Skip to content

Bump the cargo group across 1 directory with 7 updates - #2

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-2049bed6aa
Open

Bump the cargo group across 1 directory with 7 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-2049bed6aa

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the cargo group with 7 updates in the / directory:

Package From To
arc-swap 1.9.2 1.9.3
rustls 0.23.45 0.23.46
serde_json 1.0.151 1.0.154
sha2 0.11.0 0.11.1
tokio 1.53.2 1.53.3
webpki-roots 1.0.9 1.0.10
zip 8.6.0 9.0.5

Updates arc-swap from 1.9.2 to 1.9.3

Changelog

Sourced from arc-swap's changelog.

1.9.3

  • rwlock-strategy feature: RwLock<()> as an explicit, opt-in strategy (ArcSwapAny<Arc<T>, RwLock<()>>). DefaultStrategy is unchanged (#210, #211).
Commits

Updates rustls from 0.23.45 to 0.23.46

Commits
  • f04804f Delay saving KX hint until handshake confirmation
  • 049d39b Bump version to 0.23.46
  • 6d0ba08 Eliminate secret from impl Debug for ServerSessionValue
  • 2b82b81 unbuffered: update TLS 1.3 traffic keys before exhausting them
  • 74343e7 conn: update TLS 1.3 traffic keys within fragmented writes
  • 795eea7 Advance the HPKE sequence only after seal succeeds
  • d67cb71 stream: provide backpressure while buffering received plaintext
  • 7a69ade util: fuse flushes from connections with errors
  • 493d089 conn: fuse writes for connections with errors
  • db00e01 util: keep flushing after short writes
  • Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

v1.0.153

v1.0.152

Commits
  • 20572a6 Release 1.0.154
  • a91bfaf Fix RandomState links in map documentation
  • 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
  • 4b2d726 Release 1.0.153
  • 83335ee Touch up PR 1345
  • 4b4810a Resolve range_plus_one pedantic clippy lint
  • 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
  • 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
  • c9f1e3b Release 1.0.152
  • 854fc70 Touch up PR 1347
  • Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

Updates tokio from 1.53.2 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

  • io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

  • io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

  • io: wake and drop DuplexStream wakers outside the lock (#8618)
  • macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
  • runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
  • sync: wake waiters outside the lock when closing a semaphore (#8529)
  • test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

  • rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Commits
  • a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
  • df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
  • f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
  • 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
  • 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
  • c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
  • 0448618 sync: make tracing_sync tests synchronous (#8427)
  • 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
  • bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
  • 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
  • Additional commits viewable in compare view

Updates webpki-roots from 1.0.9 to 1.0.10

Release notes

Sourced from webpki-roots's releases.

1.0.10

Changes:

  • Removed "emSign ECC Root CA - G3"

What's Changed

Commits
  • 7076047 webpki-roots|webpki-root-certs: 1.0.9 -> 1.0.10
  • c644e3e webpki-roots|webpki-root-certs: remove emSign roots
  • b7815ff ccadb: bump version to 0.2.2
  • 86423a8 ccadb: replace chrono with jiff
  • 3d8edab Upgrade num-bigint to 0.5
  • aa88673 ccadb: add crl_hosts() API
  • bb89979 ccadb: extract specific root PEM from build_client()
  • 782238f ccadb: extract build_client() helper function
  • 24886ba webpki-ccadb: only trust the CCADB root CA
  • 77edb21 Take semver-compatible dependency updates
  • Additional commits viewable in compare view

Updates zip from 8.6.0 to 9.0.5

Release notes

Sourced from zip's releases.

v9.0.5

🐛 Bug Fixes

  • use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
  • (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

  • Enable release-plz on backport branches in future (#1079)

v9.0.4

🐛 Bug Fixes

  • enclosed_name rejects a separator inside one verbatim path component (#1066)
  • return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

  • Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
  • update lzma-rust2 and ppmd-rust dependencies (#1060)

v9.0.3

🐛 Bug Fixes

  • Preserve directories' read-only status when extracting on non-Unix systems (#1054)

v9.0.1

🐛 Bug Fixes

  • set_permissions was still following symlinks in non-streaming extraction (#1038)
  • two arithmetic overflows in the implode decoder (#1028)
  • reject an empty archive whose central directory offset is past the EOCD (#1025)
  • don't panic when two entries extract to the same path (#1023)
  • fail reads that exceed the declared uncompressed size (#1022)
  • shrink decoder skipped LZW code 8191 (#1029)
  • write only the sentinel-marked values in a central ZIP64 field (#1027)

v9.0.0

🚀 Features

  • add ZipFileBuilder for parallelizing compression (#911)
  • add method by_index_with_data_descriptor (#994)
  • add len, is_empty and entry to ZipArchiveMetadata (#1015)
  • read data descriptor from binary (#990)
  • add comment and test for ZipStreamReader and symlinks (#985)
  • (write) add ZipWriter::hide_file for in-place entry deletion (#924)
  • add compression (#948)
  • add test to in place modification (#945)
  • move CustomExtraField to own file (#941)
  • add a test on enum size (#939)

... (truncated)

Changelog

Sourced from zip's changelog.

9.0.5 - 2026-10-17

🐛 Bug Fixes

  • use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
  • (write) prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)

⚙️ Miscellaneous Tasks

  • Enable release-plz on backport branches in future (#1079)

9.0.4 - 2026-10-16

🐛 Bug Fixes

  • enclosed_name rejects a separator inside one verbatim path component (#1066)
  • return Ok(None) when read_zipfile_from_stream is called on an empty archive (#1063)

⚙️ Miscellaneous Tasks

  • Revert impl Copy for Zip64CentralDirectoryEndLocator due to failing semver check, fix CI where most Miri tests weren't running, and other fixes so other PRs can pass CI (#1065)
  • update lzma-rust2 and ppmd-rust dependencies (#1060)

9.0.3 - 2026-10-13

🐛 Bug Fixes

  • Preserve directories' read-only status when extracting on non-Unix systems (#1054)

9.0.2 - 2026-10-11

🐛 Bug Fixes

  • additional bug fixes for symlink extraction

9.0.1 - 2026-10-10

🐛 Bug Fixes

  • set_permissions was still following symlinks in non-streaming extraction (#1038)
  • two arithmetic overflows in the implode decoder (#1028)
  • reject an empty archive whose central directory offset is past the EOCD (#1025)
  • don't panic when two entries extract to the same path (#1023)
  • fail reads that exceed the declared uncompressed size (#1022)
  • shrink decoder skipped LZW code 8191 (#1029)
  • write only the sentinel-marked values in a central ZIP64 field (#1027)

9.0.0 - 2026-10-08

🚀 Features

... (truncated)

Commits
  • 0123ed1 chore: release v9.0.5 (#1093)
  • 00cf82b docs: Repeal policy of yanking versions with known vulnerabilities, add menti...
  • 52165b9 chore: Enable release-plz on backport branches in future (#1079)
  • ca51e64 docs: Remove doc links that break when doc build doesn't enable all features ...
  • 6639687 fix: use mode_t for fchmodat's mode, which is u32 on NetBSD and OpenBSD (#1076)
  • 5e06fa8 fix(write): prevent duplicate 0x9901 AES extra field in raw_copy_file (#1078)
  • b6f9fb8 Merge commit from fork
  • ea2ccfe Merge commit from fork
  • 8068ab4 Merge commit from fork
  • 0b51128 doc: Clarifications to security policy (#1074)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the cargo group across 1 directory with 7 updates
e18a5c9 
Bumps the cargo group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [arc-swap](https://github.com/vorner/arc-swap) | `1.9.2` | `1.9.3` |
| [rustls](https://github.com/rustls/rustls) | `0.23.45` | `0.23.46` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.11.0` | `0.11.1` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.53.2` | `1.53.3` |
| [webpki-roots](https://github.com/rustls/webpki-roots) | `1.0.9` | `1.0.10` |
| [zip](https://github.com/zip-rs/zip2) | `8.6.0` | `9.0.5` |



Updates `arc-swap` from 1.9.2 to 1.9.3
- [Changelog](https://github.com/vorner/arc-swap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/arc-swap/commits/v1.9.3)

Updates `rustls` from 0.23.45 to 0.23.46
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.45...v/0.23.46)

Updates `serde_json` from 1.0.151 to 1.0.154
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.151...v1.0.154)

Updates `sha2` from 0.11.0 to 0.11.1
- [Commits](RustCrypto/hashes@sha2-v0.11.0...sha2-v0.11.1)

Updates `tokio` from 1.53.2 to 1.53.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.53.2...tokio-1.53.3)

Updates `webpki-roots` from 1.0.9 to 1.0.10
- [Release notes](https://github.com/rustls/webpki-roots/releases)
- [Commits](rustls/webpki-roots@v/1.0.9...v/1.0.10)

Updates `zip` from 8.6.0 to 9.0.5
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v8.6.0...v9.0.5)

---
updated-dependencies:
- dependency-name: arc-swap
  dependency-version: 1.9.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: rustls
  dependency-version: 0.23.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: serde_json
  dependency-version: 1.0.154
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.53.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: webpki-roots
  dependency-version: 1.0.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: zip
  dependency-version: 9.0.5
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants