Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

Bump the rust-dependencies group with 21 updates

Merged
Number: #1465
Type: Pull Request
State: Merged
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 0
Created: September 01, 2025 at 05:51 PM UTC
(8 days ago)
Updated: September 02, 2025 at 12:04 PM UTC
(7 days ago)
Merged: September 02, 2025 at 12:04 PM UTC
(7 days ago)
by abr-egn
Time to Close: about 18 hours
Labels:
dependencies rust
Description:

Bumps the rust-dependencies group with 21 updates:

Package From To
base64 0.13.1 0.22.1
bitflags 1.3.2 2.9.0
rand 0.8.5 0.9.1
socket2 0.5.10 0.6.0
thiserror 1.0.69 2.0.12
webpki-roots 0.26.11 1.0.0
aws-credential-types 1.2.5 1.2.6
pbkdf2 0.11.0 0.12.2
time 0.3.41 0.3.42
tracing-subscriber 0.3.19 0.3.20
aws-smithy-http-client 1.1.0 1.1.1
aws-smithy-json 0.61.4 0.61.5
aws-smithy-runtime 1.9.0 1.9.1
deranged 0.4.0 0.5.3
nu-ansi-term 0.46.0 0.50.1
potential_utf 0.1.2 0.1.3
quinn 0.11.8 0.11.9
quinn-proto 0.11.12 0.11.13
quinn-udp 0.5.13 0.5.14
time-core 0.1.4 0.1.5
time-macros 0.2.22 0.2.23

Updates base64 from 0.13.1 to 0.22.1

Changelog

Sourced from base64's changelog.

0.22.1

  • Correct the symbols used for the predefined alphabet::BIN_HEX.

0.22.0

  • DecodeSliceError::OutputSliceTooSmall is now conservative rather than precise. That is, the error will only occur if the decoded output cannot fit, meaning that Engine::decode_slice can now be used with exactly-sized output slices. As part of this, Engine::internal_decode now returns DecodeSliceError instead of DecodeError, but that is not expected to affect any external callers.
  • DecodeError::InvalidLength now refers specifically to the number of valid symbols being invalid (i.e. len % 4 == 1), rather than just the number of input bytes. This avoids confusing scenarios when based on interpretation you could make a case for either InvalidLength or InvalidByte being appropriate.
  • Decoding is somewhat faster (5-10%)

0.21.7

  • Support getting an alphabet's contents as a str via Alphabet::as_str()

0.21.6

  • Improved introductory documentation and example

0.21.5

  • Add Debug and Clone impls for the general purpose Engine

0.21.4

  • Make encoded_len const, allowing the creation of arrays sized to encode compile-time-known data lengths

0.21.3

  • Implement source instead of cause on Error types
  • Roll back MSRV to 1.48.0 so Debian can continue to live in a time warp
  • Slightly faster chunked encoding for short inputs
  • Decrease binary size

0.21.2

  • Rollback MSRV to 1.57.0 -- only dev dependencies need 1.60, not the main code

0.21.1

  • Remove the possibility of panicking during decoded length calculations
  • DecoderReader no longer sometimes erroneously ignores padding #226

Breaking changes

  • Engine.internal_decode return type changed
  • Update MSRV to 1.60.0

0.21.0

... (truncated)

Commits
  • e144006 v0.22.1
  • 64cca59 Merge pull request #271 from JobanSD/patch-1
  • 838355e Correct BinHex 4.0 alphabet according to specifications
  • bf15ccf Merge pull request #270 from marshallpierce/mp/clippy
  • fc6aabe Appease clippy
  • 9a518a2 Merge pull request #267 from bdura/patch-1
  • d96c80f Merge branch 'marshallpierce:master' into patch-1
  • 5d70ba7 Merge pull request #269 from marshallpierce/mp/decode-precisely
  • efb6c00 Release notes
  • 2b91084 Add some tests to boost coverage
  • Additional commits viewable in compare view

Updates bitflags from 1.3.2 to 2.9.0

Release notes

Sourced from bitflags's releases.

2.9.0

What's Changed

Full Changelog: https://github.com/bitflags/bitflags/compare/2.8.0...2.9.0

2.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/bitflags/bitflags/compare/2.7.0...2.8.0

2.7.0

What's Changed

New Contributors

Full Changelog: https://github.com/bitflags/bitflags/compare/2.6.0...2.7.0

2.6.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from bitflags's changelog.

2.9.0

What's Changed

Full Changelog: https://github.com/bitflags/bitflags/compare/2.8.0...2.9.0

2.8.0

What's Changed

New Contributors

Full Changelog: https://github.com/bitflags/bitflags/compare/2.7.0...2.8.0

2.7.0

What's Changed

New Contributors

Full Changelog: https://github.com/bitflags/bitflags/compare/2.6.0...2.7.0

2.6.0

What's Changed

New Contributors

... (truncated)

Commits
  • e197bf5 Merge pull request #439 from KodrAus/cargo/2.9.0
  • 8df6e80 prepare for 2.9.0 release
  • e92f0ae Merge pull request #438 from KodrAus/fix/ui-tests
  • 226ff75 fix up UI tests
  • 2170a26 Merge pull request #437 from wysiwys/wysiwys/add-clear-method
  • 76dde58 add tests for clear() trait method
  • ce5d420 add clear() method to trait
  • 9e45d36 Merge pull request #434 from bitflags/KodrAus-patch-1
  • 617645a pin checkout action for miri job
  • 2c836f2 Merge pull request #433 from bitflags/ci/remove-scorecard
  • Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.9.1

Changelog

Sourced from rand's changelog.

[0.9.1] - 2025-04-17

Security and unsafe

  • Revise "not a crypto library" policy again (#1565)
  • Remove zerocopy dependency from rand (#1579)

Fixes

  • Fix feature simd_support for recent nightly rust (#1586)

Changes

  • Allow fn rand::seq::index::sample_weighted and fn IndexedRandom::choose_multiple_weighted to return fewer than amount results (#1623), reverting an undocumented change (#1382) to the previous release.

Additions

  • Add rand::distr::Alphabetic distribution. (#1587)
  • Re-export rand_core (#1604)

[0.9.0] - 2025-01-27

Security and unsafe

  • Policy: "rand is not a crypto library" (#1514)
  • Remove fork-protection from ReseedingRng and ThreadRng. Instead, it is recommended to call ThreadRng::reseed on fork. (#1379)
  • Use zerocopy to replace some unsafe code (#1349, #1393, #1446, #1502)

Dependencies

  • Bump the MSRV to 1.63.0 (#1207, #1246, #1269, #1341, #1416, #1536); note that 1.60.0 may work for dependents when using --ignore-rust-version
  • Update to rand_core v0.9.0 (#1558)

Features

  • Support std feature without getrandom or rand_chacha (#1354)
  • Enable feature small_rng by default (#1455)
  • Remove implicit feature rand_chacha; use std_rng instead. (#1473)
  • Rename feature serde1 to serde (#1477)
  • Rename feature getrandom to os_rng (#1537)
  • Add feature thread_rng (#1547)

API changes: rand_core traits

  • Add fn RngCore::read_adapter implementing std::io::Read (#1267)
  • Add trait CryptoBlockRng: BlockRngCore; make trait CryptoRng: RngCore (#1273)
  • Add traits TryRngCore, TryCryptoRng (#1424, #1499)
  • Rename fn SeedableRng::from_rng -> try_from_rng and add infallible variant fn from_rng (#1424)
  • Rename fn SeedableRng::from_entropy -> from_os_rng and add fallible variant fn try_from_os_rng (#1424)
  • Add bounds Clone and AsRef to associated type SeedableRng::Seed (#1491)

API changes: Rng trait and top-level fns

  • Rename fn rand::thread_rng() to rand::rng() and remove from the prelude (#1506)
  • Remove fn rand::random() from the prelude (#1506)
  • Add top-level fns random_iter, random_range, random_bool, random_ratio, fill (#1488)
  • Re-introduce fn Rng::gen_iter as random_iter (#1305, #1500)
  • Rename fn Rng::gen to random to avoid conflict with the new gen keyword in Rust 2024 (#1438)
  • Rename fns Rng::gen_range to random_range, gen_bool to random_bool, gen_ratio to random_ratio (#1505)
  • Annotate panicking methods with #[track_caller] (#1442, #1447)

... (truncated)

Commits
  • ec6d5c0 Prepare rand_core v0.9.1 (#1591)
  • 6a06056 rand_core: introduce an UnwrapMut wrapper (#1589)
  • 8929123 Add Alphabetic distribution (#1587)
  • 06b1642 Remove unnecessary underscore from `impl<T, const N: usize> Distribution<[T; ...
  • 49d76cd rename extract to extract_lane (#1586)
  • e0a70fd Change to use array::from_fn in Distribution\<[T; N]> for StandardUniform ...
  • 0bc3f65 Move rand distr (#1577)
  • 2677c49 Revise "not a crypto library" policy and SECURITY.md (#1565)
  • bfd1826 SeedableRng docs: add note on (lack of) reproducibility (#1572)
  • c01aee7 Fix some links (#1571)
  • Additional commits viewable in compare view

Updates socket2 from 0.5.10 to 0.6.0

Changelog

Sourced from socket2's changelog.

0.6.0

Breaking changes

All IPv4 methods now have a _v4 suffix, IPv6 uses _v6. TCP methods have a tcp_ prefix (looked better than a suffix).

Furthermore we removed all types from external libraries (i.e. libc or windows-sys) from the public API, allowing us to update those without breaking the API.

  • Renamed Socket::freebind_ipv6 to freebind_v6 (rust-lang/socket2#592).
  • Renamed Socket::freebind to freebind_v4 (rust-lang/socket2#592).
  • Renamed Socket::original_dst to original_dst_v4 (rust-lang/socket2#592).
  • Renamed Socket::original_dst_ipv6 to original_dst_v6 (rust-lang/socket2#592).
  • Bump MSRV to 1.70 (rust-lang/socket2#597).
  • Use c_int from std::ffi instead of from libc (rust-lang/socket2#599, rust-lang/socket2#595).
  • SockAddr's methods now accept/return SockAddrStorage instead of sockaddr_storage/SOCKADDR_STORAGE (rust-lang/socket2#576):
    • new
    • try_init
    • as_ptr
    • as_storage
  • Add SockFilter, wrapper around libc::sock_filter, argument to Socket::attach_filter (rust-lang/socket2#581).
  • Various renames of TCP methods on Socket (rust-lang/socket2#592):
    • keepalive_time -> tcp_keepalive_time
    • keepalive_interval -> tcp_keepalive_interval
    • keepalive_retries -> tcp_keepalive_retries
    • nodelay -> tcp_nodelay
    • set_nodelay -> set_tcp_nodelay
    • tcp_mss -> mss
    • tcp_set_mss -> set_mss
    • tcp_cork -> cork
    • tcp_set_cork -> set_cork
    • tcp_quickack -> quickack
    • tcp_set_quickack -> set_quickack
    • thin_linear_timeouts -> tcp_thin_linear_timeouts.

Non-breaking changes

... (truncated)

Commits

Updates thiserror from 1.0.69 to 2.0.12

Release notes

Sourced from thiserror's releases.

2.0.12

  • Prevent elidable_lifetime_names pedantic clippy lint in generated impl (#413)

2.0.11

2.0.10

  • Support errors containing a generic type parameter's associated type in a field (#408)

2.0.9

  • Work around missing_inline_in_public_items clippy restriction being triggered in macro-generated code (#404)

2.0.8

  • Improve support for macro-generated derive(Error) call sites (#399)

2.0.7

  • Work around conflict with #[deny(clippy::allow_attributes)] (#397, thanks @​zertosh)

2.0.6

  • Suppress deprecation warning on generated From impls (#396)

2.0.5

  • Prevent deprecation warning on generated impl for deprecated type (#394)

2.0.4

  • Eliminate needless_lifetimes clippy lint in generated From impls (#391, thanks @​matt-phylum)

2.0.3

  • Support the same Path field being repeated in both Debug and Display representation in error message (#383)
  • Improve error message when a format trait used in error message is not implemented by some field (#384)

2.0.2

  • Fix hang on invalid input inside #[error(...)] attribute (#382)

2.0.1

  • Support errors that contain a dynamically sized final field (#375)
  • Improve inference of trait bounds for fields that are interpolated multiple times in an error message (#377)

2.0.0

Breaking changes

  • Referencing keyword-named fields by a raw identifier like {r#type} inside a format string is no longer accepted; simply use the unraw name like {type} (#347)

    This aligns thiserror with the standard library's formatting macros, which gained support for implicit argument capture later than the release of this feature in thiserror 1.x.

    #[derive(Error, Debug)]
#[error("... {type} ...")]  // Before: {r#type}
pub struct Error {
    pub r#type: Type,

... (truncated)

Commits
  • 95a5126 Release 2.0.12
  • 76490f7 Merge pull request #413 from dtolnay/elidablelifetime
  • 9f27b76 Ignore elidable_lifetime_names pedantic clippy lint
  • daf2a6f Resolve some elidable_lifetime_names pedantic clippy lint
  • 5f07160 Point standard library links to stable
  • 6706a51 Convert html links to intra-doc links
  • 2706873 More precise gitignore patterns
  • 70bc20d Remove **/*.rs.bk from project-specific gitignore
  • 0f532e3 Release 2.0.11
  • 3d15543 Merge pull request #410 from dtolnay/testnostd
  • Additional commits viewable in compare view

Updates webpki-roots from 0.26.11 to 1.0.0

Release notes

Sourced from webpki-roots's releases.

1.0.0

After 51 releases over about nine years, this is the first stable release of the webpki-roots and webpki-root-certs crates.

The 1.0.0 release is functionally equal to the 0.26.10 release. We will make a 0.26.11 release that uses 1.0.0 using the semver trick.

What's Changed

Full Changelog: https://github.com/rustls/webpki-roots/compare/v/0.26.10...v/1.0.0

Commits

Updates aws-credential-types from 1.2.5 to 1.2.6

Commits

Updates pbkdf2 from 0.11.0 to 0.12.2

Commits

Updates time from 0.3.41 to 0.3.42

Release notes

Sourced from time's releases.

v0.3.42

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.42 [2025-08-31]

Added

  • Time::duration_until
  • Time::duration_since
  • per_t method for all types in time::convert. This is similar to the existing per method, but can return any of the primitive numeric types that can represent the result. This will cut down on as casts while ensuring correctness. Type inference isn't perfect, so you may need to provide a type annotation in some situations.
  • impl PartialOrd for Month and impl Ord for Month; this assumes the months are in the same year
  • SystemTimeExt trait, adding methods for checked arithmetic with time::Duration and obtaining the difference between two SystemTimes as a time::Duration
  • Permit using UtcDateTime with rand (this was inadvertently omitted previously)
  • impl core::error::Error for all error types (now available when the std feature is disabled)
  • MacOS can now obtain the local UTC offset in multi-threaded programs as the system APIs are thread-safe.
  • #[track_caller] has been added to all relevant methods.

Changed

  • The minimum supported Rust version is now 1.81.0.
  • The dependency on itoa has been removed, as the standard library now has similar functionality by default.
  • Formatting a component that involves a floating point number is now guaranteed to be deterministic, avoiding any subtle differences between platforms or compiler versions.

Fixed

  • Serializing timestamps with nanosecond precision should always emit the correct value. Previously, it could be off by one nanosecond due to floating point imprecision.
  • A previously unknown bug in OffsetDateTime::to_offset and UtcDateTime::to_offset has been fixed. The bug could result in a value that was invalid. It was unlikely to ever occur in real-world code, as it involved passing a UTC offset that has never been used in any location.

Miscellaneous

  • The amount of code generated by macros has been massively reduced, on the order of 65-70% for typical use cases of format_description!.
  • Significant performance gains for comparisons of Time, PrimitiveDateTime, UtcDateTime, and OffsetDateTime. The first three have gains of approximately 85% (i.e. 6× faster).
  • Nearly all methods are #[inline].
Commits

Updates tracing-subscriber from 0.3.19 to 0.3.20

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.20

Security Fix: ANSI Escape Sequence Injection (CVE-TBD)

Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

  • Manipulate terminal title bars
  • Clear screens or modify terminal display
  • Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

Solution

Version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

Affected Versions

All versions of tracing-subscriber prior to 0.3.20 are affected by this vulnerability.

Recommendations

Immediate Action Required: We recommend upgrading to tracing-subscriber 0.3.20 immediately, especially if your application:

  • Logs user-provided input (form data, HTTP headers, query parameters, etc.)
  • Runs in environments where terminal output is displayed to users

Migration

This is a patch release with no breaking API changes. Simply update your Cargo.toml:

[dependencies]
tracing-subscriber = "0.3.20"

Acknowledgments

We would like to thank zefr0x who responsibly reported the issue at security@tokio.rs.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at security@tokio.rs.

Commits

Updates aws-smithy-http-client from 1.1.0 to 1.1.1

Commits

Updates aws-smithy-json from 0.61.4 to 0.61.5

Commits

Updates aws-smithy-runtime from 1.9.0 to 1.9.1

Commits

Updates deranged from 0.4.0 to 0.5.3

Commits

Updates nu-ansi-term from 0.46.0 to 0.50.1

Release notes

Sourced from nu-ansi-term's releases.

v0.50.1

What's Changed

Full Changelog: https://github.com/nushell/nu-ansi-term/compare/v0.50.0...v0.50.1

v0.50.0

What's Changed

New Contributors

Full Changelog: https://github.com/nushell/nu-ansi-term/compare/v0.49.0...v0.50.0

v0.49.0

This release attempts to fix API limitations of the previous 0.48.0 release. You can now again construct Style directly through its fields.

Breaking changes

coming from 0.47.0

  • Style has now a prefix_with_reset field to enable additional reset sequences that are introduced before setting a style.

coming from 0.48.0

  • Style.with_reset has been renamed to Style.prefix_with_reset
  • AnsiGenericString::hyperlink() changed in signature from ...(&mut self, ...) to ...(self, ...) -> Self
  • AnsiGenericString::icon() and ::cwd() have been removed for now.

What's Changed

Full Changelog: https://github.com/nushell/nu-ansi-term/compare/v0.48.0...v0.49.0

v0.48.0

Warning This release introduces an unintended breaking change for users that want to construct Style directly. (see #46 for tracking)

New features

This release introduces support to express several OSC control codes by calling methods on AnsiGenericString. Primarily you can now mark particular text with a hyperlink by calling .hyperlink() on it.

... (truncated)

Changelog

Sourced from nu-ansi-term's changelog.

Changelog

v0.47.0 (2023-03-13)

Breaking changes

  • Bumped minimum supported Rust version (MSRV) to 1.62.1
  • Change of Color::default() value to the ANSI default color Color::Default (code 39 and 49 for foreground and background respectively). This replaces Color::White as the default value.

Other changes

  • constification of several functions and methods.
  • Improved CI workflow.
  • Updated to Rust edition 2021.
  • Replaced winapi dependency with windows-sys.
  • Removed overload dependency.
  • Added AnsiGenericString::as_str() to allow access to the underlying string.
  • Fixed typos in README.
  • Added CHANGELOG.md for changes since forking ansi_term.
Commits

Updates potential_utf from 0.1.2 to 0.1.3

Changelog

Sourced from potential_utf's changelog.

Changelog

Unreleased

  • Components
    • General
    • icu_calendar
      • Fix und-SA-u-ca-islamic (unicode-org#6736)
  • Data model and providers
    • ...
  • FFI
    • icu_capi
      • All C++ enums now default to a valid value; which is the Default impl where there is one, and some semi-logical value otherwise. This has changed defaults in some cases and may cause a behavioral change for people relying on C++ default constructors. (unicode-org#6692)
  • Utils
    • yoke
      • Add four map_with_cart methods to yoke...

        Description has been truncated

Pull Request Statistics
Commits:
1
Files Changed:
1
Additions:
+38
Deletions:
-68
Package Dependencies
Package:
rand
Ecosystem:
cargo
Version Change:
0.8.5 → 0.9.1
Update Type:
Minor
Package:
thiserror
Ecosystem:
cargo
Version Change:
1.0.69 → 2.0.12
Update Type:
Major
Package:
base64
Ecosystem:
cargo
Version Change:
0.13.1 → 0.22.1
Update Type:
Minor
Package:
aws-smithy-http-client
Ecosystem:
cargo
Version Change:
1.1.0 → 1.1.1
Update Type:
Patch
Package:
bitflags
Ecosystem:
cargo
Version Change:
1.3.2 → 2.9.0
Update Type:
Major
Package:
quinn
Ecosystem:
cargo
Version Change:
0.11.8 → 0.11.9
Update Type:
Patch
Package:
quinn-udp
Ecosystem:
cargo
Version Change:
0.5.13 → 0.5.14
Update Type:
Patch
Package:
socket2
Ecosystem:
cargo
Version Change:
0.5.10 → 0.6.0
Update Type:
Minor
Package:
time
Ecosystem:
cargo
Version Change:
0.3.41 → 0.3.42
Update Type:
Patch
Package:
webpki-roots
Ecosystem:
cargo
Version Change:
0.26.11 → 1.0.0
Update Type:
Major
Package:
tracing-subscriber
Ecosystem:
cargo
Version Change:
0.3.19 → 0.3.20
Update Type:
Patch
Package:
aws-credential-types
Ecosystem:
cargo
Version Change:
1.2.5 → 1.2.6
Update Type:
Patch
Package:
quinn-proto
Ecosystem:
cargo
Version Change:
0.11.12 → 0.11.13
Update Type:
Patch
Package:
aws-smithy-runtime
Ecosystem:
cargo
Version Change:
1.9.0 → 1.9.1
Update Type:
Patch
Package:
aws-smithy-json
Ecosystem:
cargo
Version Change:
0.61.4 → 0.61.5
Update Type:
Patch
Package:
time-core
Ecosystem:
cargo
Version Change:
0.1.4 → 0.1.5
Update Type:
Patch
Package:
nu-ansi-term
Ecosystem:
cargo
Version Change:
0.46.0 → 0.50.1
Update Type:
Minor
Package:
pbkdf2
Ecosystem:
cargo
Version Change:
0.11.0 → 0.12.2
Update Type:
Minor
Package:
deranged
Ecosystem:
cargo
Version Change:
0.4.0 → 0.5.3
Update Type:
Minor
Package:
potential_utf
Ecosystem:
cargo
Version Change:
0.1.2 → 0.1.3
Update Type:
Patch
Package:
time-macros
Ecosystem:
cargo
Version Change:
0.2.22 → 0.2.23
Update Type:
Patch
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 6316294
UUID: 2790484770
Node ID: PR_kwDOCvnhg86mU2si
Host: GitHub
Repository: mongodb/mongo-rust-driver
Merge State: Unknown