Skip to content

deps: bump the deps-patches group across 1 directory with 10 updates - #203

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/deps-patches-0033eaa7be
Closed

deps: bump the deps-patches group across 1 directory with 10 updates#203
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/deps-patches-0033eaa7be

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the deps-patches group with 10 updates in the / directory:

Package From To
toml 1.1.4+spec-1.1.0 1.1.6+spec-1.1.0
clap 4.6.6 4.6.7
jiff 0.2.35 0.2.37
quinn 0.11.11 0.11.12
reqwest 0.13.4 0.13.5
rustls 0.23.43 0.23.45
uuid 1.26.0 1.26.1
rustix 1.1.4 1.1.5
hickory-resolver 0.26.1 0.26.3
bestool-canopy 0.7.10 0.7.12

Updates toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits
  • 572c005 chore: Release
  • 66d0c53 docs: Update changelog
  • 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
  • 0ff90db perf(display): Write encoded strings directly
  • efb2536 perf(display): Move generated representation strings
  • 075c444 refactor(display): Consolidate key-path encoding
  • b48f338 perf(display): Borrow table keys during document output
  • c6c1de3 perf(parser): Move completed table header keys
  • ec90463 perf(parser): Borrow input when creating editable documents
  • d76a48a test: Benchmark rendering generated keys and values
  • Additional commits viewable in compare view

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

  • (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands
Commits
  • d3e59a9 chore: Release
  • d997f87 docs: Update changelog
  • fb6058c Merge pull request #6409 from heaths/pwsh-support
  • 2310870 test(complete): Add tests for completer_for_path
  • 5967c17 refactor(complete): Move shell detection to Shells
  • 594602b fix(complete): Detect pwsh for PowerShell
  • 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
  • 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
  • c968b13 chore(deps): Update Rust crate shlex to v2
  • 8f247cb chore(deps): Update actions/checkout action to v7
  • Additional commits viewable in compare view

Updates jiff from 0.2.35 to 0.2.37

Changelog

Sourced from jiff's changelog.

0.2.37 (2026-09-12)

This is a redux release of 0.2.36 that fixes a compilation bug.

Bug fixes:

  • #647: Fixes a compilation bug due to incorrect include paths.

0.2.36 (2026-09-12)

This release has a couple bug fixes and adds opt-in integration with the arbitrary crate.

Enhancements:

  • #631: Add optional Arbitrary trait implementations from the arbitrary crate.

Bug fixes:

  • #617: Fixes a bug in jiff_core::tz::Offset checked subtraction routine.
  • #627: Use serialize_some for optional Serde helpers in jiff::fmt::serde.
Commits

Updates quinn from 0.11.11 to 0.11.12

Commits
  • eaec0db Bump versions to 0.11.18 / 0.11.12
  • 4c92955 proto: handle empty ranges in RangeSet::replace
  • 9a66201 proto: avoid panic on high minimum ACK delay
  • abca008 streams: budget send windows against retained storage
  • 3c0adcc streams: release abandoned send buffers on reset
  • d2cf48f quinn: enforce cumulative read_to_end size limits
  • daa5131 quinn: separate read_to_end buffer accumulation
  • 811b548 proto: reject transport parameters with a mismatched length
  • 9bd87c9 proto: preserve the server config for pending incoming connections
  • a708a97 proto: prune queued DATAGRAMs when the active path changes
  • Additional commits viewable in compare view

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.
Commits
  • de55373 v0.13.5
  • 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
  • 9f06fd2 docs: improve description of JSON method (#3082)
  • 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
  • ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
  • 4e9a3c7 chore: add pull request template for human-written content
  • 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
  • 221abe9 chore: Remove unnecessary clones and a cast (#3071)
  • 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
  • fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
  • Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.45

Commits
  • 2976d90 Prepare 0.23.45
  • f9d4ee9 Handshake "alignment" check covers previously-received messages
  • c4e92e8 Keep data needed for HRR processing together
  • e553a7a server: TLS1.2 is not available after a HRR
  • 5dff9da Test whether server negotiates TLS1.2 after HRR
  • 185a063 reject a second ClientHello that changes the cipher suite
  • 9fafe6d reject a second ClientHello that drops pre_shared_key
  • 1b42c5f providers: zeroize private key DER
  • 64ad386 Bump version to 0.23.44
  • 1efbf66 bogo: remove PostQuantum setup
  • Additional commits viewable in compare view

Updates uuid from 1.26.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

Commits
  • 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
  • d4df8f0 prepare for 1.26.1 release
  • 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
  • fda00eb don't panic in overflowing Timestamp to SystemTime conversion
  • c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
  • ac065a6 Align the counter diagram
  • 34ec102 Seat the v7 counter below the version nibble
  • See full diff in compare view

Updates rustix from 1.1.4 to 1.1.5

Commits

Updates hickory-resolver from 0.26.1 to 0.26.3

Release notes

Sourced from hickory-resolver's releases.

v0.26.3

This release fixes regressions introduced in v0.26.2 related to DNSSEC verification, QUIC servers, HTTP/3 servers, and minimum dependency versions.

What's Changed

Full Changelog: hickory-dns/hickory-dns@v0.26.2...v0.26.3

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

  • GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
  • GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
  • GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
  • GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
  • GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
  • GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
  • GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
  • GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
  • GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
  • GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
  • GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
  • GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
  • GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
  • GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
  • GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
  • GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY
  • GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names
  • GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
  • GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
  • GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
  • GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
  • GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
  • GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
  • GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
  • GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
  • GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
  • GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
  • GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
  • GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing

... (truncated)

Commits
  • bd37caf net: require authenticated insecure-delegation proofs
  • 5a79511 Add conformance test for regression
  • c268442 net: fix ancestor delegation issues
  • 9488e8e Exclude accepting QUIC connections from timeouts
  • 4ad16c3 Bump version to 0.26.3
  • cfab556 proto: ignore RRSIGs in DnssecSummary::from_records
  • 819a6bc net: try every RRSIG before marking an RRset bogus
  • 688231e resolver: use lenient resolv.conf parsing
  • ca5d1a1 resolver: Fix 'unused method' with features blocklist,tls-ring
  • 678b01b Fix unnecessary qualification warning
  • Additional commits viewable in compare view

Updates bestool-canopy from 0.7.10 to 0.7.12

Commits
  • 323a6cc repo: release
  • c3f710a fix(download): pass allow_insecure_http to Client::default_builder
  • ff16462 repo: release
  • 54af38e repo: release (#873)
  • 5f85f55 A2: Report checks and facts split by machine and application (#872)
  • 62bc763 repo: release
  • 6c03cb7 docs(alertd): spell misattribution as one word
  • 6270592 fix(alertd): plan forwarding, legacy payloads, and review nits
  • 42088be perf(alertd): stop re-deriving what the caller already holds
  • 8f370b2 fix(psql): stop a stray filename aborting startup, and export the bytes the l...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the deps-patches group across 1 directory with 10 updates
cc23bd9 
Bumps the deps-patches group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [toml](https://github.com/toml-rs/toml) | `1.1.4+spec-1.1.0` | `1.1.6+spec-1.1.0` |
| [clap](https://github.com/clap-rs/clap) | `4.6.6` | `4.6.7` |
| [jiff](https://github.com/BurntSushi/jiff) | `0.2.35` | `0.2.37` |
| [quinn](https://github.com/quinn-rs/quinn) | `0.11.11` | `0.11.12` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` |
| [rustls](https://github.com/rustls/rustls) | `0.23.43` | `0.23.45` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.26.0` | `1.26.1` |
| [rustix](https://github.com/bytecodealliance/rustix) | `1.1.4` | `1.1.5` |
| [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.26.1` | `0.26.3` |
| [bestool-canopy](https://github.com/beyondessential/bestool) | `0.7.10` | `0.7.12` |



Updates `toml` from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.4...toml-v1.1.6)

Updates `clap` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.6...clap_complete-v4.6.7)

Updates `jiff` from 0.2.35 to 0.2.37
- [Release notes](https://github.com/BurntSushi/jiff/releases)
- [Changelog](https://github.com/BurntSushi/jiff/blob/jiff-static-0.2.37/CHANGELOG.md)
- [Commits](BurntSushi/jiff@jiff-static-0.2.35...jiff-static-0.2.37)

Updates `quinn` from 0.11.11 to 0.11.12
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-0.11.11...quinn-0.11.12)

Updates `reqwest` from 0.13.4 to 0.13.5
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5)

Updates `rustls` from 0.23.43 to 0.23.45
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.43...v/0.23.45)

Updates `uuid` from 1.26.0 to 1.26.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.26.0...v1.26.1)

Updates `rustix` from 1.1.4 to 1.1.5
- [Release notes](https://github.com/bytecodealliance/rustix/releases)
- [Changelog](https://github.com/bytecodealliance/rustix/blob/main/CHANGES.md)
- [Commits](bytecodealliance/rustix@v1.1.4...v1.1.5)

Updates `hickory-resolver` from 0.26.1 to 0.26.3
- [Release notes](https://github.com/hickory-dns/hickory-dns/releases)
- [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md)
- [Commits](hickory-dns/hickory-dns@v0.26.1...v0.26.3)

Updates `bestool-canopy` from 0.7.10 to 0.7.12
- [Release notes](https://github.com/beyondessential/bestool/releases)
- [Changelog](https://github.com/beyondessential/bestool/blob/main/release-plz.toml)
- [Commits](beyondessential/bestool@bestool-canopy-v0.7.10...bestool-canopy-v0.7.12)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.1.6+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: clap
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: jiff
  dependency-version: 0.2.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: quinn
  dependency-version: 0.11.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: reqwest
  dependency-version: 0.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: rustls
  dependency-version: 0.23.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: uuid
  dependency-version: 1.26.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: rustix
  dependency-version: 1.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: hickory-resolver
  dependency-version: 0.26.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
- dependency-name: bestool-canopy
  dependency-version: 0.7.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: deps-patches
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 24, 2026
@github-code-quality

github-code-quality Bot commented Sep 24, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/vitest

The overall line coverage in commit cc23bd9 in the dependabot/cargo/dep... branch remains at 66%, unchanged from commit 30c99fb in the main branch.

@dependabot @github

dependabot Bot commented on behalf of github Sep 29, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 29, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/deps-patches-0033eaa7be branch September 29, 2026 15:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants