Skip to content

fix(deps): update all#52

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all
Open

fix(deps): update all#52
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Feb 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
bytes dependencies minor 1.11.1 → 1.12.1
http-body-util dependencies patch 0.1.3 → 0.1.4
hyper (source) dependencies minor 1.8.1 → 1.10.1
hyper-rustls dependencies patch 0.27.7 → 0.27.9
libversion-sys dependencies digest 6839151 → 93c5691
once_cell dependencies patch 1.21.3 → 1.21.4
quick-xml dependencies minor 0.39.0 → 0.41.0
rand (source) dev-dependencies patch 0.10.0 → 0.10.2
regex dependencies minor 1.12.3 → 1.13.1
reqwest dependencies patch 0.13.2 → 0.13.4
rustls dependencies patch 0.23.36 → 0.23.42
rustls-platform-verifier dependencies minor 0.6.2 → 0.7.0
serde_json dependencies patch 1.0.149 → 1.0.150
serial_test dev-dependencies minor 3.4.0 → 3.5.0
tempfile (source) dev-dependencies minor 3.26.0 → 3.27.0
tokio (source) dependencies minor 1.49.0 → 1.52.4
uuid dependencies minor 1.21.0 → 1.24.0

Release Notes

tokio-rs/bytes (bytes)

v1.12.1

Compare Source

Fixed
  • Properly handle when Box::new panics (#​837)

v1.12.0

Compare Source

Added
  • Add BytesMut::extend_from_within() (#​818)
  • Add BytesMut::try_unsplit() (#​746)
Fixed
  • Fix panic in get_int if nbytes is zero (#​806)
Changed
  • Pass vtable data by value (#​826)
  • Exclude development scripts from published package (#​810)
Documented
  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#​808)
hyperium/http-body (http-body-util)

v0.1.4

Compare Source

What's Changed

  • Add Fused body combinator that always returns None once completed.
  • Add BodyExt::into_stream() to convert a body into a Stream.
  • Add Full::into_inner() to get the full Buf.
  • Add InspectFrame and InspectErr combinators.
hyperium/hyper (hyper)

v1.10.1

Compare Source

Bug Fixes

v1.10.0

Compare Source

Bug Fixes
Features

v1.9.0

Compare Source

Bug Fixes
Features
  • client:
  • error: add 'Error::is_parse_version_h2' method (393c77c7)
  • http1: add UpgradeableConnection::into_parts (e21205cf)
v1.8.1 (2025-11-13)
Bug Fixes
matklad/once_cell (once_cell)

v1.21.4

Compare Source

  • Fix unsoundness in OnceCell::wait under --features=parking_lot, #​295.

    If thread A calls wait, while thread B calls get_or_try_init(f), and, furthermore, f panics,
    the wait incorrectly returns and thread A observes uninitialized memory.

    Kudos to @​meng-xu-cs for a nice find!

tafia/quick-xml (quick-xml)

v0.41.0

Compare Source

New Features
  • #​970: Add NsReader::resolver_mut() and
    NamespaceResolver::{max_declarations_per_element, set_max_declarations_per_element}.
Bug Fixes
  • #​969: Attributes (and anything that iterates BytesStart::attributes()
    with the default with_checks(true)) no longer takes O(N²) time on a start
    tag with a large number of attributes. Small tags keep the previous linear
    scan; larger ones switch to a 64-bit hash pre-filter, so the whole tag is
    O(N). The exact AttrError::Duplicated(new, prev) positions are unchanged.
  • #​970: NamespaceResolver::push (and hence every NsReader Start/Empty
    event) now rejects a start tag that declares more than
    DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256) xmlns / xmlns:* namespace
    bindings, returning the new NamespaceError::TooManyDeclarations. Previously
    push allocated one NamespaceBinding per declaration with no upper bound,
    before the event was returned to the caller, so an NsReader consumer could
    not bound its memory exposure on untrusted input. The limit is configurable
    via NamespaceResolver::set_max_declarations_per_element (use usize::MAX
    to disable).

v0.40.1

Compare Source

Bug Fixes
  • #​964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE
    declaration appears between two text runs inside an element (e.g.
    <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's
    consecutive-text merge, so two DeEvent::Text events reached
    read_text and tripped its "Cannot be two consequent Text events"
    invariant. DOCTYPE is now treated as transparent during text drain —
    it still goes through the entity resolver, but the surrounding text
    is merged into one run. Discovered via libFuzzer on a real-world
    SAML deserializer harness.
Misc Changes

v0.40.0

Compare Source

MSRV bumped to 1.79.

Now quick-xml supports the UTF-16 encoded documents. See the new DecodingReader type.

New Features

  • #​956: Add DecodingReader, a BufRead adapter that auto-detects encoding
    from BOM or XML declaration and transcodes to UTF-8. Enabled by the encoding feature.

  • #​938: Add new enumeration XmlVersion and typified getter BytesDecl::xml_version().

  • #​938: Add new error variant IllFormedError::UnknownVersion.

  • #​371: Add new error variant EscapeError::TooManyNestedEntities.

  • #​371: Improved compliance with the XML attribute value normalization process by adding

    • Attribute::normalized_value()
    • Attribute::normalized_value_with()
    • Attribute::decoded_and_normalized_value()
    • Attribute::decoded_and_normalized_value_with()

    which ought to be used in place of deprecated

    • Attribute::unescape_value()
    • Attribute::unescape_value_with()
    • Attribute::decode_and_unescape_value()
    • Attribute::decode_and_unescape_value_with()

    Deprecated functions now behaves the same as newly added.

Bug Fixes
  • #​938: Use correct rules for EOL normalization in Deserializer when parse XML 1.0 documents.
    Previously XML 1.1. rules was applied.
Misc Changes
  • #​914: Remove deprecated .prefixes(), .resolve(), .resolve_attribute(), and .resolve_element()
    of NsReader. Use .resolver().<...> methods instead.
  • #​938: Now BytesText::xml_content, BytesCData::xml_content and BytesRef::xml_content
    accepts XmlVersion parameter to apply correct EOL normalization rules.
  • #​944: read_text() now returns BytesText which allows you to get the content with
    properly normalized EOLs. To get the previous behavior use .read_text().decode()?.
  • #​956: Bumped MSRV from 1.59 (Feb 2022) to 1.79 (June 2024)

v0.39.4

Compare Source

Bug Fixes
  • #​957: Fix slice-index panic when reading malformed DTD whose unknown markup
    is split across BufReader chunks. As with #​950, the returned
    Event::DocType may contain the malformed DTD; this fix only ensures that
    the parser does not panic.
  • #​960: Fix sibling slice-index panic when a single chunk delivers < followed
    by 9+ bytes of unknown markup inside a DTD internal subset. Same disposition
    as #​957 / #​950: parser must not panic; DTD validity reporting is a future
    improvement.

v0.39.3

Compare Source

Bug Fixes
  • #​950: Fix subtraction with overflow when parse malformed DTD in some cases.
    Note, that currently we do not check the validity of DTD, so the returned Event::DocType
    may contain the malformed DTD.
rust-random/rand (rand)

v0.10.2

Compare Source

Fixes
  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#​1790)
Changes
  • Document required output order of fn partial_shuffle and apply #[must_use] (#​1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#​1791)

v0.10.1

Compare Source

This release includes a fix for a soundness bug; see #​1763.

Changes
  • Document panic behavior of make_rng and add #[track_caller] (#​1761)
  • Deprecate feature log (#​1763)
rust-lang/regex (regex)

v1.13.1

Compare Source

===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#​1364 for (many) more details.

Bug fixes:

  • #​1354:
    Fixes previously unsound reverse suffix and inner optimizations.

v1.13.0

Compare Source

===================
This release includes a new API, a regex! macro, for lazy compilation of
a regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:

use regex::regex;

fn is_match(line: &str) -> bool {
    // The regex will be compiled approximately once and reused automatically.
    // This avoids the footgun of using `Regex::new` here, which would
    // guarantee that it would be compiled every time this routine is called.
    // This would likely make this routine much slower than it needs to be.
    regex!(r"bar|baz").is_match(line)
}

let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";

let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

  • #​709:
    Add a new regex! macro for efficient and automatic reuse of a compiled regex.

v1.12.4

Compare Source

===================
This release includes a performance optimization for compilation of regexes
with very large character classes.

Improvements:

  • #​1308:
    Avoid re-canonicalizing the entire interval set when pushing new class ranges.
seanmonstar/reqwest (reqwest)

v0.13.4

Compare Source

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

v0.13.3

Compare Source

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.
serde-rs/json (serde_json)

v1.0.150

Compare Source

palfrey/serial_test (serial_test)

v3.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: palfrey/serial_test@v3.4.0...v3.5.0

Stebalien/tempfile (tempfile)

v3.27.0

Compare Source

This release adds TempPath::try_from_path and deprecates TempPath::from_path.

Prior to this release, TempPath::from_path made no attempts to convert relative paths into absolute paths. The following code would have deleted the wrong file:

let tmp_path = TempPath::from_path("foo")
std::env::set_current_dir("/some/other/path").unwrap();
drop(tmp_path);

Now:

  1. TempPath::from_path will attempt to convert relative paths into absolute paths. However, this isn't always possible as we need to call std::env::current_dir, which can fail. If we fail to convert the relative path to an absolute path, we simply keep the relative path.
  2. The TempPath::try_from_path behaves exactly like TempPath::from_path, except that it returns an error if we fail to convert a relative path into an absolute path (or if the passed path is empty).

Neither function attempt to verify the existence of the file in question.

Thanks to @​meng-xu-cs for reporting this issue.

tokio-rs/tokio (tokio)

v1.52.4: Tokio v1.52.4

Compare Source

1.52.4 (July 16th, 2026)

Fixed
  • runtime: don't skip the driver when before_park schedules work (#​8222)
Fixed (unstable)
  • taskdump: remove crate disambiguators from output (#​8264)

v1.52.3: Tokio v1.52.3

Compare Source

1.52.3 (May 8th, 2026)

Fixed
  • sync: fix underflow in mpsc channel len() (#​8062)
  • sync: notify receivers in mpsc OwnedPermit::release() method (#​8075)
  • sync: require that an RwLock has max_readers != 0 (#​8076)
  • sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#​8074)

v1.52.2: Tokio v1.52.2

Compare Source

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#​7431), due to its performance impact. (#​8100)

v1.52.1: Tokio v1.52.1

Compare Source

1.52.1 (April 16th, 2026)

Fixed

v1.52.0: Tokio v1.52.0

Compare Source

1.52.0 (April 14th, 2026)

Added

  • io: AioSource::register_borrowed for I/O safety support (#​7992)
  • net: add try_io function to unix::pipe sender and receiver types (#​8030)

Added (unstable)

  • runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#​8010)
  • taskdump: add trace_with() for customized task dumps (#​8025)
  • taskdump: allow impl FnMut() in trace_with instead of just fn() (#​8040)
  • fs: support io_uring in AsyncRead for File (#​7907)

Changed

  • runtime: improve spawn_blocking scalability with sharded queue (#​7757)
  • runtime: use compare_exchange_weak() in worker queue (#​8028)

Fixed

  • runtime: overflow second half of tasks when local queue is filled instead of first half (#​8029)

Documented

  • docs: fix typo in oneshot::Sender::send docs (#​8026)
  • docs: hide #[tokio::main] attribute in the docs of sync::watch (#​8035)
  • net: add docs on ConnectionRefused errors with UDP sockets (#​7870)

v1.51.4: Tokio v1.51.4

Compare Source

1.51.4 (July 16th, 2026)
Fixed
  • runtime: don't skip the driver when before_park schedules work (#​8222)

v1.51.3: Tokio v1.51.3

Compare Source

1.51.3 (May 8th, 2026)

Fixed
  • sync: fix underflow in mpsc channel len() (#​8062)
  • sync: notify receivers in mpsc OwnedPermit::release() method (#​8075)
  • sync: require that an RwLock has max_readers != 0 (#​8076)
  • sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#​8074)

v1.51.2: Tokio v1.51.1

Compare Source

1.51.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#​7431), due to its performance impact. (#​8100)

v1.51.1: Tokio v1.51.1

Compare Source

1.51.1 (April 8th, 2026)
Fixed
  • sync: fix semaphore reopens after forget (#​8021)
  • net: surface errors from SO_ERROR on recv for UDP sockets on Linux (#​8001)
Fixed (unstable)
  • metrics: fix worker_local_schedule_count test (#​8008)
  • rt: do not leak fd when cancelling io_uring open operation (#​7983)

v1.51.0: Tokio v1.51.0

Compare Source

1.51.0 (April 3rd, 2026)
Added
  • net: implement get_peer_cred on Hurd (#​7989)
  • runtime: add tokio::runtime::worker_index() (#​7921)
  • runtime: add runtime name (#​7924)
  • runtime: stabilize LocalRuntime (#​7557)
  • wasm: add wasm32-wasip2 networking support (#​7933)
Changed
  • runtime: steal tasks from the LIFO slot (#​7431)
Fixed
  • docs: do not show "Available on non-loom only." doc label (#​7977)
  • macros: improve overall macro hygiene (#​7997)
  • sync: fix notify_waiters priority in Notify (#​7996)
  • sync: fix panic in Chan::recv_many when called with non-empty vector on closed channel (#​7991)

v1.50.0: Tokio v1.50.0

Compare Source

1.50.0 (Mar 3rd, 2026)
Added
  • net: add TcpStream::set_zero_linger (#​7837)
  • rt: add is_rt_shutdown_err (#​7771)
Changed
  • io: add optimizer hint that memchr returns in-bounds pointer (#​7792)
  • io: implement vectored writes for write_buf (#​7871)
  • runtime: panic when event_interval is set to 0 (#​7838)
  • runtime: shorten default thread name to fit in Linux limit (#​7880)
  • signal: remember the result of SetConsoleCtrlHandler (#​7833)
  • signal: specialize windows Registry (#​7885)
Fixed
  • io: always cleanup AsyncFd registration list on deregister (#​7773)
  • macros: remove (most) local use declarations in tokio::select! (#​7929)
  • net: fix GET_BUF_SIZE constant for target_os = "android" (#​7889)
  • runtime: avoid redundant unpark in current_thread scheduler (#​7834)
  • runtime: don't park in current_thread if before_park defers waker (#​7835)
  • io: fix write readiness on ESP32 on short writes (#​7872)
  • runtime: wake deferred tasks before entering block_in_place (#​7879)
  • sync: drop rx waker when oneshot receiver is dropped (#​7886)
  • runtime: fix double increment of num_idle_threads on shutdown (#​7910, #​7918, #​7922)
Unstable
  • fs: check for io-uring opcode support (#​7815)
  • runtime: avoid lock acquisition after uring init (#​7850)
Documented
  • docs: update outdated unstable features section (#​7839)
  • io: clarify the behavior of AsyncWriteExt::shutdown() (#​7908)
  • io: explain how to flush stdout/stderr (#​7904)
  • io: fix incorrect and confusing AsyncWrite documentation (#​7875)
  • rt: clarify the documentation of Runtime::spawn (#​7803)
  • rt: fix missing quotation in docs (#​7925)
  • runtime: correct the default thread name in docs (#​7896)
  • runtime: fix event_interval doc (#​7932)
  • sync: clarify RwLock fairness documentation (#​7919)
  • sync: clarify that recv returns None once closed and no more messages (#​7920)
  • task: clarify when to use spawn_blocking vs dedicated threads (#​7923)
  • task: doc that task drops before JoinHandle completion (#​7825)
  • signal: guarantee that listeners never return None (#​7869)
  • task: fix task module feature flags in docs (#​7891)
  • task: fix two typos (#​7913)
  • task: improve the docs of Builder::spawn_local (#​7828)
  • time: add docs about auto-advance and when to use sleep (#​7858)
  • util: fix typo in docs (#​7926)
uuid-rs/uuid (uuid)

v1.24.0

Compare Source

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

Compare Source

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

Compare Source

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

Compare Source

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

Compare Source

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

v1.23.1

Compare Source

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.0...v1.23.1

v1.23.0

Compare Source

What's Changed

New Contributors

Special thanks

@​meng-xu-cs raised a series of bugs against the timestamp logic in uuid using automated tooling. The issues themselves were reasonably and responsibly presented and the end result is a better uuid library for everyone. Thanks!

Deprecations

This release includes the following deprecations:

  • Context: Renamed to ContextV1
  • Timestamp::from_gregorian: Renamed to Timestamp::from_gregorian_time

Change to Version::Max

Version::Max's u8 representation has changed from 0xff to 0x0f to match the value returned by Uuid::get_version_num.

Change to Uuid::get_version for the max UUID

Uuid::get_version will only return Some(Version::Max) if the UUID is actually the max UUID (all bytes are 0xff). Previously it would return Some if only the version field was 0x0f. This change matches the behaviour of the nil UUID, which only returns Some(Version::Nil) if the UUID is the nil UUID (all bytes are 0x00).

Full Changelog: uuid-rs/uuid@v1.22.0...v1.23.0

v1.22.0

Compare Source

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.21.0...v1.22.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot changed the title chore(deps): update rust crate rustls to v0.23.37 chore(deps): update all Mar 3, 2026
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from 42f00ff to 4437abd Compare March 12, 2026 13:10
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from 6346374 to 1cbe1ee Compare March 31, 2026 21:06
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from 78cbbe1 to 8455599 Compare April 3, 2026 17:29
@renovate renovate Bot changed the title chore(deps): update all fix(deps): update all Apr 3, 2026
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from e2197e6 to d02cc84 Compare April 12, 2026 13:02
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from e5ff503 to 8c3172e Compare May 15, 2026 20:54
@renovate
fix(deps): update all
31c5aa5 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants