Skip to content

chore(deps): bump the cargo group across 2 directories with 7 updates#3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-3b6ca7defd
Open

chore(deps): bump the cargo group across 2 directories with 7 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-3b6ca7defd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026

Copy link
Copy Markdown

Bumps the cargo group with 4 updates in the / directory: serde_yml, jsonwebtoken, tar and russh.
Bumps the cargo group with 2 updates in the /e2e/rust directory: serde_yml and rand.

Updates serde_yml from 0.0.12 to 0.0.13

Release notes

Sourced from serde_yml's releases.

v0.0.13 — Final release (deprecation shim, RUSTSEC-2025-0068 fixed)

⚠️ Final release — serde_yml is deprecated

This is the final maintenance release of serde_yml. The crate is no longer under active development. 0.0.13 is a thin compatibility shim that lets existing call sites keep compiling while you migrate to one of the maintained alternatives listed below.

If you are reading this because cargo audit flagged your build, upgrading to 0.0.13 resolves RUSTSEC-2025-0068 structurally — see Security below.

TL;DR

  # Cargo.toml
- serde_yml = "0.0"
+ serde_yml = "0.0.13"

Your existing call sites compile unchanged. The compiler now emits a #[deprecated] warning at every use serde_yml::* import pointing at the migration guide. The C-FFI libyml parser is no longer in your dependency graph.

When you're ready to fully migrate, see the migration guide.

Security: RUSTSEC-2025-0068 fixed

RUSTSEC-2025-0068 (also GHSA-hhw4-xg65-fp2x) flagged every serde_yml ≤ 0.0.12 as unsound — the serde_yml::ser::Serializer.emitter field could cause a segmentation fault via the C-FFI libyaml parser.

0.0.13 removes the vulnerable surface entirely:

  • The C-FFI libyml dependency is gone from the graph.
  • serde_yml::ser::Serializer is now a re-export of a pure-Rust unit struct (pub struct Serializer;) with no emitter field — code that referenced .emitter no longer compiles, which is the desired outcome.
  • The backend (noyalib) enforces #![forbid(unsafe_code)] workspace-wide.

Verification:

cargo update -p serde_yml --precise 0.0.13
cargo tree -p serde_yml | grep libyml   # → no output

The RustSec advisory database PR adding patched = ["^0.0.13"] is pending review at rustsec/advisory-db#2915. Until it merges, cargo audit may still warn against 0.0.13 — the 0.0.13 release itself ships .cargo/audit.toml + deny.toml ignore entries so the self-referential warning doesn't block your own CI.

Maintained alternatives

Three crates are realistic destinations. Pick the one that fits.

Crate Migration shape Best fit

... (truncated)

Commits
  • 2bdacd5 ci: commit Cargo.lock for reproducible audits
  • 57983ac ci: ignore RUSTSEC-2025-0068 in cargo-audit / cargo-deny
  • c236ddd style: apply rustfmt (max_width=72)
  • 795e112 ci: include master in push triggers (default branch is master)
  • 5497552 Deprecate serde_yml — 0.0.13 shim forwarding to noyalib (#52)
  • ab3c49e Merge pull request #34 from horacimacias/master
  • c7ba7ac Merge pull request #35 from lucasvr/lucas/anchors
  • 140d00b Merge pull request #38 from nc7s/fix-cstr-pointer-type
  • a19e5c2 Merge pull request #18 from Mingun/remove-duplicated-clone
  • 6ffe205 fix: hard coded CStr pointer type, use ffi::c_char
  • Additional commits viewable in compare view

Updates jsonwebtoken from 9.3.1 to 10.3.0

Changelog

Sourced from jsonwebtoken's changelog.

10.3.0 (2026-01-27)

  • Export everything needed to define your own CryptoProvider
  • Fix type confusion with exp/nbf when not required

10.2.0 (2025-11-06)

  • Remove Clone bound from decode functions

10.1.0 (2025-10-18)

  • add dangerous::insecure_decode
  • Implement TryFrom &Jwk for DecodingKey

10.0.0 (2025-09-29)

  • BREAKING: now using traits for crypto backends, you have to choose between aws_lc_rs and rust_crypto
  • Add Clone bound to decode
  • Support decoding byte slices
  • Support JWS
Commits

Updates tar from 0.4.45 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits

Updates russh from 0.57.1 to 0.60.3

Release notes

Sourced from russh's releases.

v0.60.3

Security fixes

CVE-2026-46673

  • a2d48a7 (Mika Cohen)

When compression is negotiated, an attacker can craft a "ZIP bomb" style packet that would bypass the maximum packet size checks. This could allow the attacker to hit the OOM limit and either get the server process killed by the OS, or, prior to russh@0.58.0, aborted. A similar issue existed in the AgentClient as well, which could be triggered by a malformed SSH agent response.

v0.60.2

Changes

Fixes

  • c31cbc9: Fix channel write ordering with pending data (#693) (Mika Cohen) #693
  • 2a49916: fixed #697 - pin all pre-release dependencies (Eugene)

v0.60.1

Security fixes

GHSA-f5v4-2wr6-hqmg in 6c3c80a

This DoS vulnerability allowed an unauthenticated user to trigger an out-of-memory condition in a russh based server if keyboard-interactive authentication is allowed. A malicious authentication packet could trigger a multi-GB memory allocation likely leading to the process getting killed by the OOM killer.

Fixes

  • a9057ed: fixed #687 - PKCS8 key encryption not working (#688) (Eugene) #688

v0.60.0

Changes

  • dad8de6: use rand 0.10 (#673) (Joe Grund) #673

Fixes

v0.59.0

Changes

  • auth: add certificate-based authentication via SSH agent (#632) #632 (wi-adam)
  • 6996711: Replace libcrux-ml-kem with RustCrypto ml-kem (#660) (kpcyrd) #660

Fixes

  • 084dbcf: Replace Deprecated Function Calls to criterion::black_box() (#683) (Roger Knecht) #683
  • debc93c: Update dev-dependencies (env_logger, clap, termion) (#671) (kpcyrd) #671
  • 24d7527: Forward ChannelMsg::Close to channel before dropping sender (#674) (Corey Leavitt) #674
  • bb9cc42: Fix and harden deferred channel EOF/CLOSE replay after rekey (#670) (Mika Cohen) #670
  • 3047787: Reduce size of ReadSshIdBuffer, add unit tests (#672) (kpcyrd) #672

... (truncated)

Commits

Updates cmov from 0.5.0-pre.0 to 0.5.4

Commits

Updates russh-cryptovec from 0.52.0 to 0.60.3

Release notes

Sourced from russh-cryptovec's releases.

v0.60.3

Security fixes

CVE-2026-46673

  • a2d48a7 (Mika Cohen)

When compression is negotiated, an attacker can craft a "ZIP bomb" style packet that would bypass the maximum packet size checks. This could allow the attacker to hit the OOM limit and either get the server process killed by the OS, or, prior to russh@0.58.0, aborted. A similar issue existed in the AgentClient as well, which could be triggered by a malformed SSH agent response.

v0.60.2

Changes

Fixes

  • c31cbc9: Fix channel write ordering with pending data (#693) (Mika Cohen) #693
  • 2a49916: fixed #697 - pin all pre-release dependencies (Eugene)

v0.60.1

Security fixes

GHSA-f5v4-2wr6-hqmg in 6c3c80a

This DoS vulnerability allowed an unauthenticated user to trigger an out-of-memory condition in a russh based server if keyboard-interactive authentication is allowed. A malicious authentication packet could trigger a multi-GB memory allocation likely leading to the process getting killed by the OOM killer.

Fixes

  • a9057ed: fixed #687 - PKCS8 key encryption not working (#688) (Eugene) #688

v0.60.0

Changes

  • dad8de6: use rand 0.10 (#673) (Joe Grund) #673

Fixes

v0.59.0

Changes

  • auth: add certificate-based authentication via SSH agent (#632) #632 (wi-adam)
  • 6996711: Replace libcrux-ml-kem with RustCrypto ml-kem (#660) (kpcyrd) #660

Fixes

  • 084dbcf: Replace Deprecated Function Calls to criterion::black_box() (#683) (Roger Knecht) #683
  • debc93c: Update dev-dependencies (env_logger, clap, termion) (#671) (kpcyrd) #671
  • 24d7527: Forward ChannelMsg::Close to channel before dropping sender (#674) (Corey Leavitt) #674
  • bb9cc42: Fix and harden deferred channel EOF/CLOSE replay after rekey (#670) (Mika Cohen) #670
  • 3047787: Reduce size of ReadSshIdBuffer, add unit tests (#672) (kpcyrd) #672

... (truncated)

Commits

Updates serde_yml from 0.0.12 to 0.0.13

Release notes

Sourced from serde_yml's releases.

v0.0.13 — Final release (deprecation shim, RUSTSEC-2025-0068 fixed)

⚠️ Final release — serde_yml is deprecated

This is the final maintenance release of serde_yml. The crate is no longer under active development. 0.0.13 is a thin compatibility shim that lets existing call sites keep compiling while you migrate to one of the maintained alternatives listed below.

If you are reading this because cargo audit flagged your build, upgrading to 0.0.13 resolves RUSTSEC-2025-0068 structurally — see Security below.

