Skip to content

Bump the cargo group across 1 directory with 17 updates - #23

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-96719d8bd0
Open

Bump the cargo group across 1 directory with 17 updates#23
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-96719d8bd0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown

Bumps the cargo group with 17 updates in the / directory:

Package From To
slatedb 0.15.0 0.16.0
russh 0.62.6 0.63.2
flate2 1.1.9 1.1.10
rand 0.8.7 0.10.2
base64 0.22.1 0.23.1
sha2 0.10.9 0.11.0
rustls 0.23.43 0.23.44
imara-diff 0.1.8 0.2.0
redis 0.27.6 1.6.0
mongodb 3.8.0 3.9.0
tower-http 0.6.11 0.7.1
slatedb-common 0.15.0 0.16.0
notify 7.0.0 8.2.0
tokio-tungstenite 0.29.0 0.30.0
socket2 0.5.10 0.6.5
dirs 6.0.0 7.0.0
open 5.4.2 5.4.3

Updates slatedb from 0.15.0 to 0.16.0

Release notes

Sourced from slatedb's releases.

v0.16.0

What's Changed

... (truncated)

Commits

Updates russh from 0.62.6 to 0.63.2

Release notes

Sourced from russh's releases.

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

GHSA-35g8-35p8-c8fw - unbounded memory allocation in server

An authenticated client could trigger unbounded memory allocation during rekey phase

Fixes

  • client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
  • 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
  • b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
  • 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
  • a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
  • 422123c: dedup zlib compress loop into compress_into (Eugene)

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

    • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

    • Adds a Config::certificates that functions similarly to Config::keys

Fixes

  • f2354c7: improve strict kex checks (Eugene)
  • 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
  • 46c927a: use constant-time comparison for agent unlock (Eugene)
  • 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

... (truncated)

Commits
  • 8a51a0d v0.63.2
  • 422123c dedup zlib compress loop into compress_into
  • a04e1b5 fixed #758 - fail RSA signing explicitly when RSA feature is not enabled
  • af91598 fmt
  • b1d3893 fixed #762 - redact sensitive data from debug logging
  • a282af3 fix rekey message queueing
  • 5d56698 fix read bounds in pageant
  • 675b631 bump num-bigint
  • 24e2c37 fix for latest minz_oxide
  • 9c86cb8 Merge branch 'main' of github.com:warp-tech/russh
  • Additional commits viewable in compare view

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

New Contributors

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits
  • ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
  • fb5228d Merge pull request #559 from bushrat011899/no_std
  • 6ed3ba3 Add executable no_std example
  • faed8a0 Expand CI to test no_std compatibility and correctness
  • 2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
  • 3fe1126 Centralize usage of std for error and io
  • 98e313a Add GzHeader::mtime_as_duration
  • 0642965 Switch to core implicit prelude and only use std where required
  • 454a63c Remove left-over dbg! statement
  • 2a490b7 Add runtime_detection feature
  • Additional commits viewable in compare view

Updates rand from 0.8.7 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates rustls from 0.23.43 to 0.23.44

Commits
  • 64ad386 Bump version to 0.23.44
  • 1efbf66 bogo: remove PostQuantum setup
  • e78162f aws-lc-rs: add support for ML-DSA signatures
  • d880772 bogo: extract Options::provider() helper
  • 87201d6 bogo: force all callers to get provider from Options
  • 93657e3 server: limit 1.2 certificate requests to 1.2-compatible signature schemes
  • bbd3c9a client: avoid sending 1.3-only signature schemes if no cipher suites configured
  • eb57688 tls12: require known signature algorithm
  • e7a9cef tls12: send illegal_parameter alert for kx signed with wrong algorithm
  • 06a546d bogo: take latest
  • Additional commits viewable in compare view

Updates imara-diff from 0.1.8 to 0.2.0

Release notes

Sourced from imara-diff's releases.

v0.2.0

This release changes the API to be more suitable for hunk post-processing and implements the Git slider adjustments.

What's Changed

New Contributors

Full Changelog: pascalkuthe/imara-diff@v0.1.8...v0.2.0

Changelog

Sourced from imara-diff's changelog.

Changelog - imara-diff

All notable changes to imara-diff will be documented in this file. The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Commits

Updates redis from 0.27.6 to 1.6.0

Release notes

Sourced from redis's releases.

redis-1.6.0

Changes & Bug fixes

CI & operational improvements

New Contributors

Full Changelog: redis-rs/redis-rs@redis-1.5.0...redis-1.5.1

redis-1.5.0

Changes & Bug fixes

CI & operational improvements

redis-1.4.1

Changes & Bug fixes

  • Remove unnecessary sleep from cluster readonly error handling (#2223 by @​nihohit)

CI & operational improvements

  • ci: Allow semicolon_in_expressions_from_macros to make nightly pass (#2218 by @​somechris)
  • tests/acl: Add the missing requirements for token based authentication (#2214 by @​somechris)
  • Makefile: Switch to --locked for module tests on RESP3 (#2222 by @​somechris)

Full Changelog: redis-rs/redis-rs@redis-1.4.0...redis-1.4.1

redis-1.4.0

Changes & Bug fixes

... (truncated)

Commits

Updates mongodb from 3.8.0 to 3.9.0

Release notes

Sourced from mongodb's releases.

v3.9.0

The MongoDB Rust driver team is pleased to announce the v3.9.0 release of the mongodb crate, now available for download from crates.io.

This release adds support for the new baseBackoffMS server error field. The driver now uses the value for baseBackoffMS reported by the server in its retry backoff calculations. This new feature is part of MongoDB's Intelligent Workload Management (IWM) and is available on MongoDB Atlas server versions 9.0+.

Full Release Notes

New Features

Improvements

Bugfixes

v3.8.2

The MongoDB Rust driver team is pleased to announce the v3.8.2 release of the mongodb crate, now available for download from crates.io.

[!IMPORTANT] This is a security patch release for CVE-2026-81526. Upgrading is recommended for all users.

This release fixes a bug that would allow Client::bulk_write to write to a different database than the one specified in a write model's namespace.

Full Release Notes

Bugfixes

v3.8.1

The MongoDB Rust driver team is pleased to announce the v3.8.1 release of the mongodb crate, now available for download from crates.io.

This release fixes two bugs: a potential infinite loop in change streams, and the find_one_and_* methods not reporting errors in some circumstances.

Full Release Notes

Bugfixes

  • RUST-2465 Fix an infinite loop in ChangeStream iteration (#1760)
  • RUST-2479 Report write concern errors for findAndModify (#1768)
Commits
  • e72eafb RUST-2443 Update version numbers for 3.9.0 (#1789)
  • 4406554 RUST-2133 Allow custom aws credential provider (#1781)
  • fe6a8cd RUST-2492 Check for inherited unacknowledged write concerns (#1787)
  • 01cdcf0 RUST-1740 Break up rest of evergreen config (#1786)
  • 7b6e67c RUST-2491 Fix libmongocrypt unversioned install and failing tests (#1785)
  • af37d75 Bump the rust-dependencies group across 1 directory with 21 updates (#1784)
  • 74eb7bb RUST-2411 Remove support for MongoDB 4.2 (#1770)
  • 9a0639e minor: pin rustfmt to a specific nightly release (#1783)
  • 57d51e9 RUST-2467 Validate database and collection name arguments against "." and NUL...
  • 3f2d25b minor: fix rustdoc errors (#1777)
  • Additional commits viewable in compare view

Updates tower-http from 0.6.11 to 0.7.1

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

  • fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
  • fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
  • request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

  • fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

  • behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (

@dependabot
Bump the cargo group across 1 directory with 17 updates
4e266bb 
Bumps the cargo group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [slatedb](https://github.com/slatedb/slatedb) | `0.15.0` | `0.16.0` |
| [russh](https://github.com/warp-tech/russh) | `0.62.6` | `0.63.2` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` |
| [rand](https://github.com/rust-random/rand) | `0.8.7` | `0.10.2` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [rustls](https://github.com/rustls/rustls) | `0.23.43` | `0.23.44` |
| [imara-diff](https://github.com/pascalkuthe/imara-diff) | `0.1.8` | `0.2.0` |
| [redis](https://github.com/redis-rs/redis-rs) | `0.27.6` | `1.6.0` |
| [mongodb](https://github.com/mongodb/mongo-rust-driver) | `3.8.0` | `3.9.0` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.6.11` | `0.7.1` |
| [slatedb-common](https://github.com/slatedb/slatedb) | `0.15.0` | `0.16.0` |
| [notify](https://github.com/notify-rs/notify) | `7.0.0` | `8.2.0` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.29.0` | `0.30.0` |
| [socket2](https://github.com/rust-lang/socket2) | `0.5.10` | `0.6.5` |
| dirs | `6.0.0` | `7.0.0` |
| [open](https://github.com/Byron/open-rs) | `5.4.2` | `5.4.3` |



Updates `slatedb` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/slatedb/slatedb/releases)
- [Changelog](https://github.com/slatedb/slatedb/blob/main/RELEASE.md)
- [Commits](slatedb/slatedb@v0.15.0...v0.16.0)

Updates `russh` from 0.62.6 to 0.63.2
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.62.6...v0.63.2)

Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.9...1.1.10)

Updates `rand` from 0.8.7 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.7...0.10.2)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `rustls` from 0.23.43 to 0.23.44
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.43...v/0.23.44)

Updates `imara-diff` from 0.1.8 to 0.2.0
- [Release notes](https://github.com/pascalkuthe/imara-diff/releases)
- [Changelog](https://github.com/pascalkuthe/imara-diff/blob/master/CHANGELOG.md)
- [Commits](pascalkuthe/imara-diff@v0.1.8...v0.2.0)

Updates `redis` from 0.27.6 to 1.6.0
- [Release notes](https://github.com/redis-rs/redis-rs/releases)
- [Commits](redis-rs/redis-rs@redis-0.27.6...redis-1.6.0)

Updates `mongodb` from 3.8.0 to 3.9.0
- [Release notes](https://github.com/mongodb/mongo-rust-driver/releases)
- [Commits](mongodb/mongo-rust-driver@v3.8.0...v3.9.0)

Updates `tower-http` from 0.6.11 to 0.7.1
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.1)

Updates `slatedb-common` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/slatedb/slatedb/releases)
- [Changelog](https://github.com/slatedb/slatedb/blob/main/RELEASE.md)
- [Commits](slatedb/slatedb@v0.15.0...v0.16.0)

Updates `notify` from 7.0.0 to 8.2.0
- [Release notes](https://github.com/notify-rs/notify/releases)
- [Changelog](https://github.com/notify-rs/notify/blob/notify-8.2.0/CHANGELOG.md)
- [Commits](notify-rs/notify@notify-7.0.0...notify-8.2.0)

Updates `tokio-tungstenite` from 0.29.0 to 0.30.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.29.0...v0.30.0)

Updates `socket2` from 0.5.10 to 0.6.5
- [Release notes](https://github.com/rust-lang/socket2/releases)
- [Changelog](https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/socket2/commits/v0.6.5)

Updates `dirs` from 6.0.0 to 7.0.0

Updates `open` from 5.4.2 to 5.4.3
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.4.2...v5.4.3)

---
updated-dependencies:
- dependency-name: slatedb
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: russh
  dependency-version: 0.63.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: rustls
  dependency-version: 0.23.44
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: imara-diff
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: redis
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: mongodb
  dependency-version: 3.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tower-http
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: slatedb-common
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: notify
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: tokio-tungstenite
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: socket2
  dependency-version: 0.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: dirs
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: open
  dependency-version: 5.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 11, 2026
@coderabbitai

coderabbitai Bot commented Sep 11, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d5f7f8f5-76aa-42a0-8384-139ff4b80824

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants