Skip to content

build(deps): bump the cargo group across 1 directory with 6 updates - #369

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-f4583ebf31
Open

build(deps): bump the cargo group across 1 directory with 6 updates#369
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-f4583ebf31

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 6 updates in the / directory:

Package From To
openssl 0.10.71 0.10.80
bytes 1.4.0 1.12.1
git2 0.20.0 0.20.4
idna 0.3.0 1.1.0
ring 0.17.8 0.17.14
time 0.3.36 0.3.55

Updates openssl from 0.10.71 to 0.10.80

Release notes

Sourced from openssl's releases.

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

openssl-v0.10.78

What's Changed

... (truncated)

Commits
  • 35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
  • 19eceb2 Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-pad...
  • b460eb3 Prefer Homebrew openssl@4 and stop looking for openssl@1.1 (#2633)
  • 649f2d9 Release openssl 0.10.79 and openssl-sys 0.9.115 (#2632)
  • 257f9b2 Fix output buffer overflow for AES key-wrap-with-padding ciphers (#2630)
  • d43e917 Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders (#2631)
  • f46519c Add PkeyCtxRef::set_context_string for ML-DSA (#2629)
  • ad9ae31 Bind OSSL_PARAM_modified and use it for seed_into (#2628)
  • 4e25c9b Fix process abort when verify/PSK callbacks fire after SSL_CTX swap (#2624)
  • 3dd8f42 Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction (#2626)
  • Additional commits viewable in compare view

Updates bytes from 1.4.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)

Bytes v1.10.1

1.10.1 (March 5th, 2025)

... (truncated)

Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)

1.10.1 (March 5th, 2025)

Fixed

  • Fix memory leak when using to_vec with Bytes::from_owner (#773)

... (truncated)

Commits

Updates git2 from 0.20.0 to 0.20.4

Changelog

Sourced from git2's changelog.

0.20.4 - 2026-02-02

0.20.3...0.20.4

Fixed

  • Fix undefined behavior when dereferencing empty Buf. #1213

0.20.3 - 2025-12-06

0.20.2...0.20.3

Changed

  • Bumped requirement to libgit2-sys 0.18.3, which updates libgit2 from 1.9.0 to 1.9.2. #1197

0.20.2 - 2025-05-05

0.20.1...0.20.2

Added

  • Added Status::WT_UNREADABLE. #1151

Fixed

  • Added missing codes for GIT_EDIRECTORY, GIT_EMERGECONFLICT, GIT_EUNCHANGED, GIT_ENOTSUPPORTED, and GIT_EREADONLY to Error::raw_code. #1153
  • Fixed missing initialization in Indexer::new. #1160

0.20.1 - 2025-03-17

0.20.0...0.20.1

Added

  • Added Repository::branch_upstream_merge() #1131
  • Added Index::conflict_get() #1134
  • Added Index::conflict_remove() #1133
  • Added opts::set_cache_object_limit() #1118
  • Added Repo::merge_file_from_index() and associated MergeFileOptions and MergeFileResult. #1062

Changed

  • The url dependency minimum raised to 2.5.4

... (truncated)

Commits
  • 8852d7d Merge pull request #1214 from weihanglo/backport-from-raw-parts
  • 0b274f7 Bump to 0.20.4
  • 73a5d5d Add test for dereference of an empty Buf
  • ce56683 fix: check ptr nullity before calling from_raw_parts
  • 7cf345c Merge pull request #1197 from ehuss/git2-0.20-br
  • dd41077 Bump git2 to 0.20.3
  • a6a58e2 Merge pull request #1195 from ehuss/update-libgit2
  • 1fb5f64 Merge pull request #1161 from ehuss/bump-version
  • 26bfd30 Update version of git2 to 0.20.2
  • eef4592 Merge pull request #1160 from ehuss/indexer-init
  • Additional commits viewable in compare view

Updates idna from 0.3.0 to 1.1.0

Release notes

Sourced from idna's releases.

idna v1.0.3

What's Changed

New Contributors

Full Changelog: servo/rust-url@v2.5.2...idna-v1.0.3

idna v1.0.1

What's Changed

Full Changelog: servo/rust-url@v2.5.1...idna-v1.0.1

Commits

Updates ring from 0.17.8 to 0.17.14

Changelog

Sourced from ring's changelog.

Version 0.17.14 (2025-03-11)

Fixed a performance bug in the AVX2-based AES-GCM implementation added in ring 0.17.13. This will be another notable performance improvement for most newish x86-64 systems. The performance issue impacted not just AES-GCM.

Compatibility with GNU binutils 2.29 (used on Amazon Linux 2), and probably even earlier versions, was restored. It is expected that ring 0.17.14 will build on all the systems that 0.17.12 would build on.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

  • Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

  • Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

Commits

Updates time from 0.3.36 to 0.3.55

Release notes

Sourced from time's releases.

v0.3.55

See the changelog for details.

v0.3.54

See the changelog for details.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

v0.3.44

See the changelog for details.

v0.3.43

See the changelog for details.

v0.3.42

See the changelog for details.

v0.3.41

See the changelog for details.

v0.3.40

See the changelog for details.

v0.3.39

See the changelog for details.

v0.3.38

See the changelog for details.

... (truncated)

Changelog

Sourced from time's changelog.

0.3.55 [2026-08-01]

Fixed

  • Avoid underflow in DateIter::nth, ensuring correct behavior.
  • Avoid overflow when deserializing timestamps.
  • Handle out-of-bounds data when deserializing.
  • Don't assume that the format being deserialized was generated by the serializer; this previously led to some valid values being parsed incorrectly and others being rejected.
  • No longer silence errors when deserializing UtcOffset.
  • OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.
  • OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.

0.3.54 [2026-07-20]

Added

  • PrimitiveDateTime has been renamed to PlainDateTime.
  • Duration has been renamed to SignedDuration.
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

  • The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

  • More gains when parsing RFC 2822.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result

... (truncated)

Commits
  • 857d9c4 v0.3.55 release
  • 2b72fcd Precise feature gating for macro
  • c1089eb Run check-targets, miri in parallel
  • f377fad Avoid range-validated ordinal => year in cascade
  • 2eacb0a Report miscellaneous tasks, overall status
  • 29621ac Speed up CI
  • 08de7ba Fix nano-timestamp validation
  • 3c3f046 Fix copy-paste error
  • 3c0c81c Cascade errors when deserializing UtcOffset
  • c21acd5 Handle more deserializations of SignedDuration
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the cargo group across 1 directory with 6 updates
98a8c81 
Bumps the cargo group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.71` | `0.10.80` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.4.0` | `1.12.1` |
| [git2](https://github.com/rust-lang/git2-rs) | `0.20.0` | `0.20.4` |
| [idna](https://github.com/servo/rust-url) | `0.3.0` | `1.1.0` |
| [ring](https://github.com/briansmith/ring) | `0.17.8` | `0.17.14` |
| [time](https://github.com/time-rs/time) | `0.3.36` | `0.3.55` |



Updates `openssl` from 0.10.71 to 0.10.80
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.71...openssl-v0.10.80)

Updates `bytes` from 1.4.0 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.4.0...v1.12.1)

Updates `git2` from 0.20.0 to 0.20.4
- [Changelog](https://github.com/rust-lang/git2-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/git2-rs@git2-0.20.0...git2-0.20.4)

Updates `idna` from 0.3.0 to 1.1.0
- [Release notes](https://github.com/servo/rust-url/releases)
- [Commits](https://github.com/servo/rust-url/commits)

Updates `ring` from 0.17.8 to 0.17.14
- [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md)
- [Commits](https://github.com/briansmith/ring/commits)

Updates `time` from 0.3.36 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.36...v0.3.55)

---
updated-dependencies:
- dependency-name: openssl
  dependency-version: 0.10.80
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: git2
  dependency-version: 0.20.4
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: idna
  dependency-version: 1.1.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ring
  dependency-version: 0.17.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Oct 7, 2026
@mergify

mergify Bot commented Oct 7, 2026

Copy link
Copy Markdown

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants