chore(deps): Bump the rust-security-and-maintenance group across 1 directory with 9 updates by dependabot[bot] · Pull Request #104 · RNT56/CrustCore

dependabot · 2026-10-18T11:24:06Z

Bumps the rust-security-and-maintenance group with 9 updates in the / directory:

Package	From	To
aes-gcm	`0.11.0`	`0.11.1`
zeroize	`1.9.0`	`1.9.1`
serde_json	`1.0.151`	`1.0.154`
ureq	`3.3.0`	`3.4.2`
jsonwebtoken	`11.0.0`	`11.1.0`
tree-sitter	`0.26.11`	`0.27.1`
tokio	`1.53.1`	`1.53.3`
syn	`3.0.3`	`3.0.9`
trybuild	`1.0.118`	`1.0.122`

Updates aes-gcm from 0.11.0 to 0.11.1

Commits

2eff6cc Cut releases that replace subtle with ctutils (#880)
c90047f Replace subtle with ctutils (#879)
da2169e ocb3: remove unused ctr and zeroize dependencies (#876)
f5374f3 Add missing crates to the root readme table (#877)
e946770 eax v0.6.0 (#875)
88ceb7d deoxys v0.2.0 (#874)
7d22c81 belt-dwp v0.1.0 (#873)
09308ef ascon-aead128 v0.1.0 (#872)
e1b1e6e aes-siv v0.8.0 (#871)
303c27f ccm v0.6.0 (#869)
Additional commits viewable in compare view

Updates zeroize from 1.9.0 to 1.9.1

Commits

34a6ebc zeroize v1.9.1 (#1553)
e68c684 zeroize: test under cargo miri in CI (#1552)
4a53d7d Update Cargo.lock (#1545)
a2b1713 zeroize: fix fallback code used by optimization_barrier (#1551)
3c5aa70 ctutils v0.4.3 (#1550)
6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
f09945d ci: allow triggering workflows manually (#1543)
53493df dit v0.0.1-alpha (#1540)
c89949d Rename aarch64-dit to dit (#1539)
Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

Support preserve_order in no_std builds (#1333, thanks @razmser)

v1.0.153

Report invalid UTF-8 at the first bad byte (#1345, thanks @00200200)

v1.0.152

Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @yuxi-liu-wired)

Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @yuxi-liu-wired)

Commits

20572a6 Release 1.0.154
a91bfaf Fix RandomState links in map documentation
3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
4b2d726 Release 1.0.153
83335ee Touch up PR 1345
4b4810a Resolve range_plus_one pedantic clippy lint
8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
c9f1e3b Release 1.0.152
854fc70 Touch up PR 1347
Additional commits viewable in compare view

Updates ureq from 3.3.0 to 3.4.2

Changelog

Sourced from ureq's changelog.

3.4.2

Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)

Bypass pooling for request connection settings incompatible with the Agent #1201

Try the next resolved address on unreachable/unavailable connect errors #1195

3.4.1

Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199

Do not pool connections with unconsumed buffered input #1198

Fix timeout budgets restarting and applying to later phases #1194

Complete TLS handshake during connect so timeout_connect covers it #1193

Speed up read_json for responses with a known, small body size #1191

3.4.0

Seal RequestExt (technically breaking) #1189

Send canonical Basic authentication scheme to CONNECT proxies #1185

Establish target TLS through HTTPS CONNECT proxies #1183

Update rustls-platform-verifier to 0.7.0 #1174

Fix pooled connections never aging out according to max_idle_age #1172

Strip brackets from IPv6-literal hosts before TLS SNI/ServerName #1171

RequestExt::middleware_config for conf inside middleware #1169

Commits

2e9ef24 3.4.2
b983841 Bump ureq-proto to 0.6.3
075a1d7 Respect request connection settings when pooling
fb634de Try the next resolved address when a connect fails for that address only (#1195)
cf4a3cd 3.4.1
9559d7b Bump ureq-proto to 0.6.2 (#1199)
9eb654c Do not pool a connection with unconsumed input (#1198)
5b81318 Anchor timeout budgets to phase boundaries (#1194)
d480543 Complete TLS handshakes while connecting (#1193)
662410b Buffer read_json into memory when Content-Length is below the limit (#1191)
Additional commits viewable in compare view

Updates jsonwebtoken from 11.0.0 to 11.1.0

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

Add dangerous::insecure_decode_claims

Commits

4c0ae75 Ready for release
46690b5 Add insecure_decode_claims (#539)
See full diff in compare view

Updates tree-sitter from 0.26.11 to 0.27.1

Release notes

Sourced from tree-sitter's releases.

v0.27.1

What's Changed

fix: decode UTF-16 surrogate pairs with input endianness by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5913

fix(cli)!: fix query test capture range matching across lines by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5918

fix(rust): address new nightly lints by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5921

fix(generate): resolve token names in debug output by @WillLillis in tree-sitter/tree-sitter#5941

fix(generate): keep GCC jump tables enabled for large lexers by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5985

fix(generate): exclude external word tokens from keyword extraction by @WillLillis in tree-sitter/tree-sitter#5989

fix(lib): check shifted stack versions during error recovery by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#5998

fix(generate): detect indirect recursion in flattened productions by @WillLillis in tree-sitter/tree-sitter#6003

fix: preserve column dependency when balancing repeat nodes by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6006

perf(lib): acquire capture lists from a free stack instead of scanning by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6012

fix(build): don't compile the Wasm stdlib into Emscripten builds by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6015

fix: various query issues by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6017

fix(rust): ban std::fs::canonicalize by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6018

fix(bindings): load Node bindings under Bun again by @tree-sitter-ci-bot[bot] in tree-sitter/tree-sitter#6021

release v0.27.1 by @clason in tree-sitter/tree-sitter#6024

Full Changelog: tree-sitter/tree-sitter@v0.27.0...v0.27.1

v0.27.0

What's Changed

feat: start working on v0.27 by @clason in tree-sitter/tree-sitter#5127

docs(cli): include information on generated files by @clason in tree-sitter/tree-sitter#5129

fix(docs): remove conflicting --release cargo flag in contributing.md by @arkriny in tree-sitter/tree-sitter#5132

fix(cli): trailing whitespace after multiline text nodes in CST by @arkriny in tree-sitter/tree-sitter#5133

ci: bump the actions group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5137

fix(cli): correct discrepancy with cst for --no-ranges by @WillLillis in tree-sitter/tree-sitter#5134

ci: bump korthout/backport-action from 3 to 4 in the actions group by @dependabot[bot] in tree-sitter/tree-sitter#5155

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5154

Fix Playground Query by @kevin-hua-kraken in tree-sitter/tree-sitter#5150

fix(cli): cst printing improvements by @arkriny in tree-sitter/tree-sitter#5161

docs(cli): better description of files generated by init by @clason in tree-sitter/tree-sitter#5152

fix(cli): set language in cwd for all usages of highlight command by @WillLillis in tree-sitter/tree-sitter#5180

feat(cli): concurrent builds of the same grammar on different locations on disk by @stackmystack in tree-sitter/tree-sitter#5174

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5184

fix(cli): canonicalize build --output path by @WillLillis in tree-sitter/tree-sitter#5183

feat(cli): make test --update rewrite all corpus files by @arkriny in tree-sitter/tree-sitter#5179

build(deps): update rquickjs to 0.11.0 by @clason in tree-sitter/tree-sitter#5186

fix(cli): increase verbosity of tree-sitter init -u updates by @WillLillis in tree-sitter/tree-sitter#5178

fix(cli): restore test summary output for tree-sitter test by @arkriny in tree-sitter/tree-sitter#5197

feat(wasm): add some common used defs to wasm stdlib by @trim21 in tree-sitter/tree-sitter#5199

fix(wasm): update wasm-stdlib.h by @clason in tree-sitter/tree-sitter#5209

build(deps): bump clap from 4.5.53 to 4.5.54 in the cargo group by @dependabot[bot] in tree-sitter/tree-sitter#5211

Fix python free-threading compatibility by @kevmo314 in tree-sitter/tree-sitter#5212

fix(build): define _BSD_SOURCE by @WillLillis in tree-sitter/tree-sitter#5219

build(deps): bump the cargo group with 3 updates by @dependabot[bot] in tree-sitter/tree-sitter#5227

docs: various updates by @WillLillis in tree-sitter/tree-sitter#5228

fix(docs): appease clippy regarding spacing in README by @WillLillis in tree-sitter/tree-sitter#5236

... (truncated)

Commits

10eb5ac release v0.27.1
1bf93c4 fix(bindings): embed queries in Bun standalone executables
2173ca8 fix(bindings): await the load check in the Node binding test
a89d5b8 fix(bindings): load Node bindings under Bun again
17d6c94 fix(bindings): load node-types.json on Windows
825b3e4 fix(rust): ban std::fs::canonicalize
4eb3973 fix(web): pass the progress callback to the cursor in Query.captures
60cdb55 fix(test): give the query timeout tests room to time out
bdf4e7e fix(lib): charge query cursor work for the states it visits
dc21d38 fix(lib): halt the query cursor when the progress callback asks to stop
Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

io: wake and drop DuplexStream wakers outside the lock (#8618)

macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)

runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)

sync: wake waiters outside the lock when closing a semaphore (#8529)

test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)

io: revert "always cleanup AsyncFd registration list on deregister" (#8540)

process: unregister Windows wait before closing child handle (#8564)

rt: drop blocking pool mutex before shutting down rejected task (#8562)

sync: fix mpsc index wraparound in block reclamation (#8546)

sync: forget mpsc Permit before sending value (#8560)

sync: validate MAX_PERMITS in Semaphore::acquire (#8548)

sync: wake broadcast Sender::closed outside mutex (#8558)

task: drop replaced waker outside lock in JoinSet (#8554)

time: drop timer lock before dropping waker in clear_entry (#8552)

time: expire timers directly on shutdown without rotating wheel (#8570)

... (truncated)

Commits

a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
482eadd runtime: record time wake when unparking tasks on current thread (#8595)
55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
0448618 sync: make tracing_sync tests synchronous (#8427)
2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
Additional commits viewable in compare view

Updates syn from 3.0.3 to 3.0.9

Release notes

Sourced from syn's releases.

3.0.9

Add Punctuated::retain (#2088)

3.0.8

Fix parsing of <- and -> tokens in expressions (#2086, #2087)

3.0.7

Fix parsing absolute path expr in labeled break (#2085, thanks @A4-Tacks)

3.0.6

Fix parsing interpolated lifetime at statement start (#2082)

3.0.5

Report correct span for lex errors from LitStr::parse_with (#2080, thanks @sunshowers)

3.0.4

Allow safe fn in impl Parse for ForeignItemFn (#2078)

Commits

7c44a55 Release 3.0.9
13234ab Merge pull request #2088 from dtolnay/retain
b617dc9 Add Punctuated::retain
f18a083 Release 3.0.8
e1eab98 Merge pull request #2087 from dtolnay/rightarrow
5345ee5 Allow end of expr before ->
5631c74 Merge pull request #2086 from dtolnay/leftarrow
c5b3cf0 Fix left arrow being split into less-than and negative-sign
ec4c2da Release 3.0.7
f947cf7 Merge pull request #2085 from A4-Tacks/break-label-abs-path
Additional commits viewable in compare view

Updates trybuild from 1.0.118 to 1.0.122

Release notes

Sourced from trybuild's releases.

1.0.122

Avoid triggering cargo::unused_workspace_dependencies warning in synthesized workspace (#344, thanks @tamaro-skaljic)

1.0.121

Replace target_triple dependency with target_tuple

1.0.120

Collect more path dependencies from dev deps and target deps (#340)

Prefer longest match in path dependency search (#341, #342)

1.0.119

Fix detection of crate features in new Cargo build-dir layout (#338, thanks @ranger-ross)

Commits

3f6a324 Release 1.0.122
ce13e9b Merge pull request 344 from tamaro-skaljic/fix/issue-343-unused-workspace-dep...
d027c0b Copy only inherited workspace dependencies into generated manifest
4b51119 Release 1.0.121
a061640 Rename target-triple -> target-tuple
2adc265 Release 1.0.120
bc87f59 Merge pull request #342 from dtolnay/longestdep
85d74ec Accept snapshots with original path dep behavior
a20999d Merge pull request #341 from dtolnay/longestdep
cf672ed Prefer longest match in path dependency search
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…rectory with 9 updates Bumps the rust-security-and-maintenance group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aes-gcm](https://github.com/RustCrypto/AEADs) | `0.11.0` | `0.11.1` | | [zeroize](https://github.com/RustCrypto/utils) | `1.9.0` | `1.9.1` | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [ureq](https://github.com/algesten/ureq) | `3.3.0` | `3.4.2` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `11.0.0` | `11.1.0` | | [tree-sitter](https://github.com/tree-sitter/tree-sitter) | `0.26.11` | `0.27.1` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.3` | | [syn](https://github.com/dtolnay/syn) | `3.0.3` | `3.0.9` | | [trybuild](https://github.com/dtolnay/trybuild) | `1.0.118` | `1.0.122` | Updates `aes-gcm` from 0.11.0 to 0.11.1 - [Commits](RustCrypto/AEADs@aes-gcm-v0.11.0...aes-gcm-v0.11.1) Updates `zeroize` from 1.9.0 to 1.9.1 - [Commits](RustCrypto/utils@zeroize-v1.9.0...zeroize-v1.9.1) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `ureq` from 3.3.0 to 3.4.2 - [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md) - [Commits](algesten/ureq@3.3.0...3.4.2) Updates `jsonwebtoken` from 11.0.0 to 11.1.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v11.0.0...v11.1.0) Updates `tree-sitter` from 0.26.11 to 0.27.1 - [Release notes](https://github.com/tree-sitter/tree-sitter/releases) - [Commits](tree-sitter/tree-sitter@v0.26.11...v0.27.1) Updates `tokio` from 1.53.1 to 1.53.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.3) Updates `syn` from 3.0.3 to 3.0.9 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](dtolnay/syn@3.0.3...3.0.9) Updates `trybuild` from 1.0.118 to 1.0.122 - [Release notes](https://github.com/dtolnay/trybuild/releases) - [Commits](dtolnay/trybuild@1.0.118...1.0.122) --- updated-dependencies: - dependency-name: aes-gcm dependency-version: 0.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: zeroize dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: ureq dependency-version: 3.4.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-security-and-maintenance - dependency-name: jsonwebtoken dependency-version: 11.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-security-and-maintenance - dependency-name: tree-sitter dependency-version: 0.27.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust-security-and-maintenance - dependency-name: tokio dependency-version: 1.53.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: syn dependency-version: 3.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance - dependency-name: trybuild dependency-version: 1.0.122 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust-security-and-maintenance ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from RNT56 as a code owner October 18, 2026 11:24

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 18, 2026

Navigation Menu

Repository navigation

chore(deps): Bump the rust-security-and-maintenance group across 1 directory with 9 updates - #104

chore(deps): Bump the rust-security-and-maintenance group across 1 directory with 9 updates#104
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-security-and-maintenance-dc1b18902a

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 18, 2026

v1.0.154

v1.0.153

v1.0.152

3.4.2

3.4.1

3.4.0

11.1.0 (2026-09-16)

v0.27.1

What's Changed

v0.27.0

What's Changed

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

Changed

Fixed

Fixed (unstable)

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

3.0.9

3.0.8

3.0.7

3.0.6

3.0.5

3.0.4

1.0.122

1.0.121

1.0.120

1.0.119

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants