Skip to content

Bump the cargo group across 1 directory with 13 updates - #22

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-5366360688
Closed

Bump the cargo group across 1 directory with 13 updates#22
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-5366360688

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the cargo group with 13 updates in the / directory:

Package From To
slatedb 0.15.0 0.16.0
russh 0.62.7 0.63.2
rand 0.8.8 0.10.2
base64 0.22.1 0.23.1
sha2 0.10.9 0.11.0
imara-diff 0.1.8 0.2.0
redis 0.27.6 1.7.0
tower-http 0.6.11 0.7.1
slatedb-common 0.15.0 0.16.0
notify 7.0.0 8.2.0
tokio-tungstenite 0.29.0 0.30.0
socket2 0.5.10 0.6.5
dirs 6.0.0 7.0.0

Updates slatedb from 0.15.0 to 0.16.0

Release notes

Sourced from slatedb's releases.

v0.16.0

What's Changed

... (truncated)

Commits

Updates russh from 0.62.7 to 0.63.2

Release notes

Sourced from russh's releases.

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

GHSA-35g8-35p8-c8fw - unbounded memory allocation in server

An authenticated client could trigger unbounded memory allocation during rekey phase

Fixes

  • client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
  • 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
  • b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
  • 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
  • a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
  • 422123c: dedup zlib compress loop into compress_into (Eugene)

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

    • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

    • Adds a Config::certificates that functions similarly to Config::keys

Fixes

  • f2354c7: improve strict kex checks (Eugene)
  • 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
  • 46c927a: use constant-time comparison for agent unlock (Eugene)
  • 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

... (truncated)

Commits
  • 8a51a0d v0.63.2
  • 422123c dedup zlib compress loop into compress_into
  • a04e1b5 fixed #758 - fail RSA signing explicitly when RSA feature is not enabled
  • af91598 fmt
  • b1d3893 fixed #762 - redact sensitive data from debug logging
  • a282af3 fix rekey message queueing
  • 5d56698 fix read bounds in pageant
  • 675b631 bump num-bigint
  • 24e2c37 fix for latest minz_oxide
  • 9c86cb8 Merge branch 'main' of github.com:warp-tech/russh
  • Additional commits viewable in compare view

Updates rand from 0.8.8 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates imara-diff from 0.1.8 to 0.2.0

Release notes

Sourced from imara-diff's releases.

v0.2.0

This release changes the API to be more suitable for hunk post-processing and implements the Git slider adjustments.

What's Changed

New Contributors

Full Changelog: pascalkuthe/imara-diff@v0.1.8...v0.2.0

Changelog

Sourced from imara-diff's changelog.

Changelog - imara-diff

All notable changes to imara-diff will be documented in this file. The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Commits

Updates redis from 0.27.6 to 1.7.0

Release notes

Sourced from redis's releases.

redis-1.7.0

1.7.0 (2026-09-05)

Changes & Bug fixes

CI & operational improvements

redis-1.6.0

Changes & Bug fixes

CI & operational improvements

New Contributors

Full Changelog: redis-rs/redis-rs@redis-1.5.0...redis-1.5.1

redis-1.5.0

Changes & Bug fixes

CI & operational improvements

... (truncated)

Commits

Updates tower-http from 0.6.11 to 0.7.1

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

  • fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
  • fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
  • request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

  • fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

  • behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (#718)
  • decompression: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered (#722)
  • decompression: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 (#712)
  • fs: multipart range requests are now rejected before range validation, so they consistently return 416 Range Not Satisfiable with a Cannot serve multipart range requests body instead of a generic unsatisfiable-range response (#661)
  • fs: range error responses no longer carry representation headers such as Content-Type and Content-Encoding (#727)
  • set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader are now Clone regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 (#714)

#661: tower-rs/tower-http#661 #712: tower-rs/tower-http#712 #714: tower-rs/tower-http#714 #716: tower-rs/tower-http#716 #718: tower-rs/tower-http#718 #722: tower-rs/tower-http#722 #727: tower-rs/tower-http#727 #728: tower-rs/tower-http#728

All the changes

... (truncated)

