Skip to content

chore(deps): bump the rust-major-dependencies group across 1 directory with 7 updates#526

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/apps/desktop/src-tauri/rust-major-dependencies-922f89e32e
Closed

chore(deps): bump the rust-major-dependencies group across 1 directory with 7 updates#526
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/apps/desktop/src-tauri/rust-major-dependencies-922f89e32e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the rust-major-dependencies group with 7 updates in the /apps/desktop/src-tauri directory:

Package From To
sqlx 0.8.6 0.9.0
rmcp 1.7.0 2.2.0
sha2 0.10.9 0.11.0
velopack 0.0.1589-ga2c5a97 1.2.110-ge826545
windows 0.58.0 0.62.2
windows-core 0.61.2 0.62.2
zip 2.4.2 8.6.0

Updates sqlx from 0.8.6 to 0.9.0

Changelog

Sourced from sqlx's changelog.

0.9.0 - 2026-05-06

Important Announcements

New Github Organization

Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization: https://github.com/transact-rs/

This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been informally transferred to the collective ownership of its principal authors. Moving the repository to a new organization makes this change more clear, and also allows for potentially inviting outside collaborators.

Cargo.lock Removed from Tracking

The Cargo.lock has been removed from tracking in Git. CI should now always test with the latest versions of all dependencies by default, alongside our pass that checks with cargo generate-lockfile -Z minimal-versions.

This should eliminate the need for any PRs that update dependencies to also update Cargo.lock or contend with an endless stream of merge conflicts against it.

N.B. cargo install --locked sqlx-cli will no longer work. However, cargo install sqlx-cli has always used the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran cargo update sporadically, so relying on SQLx's lockfile offered few guarantees anyway.

See [the manual page for cargo install][man-cargo-install] for details.

Breaking

As per our MSRV policy, the supported Rust version for this release cycle is 1.94.0.

  • [#3383]: feat: create sqlx.toml format [[@​abonander]]
    • SQLx and sqlx-cli now support per-crate configuration files (sqlx.toml)
    • New functionality includes, but is not limited to:
      • Rename DATABASE_URL for a crate (for multi-database workspaces)
      • Set global type overrides for the macros (supporting custom types)
      • Rename or relocate the _sqlx_migrations table (for multiple crates using the same database)
      • Set characters to ignore when hashing migrations (e.g. ignore whitespace)
    • More to be implemented in future releases.
    • Enable feature sqlx-toml to use.
      • sqlx-cli has it enabled by default, but sqlx does not.
      • Default features of library crates can be hard to completely turn off because of [feature unification], so it's better to keep the default feature set as limited as possible. [This is something we learned the hard way.][preferred-crates]
    • Guide: see sqlx::_config module in documentation.
    • Reference: [Link]
    • Examples (written for Postgres but can be adapted to other databases; PRs welcome!):
      • Multiple databases using DATABASE_URL renaming and global type overrides: [Link]
      • Multi-tenant database using _sqlx_migrations renaming and multiple schemas: [Link]
      • Force use of chrono when time is enabled (e.g. when using tower-sessions-sqlx-store): [[Link][preferred-crates]]
        • Forcing bigdecimal when rust_decimal is enabled is also shown, but problems with chrono/time are more common.

... (truncated)

Commits
  • 75bc048 Release 0.9.0 (#4256)
  • 6956cef Prefer to give real data to .bind() in README.md (#4257)
  • 45ba990 Add the possibility to skip migrations (#3846)
  • 66533fa Ensure Deterministic Migration Order (#4136)
  • db47fe3 ci: check direct minimal versions (#4173)
  • 9ecb76d Unescape PostgreSQL passfile password (#3993)
  • c0a3218 breaking(any+mysql): correctly convert text and blob types to AnyTypeInfo (...
  • d82b781 test(sqlite): add regression test for ORDER BY + LIMIT nullability (#4223)
  • b77ba16 chore: update to axum 0.8 (#4253)
  • c0ec9c0 fix(tls): potential deadlock in StdSocket::poll_ready() (#4251)
  • Additional commits viewable in compare view

Updates rmcp from 1.7.0 to 2.2.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v2.2.0

Added

  • [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

  • fill missing fully qualified syntax in prompt_handler macros (#866)

Other

  • align README examples with v2 model API (#928)

rmcp-v2.2.0

Added

  • reject auth servers lacking S256 PKCE support (#955)

Fixed

  • pass client conformance suite (#960)
  • don't respond to cancelled requests (#957)
  • fail orphaned streamable HTTP responses on reinit (#914)
  • address 2025-11-25 conformance audit findings (#951)

rmcp-macros-v2.1.0

Added

  • [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

  • fill missing fully qualified syntax in prompt_handler macros (#866)

Other

  • align README examples with v2 model API (#928)

rmcp-v2.1.0

Added

  • add SEP-414 trace context meta accessors (#910)
  • add SEP-2575 meta helpers (#942)

Fixed

  • (transport) make AsyncRwTransport::receive cancel-safe (#941) (#947)
  • (auth) preserve refresh_token when refresh response omits it (#949)
  • block redirect header leaks (#936)
  • don't respond to unparsable messages (#940)

... (truncated)

Commits
  • 5195776 chore: release v2.2.0 (#953)
  • 6dd7b85 chore(deps): update p256 requirement from 0.13 to 0.14 (#959)
  • a037935 fix: pass client conformance suite (#960)
  • dbda50c fix: don't respond to cancelled requests (#957)
  • 45f2f72 fix: fail orphaned streamable HTTP responses on reinit (#914)
  • 95490fa feat: reject auth servers lacking S256 PKCE support (#955)
  • bdf0c32 fix: address 2025-11-25 conformance audit findings (#951)
  • 8e44af4 chore: release v2.1.0 (#950)
  • 4833ec7 fix(transport): make AsyncRwTransport::receive cancel-safe (#941) (#947)
  • 5837e22 fix(auth): preserve refresh_token when refresh response omits it (#949)
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates velopack from 0.0.1589-ga2c5a97 to 1.2.110-ge826545

Release notes

Sourced from velopack's releases.

1.2.110-ge826545

What's Changed

New Contributors

Dependency Updates

... (truncated)

Commits
  • e826545 Wait for install dir to be unlocked before MSI uninstall in test
  • a1a293f Fix remaining clippy useless_borrows_in_formatting in linux/osx code
  • 809b8d0 Fix clippy useless_borrows_in_formatting errors from Rust 1.97
  • e58ad1d Make Velopack Flow commands visible in the vpk CLI
  • 8ad0724 Use Velopack Flow as the update source when none is provided
  • f6d82b9 Fix crate docs example passing Box<UpdateInfo> to apply_updates_and_restart
  • 732549c Apply Setup.exe channel override before install hooks and app launch
  • b46484a Add Windows installer channel-override tag readers
  • b8be79c Lock file maintenance
  • c3fd772 Update dotnet packages
  • Additional commits viewable in compare view

Updates windows from 0.58.0 to 0.62.2

Commits

Updates windows-core from 0.61.2 to 0.62.2

Release notes

Sourced from windows-core's releases.

62

New crates in this release

  • The windows-collections crate defines the Windows collection types like IIterable<T>, IVector<T>, IMap<K, V>, and so on (#3483). It also includes all of the stock implementations for creating such collections (#2346, #2350, #2353). This allows these collections to be used without requiring a dependency on the larger windows crate. This crate also provides an optimized implementation of the standard Iterator trait for the Windows IIterator<T> interface (#3476).

  • The windows-future crate defines the Windows async types like IAsyncAction, IAsyncOperation<T>, and so on (#3490). It also includes all of the stock implementations for creating such async types (#3221, #3235). This allows these async types to be used without requiring a dependency on the larger windows crate.

  • The windows-link crate provides linker support for Windows (#3450). This is the evolution of the older windows-targets crate but is substantially simpler and more versatile thanks to advances in the Rust compiler since the windows-targets crate was unveiled. Notably, it does not depend on or insert any import libs and can be used with custom libraries, not only those provided by the Windows operating system. All of the crates, with the exception of windows-sys, now depend on the new windows-link crate instead of the older windows-targets crate. This greatly simplifies compilation and also greatly reduces the size of dependencies as the windows-link crate is tiny. The windows-bindgen crate defaults to windows-link but also adds the --link option to override this as needed. You may for example want to use --link windows_targets if you need to stick with the windows-targets crate if you cannot change your MSRV to Rust 1.71 or later as that was the first version to stabilize raw-dylib for all Windows targets. This then lets you continue to use windows-bindgen until you are ready to move to a newer version of Rust.

  • The windows-numerics crate defines the Windows numeric types to support graphics-oriented math APIs and calculations (#3488). It also also includes all of the stock implementations for overloaded operators and other transformations. This allows these numeric types to be used without requiring a dependency on the larger windows crate.

Major updates to existing crates

  • The windows-bindgen crate provides a number of improvements including new diagnostics (#3498), streamlined and more capable reference support (#3497, #3492), hardened method overloading (#3477), far fewer transmute calls, as well as many other critical fixes and improvements.

  • The windows-core crate is largely unchanged but required some breaking changes to support windows-bindgen type system improvements.

  • The windows-registry crate continues to improve with generalized support for access rights (#3482), open options (#3461), and other minor improvements.

  • The windows crate now delegates to the windows-numerics, windows-future, and windows-collections crates for those types, as well as a number of critical fixes and improvements to features and cfg guards (#3431), and many other small improvements.

Minor updates to existing crates

  • The windows-result now includes the BOOL type (#3441) as a core type. This allows this ubiquitous type to be used without requiring a dependency on the larger windows crate.

  • The windows-strings crate now depends on the new windows-link crate instead of the older windows-targets crate.

  • The windows-version crate now depends on the new windows-link crate instead of the older windows-targets crate.

  • The cppwinrt crate includes minor improvements to improve build reliability.

What's Changed

... (truncated)

Commits

Updates zip from 2.4.2 to 8.6.0

Release notes

Sourced from zip's releases.

v8.6.0

🚀 Features

  • add compression not supported as enum error (#774)

🐛 Bug Fixes

  • allow for [u8] as filename (#775)

🚜 Refactor

  • mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
  • use and simplify is_dir (#776)

v8.5.1

🚜 Refactor

  • change magic finder to stack buffer (#763)
  • simplify extra field parsing (#764)

v8.5.0

🐛 Bug Fixes

  • remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

  • remove useless magic in struct (#730)
  • change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

  • cleanup README (#758)

v8.4.0

🚀 Features

  • add a check for building benches (#748)

🚜 Refactor

  • split part of read.rs for code readability (#744)
  • remove unused allow (#745)

⚡ Performance

  • skip BufReader for Stored files in make_reader (#739)

⚙️ Miscellaneous Tasks

... (truncated)

Changelog

Sourced from zip's changelog.

8.6.0 - 2026-04-25

🚀 Features

  • add compression not supported as enum error (#774)

🐛 Bug Fixes

  • allow for [u8] as filename (#775)

🚜 Refactor

  • mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
  • use and simplify is_dir (#776)

8.5.1 - 2026-04-06

🚜 Refactor

  • change magic finder to stack buffer (#763)
  • simplify extra field parsing (#764)

8.5.0 - 2026-04-01

🐛 Bug Fixes

  • remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

  • remove useless magic in struct (#730)
  • change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

  • cleanup README (#758)

8.4.0 - 2026-03-23

🚀 Features

  • add a check for building benches (#748)

🚜 Refactor

  • split part of read.rs for code readability (#744)
  • remove unused allow (#745)

⚡ Performance

... (truncated)

Commits
  • 771dfc5 chore: release v8.6.0 (#781)
  • 8e480cc chore(deps): update sha1 requirement from 0.10 to 0.11 (#767)
  • 2513bbe chore(deps): update aes requirement from 0.8 to 0.9 (#787)
  • 957e240 ci(deps): bump actions/cache from 5.0.4 to 5.0.5 (#786)
  • 0329d9d fix: allow for [u8] as filename (#775)
  • ddcf854 ci(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#788)
  • 42323a8 ci(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 (#785)
  • 901014a ci(deps): bump crate-ci/typos from 1.45.0 to 1.45.1 (#784)
  • 07702d4 feat: add compression not supported as enum error (#774)
  • 2d0c46b ci(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#783)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 17, 2026
@github-actions github-actions Bot added the area:tauri Tauri shell or desktop runtime changes label Jul 17, 2026
@hiqiancheng

hiqiancheng commented Jul 17, 2026

Copy link
Copy Markdown
Collaborator

Review: do not merge yet

Rust major group is red on CI (Rust Checks, CodeQL rust, E2E).

Notable majors:

  • sqlx 0.8 → 0.9
  • rmcp 1 → 2
  • windows / windows-core 0.58/0.61 → 0.62
  • zip 2 → 8
  • velopack pre-1 → 1.x
  • sha2 0.10 → 0.11

Example compile break already seen: SseStream::from_bytes_stream missing under the new stack — needs code migration, not a lockfile-only bump.

Recommendation: handle as dedicated migration PR(s), not Dependabot auto-merge.

@dependabot dependabot Bot changed the title chore(deps): bump the rust-major-dependencies group in /apps/desktop/src-tauri with 7 updates chore(deps): bump the rust-major-dependencies group across 1 directory with 7 updates Jul 17, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/apps/desktop/src-tauri/rust-major-dependencies-922f89e32e branch from 8a06c38 to 61390f0 Compare July 17, 2026 14:26
@dependabot
chore(deps): bump the rust-major-dependencies group across 1 director…
3134220 
…y with 7 updates

Bumps the rust-major-dependencies group with 7 updates in the /apps/desktop/src-tauri directory:

| Package | From | To |
| --- | --- | --- |
| [sqlx](https://github.com/launchbadge/sqlx) | `0.8.6` | `0.9.0` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `1.7.0` | `2.2.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [velopack](https://github.com/velopack/velopack) | `0.0.1589-ga2c5a97` | `1.2.110-ge826545` |
| [windows](https://github.com/microsoft/windows-rs) | `0.58.0` | `0.62.2` |
| [windows-core](https://github.com/microsoft/windows-rs) | `0.61.2` | `0.62.2` |
| [zip](https://github.com/zip-rs/zip2) | `2.4.2` | `8.6.0` |



Updates `sqlx` from 0.8.6 to 0.9.0
- [Changelog](https://github.com/transact-rs/sqlx/blob/main/CHANGELOG.md)
- [Commits](transact-rs/sqlx@v0.8.6...v0.9.0)

Updates `rmcp` from 1.7.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v1.7.0...rmcp-v2.2.0)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `velopack` from 0.0.1589-ga2c5a97 to 1.2.110-ge826545
- [Release notes](https://github.com/velopack/velopack/releases)
- [Commits](velopack/velopack@0.0.1589-ga2c5a97...1.2.110-ge826545)

Updates `windows` from 0.58.0 to 0.62.2
- [Release notes](https://github.com/microsoft/windows-rs/releases)
- [Commits](https://github.com/microsoft/windows-rs/commits)

Updates `windows-core` from 0.61.2 to 0.62.2
- [Release notes](https://github.com/microsoft/windows-rs/releases)
- [Commits](https://github.com/microsoft/windows-rs/commits)

Updates `zip` from 2.4.2 to 8.6.0
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v2.4.2...v8.6.0)

---
updated-dependencies:
- dependency-name: rmcp
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-major-dependencies
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-major-dependencies
- dependency-name: sqlx
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-major-dependencies
- dependency-name: velopack
  dependency-version: 1.2.110-ge826545
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-major-dependencies
- dependency-name: windows
  dependency-version: 0.62.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-major-dependencies
- dependency-name: windows-core
  dependency-version: 0.62.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-major-dependencies
- dependency-name: zip
  dependency-version: 8.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-major-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/apps/desktop/src-tauri/rust-major-dependencies-922f89e32e branch from 61390f0 to 3134220 Compare July 17, 2026 14:31
@hiqiancheng

hiqiancheng commented Jul 17, 2026

Copy link
Copy Markdown
Collaborator

Closing for now.

Rust major group is red (Rust Checks / CodeQL / E2E) and includes breaking upgrades (sqlx 0.9, rmcp 2, windows 0.62, zip 8, velopack 1.x, sha2 0.11). Needs a dedicated migration PR, not a Dependabot lockfile bump.

@dependabot @github

dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/apps/desktop/src-tauri/rust-major-dependencies-922f89e32e branch July 17, 2026 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area:tauri Tauri shell or desktop runtime changes dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hiqiancheng