TL;DR

  # Cargo.toml
- serde_yml = "0.0"
+ serde_yml = "0.0.13"

Your existing call sites compile unchanged. The compiler now emits a #[deprecated] warning at every use serde_yml::* import pointing at the migration guide. The C-FFI libyml parser is no longer in your dependency graph.

When you're ready to fully migrate, see the migration guide.

Security: RUSTSEC-2025-0068 fixed

RUSTSEC-2025-0068 (also GHSA-hhw4-xg65-fp2x) flagged every serde_yml ≤ 0.0.12 as unsound — the serde_yml::ser::Serializer.emitter field could cause a segmentation fault via the C-FFI libyaml parser.

0.0.13 removes the vulnerable surface entirely:

  • The C-FFI libyml dependency is gone from the graph.
  • serde_yml::ser::Serializer is now a re-export of a pure-Rust unit struct (pub struct Serializer;) with no emitter field — code that referenced .emitter no longer compiles, which is the desired outcome.
  • The backend (noyalib) enforces #![forbid(unsafe_code)] workspace-wide.

Verification:

cargo update -p serde_yml --precise 0.0.13
cargo tree -p serde_yml | grep libyml   # → no output

The RustSec advisory database PR adding patched = ["^0.0.13"] is pending review at rustsec/advisory-db#2915. Until it merges, cargo audit may still warn against 0.0.13 — the 0.0.13 release itself ships .cargo/audit.toml + deny.toml ignore entries so the self-referential warning doesn't block your own CI.

Maintained alternatives

Three crates are realistic destinations. Pick the one that fits.

Crate Migration shape Best fit

... (truncated)

Commits
  • 2bdacd5 ci: commit Cargo.lock for reproducible audits
  • 57983ac ci: ignore RUSTSEC-2025-0068 in cargo-audit / cargo-deny
  • c236ddd style: apply rustfmt (max_width=72)
  • 795e112 ci: include master in push triggers (default branch is master)
  • 5497552 Deprecate serde_yml — 0.0.13 shim forwarding to noyalib (#52)
  • ab3c49e Merge pull request #34 from horacimacias/master
  • c7ba7ac Merge pull request #35 from lucasvr/lucas/anchors
  • 140d00b Merge pull request #38 from nc7s/fix-cstr-pointer-type
  • a19e5c2 Merge pull request #18 from Mingun/remove-duplicated-clone
  • 6ffe205 fix: hard coded CStr pointer type, use ffi::c_char
  • Additional commits viewable in compare view

Updates rand from 0.9.2 to 0.9.3

Changelog

Sourced from rand's changelog.

[0.9.3] — 2026-02-11

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1764)
  • Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the cargo group across 2 directories with 7 updates
39d4963 
Bumps the cargo group with 4 updates in the / directory: [serde_yml](https://github.com/sebastienrousseau/serde_yml), [jsonwebtoken](https://github.com/Keats/jsonwebtoken), [tar](https://github.com/composefs/tar-rs) and [russh](https://github.com/warp-tech/russh).
Bumps the cargo group with 2 updates in the /e2e/rust directory: [serde_yml](https://github.com/sebastienrousseau/serde_yml) and [rand](https://github.com/rust-random/rand).


Updates `serde_yml` from 0.0.12 to 0.0.13
- [Release notes](https://github.com/sebastienrousseau/serde_yml/releases)
- [Commits](sebastienrousseau/serde_yml@v0.0.12...v0.0.13)

Updates `jsonwebtoken` from 9.3.1 to 10.3.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v9.3.1...v10.3.0)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `russh` from 0.57.1 to 0.60.3
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.57.1...v0.60.3)

Updates `cmov` from 0.5.0-pre.0 to 0.5.4
- [Commits](RustCrypto/utils@cmov-v0.5.0-pre.0...cmov-v0.5.4)

Updates `russh-cryptovec` from 0.52.0 to 0.60.3
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.52.0...v0.60.3)

Updates `serde_yml` from 0.0.12 to 0.0.13
- [Release notes](https://github.com/sebastienrousseau/serde_yml/releases)
- [Commits](sebastienrousseau/serde_yml@v0.0.12...v0.0.13)

Updates `rand` from 0.9.2 to 0.9.3
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.3/CHANGELOG.md)
- [Commits](rust-random/rand@rand_core-0.9.2...0.9.3)

---
updated-dependencies:
- dependency-name: serde_yml
  dependency-version: 0.0.13
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: jsonwebtoken
  dependency-version: 10.3.0
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: russh
  dependency-version: 0.60.3
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: cmov
  dependency-version: 0.5.4
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: russh-cryptovec
  dependency-version: 0.60.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: serde_yml
  dependency-version: 0.0.13
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.9.3
  dependency-type: direct:production
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants