chore(deps): Update rust-dependencies by renovate[bot] · Pull Request #47 · hyperi-io/hyperi-rustlib

renovate · 2026-08-03T00:01:04Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
aes-gcm	dependencies	minor	`0.10` → `0.11`
base64	dependencies	minor	`>=0.22, <0.23` → `>=0.22, <0.24`
cel	dependencies	minor	`>=0.13, <0.14` → `>=0.13, <0.15`	`0.14.1`
git2	dev-dependencies	minor	`>=0.20.0, <0.21` → `>=0.20.0, <0.22`
git2	dependencies	minor	`>=0.20.0, <0.21` → `>=0.20.0, <0.22`
hkdf	dependencies	minor	`0.12` → `0.13`
lz4_flex	dependencies	minor	`>=0.11, <0.14` → `>=0.11, <0.15`
opentelemetry (source)	dependencies	minor	`>=0.31.0, <0.32` → `>=0.31.0, <0.33`
opentelemetry-otlp (source)	dependencies	minor	`>=0.31.0, <0.32` → `>=0.31.0, <0.33`
rand_core (source)	dependencies	minor	`0.6` → `0.10`
sha2	dependencies	minor	`0.10` → `0.11`
sqlx	dependencies	minor	`>=0.8, <0.9` → `>=0.8, <0.10`
tower-http	dependencies	minor	`>=0.6.8, <0.7` → `>=0.6.8, <0.8`
tracing-opentelemetry	dependencies	minor	`>=0.32.1, <0.33` → `>=0.32.1, <0.34`

Release Notes

RustCrypto/AEADs (aes-gcm)

`v0.11.0`

Compare Source

marshallpierce/rust-base64 (base64)

`v0.23.0`

Compare Source

Added more consts for preconfigured configs and engines
Make DecodeError::InvalidLastSymbol more clear by including the decoded value
Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best
instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar
GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime
detection and work in no_std. The engines support the standard and URL-safe alphabets.
Update MSRV to 1.71.0
Add support for custom padding symbols

cel-rust/cel-rust (cel)

`v0.14.0`

Compare Source

Added

(context) make add_variable_as_val public
(overloads) Optional use proper overloads
(traits) Zeroer trait and impl
(overloads) type checking on Opaque's type param
(structs) equality of CeStruct implemented
(structs) default values from definition
(structs) Structs need to be known & adhere to StructDef
(structs) field access to structs
(structs) Adds 'dynamic' CelStruct support
(structs) Basic wiring for struct supports, both literal and Val
(overloads) UInt conversion function
(overloads) Int conversion function
(overloads) Double conversion function
(overloads) String conversion function
(overloads) ported CelString's matches
(overloads) Added missing duration_to_duration
(overloads) No more min or max by default
(overloads) Duration overloads
(overloads) Added missing timestamp_to_timestamp
(overloads) Timestamp overloads
(overloads) String::startsWith & ::endsWith
(overloads) [breaking] contains for string only, removed on containers
(overloads) size only impl. using overloads
(overloads) DefaultMap impl Sizer trait
(overloads) DefaultList impl Sizer trait
(overloads) String impl Sizer trait
(overloads) extracted Sizer trait & util fns for Bytes
(overloads) Box<dyn Val> downcastable to avoid cloning
(overloads) no need to previous bytes func
(overloads) CelBytes::stdlib() fns
(overloads) resolve qualified overloads
(overloads) dispatching member overloads
(overloads) Wire overload lookups in interpreter
(overloads) Function to use Cow<dyn Val>s
(overloads) Opening seam for Env
(overloads) mimic Decl's wireframe of go for now

Fixed

Val::get_type lifetime fix
(contains) not on bytes
(numbers) fixed number type equals to allow for other number types

Other

(types) No need for two factories for Opaques
a whole lot of additional docs and doc fixes
(README) generic cargo add cel, version agnostic
:unnecessary_sort_by
Support has on struct fields
Try from struct into dyn val
Update structs feature gating and expose StructDef
no need to provide Type when Val is provided
[breaking] No more lifetimes on Type, Env et al
factory functions for Type<'a> proper lifetime
[breaking] Type is passed by ref only now
helper for binary_fns in overloads
(overloads) opened seam for type parameters & Dyns
showing off value::Downcast's usage
(overloads) Function takes ownership of args
DI'ed the stdlib into the Env
keep insertion ordering of overloads, as golang
less vec manipulations on overloads
member callsite to be simpler
[breaking] Have FunctionContext store actual Val args
FunctionContext.this uses Cow<dyn Val>
remove useless profile
no to ref lhs, easier code to read
Introduced TraitSet = u16 type alias
Update CEL example version to 0.13.0 (#278)

rust-lang/git2-rs (git2)

`v0.21.0`

Compare Source

0.20.4...main

Added

Added experimental SHA256 repository support behind the new unstable-sha256 Cargo feature,
along with *_ext API variants that accept an ObjectFormat.
#1206
Added opts::set_cache_max_size() and opts::get_cached_memory().
#1188
Added Repository::object_format() and a new ObjectFormat enum.
#1204
Added Repository::set_config().
#1208
Added merge_file() along with MergeFileInput.
#1210
Added Repository::refdb_compress() for packing loose refs.
#1221
Added public Refdb type, along with Repository::refdb() and Repository::set_refdb(). Repository::refdb_compress() now delegates to Refdb::compress().
#1228
Added Revspec::into_objects().
#1230
Added BlameHunk::final_committer(), BlameHunk::orig_committer(), BlameHunk::summary(), and BlameHunk::summary_bytes().
#1231
Implemented Clone for Reference.
#1233
Added Repository::author_from_env() and Repository::committer_from_env().
#1237
Added impl From<Utf8Error> for Error.
#1239

Changed

❗ The ssh, https, and cred Cargo features are no longer enabled by default.
Previously default = ["ssh", "https"]; now default = [].
Enable them explicitly if you rely on credential helpers or transport support.
#1168
❗ CredentialHelper and the url dependency are now gated behind the new cred Cargo feature.
Enabling ssh or https transitively enables cred.
#1168
❗ Updated to the 2021 edition.
#1173
❗ Many string accessors that previously returned Option<&str>
now return Result<&str, Error> or Result<Option<&str>, Error>,
so callers can distinguish a missing value from a non-UTF-8 one.
#1241
❗ BlameHunk::final_signature, BlameHunk::final_committer, BlameHunk::orig_signature, and BlameHunk::orig_committer
now return Option to avoid segfaults when signature information is missing.
#1254
Bumped requirement to libgit2-sys 0.18.4, which updates libgit2 to 1.9.3.
#1242

Fixed

Fixed MergeOptions::skip_reuc() to use the correct GIT_MERGE_SKIP_REUC flag.
#1194
Repository::submodules() now returns an Error when the underlying git_submodule_lookup() call to libgit2 fails, rather than panicking with a failed assertion.
#1220
Reference::is_valid_name() now propagates errors from CString conversion instead of panicking.
#1229
Fixed Remote::list() to return an empty list instead of erroring
when the remote advertises no refs.
#1250
ReferenceNames now returns an Err for non-UTF-8 branch names instead of panicking.
#1239

Documentation

Added note regarding potentially confusing behavior of git_checkout_head.
#1149
Added comments describing the IndexAddOption flags.
#1163
Updated README note about the ssh feature.
#1187
Improved function docs for Repository::tag_foreach().
#1190
Fixed doc comment typo in StatusOptions.
#1199
Fixed missing period in module documentation.
#1219
Small wording fix in Signature::from_raw_const() docs.
#1222
Replaced discussion of missing gist in README.
#1223
Documented the bitflag methods for checking flags.
#1224
Clarified CheckoutBuilder::update_index() documentation.
#1232
Added more missing documentation.
#1235
Fixed typo in Repository::stash_save_ext() docs.
#1245
Added example showing retrieval of the latest commit for a file.
#1243
Replaced comma with period in CheckoutBuilder::refresh() docs.
#1252

Internals

Dropped civet/conduit from dev-dependencies.
#1170
Updated dependencies.
#1171
Fixed lockfile verification in CI.
#1177
Updated CI and documentation to cover feature combinations.
#1182
Listed all examples that may need HTTP and SSH.
#1196
Allowed publishing from any ref in the publish workflow.
#1198
Bumped time from 0.3.41 to 0.3.47.
#1215
Added end-to-end test for branch name on initialization.
#1244
Added end-to-end test for stash count.
#1246
Added end-to-end tests demonstrating use of Repository::statuses().
#1251
Internal refactors preparing for experimental SHA256 OID support.
#1201
#1205

RustCrypto/KDFs (hkdf)

`v0.13.0`

Compare Source

pseitz/lz4_flex (lz4_flex)

`v0.14.0`

Compare Source

==================

Features

Add alloc feature to allow no_std operation without an allocator. The std feature now implies alloc. Without alloc only the _into variants of the block API are available, e.g. compress_into; the compression hash table is placed on the stack or can be provided via compress_into_with_table.

Note: Users with `default-features = false` need to additionally enable the `alloc`
feature to keep the APIs returning `Vec`, e.g. `compress` and `decompress`.

open-telemetry/opentelemetry-rust (opentelemetry)

`v0.32.0`

Compare Source

Released 2026-May-08

Added BoundCounter<T> and BoundHistogram<T> types that cache resolved
aggregator references for a fixed attribute set. Created via Counter::bind()
and Histogram::bind(), bound instruments bypass per-call attribute lookup,
providing significant performance improvements for hot paths where the same
attributes are used repeatedly. Both types implement Clone so a single bound
state can be shared across threads or modules without re-binding. Also adds
the SyncInstrument::bind() trait method and BoundSyncInstrument<T> trait
for SDK implementors; the trait method has a no-op default so custom
SyncInstrument impls degrade gracefully without panicking. Gated behind the
experimental_metrics_bound_instruments feature flag.
Add reserve method to opentelemetry::propagation::Injector to hint at the number of elements that will be added to avoid multiple resize operations of the underlying data structure. Has an empty default implementation.
Breaking Removed the following public fields and methods from the SpanBuilder #3227:
- trace_id, span_id, end_time, status, sampling_result
- with_trace_id, with_span_id, with_end_time, with_status, with_sampling_result
Added #[must_use] attribute to opentelemetry::metrics::AsyncInstrumentBuilder to add compile time warning when .build() is not called on observable instrument builders, preventing silent failures where callbacks are never registered and metrics are never reported.
Breaking Moved the following SDK sampling types from opentelemetry::trace to opentelemetry_sdk::trace #3277:
- SamplingDecision, SamplingResult
- These types are SDK implementation details and should be imported from opentelemetry_sdk::trace instead.
"spec_unstable_logs_enabled" feature flag is removed. The capability (and the
backing specification) is now stable and is enabled by default.
3278
Remove the empty "message" field from tracing events emitted via the internal-logs feature
Fix panic when calling Context::current() from Drop implementations triggered by ContextGuard cleanup (#3262).

open-telemetry/opentelemetry-rust (opentelemetry-otlp)

`v0.32.0`

Compare Source

Released 2026-May-08

Add tls-provider-agnostic feature flag for environments that require a custom crypto backend (e.g., OpenSSL for FIPS compliance). Enables TLS code paths without bundling ring or aws-lc-rs.
Add build() directly on SpanExporterBuilder, MetricExporterBuilder, and LogExporterBuilder
(before selecting a transport), which auto-selects the transport based on the
OTEL_EXPORTER_OTLP_PROTOCOL environment variable or enabled features.
#3394
Breaking Removed ExportConfig, HasExportConfig, with_export_config(), HasTonicConfig, HasHttpConfig, TonicConfig, and HttpConfig from public API.
Use the public WithExportConfig, WithTonicConfig, and WithHttpConfig trait methods instead, which remain unchanged.
The gRPC/tonic OTLP exporter's build method now returns an error for all signals (traces, metrics, logs) when
an https:// endpoint is configured but no TLS feature (tls-ring or tls-aws-lc) is enabled, instead of
silently sending unencrypted traffic. When a TLS feature is enabled and an https:// endpoint is used without
an explicit .with_tls_config(), a default ClientTlsConfig is automatically applied.
#3182
Prevent auth tokens from leaking in export error messages. gRPC and HTTP
exporter errors no longer include potentially sensitive server responses
(e.g., authentication tokens echoed back). Error messages returned to SDK
processors contain only the gRPC status code or HTTP status code. Full
details are logged at DEBUG level only.
#3021
Surface pre-flight transport error details at ERROR level when grpc-tonic
OTLP export fails due to a local misconfiguration. When the returned
tonic::Status wraps a local transport error (invalid URL, connect failure,
DNS), its source chain (e.g., "transport error: invalid URI") is appended
to the returned error so SDK processors surface it at ERROR without
requiring DEBUG logging. Server-returned gRPC status messages remain
DEBUG-only to preserve the auth-token leak safeguards from
#3021.
#3331
Add support for per-signal protocol environment variables:
OTEL_EXPORTER_OTLP_TRACES_PROTOCOL, OTEL_EXPORTER_OTLP_METRICS_PROTOCOL,
OTEL_EXPORTER_OTLP_LOGS_PROTOCOL. These allow configuring different transport protocols
per signal type. Signal-specific vars take precedence over generic OTEL_EXPORTER_OTLP_PROTOCOL.
The auto-select build() method on each exporter builder now respects the full priority chain:
signal-specific env var > generic env var > feature-based default.
Transport/protocol mismatch validation: HTTP transport returns InvalidConfig when gRPC protocol
is requested; gRPC transport returns InvalidConfig when an HTTP protocol is requested.
Breaking: Protocol::default() no longer consults the OTEL_EXPORTER_OTLP_PROTOCOL
environment variable. It now returns only the feature-based default (http-json > http-proto >
grpc-tonic). Protocol resolution from environment variables is handled internally by the
exporter builders. Users who relied on Protocol::default() to read env vars should use
Protocol::from_env() instead.
Add support for OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE environment variable
to configure metrics temporality. Accepted values: cumulative (default), delta,
lowmemory (case-insensitive). Programmatic .with_temporality() overrides the env var.
Fix NoHttpClient error when multiple HTTP client features are enabled by using priority-based selection (reqwest-client > hyper-client > reqwest-blocking-client). #2994
Add partial success response handling for OTLP exporters (traces, metrics, logs) per OTLP spec. Exporters now log warnings when the server returns partial success responses with rejected items and error messages. #865
Refactor internal-logs feature in opentelemetry-otlp to reduce unnecessary dependencies3191
Fixed [#2777](https://github.com/open-telemetry/opentelemetry rust/issues/2777) to properly handle shutdown_with_timeout() when using grpc-tonic.
Deprecate tls feature in favor of explicit tls-ring and tls-aws-lc features.
Migration: Replace tls with tls-ring (or tls-aws-lc). Users of tls-roots or tls-webpki-roots must now also enable one of these.
Prevent logging of header values in OTLP tonic exporter #3465

rust-random/rand_core (rand_core)

`v0.10.1`

Compare Source

Fixed

Reference to the rand crate in TryRng docs (#75)

`v0.10.0`

This release makes a number of significant changes which we hope will be the
last significant breakage before 1.0. Code has moved from the rust-random/rand
repository to its own rust-random/rand_core.

User-facing API changes

Changed

Edition changed to 2024 and MSRV bumped to 1.85 (rand#1668)
RngCore and TryRngCore are renamed to Rng and TryRng respectively (#54)
Rng is now an extension trait of TryRng<Error = Infallible> (#45)
TryRng::Error is bound on core::error::Error instead of Debug + Display (#58)
Relax Sized bound on impls of SeedableRng (rand#1641)

Added

SeedableRng::{fork, try_fork} methods (#17)
Re-export of core::convert::Infallible (#56)

Removed

TryRng::read_adapter method (replaced with rand::RngReader) (rand#1669)
os_rng crate feature (rand#1674)
OsRng and OsError structs (rand#1674)
SeedableRng::from_os_rng and SeedableRng::try_from_os_rng methods (rand#1674)
getrandom dependency (rand#1674)
std crate feature (rand#1674)
Optional serde dependency (#28)
UnwrapMut struct and Rng::unwrap_mut method (#45)
Rng::unwrap_err method in favor of explicit wrapping in UnwrapErr (#53)

API changes to PRNG implementation helpers

Added

BlockRng::reconstruct and BlockRng::remaining_results methods (#36)
block::Generator::drop method (#35)
BlockRng::word_offset method (#44)

Changed

Replaced le helper functions with new utils helpers (rand#1667, #34, #38, #45)
Rename BlockRng::generate_and_set method to reset_and_skip (#44)
Rename block::BlockRngCore trait to block::Generator (#26)
Rename BlockRngCore::Results associated type to Output and remove type bounds on it (#26)

Removed

Implementation of Rng for BlockRng, making the latter more generic (#34)
BlockRng64 struct (#34)
BlockRng::reset method (#44)
BlockRng::index method (replaced with BlockRng::word_offset) (#44)
Generator::Item associated type (#26)
CryptoBlockRng (#69)

`v0.9.4`

Compare Source

`v0.9.3`

Compare Source

This release makes a number of significant changes which we hope will be the
last significant breakage before 1.0. Code has moved from the rust-random/rand
repository to its own rust-random/rand_core.

User-facing API changes

Changed

Edition changed to 2024 and MSRV bumped to 1.85 (rand#1668)
RngCore and TryRngCore are renamed to Rng and TryRng respectively (#54)
Rng is now an extension trait of TryRng<Error = Infallible> (#45)
TryRng::Error is bound on core::error::Error instead of Debug + Display (#58)
Relax Sized bound on impls of SeedableRng (rand#1641)

Added

SeedableRng::{fork, try_fork} methods (#17)
Re-export of core::convert::Infallible (#56)

Removed

TryRng::read_adapter method (replaced with rand::RngReader) (rand#1669)
os_rng crate feature (rand#1674)
OsRng and OsError structs (rand#1674)
SeedableRng::from_os_rng and SeedableRng::try_from_os_rng methods (rand#1674)
getrandom dependency (rand#1674)
std crate feature (rand#1674)
Optional serde dependency (#28)
UnwrapMut struct and Rng::unwrap_mut method (#45)
Rng::unwrap_err method in favor of explicit wrapping in UnwrapErr (#53)

API changes to PRNG implementation helpers

Added

BlockRng::reconstruct and BlockRng::remaining_results methods (#36)
block::Generator::drop method (#35)
BlockRng::word_offset method (#44)

Changed

Replaced le helper functions with new utils helpers (rand#1667, #34, #38, #45)
Rename BlockRng::generate_and_set method to reset_and_skip (#44)
Rename block::BlockRngCore trait to block::Generator (#26)
Rename BlockRngCore::Results associated type to Output and remove type bounds on it (#26)

Removed

Implementation of Rng for BlockRng, making the latter more generic (#34)
BlockRng64 struct (#34)
BlockRng::reset method (#44)
BlockRng::index method (replaced with BlockRng::word_offset) (#44)
Generator::Item associated type (#26)
CryptoBlockRng (#69)

`v0.9.2`

Compare Source

Other

Remove zerocopy dependency (rand#1607)
Deprecate rand_core::impls::fill_via_u32_chunks, fill_via_u64_chunks (rand#1607)

`v0.9.1`

Compare Source

API changes

Relax Sized bound on impls of TryRngCore, TryCryptoRng and UnwrapMut (rand#1593)
Add UnwrapMut::re to reborrow the inner rng with a tighter lifetime (rand#1595)

`v0.9.0`

Compare Source

API changes

Add TryRngCore::unwrap_mut, providing an impl of RngCore over &mut rng (rand#1589)

RustCrypto/hashes (sha2)

`v0.11.0`

Compare Source

launchbadge/sqlx (sqlx)

`v0.9.0`

Compare Source

Important Announcements

New Github Organization

Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization:
https://github.com/transact-rs/

This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been
informally transferred to the collective ownership of its principal authors. Moving the repository to a new
organization makes this change more clear, and also allows for potentially inviting outside collaborators.

`Cargo.lock` Removed from Tracking

The Cargo.lock has been removed from tracking in Git. CI should now always test with the latest versions of
all dependencies by default, alongside our pass that checks with cargo generate-lockfile -Z minimal-versions.

This should eliminate the need for any PRs that update dependencies to also update Cargo.lock or
contend with an endless stream of merge conflicts against it.

N.B. cargo install --locked sqlx-cli will no longer work. However, cargo install sqlx-cli has always
used the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users
requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran cargo update
sporadically, so relying on SQLx's lockfile offered few guarantees anyway.

See [the manual page for cargo install][man-cargo-install] for details.

Breaking

As per our MSRV policy, the supported Rust version for this release cycle is 1.94.0.

[[#3383]]: feat: create sqlx.toml format [[@abonander]]
- SQLx and sqlx-cli now support per-crate configuration files (sqlx.toml)
- New functionality includes, but is not limited to:
  - Rename DATABASE_URL for a crate (for multi-database workspaces)
  - Set global type overrides for the macros (supporting custom types)
  - Rename or relocate the _sqlx_migrations table (for multiple crates using the same database)
  - Set characters to ignore when hashing migrations (e.g. ignore whitespace)
- More to be implemented in future releases.
- Enable feature sqlx-toml to use.
  - sqlx-cli has it enabled by default, but sqlx does not.
  - Default features of library crates can be hard to completely turn off because of [feature unification],
    so it's better to keep the default feature set as limited as possible.
    [This is something we learned the hard way.][preferred-crates]
- Guide: see sqlx::_config module in documentation.
- Reference: [Link]
- Examples (written for Postgres but can be adapted to other databases; PRs welcome!):
  - Multiple databases using DATABASE_URL renaming and global type overrides: [Link]
  - Multi-tenant database using _sqlx_migrations renaming and multiple schemas: [Link]
  - Force use of chrono when time is enabled (e.g. when using tower-sessions-sqlx-store): [[Link][preferred-crates]]
    - Forcing bigdecimal when rust_decimal is enabled is also shown, but problems with chrono/time are more common.
- Breaking changes:
  - Significant changes to the Migrate trait
  - sqlx::migrate::resolve_blocking() is now #[doc(hidden)] and thus SemVer-exempt.
[[#3486]]: fix(logs): Correct spelling of aquired_after_secs tracing field [[@iamjpotts]]
- Breaking behavior change: implementations parsing tracing logs from SQLx will need to update the spelling.
[[#3495]]: feat(postgres): remove lifetime from PgAdvisoryLockGuard [[@bonsairobo]]
[[#3526]]: Return &mut Self from the migrator set_ methods [[@nipunn1313]]
- Minor breaking change: Migrator::set_ignore_missing and set_locking now return &mut Self instead of &Self
  which may break code in rare circumstances.
[[#3541]]: Postgres: force generic plan for better nullability inference. [[@joeydewaal]]
- Breaking change: may alter the output of the query!() macros for certain queries in Postgres.
[[#3613]]: fix: RawSql lifetime issues [[@abonander]]
- Breaking change: adds DB type parameter to all methods of RawSql
[[#3670]]: Bump ipnetwork to v0.21.1 [[@BeauGieskens]]
[[#3674]]: Implement Decode, Encode and Type for Box, Arc, Cow and Rc [[@joeydewaal]]
- Breaking change: impl Decode for Cow now always decodes Cow::Owned, lifetime is unlinked
- See this discussion for motivation: #3674 (comment)
[[#3723]]: Add SqlStr [[@joeydewaal]]
- Breaking change: all query*() functions now take impl SqlSafeStr
  which is only implemented for &'static str and AssertSqlSafe.
  For all others, wrap in AssertSqlSafe(<query>).
- This, along with [[#3960]], finally allows returning owned queries as the type will be Query<'static, DB>.
- SqlSafeStr trait is deliberately similar to std::panic::UnwindSafe,
  serving as a speedbump to warn users about naïvely building queries with format!()
  while allowing a workaround for advanced usage that is easy to spot on code review.
[[#3800]]: Escape PostgreSQL Options [[@V02460]]
- Breaking behavior change: options passed to PgConnectOptions::options() are now automatically escaped.
  Manual escaping of options is no longer necessary and may cause incorrect behavior.
[[#3821]]: Groundwork for 0.9.0-alpha.1 [[@abonander]]
- Increased MSRV to 1.86 and set rust-version
- Deleted deprecated combination runtime+TLS features (e.g. runtime-tokio-native-tls)
- Deleted re-export of unstable TransactionManager trait in sqlx.
  - Not technically a breaking change because it's #[doc(hidden)],
    but [it will break SeaORM][seaorm-2600] if not proactively fixed.
[[#3924]]: breaking(mysql): assume all non-binary collations compatible with str [[@abonander]]
- Text (or text-like) columns which previously were inferred to be Vec<u8> will be inferred to be String
  (this should ultimately fix more code than it breaks).
- SET NAMES utf8mb4 COLLATE utf8_general_ci is no longer sent by default; instead, SET NAMES utf8mb4 is sent to
  allow the server to select the appropriate default collation (since this is version- and configuration-dependent).
- MySqlConnectOptions::charset() and ::collation() now imply ::set_names(true) because they don't do anything otherwise.
- Setting charset doesn't change what's sent in the Protocol::HandshakeResponse41 packet as that normally only
  matters for error messages before SET NAMES is sent.
  The default collation if set_names = false is utf8mb4_general_ci.
- See this comment for details.
- Incidental breaking change: RawSql::fetch_optional() now returns sqlx::Result<Option<DB::Row>>
  instead of sqlx::Result<DB::Row>. Whoops.
[[#3928]]: breaking(sqlite): libsqlite3-sys versioning, feature flags, safety changes [[@abonander]]
- SemVer policy changes: libsqlite3-sys version is now specified using a range.
  The maximum of the range may now be increased in any backwards-compatible release.
  The minimum of the range may only be increased in major releases.
  If you have libsqlite3-sys in your dependencies, Cargo should choose a compatible version automatically.
  If otherwise unconstrained, Cargo should choose the latest version supported.
- SQLite extension loading (including through the new sqlx-toml feature) is now unsafe.
- Added new non-default features corresponding to conditionally compiled SQLite APIs:
  - sqlite-deserialize enabling SqliteConnection::serialize() and SqliteConnection::deserialize()
  - sqlite-load-extension enabling SqliteConnectOptions::extension() and ::extension_with_entrypoint()
  - sqlite-unlock-notify enables internal use of sqlite3_unlock_notify()
- SqliteValue and SqliteValueRef changes:
  - The sqlite3_value* interface reserves the right to be stateful.
    Without protection, any call could theoretically invalidate values previously returned, leading to dangling pointers.
  - SqliteValue is now !Sync and SqliteValueRef is !Send to prevent data races from concurrent accesses.
    - Instead, clone or wrap the SqliteValue in Mutex, or convert the SqliteValueRef to an owned value.
  - SqliteValue and any derived SqliteValueRefs now internally track if that value has been used to decode a
    borrowed &[u8] or &str and errors if it's used to decode any other type.
  - This is not expected to affect the vast majority of usages, which should only decode a single type
    per SqliteValue/SqliteValueRef.
  - See new docs on SqliteValue for details.
[[#3949]]: Postgres: move PgLTree::from to From<Vec<PgLTreeLabel>> implementation [[@JerryQ17]]
[[#3957]]: refactor(sqlite): do not borrow bound values, delete lifetime on SqliteArguments [[@iamjpotts]]
[[#3958]]: refactor(any): Remove lifetime parameter from AnyArguments [[@iamjpotts]]
[[#3960]]: refactor(core): Remove lifetime parameter from Arguments trait [[@iamjpotts]]
[[#3993]]: Unescape PostgreSQL passfile password [[@V02460]]
- Previously, .pgpass file handling did not process backslash-escapes in the password part.
  Now it does, which may change what password is sent to the server.
[[#4008]]: make #[derive(sqlx::Type)] automatically generate impl PgHasArrayType by default for newtype structs [[@papaj-na-wrotkach]]
- Manual implementations of PgHasArrayType for newtypes will conflict with the generated one.
  Delete the manual impl or add #[sqlx(no_pg_array)] where conflicts occur.
[[#4077]]: breaking: make offline optional to allow building without serde [[@CathalMullan]]
[[#4094]]: Bump bit-vec to v0.8 [[@zennozenith]]
[[#4142]]: feat(mysql): add mysql-rsa feature for non-TLS RSA auth [[@dertin]]
- Connections requiring RSA password encryption now need to enable the mysql-rsa feature
  or an error will be generated at runtime. RSA encryption is only used for plaintext (non-TLS) connections.
[[#4255]]: breaking(any+mysql): correctly convert text and blob types to AnyTypeInfo [[@abonander]]

Added

[[#3641]]: feat(Postgres): support nested domain types [[@joeydewaal]]
[[#3651]]: Add PgBindIter for encoding and use it as the implementation encoding &[T] [[@tylerhawkes]]
[[#3675]]: feat: implement Encode, Decode, Type for Arc<str> and Arc<[u8]> (and Rc equivalents) [[@joeydewaal]]
[[#3791]]: Smol+async global executor 1.80 dev [[@martin-kolarik]]
- Adds runtime-smol and runtime-async-global-executor features to replace usages of the deprecated async-std crate.
[[#3859]]: Add more JsonRawValue encode/decode impls. [[@Dirbaio]]
[[#3881]]: CLi: made cli-lib modules publicly available for other crates [[@silvestrpredko]]
[[#3889]]: Compile-time support for external drivers [[@bobozaur]]
[[#3917]]: feat(sqlx.toml): support SQLite extensions in macros and sqlx-cli [[@djarb]]
[[#3918]]: Feature: Add exclusion violation error kind [[@barskern]]
[[#3971]]: Allow single-field named structs to be transparent [[@Xiretza]]
[[#4015]]: feat(sqlite): no_tx migration support [[@AlexTMjugador]]
[[#4020]]: Add Migrator::with_migrations() constructor [[@xb284524239]]
[[#3846]]: Add the possibility to skip migrations [[@Dosenpfand]]
[[#4107]]: Add SQLite extension entrypoint config to sqlx.toml, update SQLite extension example [[@supleed2]]
[[#4118]]: [postgres] Display line number in error message [[@mousetail]]
[[#4123]]: feat: add Json::into_inner() [[@chrxn1c]]
[[#4153]]: Add on unimplemented diagnostic to SqlStr [[@joeydewaal]]
[[#4167]]: add sqlite serialize/deserialize example [[@mattrighetti]]
[[#4228]]: sqlx-postgres: Make PgNotification struct clone [[@michaelvanstraten]]

Changed

[[#3525]]: Remove unnecessary boxfutures [[@joeydewaal]]
[[#3867]]: sqlx-postgres: Bump etcetera to 0.10.0 [[@miniduikboot]]
[[#3709]]: chore: replace once_cell OnceCell/Lazy with std OnceLock/LazyLock [[@paolobarbolini]]
[[#3890]]: feat: Unify Debug implementations across PgRow, MySqlRow and SqliteRow [[@davidcornu]]
[[#3911]]: chore: upgrade async-io to v2.4.1 [[@zebrapurring]]
[[#3938]]: Move QueryLogger back [[@joeydewaal]]
[[#3956]]: chore(sqlite): Remove unused test of removed git2 feature [[@iamjpotts]]
[[#3962]]: Give SQLX_OFFLINE_DIR from environment precedence in macros [[@psionic-k]]
[[#3968]]: chore(ci): Add timeouts to ci jobs [[@iamjpotts]]
[[#4002]]: sqlx-postgres(tests): cleanup 2 unit tests. [[@joeydewaal]]
[[#4022]]: refactor: tweaks after #3791 [[@abonander]]
[[#4257]]: Prefer to give real data to .bind() in README.md [[@sobolevn]]
[[#4042]]: Update to webpki-roots 1 [[@tottoto]]
[[#4072]]: chore: update hashlink to v0.11.0 [[@anmolitor]]
[[#4143]]: Bump whoami to v2 [[@tisonkun]]
[[#4161]]: sqlx-sqlite: relax libsqlite3-sys constraint to allow 0.36.x [[@darioAnongba]]
[[#4173]]: ci: check direct minimal versions [[@ricochet]]
- Note: reverted in 0.9.0 release but still listed for contributor credit. See end of PR thread for details.
[[#4189]]: Bump flume to 0.12.0 [[@opoplawski]]
[[#4223]]: test(sqlite): add regression test for ORDER BY + LIMIT nullability (#4147) [[@barry3406]]
[[#4230]]: chore: Update to cargo_metadata 0.23 [[@tottoto]]
[[#4233]]: Change reference to dotenvy [[@graemer957]]
[[#4235]]: chore: Update to validator 0.20 [[@tottoto]]
[[#4253]]: chore: update example to axum 0.8 [[@tottoto]]
Release PR:
- Upgraded all Rust-Crypto crates, rand
- Upgraded etcetera to 0.11.0
- Increased max of libsqlite3-sys version range to <0.38.0

Fixed

[[#3840]]: Fix docs.rs build of sqlx-sqlite [[@gferon]]
[[#3848]]: fix(macros): don't mutate environment variables [[@joeydewaal]]
[[#3856]]: fix(macros): slightly improve unsupported type error message [[@dyc3]]
[[#3857]]: fix(mysql): validate parameter count for prepared statements [[@cvzx]]
[[#3861]]: Fix NoHostnameTlsVerifier for rustls 0.23.24 and above [[@elichai]]
[[#3863]]: Use unnamed statement in pg when not persistent [[@ThomWright]]
[[#3874]]: Further reduce dependency on futures and futures-util [[@paolobarbolini]]
[[#3886]]: fix: use Executor::fetch in QueryAs::fetch [[@bobozaur]]
[[#3910]]: feat(ok): add correct handling of ok packets in MYSQL implementation [[@0xfourzerofour]]
[[#3914]]: fix: regenerate test certificates [[@abonander]]
[[#3915]]: fix: spec_error is used by try_from derive [[@saiintbrisson]]
[[#3919]]: fix[sqlx-postgres]: do a checked_mul to prevent panic'ing [[@nhatcher-frequenz]]
[[#3923]]: sqlx-mysql: Fix bug in cleanup test db's. [[@joeydewaal]]
[[#3950]]: chore: Fix warnings for custom postgres_## cfg flags [[@iamjpotts]]
[[#3952]]: Pool.close: close all connections before returning [[@jpmelos]]
[[#3975]]: fix documentation for rustls native root certificates [[@2ndDerivative]]
[[#3977]]: refactor(ci): Use separate job for postgres ssl auth tests [[@iamjpotts]]
[[#3980]]: Correctly ROLLBACK transaction when dropped during BEGIN. [[@kevincox]]
[[#3981]]: SQLite: fix transaction level accounting with bad custom command. [[@kevincox]]
[[#3986]]: chore(core): Fix docstring for Query::try_bind [[@iamjpotts]]
[[#3987]]: chore(deps): Resolve deprecation warning for chrono Date and ymd methods [[@iamjpotts]]
[[#3988]]: refactor(sqlite): Resolve duplicate test target warning for macros.rs [[@iamjpotts]]
[[#3989]]: chore(deps): Set default-features=false on sqlx in workspace.dependencies [[@iamjpotts]]
[[#3991]]: fix(sqlite): regression when decoding nulls [[@abonander]]
[[#4006]]: PostgreSQL SASL – run SHA256 in a blocking executor [[@ThomWright]]
[[#4007]]: fix(compose): use OS-assigned ports for all conatiners [[@papaj-na-wrotkach]]
[[#4009]]: Drop cached db connections in macros upon hitting an error [[@swlynch99]]
[

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

chore(deps): Update rust-dependencies

b52c264

renovate Bot added the dependencies label Aug 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): Update rust-dependencies - #47

chore(deps): Update rust-dependencies#47
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/rust-dependencies

renovate Bot commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 3, 2026

Release Notes

Added

Fixed

Other

Added

Changed

Fixed

Documentation

Internals

Features

Fixed

User-facing API changes

Changed

Added

Removed

API changes to PRNG implementation helpers

Added

Changed

Removed

User-facing API changes

Changed

Added

Removed

API changes to PRNG implementation helpers

Added

Changed

Removed

Other

API changes

API changes

Important Announcements

New Github Organization

Cargo.lock Removed from Tracking

Breaking

Added

Changed

Fixed

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`Cargo.lock` Removed from Tracking