chore(deps): Bump the rust-security-and-maintenance group across 1 directory with 8 updates by dependabot[bot] · Pull Request #103 · RNT56/CrustCore

dependabot · 2026-10-11T11:25:06Z

Bumps the rust-security-and-maintenance group with 8 updates in the / directory:

Package	From	To
aes-gcm	`0.11.0`	`0.11.1`
zeroize	`1.9.0`	`1.9.1`
ureq	`3.3.0`	`3.4.2`
jsonwebtoken	`11.0.0`	`11.1.0`
tree-sitter	`0.26.11`	`0.27.0`
tokio	`1.53.1`	`1.53.2`
syn	`3.0.3`	`3.0.6`
trybuild	`1.0.118`	`1.0.122`

Updates aes-gcm from 0.11.0 to 0.11.1

Commits

2eff6cc Cut releases that replace subtle with ctutils (#880)
c90047f Replace subtle with ctutils (#879)
da2169e ocb3: remove unused ctr and zeroize dependencies (#876)
f5374f3 Add missing crates to the root readme table (#877)
e946770 eax v0.6.0 (#875)
88ceb7d deoxys v0.2.0 (#874)
7d22c81 belt-dwp v0.1.0 (#873)
09308ef ascon-aead128 v0.1.0 (#872)
e1b1e6e aes-siv v0.8.0 (#871)
303c27f ccm v0.6.0 (#869)
Additional commits viewable in compare view

Updates zeroize from 1.9.0 to 1.9.1

Commits

34a6ebc zeroize v1.9.1 (#1553)
e68c684 zeroize: test under cargo miri in CI (#1552)
4a53d7d Update Cargo.lock (#1545)
a2b1713 zeroize: fix fallback code used by optimization_barrier (#1551)
3c5aa70 ctutils v0.4.3 (#1550)
6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
f09945d ci: allow triggering workflows manually (#1543)
53493df dit v0.0.1-alpha (#1540)
c89949d Rename aarch64-dit to dit (#1539)
Additional commits viewable in compare view

Updates ureq from 3.3.0 to 3.4.2

Changelog

Sourced from ureq's changelog.

3.4.2

Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)

Bypass pooling for request connection settings incompatible with the Agent #1201

Try the next resolved address on unreachable/unavailable connect errors #1195

3.4.1

Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199

Do not pool connections with unconsumed buffered input #1198

Fix timeout budgets restarting and applying to later phases #1194

Complete TLS handshake during connect so timeout_connect covers it #1193

Speed up read_json for responses with a known, small body size #1191

3.4.0

Seal RequestExt (technically breaking) #1189

Send canonical Basic authentication scheme to CONNECT proxies #1185

Establish target TLS through HTTPS CONNECT proxies #1183

Update rustls-platform-verifier to 0.7.0 #1174

Fix pooled connections never aging out according to max_idle_age #1172

Strip brackets from IPv6-literal hosts before TLS SNI/ServerName #1171

RequestExt::middleware_config for conf inside middleware #1169

Commits

2e9ef24 3.4.2
b983841 Bump ureq-proto to 0.6.3
075a1d7 Respect request connection settings when pooling
fb634de Try the next resolved address when a connect fails for that address only (#1195)
cf4a3cd 3.4.1
9559d7b Bump ureq-proto to 0.6.2 (#1199)
9eb654c Do not pool a connection with unconsumed input (#1198)
5b81318 Anchor timeout budgets to phase boundaries (#1194)
d480543 Complete TLS handshakes while connecting (#1193)
662410b Buffer read_json into memory when Content-Length is below the limit (#1191)
Additional commits viewable in compare view

Updates jsonwebtoken from 11.0.0 to 11.1.0

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

Add dangerous::insecure_decode_claims

Commits

4c0ae75 Ready for release
46690b5 Add insecure_decode_claims (#539)
See full diff in compare view

Updates tree-sitter from 0.26.11 to 0.27.0

Release notes

Sourced from tree-sitter's releases.

v0.27.0

What's Changed

feat: start working on v0.27 by @clason in tree-sitter/tree-sitter#5127

docs(cli): include information on generated files by @clason in tree-sitter/tree-sitter#5129

fix(docs): remove conflicting --release cargo flag in contributing.md by @arkriny in tree-sitter/tree-sitter#5132

fix(cli): trailing whitespace after multiline text nodes in CST by @arkriny in tree-sitter/tree-sitter#5133

ci: bump the actions group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5137

fix(cli): correct discrepancy with cst for --no-ranges by @WillLillis in tree-sitter/tree-sitter#5134

ci: bump korthout/backport-action from 3 to 4 in the actions group by @dependabot[bot] in tree-sitter/tree-sitter#5155

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5154

Fix Playground Query by @kevin-hua-kraken in tree-sitter/tree-sitter#5150

fix(cli): cst printing improvements by @arkriny in tree-sitter/tree-sitter#5161

docs(cli): better description of files generated by init by @clason in tree-sitter/tree-sitter#5152

fix(cli): set language in cwd for all usages of highlight command by @WillLillis in tree-sitter/tree-sitter#5180

feat(cli): concurrent builds of the same grammar on different locations on disk by @stackmystack in tree-sitter/tree-sitter#5174

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5184

fix(cli): canonicalize build --output path by @WillLillis in tree-sitter/tree-sitter#5183

feat(cli): make test --update rewrite all corpus files by @arkriny in tree-sitter/tree-sitter#5179

build(deps): update rquickjs to 0.11.0 by @clason in tree-sitter/tree-sitter#5186

fix(cli): increase verbosity of tree-sitter init -u updates by @WillLillis in tree-sitter/tree-sitter#5178

fix(cli): restore test summary output for tree-sitter test by @arkriny in tree-sitter/tree-sitter#5197

feat(wasm): add some common used defs to wasm stdlib by @trim21 in tree-sitter/tree-sitter#5199

fix(wasm): update wasm-stdlib.h by @clason in tree-sitter/tree-sitter#5209

build(deps): bump clap from 4.5.53 to 4.5.54 in the cargo group by @dependabot[bot] in tree-sitter/tree-sitter#5211

Fix python free-threading compatibility by @kevmo314 in tree-sitter/tree-sitter#5212

fix(build): define _BSD_SOURCE by @WillLillis in tree-sitter/tree-sitter#5219

build(deps): bump the cargo group with 3 updates by @dependabot[bot] in tree-sitter/tree-sitter#5227

docs: various updates by @WillLillis in tree-sitter/tree-sitter#5228

fix(docs): appease clippy regarding spacing in README by @WillLillis in tree-sitter/tree-sitter#5236

fix(wasm): regenerate stdlib with wasm-opt by @clason in tree-sitter/tree-sitter#5237

fix: Clarify lifetime parameters; Rust 2018 idioms by @DanikVitek in tree-sitter/tree-sitter#5223

feat: free memory automatically by @theanarkh in tree-sitter/tree-sitter#5225

fix(cli): warn user when nm can't be run to verify the symbols inside the parser being built by @WillLillis in tree-sitter/tree-sitter#5245

feat(ci): ensure wasm-stdlib.h is regenerated when wasm stdlib source files are modified by @WillLillis in tree-sitter/tree-sitter#5229

docs(playground): highlight full row for highlighted nodes by @Tam1SH in tree-sitter/tree-sitter#5207

ci: bump actions/github-script from 7 to 8 in the actions group by @dependabot[bot] in tree-sitter/tree-sitter#5248

build(deps): bump cc from 1.2.52 to 1.2.53 in the cargo group by @dependabot[bot] in tree-sitter/tree-sitter#5247

wasm: give binaryen the wasi-sdk treatment by @WillLillis in tree-sitter/tree-sitter#5241

fix(loader): search correct cache directory for wasi-sdk clang by @WillLillis in tree-sitter/tree-sitter#5251

Fix tree-sitter-ruby crate failing to build to Wasm by @kossnocorp in tree-sitter/tree-sitter#5158

fix(wasm): add iswpunct to stdlib by @clason in tree-sitter/tree-sitter#5130

fix(lib): address strict aliasing violations with Array type by @WillLillis in tree-sitter/tree-sitter#5242

misc Windows fixes by @WillLillis in tree-sitter/tree-sitter#5256

docs: document parser library symbol checks for build command by @WillLillis in tree-sitter/tree-sitter#5258

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5263

fix(wasm): correct several bugs in realloc by @WillLillis in tree-sitter/tree-sitter#5261

fix(ci): add wasm-stdlib.h to cache key by @WillLillis in tree-sitter/tree-sitter#5266

fix(generate): error if a supertype is defined as a terminal by @WillLillis in tree-sitter/tree-sitter#5267

Action overflow by @WillLillis in tree-sitter/tree-sitter#5273

fix(wasm): don't wasm-opt twice by @clason in tree-sitter/tree-sitter#5253

... (truncated)

Commits

6070dbf fix(nix): remove Dockerfile reference from flake (#5892)
f52e78c build(deps): cargo update
49dbf70 fix(rust): ensure C returned pointers are non-null in
9540ea3 fix(lib): reject an old_tree from a different language
3e7be91 fix(rust): reject out-of-range node kind ids
f471709 fix(lib): bounds-check symbol and state ids in language lookups
5ddf71b fix(rust)!: expose QueryMatch::captures as a method
efa0dd9 fix(cli): correct zero-based positions for --edits
16d5e9d ci(checks): add lint-toml step using taplo
3ac04a6 docs: add taplo instructions
Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)

io: revert "always cleanup AsyncFd registration list on deregister" (#8540)

process: unregister Windows wait before closing child handle (#8564)

rt: drop blocking pool mutex before shutting down rejected task (#8562)

sync: fix mpsc index wraparound in block reclamation (#8546)

sync: forget mpsc Permit before sending value (#8560)

sync: validate MAX_PERMITS in Semaphore::acquire (#8548)

sync: wake broadcast Sender::closed outside mutex (#8558)

task: drop replaced waker outside lock in JoinSet (#8554)

time: drop timer lock before dropping waker in clear_entry (#8552)

time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

fs: clamp io_uring read length to u32::MAX (#8572)

rt: ignore current_thread task dumps from other runtimes (#8544)

rt: preserve io_uring context if a completion waker panics (#8566)

sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)

taskdump: restore deferred leaf wakes during capture (#8445)

time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

ff0c406 chore: prepare Tokio v1.53.2 (#8580)
a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
ec31a9f chore: prepare Tokio v1.51.5 (#8579)
625c851 sync: assign semaphore permits before emitting tracing event (#8542)
832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
9a47992 process: unregister Windows wait before closing child handle (#8564)
2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
Additional commits viewable in compare view

Updates syn from 3.0.3 to 3.0.6

Release notes

Sourced from syn's releases.

3.0.6

Fix parsing interpolated lifetime at statement start (#2082)

3.0.5

Report correct span for lex errors from LitStr::parse_with (#2080, thanks @sunshowers)

3.0.4

Allow safe fn in impl Parse for ForeignItemFn (#2078)

Commits

559cab5 Release 3.0.6
9088cad Merge pull request #2082 from dtolnay/lifetimevar
3eb43bb Fix parsing interpolated lifetime at statement start
7b2f6f9 Add regression test for issue 2081
d55bcd2 Update test suite to nightly-2026-09-13
8e37bca Resolve non_kebab_case_bins warning
4dfd88f Update test suite to nightly-2026-09-06
e0ad92d Release 3.0.5
74e7d75 Merge pull request #2080 from sunshowers/lit-str-span
4c264f3 In LitStr::parse_with, report correct span for lex errors
Additional commits viewable in compare view

Updates trybuild from 1.0.118 to 1.0.122

Release notes

Sourced from trybuild's releases.

1.0.122

Avoid triggering cargo::unused_workspace_dependencies warning in synthesized workspace (#344, thanks @tamaro-skaljic)

1.0.121

Replace target_triple dependency with target_tuple

1.0.120

Collect more path dependencies from dev deps and target deps (#340)

Prefer longest match in path dependency search (#341, #342)

1.0.119

Fix detection of crate features in new Cargo build-dir layout (#338, thanks @ranger-ross)

Commits

3f6a324 Release 1.0.122
ce13e9b Merge pull request 344 from tamaro-skaljic/fix/issue-343-unused-workspace-dep...
d027c0b Copy only inherited workspace dependencies into generated manifest
4b51119 Release 1.0.121
a061640 Rename target-triple -> target-tuple
2adc265 Release 1.0.120
bc87f59 Merge pull request #342 from dtolnay/longestdep
85d74ec Accept snapshots with original path dep behavior
a20999d Merge pull request #341 from dtolnay/longestdep
cf672ed Prefer longest match in path dependency search
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…rectory with 8 updates Bumps the rust-security-and-maintenance group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aes-gcm](https://github.com/RustCrypto/AEADs) | `0.11.0` | `0.11.1` | | [zeroize](https://github.com/RustCrypto/utils) | `1.9.0` | `1.9.1` | | [ureq](https://github.com/algesten/ureq) | `3.3.0` | `3.4.2` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `11.0.0` | `11.1.0` | | [tree-sitter](https://github.com/tree-sitter/tree-sitter) | `0.26.11` | `0.27.0` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [syn](https://github.com/dtolnay/syn) | `3.0.3` | `3.0.6` | | [trybuild](https://github.com/dtolnay/trybuild) | `1.0.118` | `1.0.122` | Updates `aes-gcm` from 0.11.0 to 0.11.1 - [Commits](RustCrypto/AEADs@aes-gcm-v0.11.0...aes-gcm-v0.11.1) Updates `zeroize` from 1.9.0 to 1.9.1 - [Commits](RustCrypto/utils@zeroize-v1.9.0...zeroize-v1.9.1) Updates `ureq` from 3.3.0 to 3.4.2 - [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md) - [Commits](algesten/ureq@3.3.0...3.4.2) Updates `jsonwebtoken` from 11.0.0 to 11.1.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v11.0.0...v11.1.0) Updates `tree-sitter` from 0.26.11 to 0.27.0 - [Release notes](https://github.com/tree-sitter/tree-sitter/releases) - [Commits](tree-sitter/tree-sitter@v0.26.11...v0.27.0) Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.2) Updates `syn` from 3.0.3 to 3.0.6 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](dtolnay/syn@3.0.3...3.0.6) Updates `trybuild` from 1.0.118 to 1.0.122 - [Release notes](https://github.com/dtolnay/trybuild/releases) - [Commits](dtolnay/trybuild@1.0.118...1.0.122) --- updated-dependencies: - dependency-name: aes-gcm dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: zeroize dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: ureq dependency-version: 3.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-security-and-maintenance - dependency-name: jsonwebtoken dependency-version: 11.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-security-and-maintenance - dependency-name: tree-sitter dependency-version: 0.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-security-and-maintenance - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: syn dependency-version: 3.0.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: trybuild dependency-version: 1.0.122 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-18T11:23:45Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot requested a review from RNT56 as a code owner October 11, 2026 11:25

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 11, 2026

dependabot Bot closed this Oct 18, 2026

dependabot Bot deleted the dependabot/cargo/rust-security-and-maintenance-ff954f3b9b branch October 18, 2026 11:23

Navigation Menu

Repository navigation

chore(deps): Bump the rust-security-and-maintenance group across 1 directory with 8 updates - #103

chore(deps): Bump the rust-security-and-maintenance group across 1 directory with 8 updates#103
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-security-and-maintenance-ff954f3b9b

dependabot Bot commented on behalf of github Oct 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.4.2

3.4.1

3.4.0

11.1.0 (2026-09-16)

v0.27.0

What's Changed

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

Fixed (unstable)

3.0.6

3.0.5

3.0.4

1.0.122

1.0.121

1.0.120

1.0.119

Uh oh!

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 11, 2026 •

edited

Loading