deps: bump the production-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: clap, regex and tree-sitter.

Updates clap from 4.6.1 to 4.6.4

Release notes

Sourced from clap's releases.

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Commits

• 87ec1ad chore: Release
• 78f2529 docs: Update changelog
• b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
• 74c6666 fix(complete): Keep zsh candidate order
• d142d8f Merge pull request #6360 from epage/string
• ba89563 style: Prefer explicit string operations
• bea966e Merge pull request #6359 from epage/man
• b811986 chore(man):Remove unused required-features
• 0010bf2 Merge pull request #6358 from clap-rs/renovate/crate-ci-typos-1.x
• bab9b24 chore(deps): Update compatible (dev) (#6357)
• Additional commits viewable in compare view

Updates regex from 1.12.3 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

• #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes

... (truncated)

Commits

• 2b52759 1.13.1, redux
• 40e9823 1.13.1
• 75fcb96 changelog: 1.13.1
• 64ad0b6 automata: fix bug in reverse suffix/inner optimization
• fa91c31 automata: fix a bug caught by Codex review
• 30390ec automata: formatting tweaks
• 821a8eb automata: refactor reverse suffix/inner search slightly
• 10afd70 automata: expose the extracted literals for inner literal extraction
• 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
• 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
• Additional commits viewable in compare view

Updates tree-sitter from 0.26.9 to 0.26.11

Release notes

Sourced from tree-sitter's releases.

v0.26.11

What's Changed

• fix(deps): zig manifest for wasmtime is missing windows hashes by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5720
• fix(xtask): eliminate silent errors in zig fetch by @​WillLillis in tree-sitter/tree-sitter#5724
• fix(query): short-circuit longest-match dedup for disjoint states by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5726
• fix(query): various anchor fixes by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5727
• Fix C++ compilation errors in array macros. by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5735
• fix(rust): address new clippy lints by @​WillLillis in tree-sitter/tree-sitter#5743
• fix(generate): strip non-ASCII case folds by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5744
• fix(ci): re-set executable permission on release artifacts before zipping by @​clason in tree-sitter/tree-sitter#5746
• release v0.26.11 by @​clason in tree-sitter/tree-sitter#5748

Full Changelog: tree-sitter/tree-sitter@v0.26.10...v0.26.11

v0.26.10

What's Changed

• fix(lib): update doc comment for ts_parser_parse by @​WillLillis in tree-sitter/tree-sitter#5642
• fix(lib): use correct TREE_SITTER_HIDE_SYMBOLS macro name in alloc.h by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5643
• fix(cli): improve soundness of cst range calculation by @​WillLillis in tree-sitter/tree-sitter#5650
• fix(lib): Consider subtree lookahead bytes when determining whether the parser can reuse a node. by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5656
• fix(cli): display warning to user if parser test corpus dir isn't found by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5669
• fix: add DESCRIPTION to grammar Makefile template by @​WillLillis in tree-sitter/tree-sitter#5672
• fix(cli): infinite loop in highlight test by @​WillLillis in tree-sitter/tree-sitter#5674
• fix(lib): address strict aliasing violations in TreeCursor type by @​WillLillis in tree-sitter/tree-sitter#5693
• build(deps): bump wasmtime-c-api to v36.0.12 by @​clason in tree-sitter/tree-sitter#5709
• fix(dsl): forbid invalid field names by @​WillLillis in tree-sitter/tree-sitter#5710
• Fix issues with queries matching a parent node with anchored children (siblings) by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5712
• test(query): regression test for anchored siblings inside a parent by @​tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5716
• release v0.26.10 by @​WillLillis in tree-sitter/tree-sitter#5717

Full Changelog: tree-sitter/tree-sitter@v0.26.9...v0.26.10

Commits

• 64402de release v0.26.11
• 2194ac1 fix(ci): re-set executable permission on release artifacts before zipping
• a2b8369 fix(generate): strip non-ASCII case folds
• 1ae3cc5 fix(rust): address new clippy lints
• 90dd1a0 fix(templates): generated array macros do not compile with C++
• fa6222a docs(queries): clarify behavior of first child anchor example
• 77b741b docs(queries): specify anchor behavior with quantifiers and groups
• 1c21ff3 fix(query): apply a trailing anchor when its optional node is skipped
• 5756ced fix(query): make an anchor after a zero-matched quantifier vacuous
• eca86a7 fix(query): forbid an anchor at the end of a group
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d7f013d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
cargo/clap	4.6.4	🟢 5.6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 2 Found 4/17 approved changesets -- score normalized to 2 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/clap_builder	4.6.2	🟢 5.6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 2 Found 4/17 approved changesets -- score normalized to 2 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/clap_derive	4.6.4	🟢 5.6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 2 Found 4/17 approved changesets -- score normalized to 2 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/regex	1.13.1	🟢 6.5	Details Check Score Reason Code-Review 🟢 3 Found 6/19 approved changesets -- score normalized to 3 Maintained 🟢 10 28 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/regex-automata	0.4.16	🟢 6.5	Details Check Score Reason Code-Review 🟢 3 Found 6/19 approved changesets -- score normalized to 3 Maintained 🟢 10 28 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/regex-syntax	0.8.11	🟢 6.5	Details Check Score Reason Code-Review 🟢 3 Found 6/19 approved changesets -- score normalized to 3 Maintained 🟢 10 28 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Fuzzing 🟢 10 project is fuzzed Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/syn	3.0.3	🟢 5.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/19 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 3 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
cargo/tree-sitter	0.26.11	🟢 3.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Security-Policy ⚠️ 0 security policy file not detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• Cargo.lock