Repository navigation
build(deps): bump the cargo group across 1 directory with 18 updates - #2230
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps the cargo group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [arbitrary](https://github.com/rust-fuzz/arbitrary) | `1.4.2` | `1.5.0` | | [either](https://github.com/rayon-rs/either) | `1.18.0` | `1.19.0` | | [indoc](https://github.com/dtolnay/indoc) | `2.0.7` | `2.0.8` | | [insta](https://github.com/mitsuhiko/insta) | `1.48.0` | `1.49.0` | | [json-subscriber](https://github.com/mladedav/json-subscriber) | `0.3.0` | `0.3.1` | | [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-rust) | `0.33.0` | `0.33.1` | | [opentelemetry](https://github.com/open-telemetry/opentelemetry-rust) | `0.33.0` | `0.33.1` | | [opentelemetry_sdk](https://github.com/open-telemetry/opentelemetry-rust) | `0.33.0` | `0.33.1` | | [opentelemetry-http](https://github.com/open-telemetry/opentelemetry-rust) | `0.33.0` | `0.33.1` | | [opentelemetry-appender-tracing](https://github.com/open-telemetry/opentelemetry-rust) | `0.33.0` | `0.33.1` | | [proptest](https://github.com/proptest-rs/proptest) | `1.11.0` | `1.12.0` | | [russh](https://github.com/warp-tech/russh) | `0.63.3` | `0.64.1` | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [sha2](https://github.com/RustCrypto/hashes) | `0.11.0` | `0.11.1` | | [smallvec](https://github.com/servo/rust-smallvec) | `1.16.2` | `1.16.3` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.19` | `0.7.20` | | [uuid](https://github.com/uuid-rs/uuid) | `1.27.0` | `1.28.0` | Updates `arbitrary` from 1.4.2 to 1.5.0 - [Changelog](https://github.com/rust-fuzz/arbitrary/blob/main/CHANGELOG.md) - [Commits](rust-fuzz/arbitrary@v1.4.2...v1.5.0) Updates `either` from 1.18.0 to 1.19.0 - [Changelog](https://github.com/rayon-rs/either/blob/main/RELEASES.md) - [Commits](rayon-rs/either@1.18.0...1.19.0) Updates `indoc` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/dtolnay/indoc/releases) - [Commits](dtolnay/indoc@2.0.7...2.0.8) Updates `insta` from 1.48.0 to 1.49.0 - [Release notes](https://github.com/mitsuhiko/insta/releases) - [Changelog](https://github.com/mitsuhiko/insta/blob/master/CHANGELOG.md) - [Commits](mitsuhiko/insta@1.48.0...1.49.0) Updates `json-subscriber` from 0.3.0 to 0.3.1 - [Release notes](https://github.com/mladedav/json-subscriber/releases) - [Changelog](https://github.com/mladedav/json-subscriber/blob/main/CHANGELOG.md) - [Commits](mladedav/json-subscriber@json-subscriber-v0.3.0...json-subscriber-v0.3.1) Updates `opentelemetry-semantic-conventions` from 0.33.0 to 0.33.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-semantic-conventions-0.33.0...opentelemetry-semantic-conventions-0.33.1) Updates `opentelemetry` from 0.33.0 to 0.33.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-0.33.0...opentelemetry-0.33.1) Updates `opentelemetry_sdk` from 0.33.0 to 0.33.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry_sdk-0.33.0...opentelemetry_sdk-0.33.1) Updates `opentelemetry-http` from 0.33.0 to 0.33.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-http-0.33.0...opentelemetry-http-0.33.1) Updates `opentelemetry-appender-tracing` from 0.33.0 to 0.33.1 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-appender-tracing-0.33.0...opentelemetry-appender-tracing-0.33.1) Updates `proptest` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/proptest-rs/proptest/releases) - [Changelog](https://github.com/proptest-rs/proptest/blob/main/CHANGELOG.md) - [Commits](proptest-rs/proptest@v1.11.0...v1.12.0) Updates `russh` from 0.63.3 to 0.64.1 - [Release notes](https://github.com/warp-tech/russh/releases) - [Commits](Eugeny/russh@v0.63.3...v0.64.1) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `sha2` from 0.11.0 to 0.11.1 - [Commits](RustCrypto/hashes@sha2-v0.11.0...sha2-v0.11.1) Updates `smallvec` from 1.16.2 to 1.16.3 - [Release notes](https://github.com/servo/rust-smallvec/releases) - [Commits](smallvec/smallvec@v1.16.2...v1.16.3) Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.2) Updates `tokio-util` from 0.7.19 to 0.7.20 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-util-0.7.19...tokio-util-0.7.20) Updates `uuid` from 1.27.0 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.27.0...v1.28.0) --- updated-dependencies: - dependency-name: arbitrary dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: either dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: indoc dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: insta dependency-version: 1.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: json-subscriber dependency-version: 0.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: opentelemetry-semantic-conventions dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: opentelemetry dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: opentelemetry_sdk dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: opentelemetry-http dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: opentelemetry-appender-tracing dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: proptest dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: russh dependency-version: 0.64.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: sha2 dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: smallvec dependency-version: 1.16.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: tokio-util dependency-version: 0.7.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
Reviewed: 1 finding, none blocking at Address the comments on the diff. Clobber: none: |
| "chacha20 0.10.2", | ||
| "core_detect", | ||
| "num-traits", | ||
| "rand 0.9.5", | ||
| "rand_chacha", | ||
| "rand 0.10.3", |
There was a problem hiding this comment.
LOW · supply-chain · confidence 0.55 · in proptest
The proptest 1.11 -> 1.12 bump is not a routine patch: it transitively adds a sizeable new dependency subtree to the tree — borsh 1.8.1 with borsh-derive and proc-macro-crate (a full derive-driven serialization framework), core_detect, rand 0.10.3 (replacing rand 0.9.5), rand_xorshift 0.5.0, and chacha20 0.10.2, and moves bit-set/bit-vec to 0.11/0.10. None of borsh, borsh-derive, proc-macro-crate or core_detect existed in the base lock. The blast radius is contained — proptest is a dev-dependency of crates/minimald only (the NET-071 proxy property tests) — but the two things a maintainer should eyeball before merge are (1) that cargo-deny's unused-allowed-license = "deny" gate still passes: borsh is Apache-2.0/MIT and fine, while the license of the newly added core_detect crate could not be verified from this sandbox; and (2) that pulling a serialization framework into the dev graph is acceptable. If it is not desired, the proptest bump could be excluded from the group update.
What the reviewer checked
Cargo.lock proptest 1.12.0 deps: "chacha20 0.10.2", "core_detect", "rand 0.10.3"; new packages borsh 1.8.1 / borsh-derive / proc-macro-crate absent from base.
Hand this to an agent
Act on a code-review finding.
File: Cargo.lock
Lines: 5669-5672
Category: supply-chain
Severity: low (reviewer confidence 0.55)
Finding:
The proptest 1.11 -> 1.12 bump is not a routine patch: it transitively adds a sizeable new dependency subtree to the tree — borsh 1.8.1 with borsh-derive and proc-macro-crate (a full derive-driven serialization framework), core_detect, rand 0.10.3 (replacing rand 0.9.5), rand_xorshift 0.5.0, and chacha20 0.10.2, and moves bit-set/bit-vec to 0.11/0.10. None of borsh, borsh-derive, proc-macro-crate or core_detect existed in the base lock. The blast radius is contained — proptest is a dev-dependency of crates/minimald only (the NET-071 proxy property tests) — but the two things a maintainer should eyeball before merge are (1) that cargo-deny's `unused-allowed-license = "deny"` gate still passes: borsh is Apache-2.0/MIT and fine, while the license of the newly added core_detect crate could not be verified from this sandbox; and (2) that pulling a serialization framework into the dev graph is acceptable. If it is not desired, the proptest bump could be excluded from the group update.
First verify this against the code yourself. It is model output and
may be wrong. If it is wrong, or the tradeoff was deliberate, say so
and change nothing.
👍 useful · 👎 noise — react to tell the reviewer. Replying works too, and says more.
| dependencies = [ | ||
| "fastrand", | ||
| "getrandom 0.4.3", | ||
| "getrandom 0.3.4", |
There was a problem hiding this comment.
LOW · supply-chain · confidence 0.55 · in tempfile
Silent change to what executes, worth a deliberate look before merge: the tempfile package entry (same version 3.27.0 and same checksum as the base) now depends on getrandom 0.3.4 where the base lockfile had getrandom 0.4.3. tempfile is used pervasively across the workspace for scratch files, and getrandom is the crate that sources OS entropy (RDRAND / the getrandom syscall), so this downgrades the entropy dependency for a widely-used crate while its version is unchanged. This is almost certainly resolver churn from the same cargo update re-resolution rather than an author decision, and 0.3.4 is a maintained line, so there is likely nothing to fix — but the change is invisible in the update list, and whoever merges should be comfortable that the downgrade is intended. If it is not wanted, pinning or excluding the offending bump would restore 0.4.3.
What the reviewer checked
Cargo.lock:7389 "getrandom 0.3.4", inside the tempfile 3.27.0 entry; base had "getrandom 0.4.3" for the identical tempfile version/checksum.
Hand this to an agent
Act on a code-review finding.
File: Cargo.lock
Lines: 7389-7389
Category: supply-chain
Severity: low (reviewer confidence 0.55)
Finding:
Silent change to what executes, worth a deliberate look before merge: the tempfile package entry (same version 3.27.0 and same checksum as the base) now depends on getrandom 0.3.4 where the base lockfile had getrandom 0.4.3. tempfile is used pervasively across the workspace for scratch files, and getrandom is the crate that sources OS entropy (RDRAND / the getrandom syscall), so this downgrades the entropy dependency for a widely-used crate while its version is unchanged. This is almost certainly resolver churn from the same `cargo update` re-resolution rather than an author decision, and 0.3.4 is a maintained line, so there is likely nothing to fix — but the change is invisible in the update list, and whoever merges should be comfortable that the downgrade is intended. If it is not wanted, pinning or excluding the offending bump would restore 0.4.3.
First verify this against the code yourself. It is model output and
may be wrong. If it is wrong, or the tradeoff was deliberate, say so
and change nothing.
👍 useful · 👎 noise — react to tell the reviewer. Replying works too, and says more.
tokio 1.53.3 deprecates AsyncFd::new as unsound: it cannot prove that the fd stays open and unchanged while the AsyncFd lives (tokio-rs/tokio#8587). With clippy's -D warnings the deprecation fails the build. Both call sites, the PTY master and the tap device, now call AsyncFd::register. Each SAFETY comment states why the fd stays valid: the AsyncFd owns the File, and nothing reaches it to close or replace the fd.
There was a problem hiding this comment.
correctness
minimal-review — approved
Verdict APPROVE — No findings.
security
minimal-review — approved
Verdict APPROVE — No findings.
supply-chain
minimal-review — advisory review
Verdict COMMENT — 1 finding, 1 inline.
Panel: 3 of 3 personas ran (correctness, security, supply-chain).
| [[package]] | ||
| name = "tokio" | ||
| version = "1.53.1" | ||
| version = "1.53.3" |
There was a problem hiding this comment.
LOW · supply-chain · confidence 0.65
The lockfile resolves tokio at 1.53.3, above the 1.53.2 the PR body declares, and that is not a routine patch from a supply-chain standpoint: tokio 1.53.3 deprecates AsyncFd::new as unsound (tokio-rs/tokio#8587), which is what forced the hand-added head commit to switch the SSH daemon's PTY-master and tap paths from AsyncFd::new to unsafe AsyncFd::register. A dependency bump framed as '18 routine updates' thus changed what the daemon executes at two call sites, and the merged lockfile differs from the version the Dependabot description reviewed. A supply-chain reviewer should sign off explicitly that the merged state runs tokio 1.53.3, not the declared 1.53.2, before it is merged as a 'build(deps)' change.
What the reviewer checked
Cargo.lock:7623 version = "1.53.3" (PR body table: tokio 1.53.1 -> 1.53.2); commit a2303e3: 'tokio 1.53.3 deprecates AsyncFd::new as unsound' -> 'Both call sites ... now call AsyncFd::register'.
Hand this to an agent
Act on a code-review finding.
File: Cargo.lock
Lines: 7623-7623
Category: supply-chain
Severity: low (reviewer confidence 0.65)
Finding:
The lockfile resolves tokio at 1.53.3, above the 1.53.2 the PR body declares, and that is not a routine patch from a supply-chain standpoint: tokio 1.53.3 deprecates `AsyncFd::new` as unsound (tokio-rs/tokio#8587), which is what forced the hand-added head commit to switch the SSH daemon's PTY-master and tap paths from `AsyncFd::new` to `unsafe AsyncFd::register`. A dependency bump framed as '18 routine updates' thus changed what the daemon executes at two call sites, and the merged lockfile differs from the version the Dependabot description reviewed. A supply-chain reviewer should sign off explicitly that the merged state runs tokio 1.53.3, not the declared 1.53.2, before it is merged as a 'build(deps)' change.
First verify this against the code yourself. It is model output and
may be wrong. If it is wrong, or the tradeoff was deliberate, say so
and change nothing.
👍 useful · 👎 noise — react to tell the reviewer. Replying works too, and says more.
|
Superseded: this branch predates main's module renames (#2228), so it no longer applies. The same 18 updates, with Norrie's AsyncFd commit carried onto the renamed file, are up as a PR on main; dependabot closes this one when main's Cargo.toml moves. |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
… on main (gominimal#2326) * build(deps): the cargo group bump of gominimal#2230 (russh 0.64.1 and 17 others) on main * fix(minimald): build AsyncFd with tokio's unsafe register tokio 1.53.3 deprecates AsyncFd::new as unsound: it cannot prove that the fd stays open and unchanged while the AsyncFd lives (tokio-rs/tokio#8587). With clippy's -D warnings the deprecation fails the build. Both call sites, the PTY master and the tap device, now call AsyncFd::register. Each SAFETY comment states why the fd stays valid: the AsyncFd owns the File, and nothing reaches it to close or replace the fd. * build(deps): sha2 0.11.1 in the lock, as main has it, after the rebase The group bump's lock still named sha2 0.11.0, which main's sign-in work had moved on from; merged, the lock no longer matched the manifests and the merge queue's --locked builds refused it. --------- Co-authored-by: Norrie Taylor <norrie@minimal.dev>
Bumps the cargo group with 18 updates in the / directory:
1.4.21.5.01.18.01.19.02.0.72.0.81.48.01.49.00.3.00.3.10.33.00.33.10.33.00.33.10.33.00.33.10.33.00.33.10.33.00.33.11.11.01.12.00.63.30.64.11.0.1511.0.1540.11.00.11.11.16.21.16.31.53.11.53.20.7.190.7.201.27.01.28.0Updates
arbitraryfrom 1.4.2 to 1.5.0Changelog
Sourced from arbitrary's changelog.
Commits
9807b59Merge pull request #243 from fitzgen/bump-to-1.5.07a49e61Bump to version 1.5.0aa2802bMerge pull request #242 from drakeo338/claude/241-fixa9f7ca5Update derive_arbitrary to syn 3 and raise MSRV to 1.71cd35bd2Merge pull request #239 from Manishearth/fix-soundness53a651dagent-driven: Fix soundness in try_create_arraydf8afe9Merge pull request #238 from baloo/baloo/push-lopsmyosqnpv15f5c08Bring fix for fully qualified path341a8fdMerge pull request #237 from ngildenhuys/downgrading_msrv_deps9b68ef4ci: adding update commands to downgrade dependencies to fix MSRV testUpdates
eitherfrom 1.18.0 to 1.19.0Changelog
Sourced from either's changelog.
Commits
1e4326dMerge pull request #148 from cuviper/release-1.19.05278988Release 1.19.044a0670Merge pull request #147 from joshtriplett/either-fold-inlineecabe24Add#[inline]to fold functions50d4708Merge pull request #145 from A4-Tacks/is-orf9cbdd3feat: Addis_left_orandis_right_orUpdates
indocfrom 2.0.7 to 2.0.8Release notes
Sourced from indoc's releases.
Commits
79ab4aaRelease 2.0.823804cfTouch up PR 7069d23e5Merge pull request #70 from joshka/joshka/panicdoce769537Add panicdoc macroc75dfaeUpdate ui test suite to nightly-2026-08-128faf6faRaise minimum tested compiler to rust 1.8877d569fUpdate actions/upload-artifact@v6 -> v7615b766Update actions/checkout@v6 -> v78ab5301Lintclippy::from_iter_instead_of_collecthas been removed7d85ef9Raise minimum tested compiler to rust 1.85Updates
instafrom 1.48.0 to 1.49.0Release notes
Sourced from insta's releases.
Changelog
Sourced from insta's changelog.
Commits
5df39ceRelease 1.49.0 (#944)1c28c19Skip the separate doctest run for nextest with--all-targets(#941)064742eBuild cargo-insta for aarch64-unknown-linux-gnu (#942)08b67d9Remove trailing semicolons from macro bodies (#940)06858e1fix: regenerate Cargo.lock to avoid broken rustix 0.37.27 (#939)70be034Serialize unit enum variants used as JSON map keys (#934)54d0b96feat: implement From for SnapshotValue with OsStr (#929)3d62572[fix] Mention INSTA_UPDATE variable in snapshot mismatch errors (#927)1712876ci: run CI on a pinned toolchain via rust-toolchain.toml; fix format-arg lint...Updates
json-subscriberfrom 0.3.0 to 0.3.1Release notes
Sourced from json-subscriber's releases.
Changelog
Sourced from json-subscriber's changelog.
Commits
2443723chore: release v0.3.1 (#47)392c686Implement tracing valuable support (#44)e7d8643ci: fix criterion benchmark usage in CI4219d94chore: fix clippy lint3b9dac4fmt: Exposewith_opentelemetry_ids()for all supported versions (#45)d1e1372Add support fortracing-opentelemetry0.34 (#46)Updates
opentelemetry-semantic-conventionsfrom 0.33.0 to 0.33.1Commits
372ebbcchore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)5582e71docs(logs): polish design doc and fill perf numbers (#3566)7ce1269fix(sdk): log when the periodic metrics reader panics (#3777)b547036fix(prometheus): keep resource labels when scope info is disabled (#3751)e8480dbchore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)0fdfc48feat(proto): Add support for protobuffer descriptor output (#3675)87929d7ci: install markdown-link-check from npm (#3661)ff2ab2ddocs(trace): explain async context propagation (#3759)2595432fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...952bdeefix: accept optional whitespace in TraceState (#3761)Updates
opentelemetryfrom 0.33.0 to 0.33.1Commits
372ebbcchore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)5582e71docs(logs): polish design doc and fill perf numbers (#3566)7ce1269fix(sdk): log when the periodic metrics reader panics (#3777)b547036fix(prometheus): keep resource labels when scope info is disabled (#3751)e8480dbchore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)0fdfc48feat(proto): Add support for protobuffer descriptor output (#3675)87929d7ci: install markdown-link-check from npm (#3661)ff2ab2ddocs(trace): explain async context propagation (#3759)2595432fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...952bdeefix: accept optional whitespace in TraceState (#3761)Updates
opentelemetry_sdkfrom 0.33.0 to 0.33.1Commits
372ebbcchore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)5582e71docs(logs): polish design doc and fill perf numbers (#3566)7ce1269fix(sdk): log when the periodic metrics reader panics (#3777)b547036fix(prometheus): keep resource labels when scope info is disabled (#3751)e8480dbchore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)0fdfc48feat(proto): Add support for protobuffer descriptor output (#3675)87929d7ci: install markdown-link-check from npm (#3661)ff2ab2ddocs(trace): explain async context propagation (#3759)2595432fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...952bdeefix: accept optional whitespace in TraceState (#3761)Updates
opentelemetry-httpfrom 0.33.0 to 0.33.1Commits
372ebbcchore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)5582e71docs(logs): polish design doc and fill perf numbers (#3566)7ce1269fix(sdk): log when the periodic metrics reader panics (#3777)b547036fix(prometheus): keep resource labels when scope info is disabled (#3751)e8480dbchore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)0fdfc48feat(proto): Add support for protobuffer descriptor output (#3675)87929d7ci: install markdown-link-check from npm (#3661)ff2ab2ddocs(trace): explain async context propagation (#3759)2595432fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...952bdeefix: accept optional whitespace in TraceState (#3761)Updates
opentelemetry-appender-tracingfrom 0.33.0 to 0.33.1Commits
372ebbcchore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)5582e71docs(logs): polish design doc and fill perf numbers (#3566)7ce1269fix(sdk): log when the periodic metrics reader panics (#3777)b547036fix(prometheus): keep resource labels when scope info is disabled (#3751)e8480dbchore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)0fdfc48feat(proto): Add support for protobuffer descriptor output (#3675)87929d7ci: install markdown-link-check from npm (#3661)ff2ab2ddocs(trace): explain async context propagation (#3759)2595432fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...952bdeefix: accept optional whitespace in TraceState (#3761)Updates
proptestfrom 1.11.0 to 1.12.0Commits
70cf37dMerge pull request #675 from proptest-rs/prep-1.12729e0ffprepare next releases and fix panic handling28c1fadMerge pull request #664 from Expyron/main5ddd9a4Merge pull request #668 from toddATavail/fix-fork-persisted-failurea6a9ac7Merge pull request #673 from glaziermag/fix-book-deployd57d88bReplacerand_chachawithchacha209411213Deploy the book on pushes to main1719745fix: terminate the fork replay when a persisted failure fails0f55b7atest: a persisted failure in a forked test must be reported4b0594eMerge pull request #669 from proptest-rs/no-fail-fastUpdates
russhfrom 0.63.3 to 0.64.1Release notes
Sourced from russh's releases.
Commits
e5d80a0v0.64.14c30503handle lifetime constraints correctlyc0fe3b1bump pageant4973149v0.64.0bf05d50cleanupa0ded76Support sending custom global requests from the client (#759)e8b2fd3Fix enforce rekey read and time limits (#766)efa9a03Add support hostkeys-prove-00@openssh.com (#767)36fa1bcfix(pageant): trim username padding and handle empty principals (#779)d27ff7eadd t8y2 as a contributor for code (#780)Updates
serde_jsonfrom 1.0.151 to 1.0.154Release notes
Sourced from serde_json's releases.
Commits
20572a6Release 1.0.154a91bfafFix RandomState links in map documentation3c932c0Merge pull request #1333 from razmser/no-std-preserve-order4b2d726Release 1.0.15383335eeTouch up PR 13454b4810aResolve range_plus_one pedantic clippy lint8af71ccMerge pull request #1345 from 00200200/fix-invalid-utf8-error-column452afa2Correct multiline raw UTF-8 error positions and simplify indexingc9f1e3bRelease 1.0.152854fc70Touch up PR 1347Updates
sha2from 0.11.0 to 0.11.1Commits
138dc5aRelease sha2 v0.11.1 (#927)cf01056sha2: fixunsafe_op_in_unsafe_fnlint, bump MSRV to 1.88 (#926)7c59cadUpdate Cargo.lock (#921)f57b947streebog: tweak internal implementation (#925)336611fFixcargo::manual_readmelint (#924)1df8877md2: fixclippy::needless_range_looplint (#923)6075989sha2: fix loading of round constants on AArch64 backends (#922)eadfd90Update Cargo.lock (#913)fa30840blake2 v0.11.0 (#911)f6c786dci: bump the all-deps group across 1 directory with 3 updates (#896)Updates
smallvecfrom 1.16.2 to 1.16.3Release notes
Sourced from smallvec's releases.
Commits
7ad35d2chore: bump version (#723)8aaf33efix: overflow during fuzzy check (#693)c936db1Port new fuzzer to v1 (#678)Updates
tokiofrom 1.53.1 to 1.53.2Release notes
Sourced from tokio's releases.
Commits
ff0c406chore: prepare Tokio v1.53.2 (#8580)a762700Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)ec31a9fchore: prepare Tokio v1.51.5 (#8579)625c851sync: assign semaphore permits before emitting tracing event (#8542)832dd23sync: avoid leaking semaphore permits on tracing panic (#8542)826954async: unlink semaphore waiter before emitting tracing event (#8542)9a47992process: unregister Windows wait before closing child handle (#8564)2fc5972fs: handle integer overflow in buffered relative seek (#8574)85a6d13io: revert "always cleanup AsyncFd registration list on deregister" (#8540)436faa2rt: drop blocking pool mutex before shutting down rejected task (#8562)Updates
tokio-utilfrom 0.7.19 to 0.7.20Commits
5ec9e6bchore: prepare tokio-util v0.7.20 (#8608)afd1b26docs: fix stray braces and broken links in rustdoc (#8605)3eb95a4wasm: use sleep on emscripten without JSPI (#8528)b22c802wasm: link emscripten_promise_await for Emscripten 4.x compatibility (#8528)16b1f9dci: pin libc to 0.2.189 on FreeBSD (#8594)b263675time: clean up stale Err(Invalid) doc and typo (#8590)5d5cd8bMerge 'tokio-1.53.2' into 'master' (#8578)ff0c406chore: prepare Tokio v1.53.2 (#8580)a762700Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)