rust2 requirement from ^0.23.0 to ^0.24.0 (#1252)
• See full diff in compare view

Updates odoo-lint from 0.1.0-alpha.17 to 0.1.0-alpha.20

Release notes

Sourced from odoo-lint's releases.

v0.1.0-alpha.20

New

• odl check --show-fixes: with --fix or --diff, lists the fixes per file and rule, the most frequent first. (#152)

Changed

• PO106 without the module's dependencies on the addons path reports only terms of its code and data files that the template lacks (a new _() message or view label), and offers no fix: the labels of its models may then be wrong, which made every template look outdated. With the dependencies it reports and fixes as before. (#150)

v0.1.0-alpha.19

New

• PO106 pot-outdated (opt-in): reports a module's i18n/<module>.pot that differs from what odl pot writes from its source, with how many terms it lacks and how many the source no longer exports. The fix writes the template; it is unsafe when dependencies are missing from the addons path. odl pot --check as a rule, for the editor and odl check. (#147)

v0.1.0-alpha.18

New

• odl pot writes a module's .pot template without running Odoo: the terms of its Python code, models (labels, help, selections, constraints) and the records its data files create, at 99% parity with OCA's templates on 19.0. --merge updates the module's .po files from it. (#118, #120, #133, #140)
• noqa comments in XML and .po files: <!-- noqa: XML004 --> and # noqa: PO003. (#138)
• odl check --statistics counts the findings per rule, the most frequent first; [*] marks the rules --fix fixes. (#145)
• Colours on a terminal: the path in bold, the code in red. NO_COLOR turns them off; piped output is unchanged. (#145)
• odl rule W83 lists the rules of a code prefix, odl rule 8101 those of a number. (#144)

Changed

• No banner or "No config found" notice by default; -v/--verbose prints the Odoo version source and config, -q/--quiet only the findings. (#128)
• An unknown --select/--ignore selector, or a config select that matches no rule, exits 2 instead of linting nothing. (#128)
• A path that does not exist exits 2; a file odoo-lint does not lint (a README.md) is skipped. (#121)
• With an addons path, odl check warns about a folder that does not exist, one a level too high (the Odoo checkout instead of its addons), and dependencies it cannot find. (#128, #136)

Fixes

From a review of the whole code base. (#121–#126)

• C8116 no longer removes "installable": False (regression in alpha.17).
• W8161's fix no longer rewrites _() in parameter defaults and decorators, where there is no self; its quick fix keeps the import while other calls use it.
• XML023/XML024 fixes no longer corrupt a <field> tag over several lines; XML002 handles a BOM or CRLF.
• odl format keeps whitespace that is alone in an element, and formats stylesheets again.
• PO007 wraps Thai, Devanagari and Arabic as polib does; PO metadata sorts as polib does; PO005 puts merged references one per line (#117).
• exclude and per-file-ignores work from a subdirectory and with a relative --config; ignore = ["ALL"] turns opt-in rules off too; # noqa after a string over several lines covers the line it starts on.
• odl server survives a malformed request and finds references in unsaved files; odl hook reports only the edited file's findings; odl mcp rejects a string where a list is expected; the LSP, hook and editor integrations lint JavaScript.
• Upgrade rules: U1701 keeps the attrs of columns added to a list through an xpath, renames inside nested xpaths go to the right model, version guards on the new name count, U1902 gives no fix for a name Python would mangle.
• ODOO004, ODOO008 and ODOO013 false positives; widgets and OWL templates no longer go stale in the LSP.
• odl check | head no longer panics.

Performance

• Hints about where a missing model or field lives parse only modules that mention it (5.3 s → 0.5 s on a large addons path). (#127)
• The index computes line numbers by index and parses modules and their files in parallel. (#139)

... (truncated)

Commits

• 1e29bef Release 0.1.0-alpha.20 (#153)
• 8cb45ab feat(check): --show-fixes lists the fixes per file and rule (#152)
• 4149d9c docs(roadmap): drop translation templates, which odl pot now writes (#151)
• 9bd70c0 feat(PO106): without the dependencies, report only missing terms of code and ...
• 74c0df3 chore(deps-dev): bump follow-redirects in /integrations/vscode (#149)
• 4877b2b Release 0.1.0-alpha.19 (#148)
• f8d5083 feat(PO106): pot-outdated reports a template that differs from its source (#147)
• 4525cfc Release 0.1.0-alpha.18 (#146)
• 3664fd0 feat(check): colours on a terminal, --statistics (#145)
• 741301e feat(rule): odl rule lists the rules of a code prefix or number (#144)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Benchmark

Tool	cold	warm	no-op
git-aggregate-rs	6.79 s → 6.65 s (-2%)	1.59 s → 1.83 s (+15%)	0.69 s → 0.69 s (-1%)
git-aggregate-rs, 1 job	11.79 s → 11.78 s (-0%)	3.82 s → 3.82 s (-0%)	1.19 s → 1.21 s (+1%)
odx aggregate --locked	6.65 s → 6.64 s (-0%)	1.62 s → 1.68 s (+3%)	0.08 s → 0.08 s (+3%)
odx aggregate --locked, 1 job	11.76 s → 11.77 s (+0%)	3.82 s → 3.82 s (-0%)	0.09 s → 0.09 s (+1%)

Base against this pull request, median of 3 runs on a GitHub runner (4 CPUs), the fixture of docs/benchmarks.md from local mirrors. Not a gate: changes within ±10% (cold) and ±20% (warm, no-op), or of 0.05 s at most, are runner noise; larger ones are in bold.