Commits
  • c941451 chore(release): prepare 0.7.1 (#729)
  • 9697702 chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)
  • e2582e2 Allow ignoring multi-range requests (#727)
  • 888f7fe feat(services): configure directory redirects (#728)
  • 5ad7654 chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)
  • d154adb fix: reject multipart ranges before validation (#661)
  • d9e5c8a ci: Update to cargo-check-external-types 0.5.0 (#724)
  • 90c072b Propagate ServeDir::try_call I/O errors (#718)
  • 860922e fix(decompression): don't end the body on an empty data frame (#722)
  • 8532252 docs(example)/custom future with multiple bodies (#711)
  • Additional commits viewable in compare view

Updates slatedb-common from 0.15.0 to 0.16.0

Release notes

Sourced from slatedb-common's releases.

v0.16.0

What's Changed

@dependabot
Bump the cargo group across 1 directory with 13 updates
d3ed6b6 
Bumps the cargo group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [slatedb](https://github.com/slatedb/slatedb) | `0.15.0` | `0.16.0` |
| [russh](https://github.com/warp-tech/russh) | `0.62.7` | `0.63.2` |
| [rand](https://github.com/rust-random/rand) | `0.8.8` | `0.10.2` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [imara-diff](https://github.com/pascalkuthe/imara-diff) | `0.1.8` | `0.2.0` |
| [redis](https://github.com/redis-rs/redis-rs) | `0.27.6` | `1.7.0` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.6.11` | `0.7.1` |
| [slatedb-common](https://github.com/slatedb/slatedb) | `0.15.0` | `0.16.0` |
| [notify](https://github.com/notify-rs/notify) | `7.0.0` | `8.2.0` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.29.0` | `0.30.0` |
| [socket2](https://github.com/rust-lang/socket2) | `0.5.10` | `0.6.5` |
| dirs | `6.0.0` | `7.0.0` |



Updates `slatedb` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/slatedb/slatedb/releases)
- [Changelog](https://github.com/slatedb/slatedb/blob/main/RELEASE.md)
- [Commits](slatedb/slatedb@v0.15.0...v0.16.0)

Updates `russh` from 0.62.7 to 0.63.2
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.62.7...v0.63.2)

Updates `rand` from 0.8.8 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.8...0.10.2)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `imara-diff` from 0.1.8 to 0.2.0
- [Release notes](https://github.com/pascalkuthe/imara-diff/releases)
- [Changelog](https://github.com/pascalkuthe/imara-diff/blob/master/CHANGELOG.md)
- [Commits](pascalkuthe/imara-diff@v0.1.8...v0.2.0)

Updates `redis` from 0.27.6 to 1.7.0
- [Release notes](https://github.com/redis-rs/redis-rs/releases)
- [Commits](redis-rs/redis-rs@redis-0.27.6...redis-1.7.0)

Updates `tower-http` from 0.6.11 to 0.7.1
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.1)

Updates `slatedb-common` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/slatedb/slatedb/releases)
- [Changelog](https://github.com/slatedb/slatedb/blob/main/RELEASE.md)
- [Commits](slatedb/slatedb@v0.15.0...v0.16.0)

Updates `notify` from 7.0.0 to 8.2.0
- [Release notes](https://github.com/notify-rs/notify/releases)
- [Changelog](https://github.com/notify-rs/notify/blob/notify-8.2.0/CHANGELOG.md)
- [Commits](notify-rs/notify@notify-7.0.0...notify-8.2.0)

Updates `tokio-tungstenite` from 0.29.0 to 0.30.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.29.0...v0.30.0)

Updates `socket2` from 0.5.10 to 0.6.5
- [Release notes](https://github.com/rust-lang/socket2/releases)
- [Changelog](https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/socket2/commits/v0.6.5)

Updates `dirs` from 6.0.0 to 7.0.0

---
updated-dependencies:
- dependency-name: slatedb
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: russh
  dependency-version: 0.63.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: imara-diff
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: redis
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: tower-http
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: slatedb-common
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: notify
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: tokio-tungstenite
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: socket2
  dependency-version: 0.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: dirs
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 11, 2026
@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 095adfd3-af75-4c27-be5d-9f71e6dd7865

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 11, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-5366360688 branch September 11, 2026 20:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants