Repository navigation
build(deps): bump the cargo group with 10 updates - #1398
Merged
Merged
Conversation
Bumps the cargo group with 10 updates: | Package | From | To | | --- | --- | --- | | [async-compression](https://github.com/Nullus157/async-compression) | `0.4.44` | `0.4.46` | | dirs | `6.0.0` | `7.0.0` | | [rustls](https://github.com/rustls/rustls) | `0.23.43` | `0.23.44` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` | | [russh](https://github.com/warp-tech/russh) | `0.63.2` | `0.63.3` | | [smallvec](https://github.com/servo/rust-smallvec) | `1.16.0` | `1.16.1` | | [toml](https://github.com/toml-rs/toml) | `1.1.5+spec-1.1.0` | `1.1.6+spec-1.1.0` | | [toml_edit](https://github.com/toml-rs/toml) | `0.25.13+spec-1.1.0` | `0.25.15+spec-1.1.0` | | [uuid](https://github.com/uuid-rs/uuid) | `1.26.0` | `1.26.1` | | [zstd](https://github.com/gyscos/zstd-rs) | `0.13.3` | `0.14.0` | Updates `async-compression` from 0.4.44 to 0.4.46 - [Release notes](https://github.com/Nullus157/async-compression/releases) - [Commits](Nullus157/async-compression@async-compression-v0.4.44...async-compression-v0.4.46) Updates `dirs` from 6.0.0 to 7.0.0 Updates `rustls` from 0.23.43 to 0.23.44 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.43...v/0.23.44) Updates `reqwest` from 0.13.4 to 0.13.5 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5) Updates `russh` from 0.63.2 to 0.63.3 - [Release notes](https://github.com/warp-tech/russh/releases) - [Commits](Eugeny/russh@v0.63.2...v0.63.3) Updates `smallvec` from 1.16.0 to 1.16.1 - [Release notes](https://github.com/servo/rust-smallvec/releases) - [Commits](smallvec/smallvec@v1.16.0...v1.16.1) Updates `toml` from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0 - [Commits](toml-rs/toml@toml-v1.1.5...toml-v1.1.6) Updates `toml_edit` from 0.25.13+spec-1.1.0 to 0.25.15+spec-1.1.0 - [Commits](toml-rs/toml@v0.25.13...v0.25.15) Updates `uuid` from 1.26.0 to 1.26.1 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.26.0...v1.26.1) Updates `zstd` from 0.13.3 to 0.14.0 - [Release notes](https://github.com/gyscos/zstd-rs/releases) - [Commits](gyscos/zstd-rs@v0.13.3...v0.14.0) --- updated-dependencies: - dependency-name: async-compression dependency-version: 0.4.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: dirs dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: rustls dependency-version: 0.23.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: reqwest dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: russh dependency-version: 0.63.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: smallvec dependency-version: 1.16.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: toml dependency-version: 1.1.6+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: toml_edit dependency-version: 0.25.15+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: uuid dependency-version: 1.26.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: zstd dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
norrietaylor
approved these changes
Sep 16, 2026
norrietaylor
added a commit
that referenced
this pull request
Sep 16, 2026
cargo-deny fails on main: RUSTSEC-2026-0285 (TLS 1.3 handshake messages accepted across encryption level boundaries) is fixed in rustls >= 0.23.45, and the dependabot group bump (#1398) only reached 0.23.44. Lock edit is the version and checksum lines only; 0.23.45 has the same dependency set, so `cargo fetch --locked` accepts it unchanged and `cargo deny check` reports advisories ok. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the cargo group with 10 updates:
0.4.440.4.466.0.07.0.00.23.430.23.440.13.40.13.50.63.20.63.31.16.01.16.11.1.5+spec-1.1.01.1.6+spec-1.1.00.25.13+spec-1.1.00.25.15+spec-1.1.01.26.01.26.10.13.30.14.0Updates
async-compressionfrom 0.4.44 to 0.4.46Release notes
Sourced from async-compression's releases.
Commits
3f2a600chore: release (#484)b22cd69Return UnexpectedEof when deflate64 does not progress (#483)d8c1b47chore: release (#482)9ffc96cchore(deps): update zstd requirement from 0.13 to 0.14 (#481)Updates
dirsfrom 6.0.0 to 7.0.0Updates
rustlsfrom 0.23.43 to 0.23.44Commits
64ad386Bump version to 0.23.441efbf66bogo: remove PostQuantum setupe78162faws-lc-rs: add support for ML-DSA signaturesd880772bogo: extract Options::provider() helper87201d6bogo: force all callers to get provider from Options93657e3server: limit 1.2 certificate requests to 1.2-compatible signature schemesbbd3c9aclient: avoid sending 1.3-only signature schemes if no cipher suites configuredeb57688tls12: require known signature algorithme7a9ceftls12: send illegal_parameter alert for kx signed with wrong algorithm06a546dbogo: take latestUpdates
reqwestfrom 0.13.4 to 0.13.5Release notes
Sourced from reqwest's releases.
Changelog
Sourced from reqwest's changelog.
Commits
de55373v0.13.54d3fe12fix: proxy could use wrong credentials if many matched (#3098)9f06fd2docs: improve description of JSON method (#3082)5bdb2f0perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...ffda263perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...4e9a3c7chore: add pull request template for human-written content17e9bcbchore(deps): upgrade base64 to 0.23 (#3074)221abe9chore: Remove unnecessary clones and a cast (#3071)99996a1fix(error): detect timeouts wrapped in body decode errors (#3064)fc99bd5feat: expose the negotiated TLS version viaTlsInfo(#3067)Updates
russhfrom 0.63.2 to 0.63.3Release notes
Sourced from russh's releases.
Commits
f33baf4v0.63.3c13b259enforce inactivity timeout if even during stalled writesUpdates
smallvecfrom 1.16.0 to 1.16.1Release notes
Sourced from smallvec's releases.
Commits
700e1c3Merge pull request #581 from alejandro-vaz/fix-warningsd3462fcMerge pull request #582 from alejandro-vaz/doc-warning68d3ff7Merge pull request #585 from ryux1/chore/584-bump-1.16.17a062b5chore: bump version to 1.16.1fa87519fix: style formatting1629294fix: style formatting09bc3a8Merge branch 'v1' into fix-warningsdc38f70fix: doc warninge3078b6fix: cargo warningsfadb3b8Merge pull request #557 from bolshoytoster/v1Updates
tomlfrom 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0Commits
572c005chore: Release66d0c53docs: Update changelog07af4e7perf: Reduce allocations in toml_edit parsing and dumping (#1215)0ff90dbperf(display): Write encoded strings directlyefb2536perf(display): Move generated representation strings075c444refactor(display): Consolidate key-path encodingb48f338perf(display): Borrow table keys during document outputc6c1de3perf(parser): Move completed table header keysec90463perf(parser): Borrow input when creating editable documentsd76a48atest: Benchmark rendering generated keys and valuesUpdates
toml_editfrom 0.25.13+spec-1.1.0 to 0.25.15+spec-1.1.0Commits
8e1d5a8chore: Release6098580docs: Update changelog27e33c7perf: reduce allocations dumping array-heavy documents (#1216)e92e2a3perf: Avoid boxed iterators in document outputee351e7test: Benchmark rendering many arrays572c005chore: Release66d0c53docs: Update changelog07af4e7perf: Reduce allocations in toml_edit parsing and dumping (#1215)0ff90dbperf(display): Write encoded strings directlyefb2536perf(display): Move generated representation stringsUpdates
uuidfrom 1.26.0 to 1.26.1Release notes
Sourced from uuid's releases.
Commits
9f92712Merge pull request #910 from uuid-rs/cargo/v1.26.1d4df8f0prepare for 1.26.1 release5613f23Merge pull request #909 from uuid-rs/fix/ts-conversion-overflowfda00ebdon't panic in overflowing Timestamp to SystemTime conversionc82e88cMerge pull request #907 from lenamonj/v7-counter-placementac065a6Align the counter diagram34ec102Seat the v7 counter below the version nibbleUpdates
zstdfrom 0.13.3 to 0.14.0Commits
648acb4Avoid let...else in the seekable callbackse1152c1Bump versions for the next release7caed6eDerive the usual traits on ResetDirectivebf7b1f7Refuse to reuse a context an error may have left undefined1565618Check the target, not the host, for MSVC8315a62Return Ok(0) from Read::read for an empty buffera7cfa93Keep the std gate on the Cursor WriteBuf impl9bf1692Say why the Send and Sync impls hold681bcc3Don't truncate Cursor positions on 32-bit targetsd5a1fddDon't hand out a &mut Seekable from AdvancedSeekableDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions