Skip to content

chore(deps): bump the cargo-minor-patch group across 1 directory with 24 updates - #693

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-fb3f562203
Closed

chore(deps): bump the cargo-minor-patch group across 1 directory with 24 updates#693
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-fb3f562203

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo-minor-patch group with 22 updates in the / directory:

Package From To
anyhow 1.0.103 1.0.104
arc-swap 1.9.1 1.9.2
async-trait 0.1.89 0.1.92
aws-lc-rs 1.17.0 1.18.0
bytes 1.12.0 1.12.1
calamine 0.36.0 0.36.1
clap 4.6.1 4.6.6
futures 0.3.32 0.3.33
http 1.4.2 1.5.0
hyper 1.10.1 1.11.0
ipnet 2.12.0 2.12.1
pyo3 0.29.1 0.29.2
serde 1.0.228 1.0.229
serde_json 1.0.150 1.0.151
schemars 1.2.1 1.2.2
thiserror 2.0.18 2.0.20
time 0.3.51 0.3.55
tokio 1.52.3 1.53.1
tokio-util 0.7.18 0.7.19
toml 1.1.2+spec-1.1.0 1.1.4+spec-1.1.0
uuid 1.23.4 1.24.0
regex 1.12.4 1.13.1

Updates anyhow from 1.0.103 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

  • Update syn dev-dependency to version 3
Commits

Updates arc-swap from 1.9.1 to 1.9.2

Changelog

Sourced from arc-swap's changelog.

1.9.2

  • Document RefCnt must not panic (#208).
Commits

Updates async-trait from 0.1.89 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

  • Resolve double_must_use clippy lint in generated code (#303)

0.1.91

  • Update to syn 3 (#299)
  • Fix mutability for by-reference receivers (#301)

0.1.90

(yanked)

Commits
  • 82e7e9e Release 0.1.92
  • 9a35cb8 Merge pull request #303 from dtolnay/mustuse
  • 875ceec Resolve double_must_use clippy lint
  • 62993a5 Raise minimum tested compiler to rust 1.88
  • d049ee0 Release 0.1.91
  • 7a0961f Merge pull request #301 from dtolnay/mutability
  • 740f86f Ignore mut_mut pedantic clippy lint in test
  • 4699cd3 Fix mutability for by-reference receivers
  • 6dd3573 Add regression test for issue 300
  • 2371797 Release 0.1.90
  • Additional commits viewable in compare view

Updates aws-lc-rs from 1.17.0 to 1.18.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.18.0

AWS-LC-FIPS module updated to 4.x

This release switches aws-lc-fips-sys (used via the fips feature) from the AWS-LC-FIPS 3.x branch to AWS-LC-FIPS 4.0.

AWS-LC-FIPS module aws-lc-rs
2.0.x <1.12.0
3.0.x <1.18.0
4.x latest

What's Changed

  • Switch aws-lc-fips-sys to AWS-LC's "FIPS 4.0" branch by @​justsmth in aws/aws-lc-rs#1185
    • aws-lc-fips-sys v0.13.16 -> v0.14.0. Please see the call-out above.
  • The ML-DSA signature APIs are now stable 🎉 by @​justsmth in aws/aws-lc-rs#1188 and aws/aws-lc-rs#1189
    • PqdsaKeyPair, PqdsaPublicKey, PqdsaPrivateKey, PqdsaSigningAlgorithm, PqdsaVerificationAlgorithm, and the ML_DSA_44 / ML_DSA_65 / ML_DSA_87 algorithms (and their _SIGNING counterparts) now live in aws_lc_rs::signature. ML-DSA no longer requires the unstable feature, and is now available under fips -- the FIPS 4.0 module provides ML-DSA, which is what had kept these APIs unstable. See our updated API documentation.
    • Please migrate any use of aws_lc_rs::unstable::signature to aws_lc_rs::signature. The unstable::signature module remains as deprecated aliases and will be removed in a future release.
    • PqdsaKeyPair::to_pkcs8 has been renamed to to_pkcs8v1, since elsewhere in the module an unqualified to_pkcs8 means PKCS#8 v2. A deprecated to_pkcs8 alias remains available under the unstable feature.
    • Existing unstable consumers continue to compile, with deprecation warnings. Two cases need a source change: builds using #![deny(warnings)], and code that glob-imports both signature::* and unstable::signature::*, which now needs an explicit import to disambiguate.
    • Behavior change: PqdsaVerificationAlgorithm::parsed_verify_digest_sig now always returns Unspecified. Digest-then-verify is not an operation defined by FIPS 204 -- pure ML-DSA signs the message itself, and the pre-hash variant (HashML-DSA) uses a distinct domain separator that this API does not implement.
  • Add out-of-place AEAD sealing by @​iainmcgin in aws/aws-lc-rs#1183
    • Adds seal_separate_out_of_place to LessSafeKey and TlsRecordSealingKey. Every sealing entry point was previously in-place, so a caller whose plaintext was borrowed or shared had to copy it into a scratch buffer purely to make it mutable. This mirrors the existing open_separate_gather, so the sealing and opening directions now match.
  • Add rsa::KeyPair::from_components for constructing RSA key pairs from raw components by @​justsmth in aws/aws-lc-rs#1175
    • Adds rsa::KeyPairComponents and rsa::KeyPair::from_components, matching ring 0.17, so a signing key can be built from formats such as JWK without first encoding the components as DER. Unlike ring, d and the CRT parameters are validated at construction using RSA_check_key, so keys with inconsistent or placeholder values that ring accepts may be rejected. Unnecessary generic bounds were also removed from PublicKeyComponents.
  • Automatically optimize aws-lc for size when opt-level is "s" or "z" by @​justsmth in aws/aws-lc-rs#1159
    • The builder now enables AWS-LC's size-optimized configuration (OPENSSL_SMALL, and no AVX-512 assembly on x86_64) whenever Cargo is already building for size. In CI, a small binary exercising SHA-256, AES-256-GCM, and ECDSA P-256 is 36-50% smaller at opt-level=z than at opt-level=3: 50% on x86_64 Linux, 48% on aarch64 macOS, 39% on x86_64 Windows, 36% on aarch64 Linux. Your own savings depend on how much of AWS-LC your binary retains.
    • No algorithms are removed and outputs are unchanged; the trade-off is slower elliptic-curve performance. Set AWS_LC_SYS_SMALL=1/=0 to force it on or off independently of opt-level.
    • FIPS builds do not opt in automatically: aws-lc-fips-sys requires an explicit AWS_LC_FIPS_SYS_SMALL=1, and warns when it is set.
    • Partially addresses aws/aws-lc-rs#745; the default size under opt-level=3 footprint is unchanged.
  • Export native library build metadata from the -sys crates by @​justsmth in aws/aws-lc-rs#1187, including original commits from @​glebpom in aws/aws-lc-rs#1184
    • Downstream build scripts compiling C code against AWS-LC can now locate our artifacts via DEP_AWS_LC_* / DEP_AWS_LC_FIPS_* (libdir, libcrypto_path, link_kind, and libssl_path with ssl), consistently across the CC, CMake, and system-library build paths. Existing linker directives are unchanged. On Windows, the *_path values are the link-time artifact (import library), not the runtime DLL.
  • Key wrap hardening by @​justsmth in aws/aws-lc-rs#1190 and aws/aws-lc-rs#1191
    • KeyEncryptionKey::unwrap no longer underflows on ciphertexts shorter than 8 bytes. Since the ciphertext is untrusted input, builds with overflow-checks = true would panic instead of returning the documented Err(Unspecified); default release builds were unaffected.
    • KeyEncryptionKey now zeroizes its key material on drop, consistent with the other key types in this crate.
  • docs(signature): correct outdated note about signing a separate digest by @​WesleyRosenblum in aws/aws-lc-rs#1186

Upstream AWS-LC (v5.5.0)

aws-lc-sys v0.44.0 aligns with AWS-LC v5.5.0 (previously v5.2.0). See also the release notes for v5.3.0 and v5.4.0.

Build Improvements

  • Fix bindings copy from read-only prebuilt AWS-LC install by @​justsmth in aws/aws-lc-rs#1194
    • Copies into OUT_DIR now remove any stale destination first and leave the fresh copy writable, so building against a read-only prebuilt install (e.g. the Nix store) no longer fails with Permission denied on a build-script rerun. An OUT_DIR already poisoned by an earlier build now recovers without a cargo clean.

