Thanks to visit codestin.com
Credit goes to github.com

Skip to content

build(deps): bump the cargo group across 1 directory with 8 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/src-tauri/cargo-531927c54f
Open

build(deps): bump the cargo group across 1 directory with 8 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/src-tauri/cargo-531927c54f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown

Bumps the cargo group with 8 updates in the /src-tauri directory:

Package From To
bytes 1.10.1 1.12.1
openssl 0.10.73 0.10.81
quinn-proto 0.11.13 0.11.17
rand 0.8.5 0.8.8
rand 0.9.2 0.9.5
rustls-webpki 0.103.7 0.103.15
serde_with 3.15.0 3.17.0
tar 0.4.44 0.4.46
time 0.3.44 0.3.55

Updates bytes from 1.10.1 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Commits

Updates openssl from 0.10.73 to 0.10.81

Release notes

Sourced from openssl's releases.

openssl-v0.10.81

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.80...openssl-v0.10.81

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

... (truncated)

Commits
  • db9c9e2 Release openssl 0.10.81 and openssl-sys 0.9.117 (#2655)
  • 3a7fb56 Bump actions/checkout from 6.0.2 to 6.0.3 (#2653)
  • d059c43 Fix verify_mode() panic on unmodeled verify mode bits (#2651)
  • 8b1519e Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string (#2652)
  • d5713d6 add mldsa.h to the boringssl bindgen (#2650)
  • 9fac317 Merge pull request #2538 from ocdlroux/feat/crl-full
  • 4dae20b x509: adding minimal support for X509CrlBuilder
  • 47f7777 Add brainpoolP224r1 and brainpoolP224t1 NID constants (#2642)
  • 659da17 Bump aws-ls-sys to 0.41 (#2640)
  • 35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.17

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

Full Changelog: quinn-rs/quinn@quinn-proto-0.11.16...quinn-proto-0.11.17

quinn-proto-0.11.16

What's Changed

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

quinn-proto 0.11.14

@​jxs reported a denial of service issue in quinn-proto 5 days ago:

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

Commits
  • 0343120 proto: bump version to 0.11.17
  • d7bf3d0 Limit total memory used to buffer outgoing datagrams
  • 31ca5d2 Limit total memory used to buffer incoming datagrams
  • 3a78b60 Factor out DatagramBuffer for queues in either direction
  • b37ced3 proto: check limits when processing already retired CIDs
  • 6a984b8 proto: extract method for checking CID retirements
  • 499dba8 proto: bound assembler chunk count regardless of over-allocation
  • 33ce0c2 congestion: saturate CUBIC window increment to avoid overflow
  • c8ad7e6 fix(ci): fix clippy lints
  • a96949f Take semver-compatible update for anyhow
  • Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.8.8

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

  • Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates rand from 0.9.2 to 0.9.5

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

  • Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates rustls-webpki from 0.103.7 to 0.103.15

Release notes

Sourced from rustls-webpki's releases.

v/0.103.15

Fixes docs.rs build errors.

What's Changed

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.14..v/0.103.15

v/0.103.14

What's Changed

Full Changelog: rustls/webpki@v/0.103.13...v/0.103.14

0.103.13

  • Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
  • For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

  • GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
  • GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

0.103.10

... (truncated)

Commits
  • c14836d Cargo: version 0.103.14 -> 0.103.15
  • 5c92308 Cargo: avoid all-features in docs.rs
  • 10a1514 Mark ML-DSA algorithms as FIPS submitted
  • 14cbaa1 Bump version to 0.103.14
  • cbb868a Support stable ML-DSA with aws-lc-rs
  • c782fd1 Update to aws-lc-rs 1.18
  • b250e31 Upgrade to base64 0.23
  • 99115b2 ci: sync cargo-check-external-types nightly
  • a82bfae crl: fix clippy::question_mark finding
  • 2879b2c Prepare 0.103.13
  • Additional commits viewable in compare view

Updates serde_with from 3.15.0 to 3.17.0

Release notes

Sourced from serde_with's releases.

serde_with v3.17.0

Added

  • Support OneOrMany with smallvec v1 (#920, #922)

Changed

  • Switch to yaml_serde for a maintained yaml dependency by @​kazan417 (#921)
  • Bump MSRV to 1.82, since that is required for yaml_serde dev-dependency.

serde_with v3.16.1

Fixed

  • Fix JsonSchemaAs of SetPreventDuplicates and SetLastValueWins. (#906, #907)

serde_with v3.16.0

Added

serde_with v3.15.1

Fixed

  • Fix building of the documentation by updating references to use serde_core.
Commits
  • 4031878 Bump version to v3.17.0 (#924)
  • 204ae56 Bump version to v3.17.0
  • 7812b5a serde_yaml 0.9 to yaml_serde 0.10 (#921)
  • 614bd89 Bump MSRV to 1.82 as required by yaml_serde
  • 518d0ed Suppress RUSTSEC-2026-0009 since we don't have untrusted time input in tests ...
  • a6579a8 Suppress RUSTSEC-2026-0009 since we don't have untrusted time input in tests
  • 9d4d069 Implement OneOrMany for smallvec_1::SmallVec (#922)
  • fc78243 Add changelog
  • 2b8c30b Implement OneOrMany for smallvec_1::SmallVec
  • 2d9b9a1 Carg.lock update
  • Additional commits viewable in compare view

Updates tar from 0.4.44 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits
  • fc459c1 Release 0.4.46
  • 43e05a8 ci: Add crates.io trusted publishing workflow
  • bba5666 Update repo links
  • cd94c46 docs: Document TOCTOU / concurrent-mutation threat model
  • 1b4997c builder: Expand docs for follow_symlinks and append_dir_all
  • bab14dd archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm)
  • 2349b49 Add support of absolute paths
  • 39d0311 Update some links
  • 59d803e Update astral-tokio-tar requirement from 0.5 to 0.6
  • 8296b9a ci: Fix and re-enable reverse dependency testing (#444)
  • Additional commits viewable in compare view

Updates time from 0.3.44 to 0.3.55

Release notes

Sourced from time's releases.

v0.3.55

See the changelog for details.

v0.3.54

See the changelog for details.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.55 [2026-08-01]

Fixed

  • Avoid underflow in DateIter::nth, ensuring correct behavior.
  • Avoid overflow when deserializing timestamps.
  • Handle out-of-bounds data when deserializing.
  • Don't assume that the format being deserialized was generated by the serializer; this previously led to some valid values being parsed incorrectly and others being rejected.
  • No longer silence errors when deserializing UtcOffset.
  • OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.
  • OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.

0.3.54 [2026-07-20]

Added

  • PrimitiveDateTime has been renamed to PlainDateTime.
  • Duration has been renamed to SignedDuration.
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

  • The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

  • More gains when parsing RFC 2822.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result

... (truncated)

Commits
  • 857d9c4 v0.3.55 release
  • 2b72fcd Precise feature gating for macro
  • c1089eb Run check-targets, miri in parallel
  • f377fad Avoid range-validated ordinal => year in cascade
  • 2eacb0a Report miscellaneous tasks, overall status
  • 29621ac Speed up CI
  • 08de7ba Fix nano-timestamp validation
  • 3c3f046 Fix copy-paste error
  • 3c0c81c Cascade errors when deserializing UtcOffset
  • c21acd5 Handle more deserializations of SignedDuration
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the cargo group across 1 directory with 8 updates
b490e0f 
Bumps the cargo group with 8 updates in the /src-tauri directory:

| Package | From | To |
| --- | --- | --- |
| [bytes](https://github.com/tokio-rs/bytes) | `1.10.1` | `1.12.1` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.73` | `0.10.81` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.13` | `0.11.17` |
| [rand](https://github.com/rust-random/rand) | `0.8.5` | `0.8.8` |
| [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.9.5` |
| [rustls-webpki](https://github.com/rustls/webpki) | `0.103.7` | `0.103.15` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.15.0` | `3.17.0` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.44` | `0.4.46` |
| [time](https://github.com/time-rs/time) | `0.3.44` | `0.3.55` |



Updates `bytes` from 1.10.1 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.10.1...v1.12.1)

Updates `openssl` from 0.10.73 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.73...openssl-v0.10.81)

Updates `quinn-proto` from 0.11.13 to 0.11.17
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.13...quinn-proto-0.11.17)

Updates `rand` from 0.8.5 to 0.8.8
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.8/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.8)

Updates `rand` from 0.9.2 to 0.9.5
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.8/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.8)

Updates `rustls-webpki` from 0.103.7 to 0.103.15
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.7...v/0.103.15)

Updates `serde_with` from 3.15.0 to 3.17.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.15.0...v3.17.0)

Updates `tar` from 0.4.44 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.44...0.4.46)

Updates `time` from 0.3.44 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.44...v0.3.55)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-version: 0.10.81
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: quinn-proto
  dependency-version: 0.11.17
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.8.8
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.9.5
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rustls-webpki
  dependency-version: 0.103.15
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: serde_with
  dependency-version: 3.17.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants