Skip to content

chore(deps): Bump the cargo group across 1 directory with 9 updates - #61

Merged
nickamzol merged 1 commit into
mainfrom
dependabot/cargo/cargo-721dc880a6
Aug 13, 2026
Merged

chore(deps): Bump the cargo group across 1 directory with 9 updates#61
nickamzol merged 1 commit into
mainfrom
dependabot/cargo/cargo-721dc880a6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 8 updates in the / directory:

Package From To
bytes 1.10.1 1.11.1
actix-http 3.11.2 3.13.3
astral-tokio-tar 0.6.1 0.6.4
openssl 0.10.74 0.10.81
quinn-proto 0.11.14 0.11.16
rand 0.8.5 0.8.7
rand 0.9.2 0.9.5
rustls-webpki 0.103.7 0.103.14
serde_with 3.17.0 3.22.0

Updates bytes from 1.10.1 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Commits

Updates actix-http from 3.11.2 to 3.13.3

Release notes

Sourced from actix-http's releases.

actix-http: v3.13.3

  • Close idle HTTP/1 keep-alive connections during graceful server shutdown and close active connections after their current request finishes.

actix-http: v3.13.2

  • Fix MessageBody implementation for ByteString to signal completion after yielding its contents. #4177

#4177: actix/actix-web#4177

actix-http: v3.13.1

3.13.1

  • Fix HTTP/1 WebSocket upgrade responses being overwritten with Connection: close when the upgraded request payload remains open. #4115

#4115: actix/actix-web#4115

actix-http: v3.13.0

3.13.0

  • When configured, gracefully close HTTP/1 connections after early responses to unread request bodies. #3967
  • Wake HTTP/1 payload receivers with an incomplete-payload error when the sender is dropped before EOF. #3100
  • Update foldhash dependency to 0.2.

#3967: actix/actix-web#3967 #3100: actix/actix-web#3100

actix-http: v3.12.1

Notice: This release contains a security fix. Users are encouraged to update to this version ASAP.

  • SECURITY: Reject HTTP/1 requests with ambiguous request framing from Content-Length and Transfer-Encoding headers to prevent request smuggling.
  • Encode the HTTP/1 Connection: Upgrade header in Camel-Case when camel-case header formatting is enabled.#3953
  • Fix HeaderMap iterators' len() and size_hint() implementations for multi-value headers.
  • Update rand dependency to 0.10.
  • Update sha1 dependency to 0.11.

#3953: actix/actix-web#3953

actix-http: v3.12.0

  • Minimum supported Rust version (MSRV) is now 1.88.
  • Increase default HTTP/2 flow control window sizes. #3638
  • Expose configuration methods to improve upload throughput. #3638
  • Fix truncated body ending without error when connection closed abnormally. #3067
  • Add config/method for TCP_NODELAY. #3918
  • Do not compress 206 Partial Content responses. #3191
  • Fix lingering sockets and client stalls when responding early to dropped chunked request payloads. #2972

#3638: actix/actix-web#3638 #3067: actix/actix-web#3067 #3918: actix/actix-web#3918

... (truncated)

Commits

Updates astral-tokio-tar from 0.6.1 to 0.6.4

Release notes

Sourced from astral-tokio-tar's releases.

astral-tokio-tar v0.6.4

What's Changed

New Contributors

Full Changelog: astral-sh/tokio-tar@v0.6.2...v0.6.4

v0.6.3

What's Changed

Full Changelog: astral-sh/tokio-tar@v0.6.2...v0.6.3

... (truncated)

Commits
  • 42052ee Bump version to 0.6.4 (#104)
  • 3c4dcd1 Align the release workflow with other Astral projects (#103)
  • ea61e74 Fix nanosecond conversion on 32-bit Unix (#101)
  • ebeb337 Use clear instead of truncate(0) (#102)
  • b6fa50e Bump the github-actions group across 1 directory with 2 updates (#89)
  • 1c72181 Update rustix dependency from 0.38 to 1.0 (#97)
  • 6cd40fe Bump version to 0.6.3 (#96)
  • 97c5c2e Report sparse data positions after continuation headers
  • 5fe6899 Reject empty local PAX values
  • 972c52d Test last-record precedence for PAX owner metadata
  • Additional commits viewable in compare view

Updates openssl from 0.10.74 to 0.10.81

Release notes

Sourced from openssl's releases.

openssl-v0.10.81

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.80...openssl-v0.10.81

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

... (truncated)

Commits
  • db9c9e2 Release openssl 0.10.81 and openssl-sys 0.9.117 (#2655)
  • 3a7fb56 Bump actions/checkout from 6.0.2 to 6.0.3 (#2653)
  • d059c43 Fix verify_mode() panic on unmodeled verify mode bits (#2651)
  • 8b1519e Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string (#2652)
  • d5713d6 add mldsa.h to the boringssl bindgen (#2650)
  • 9fac317 Merge pull request #2538 from ocdlroux/feat/crl-full
  • 4dae20b x509: adding minimal support for X509CrlBuilder
  • 47f7777 Add brainpoolP224r1 and brainpoolP224t1 NID constants (#2642)
  • 659da17 Bump aws-ls-sys to 0.41 (#2640)
  • 35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.14 to 0.11.16

Release notes

Sourced from quinn-proto's releases.

quinn-proto-0.11.16

What's Changed

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

Commits
  • a96949f Take semver-compatible update for anyhow
  • 5429f60 udp: bump version to 0.5.15
  • 262a493 proto: bump version to 0.11.16
  • c19b63a Upgrade rustls-platform-verifier to 0.7
  • aff3652 Disable default features for fastbloom
  • 01b2eee Upgrade fastbloom to 0.17
  • 2c82013 Switch BBR RNG to PCG
  • 544dd9e Upgrade to rand 0.10.1
  • a7499b8 Bump versions for release
  • 7c1970f proto: yield error on too many gaps in assembler
  • Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.8.7

Changelog

Sourced from rand's changelog.

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates rand from 0.9.2 to 0.9.5

Changelog

Sourced from rand's changelog.

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates rustls-webpki from 0.103.7 to 0.103.14

Release notes

Sourced from rustls-webpki's releases.

0.103.13

  • Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
  • For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

  • GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
  • GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correctly provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @​1seal for the report.

What's Changed

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

... (truncated)

Commits

Updates serde_with from 3.17.0 to 3.22.0

Release notes

Sourced from serde_with's releases.

serde_with v3.22.0

Added

  • Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

  • Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

Added

  • Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#943)

Fixed

serde_with v3.19.0

Added

... (truncated)

Commits
  • 88f576a Bump version to 3.22.0 (#991)
  • 931e664 Bump version to 3.22.0
  • e26930e Bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...
  • 92cd5a0 Bump github/codeql-action in the github-actions group
  • 32be66f Guard with_capacity_and_hasher against untrusted size_hint (DoS) (#971)
  • 33871cd Merge branch 'master' into fix/duplicate-key-impls-capacity-overflow
  • bb1e064 Change function position within impl (#968)
  • 202d3dd Improve the time unit macros to remove unnecessary repetition and make the co...
  • b347efb Move the use_duration_signed_ser/*_de macros utils
  • 6590545 chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2
  • Additional commits viewable in compare view

Updates time from 0.3.44 to 0.3.55

Release notes

Sourced from time's releases.

v0.3.55

See the changelog for details.

v0.3.54

See the changelog for details.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.55 [2026-08-01]

Fixed

  • Avoid underflow in DateIter::nth, ensuring correct behavior.
  • Avoid overflow when deserializing timestamps.
  • Handle out-of-bounds data when deserializing.
  • Don't assume that the format being deserialized was generated by the serializer; this previously led to some valid values being parsed incorrectly and others being rejected.
  • No longer silence errors when deserializing UtcOffset.
  • OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.
  • OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.

0.3.54 [2026-07-20]

Added

  • PrimitiveDateTime has been renamed to PlainDateTime.
  • Duration has been renamed to SignedDuration.
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

  • The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

  • More gains when parsing RFC 2822.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result

... (truncated)

Commits
  • 857d9c4 v0.3.55 release
  • 2b72fcd Precise feature gating for macro
  • c1089eb Run check-targets, miri in parallel
  • f377fad Avoid range-validated ordinal => year in cascade
  • 2eacb0a Report miscellaneous tasks, overall status
  • 29621ac Speed up CI
  • 08de7ba Fix nano-timestamp validation
  • 3c3f046 Fix copy-paste error
  • 3c0c81c Cascade errors when deserializing UtcOffset
  • c21acd5 Handle more deserializations of SignedDuration
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yo...

Description has been truncated

@dependabot
chore(deps): Bump the cargo group across 1 directory with 9 updates
7fa71fe 
Bumps the cargo group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bytes](https://github.com/tokio-rs/bytes) | `1.10.1` | `1.11.1` |
| [actix-http](https://github.com/actix/actix-web) | `3.11.2` | `3.13.3` |
| [astral-tokio-tar](https://github.com/astral-sh/tokio-tar) | `0.6.1` | `0.6.4` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.74` | `0.10.81` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.14` | `0.11.16` |
| [rand](https://github.com/rust-random/rand) | `0.8.5` | `0.8.7` |
| [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.9.5` |
| [rustls-webpki](https://github.com/rustls/webpki) | `0.103.7` | `0.103.14` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.17.0` | `3.22.0` |



Updates `bytes` from 1.10.1 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.10.1...v1.11.1)

Updates `actix-http` from 3.11.2 to 3.13.3
- [Release notes](https://github.com/actix/actix-web/releases)
- [Changelog](https://github.com/actix/actix-web/blob/main/CHANGES.md)
- [Commits](actix/actix-web@http-v3.11.2...http-v3.13.3)

Updates `astral-tokio-tar` from 0.6.1 to 0.6.4
- [Release notes](https://github.com/astral-sh/tokio-tar/releases)
- [Changelog](https://github.com/astral-sh/tokio-tar/blob/main/CHANGELOG.md)
- [Commits](astral-sh/tokio-tar@v0.6.1...v0.6.4)

Updates `openssl` from 0.10.74 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.74...openssl-v0.10.81)

Updates `quinn-proto` from 0.11.14 to 0.11.16
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.16)

Updates `rand` from 0.8.5 to 0.8.7
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.7/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.7)

Updates `rand` from 0.9.2 to 0.9.5
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.7/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.7)

Updates `rustls-webpki` from 0.103.7 to 0.103.14
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](https://github.com/rustls/webpki/commits)

Updates `serde_with` from 3.17.0 to 3.22.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.17.0...v3.22.0)

Updates `time` from 0.3.44 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.44...v0.3.55)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: actix-http
  dependency-version: 3.13.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: astral-tokio-tar
  dependency-version: 0.6.4
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-version: 0.10.81
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: quinn-proto
  dependency-version: 0.11.16
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.8.7
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.9.5
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rustls-webpki
  dependency-version: 0.103.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: serde_with
  dependency-version: 3.22.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 13, 2026
@nickamzol
nickamzol merged commit 4950d24 into main Aug 13, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-721dc880a6 branch August 13, 2026 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@nickamzol