Issues Being Closed

... (truncated)

Commits
  • f464440 Prepare aws-lc-rs v1.18.0 (#1200)
  • 7085f8b Fix bindings copy from read-only prebuilt AWS-LC install (#1194)
  • 2196440 Export native library build metadata from the -sys crates (#1187)
  • 623100f Prepare aws-lc-sys v0.44.0 (#1199)
  • 90c687e Add rsa::KeyPair::from_components for constructing RSA key pairs from raw c...
  • b84076f Automatically optimize aws-lc for size when opt-level is "s" or "z" (#1159)
  • 5a5408b Publish script fixes: cargo clean failure, and verify aws-lc-rs against minim...
  • a23dd38 ci: fix mdbook test failure and run docs checks on PRs (#1181)
  • 390622e fix: align PQDSA API with signature module conventions (#1189)
  • 4b0cb00 docs(signature): correct outdated note about signing a separate digest (#1186)
  • Additional commits viewable in compare view

Updates bytes from 1.12.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Commits

Updates calamine from 0.36.0 to 0.36.1

Release notes

Sourced from calamine's releases.

v0.36.1 - 2026-07-27

Fixed

  • Fixed a regression in 0.36.0 that broke Strict OOXML (ISO/IEC 29500) _rels/.rels links.

    [PR #681]: tafia/calamine#681

  • Fixed XLS string handling to preserve empty strings instead of discarding them. [PR #679].

    [PR #679]: tafia/calamine#679

  • Fixed XLSB workbook parsing to consume the body of unhandled workbook-global records. A leftover body was misread as the next record id, which either silently dropped the worksheet or panicked from an empty buffer. [PR #675].

    [PR #675]: tafia/calamine#675

What's Changed

New Contributors

Full Changelog: tafia/calamine@v0.36.0...v0.36.1

Changelog

Sourced from calamine's changelog.

[0.36.1] - 2026-07-27

Fixed

  • Fixed a regression in 0.36.0 that broke Strict OOXML (ISO/IEC 29500) _rels/.rels links.

    [PR #681]: tafia/calamine#681

  • Fixed XLS string handling to preserve empty strings instead of discarding them. [PR #679].

    [PR #679]: tafia/calamine#679

  • Fixed XLSB workbook parsing to consume the body of unhandled workbook-global records. A leftover body was misread as the next record id, which either silently dropped the worksheet or panicked from an empty buffer. [PR #675].

    [PR #675]: tafia/calamine#675

Commits

Updates clap from 4.6.1 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 348cff3 chore: Release
  • d478377 docs: Update changelog
  • 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
  • 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
  • f90a966 fix(complete): Use spaces for indentation in fish
  • dd4997b fix(complete): Don't glob-expand bash positionals
  • 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
  • 8141e11 chore(deps): Update compatible (dev) (#6398)
  • 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
  • 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
  • Additional commits viewable in compare view

Updates futures from 0.3.32 to 0.3.33

Release notes

Sourced from futures's releases.

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures's changelog.

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits
  • 89cc254 Release 0.3.33
  • cd9f5be ci: Update release workflow
  • d79a499 Resolve rustdoc::broken_intra_doc_links warning
  • 95bbcf8 Resolve rustdoc ambiguous link error
  • 303c165 Resolve rustdoc::redundant_explicit_links warning
  • f34e3f5 ci: Cleanup
  • 66591a2 Enable Miri for more tests
  • ab1072f Simplify target_has_atomic cfg in utility crates
  • cf5d23b Fix unsound compat01as03 implementation (fixes #2514) (#3012)
  • 8ae794f Add portable-atomic-alloc feature and use it in FuturesUnordered (#3007)
  • Additional commits viewable in compare view

Updates futures-core from 0.3.32 to 0.3.33

Release notes

Sourced from futures-core's releases.

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures-core's changelog.

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits
  • 89cc254 Release 0.3.33
  • cd9f5be ci: Update release workflow
  • d79a499 Resolve rustdoc::broken_intra_doc_links warning
  • 95bbcf8 Resolve rustdoc ambiguous link error
  • 303c165 Resolve rustdoc::redundant_explicit_links warning
  • f34e3f5 ci: Cleanup
  • 66591a2 Enable Miri for more tests
  • ab1072f Simplify target_has_atomic cfg in utility crates
  • cf5d23b Fix unsound compat01as03 implementation (fixes #2514) (#3012)
  • 8ae794f Add portable-atomic-alloc feature and use it in FuturesUnordered (#3007)
  • Additional commits viewable in compare view

Updates http from 1.4.2 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

New Contributors

Full Changelog: hyperium/http@v1.4.2...v1.5.0

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

  • Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
  • Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
  • Fix uri::PathAndQuery parsing to enforce URI max length.
Commits

Updates hyper from 1.10.1 to 1.11.0

Release notes

Sourced from hyper's releases.

v1.11.0

Features

  • rt: add ReadBufCursor::initialized_unfilled() method (#4115) (ccc1e850)

Bug Fixes

All PRs

New Contributors

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.11.0 (2026-07-20)

Bug Fixes

Features

  • rt: add ReadBufCursor::initialized_unfilled() method (#4115) (ccc1e850)
Commits
  • 67ace64 v1.11.0
  • 540fff9 fix(http1): discard content-length header when received before transfer-encod...
  • ccc1e85 feat(rt): add ReadBufCursor::initialized_unfilled() method (#4115)
  • 0ea8bc2 docs(maintainers): move some collaborators to emeriti (#4125)
  • 2fc06fc docs(governance): define Advisor role (#4098)
  • e0d14d1 style(proto): explicitly allow decimal_literal_representation lint (#4117)
  • de1483d fix(http1): use append for repeat trailer values in encoder (#4118)
  • 08c3416 style(headers): small refactor to remove question_mark lint (#4116)
  • aecf5ab fix(http2): avoid buffering Upgraded writes without send capacity (#4102)
  • f584091 fix(http1): allow up to max_headers trailers (#4108)
  • Additional commits viewable in compare view

Updates ipnet from 2.12.0 to 2.12.1

Changelog

Sourced from ipnet's changelog.

Version 2.12.1

  • Fixes bug where Ipv4Subnets(0.0.0.0, u32::MAX-1, 0) and Ipv6Subnets(::, u128::MAX-1, 0) incorrectly included u32::MAX and u128::MAX. See issue #70.
  • Fixes some typos in documentation and error messages
Commits

Updates pyo3 from 0.29.1 to 0.29.2

Release notes

Sourced from pyo3's releases.

PyO3 0.29.2

This patch fixes a regression in PyO3 0.29.1 which broke PyPy 3.11 compatibility (#[pyclass] types would crash PyPy on instance deletion).

A few further fixes have also landed with similar themes to PyO3 0.29.1: fixes to minor reference counting bugs, rough edges which would cause crashes, issues which would cause failed builds, and fixes to experimental-inspect type stub generation.

For a full list of the exact fixes please consult the CHANGELOG.

Thank you to the following contributors for the improvements:

@​davidhewitt @​dependabot[bot] @​ImFeH2 @​musicinmybrain @​Tpt @​WaterWhisperer

Changelog

Sourced from pyo3's changelog.

[0.29.2] - 2026-08-05

Packaging

  • Add PYO3_USE_RAW_DYLIB=0 opt-out of raw-dylib linking for Windows. #6185

Fixed

  • Fix PyO3 0.29 regression with failure to link under Cygwin / MSYS2. #6185
  • Fix stubs generation for field getters (#[pyo3(get)]) when IntoPyObject is only implemented on references of the field type. #6276
  • Fix #[classmethod] magic methods receiving the instance instead of its type when invoked through a type slot. #6283
  • Fix pyo3_build_config::add_libpython_rpath_link_args emitting Unix-style rpath linker arguments on Windows and Cygwin. #6284
  • Fix PyO3 0.29.1 regression on PyPy causing crashes when deallocating #[pyclass] instances. #6294
  • Fix missing trailing nul in Python 3.9 #[pyclass] docstrings. #6296
  • Fix reference count leak of #[classattr] values created from fn items. #6297
Commits
  • a70d17f release: 0.29.2
  • bd00e11 fix backports.zoneinfo for uv install
  • 7cbd144 fix double-decref in PyPy in instance dealloc (#6294)
  • e57fb6f fix missing trailing nul on Python 3.9 #[pyclass] docstrings (#6296)
  • d83693c fix refcount leak in initialize_tp_dict (#6297)
  • 48ebbd8 fix: skip libpython rpath args on Windows and Cygwin (#6284)
  • bd73377 fix: pass class to classmethod magic methods (#6283)
  • af8d149 Restore pyo3-introspection license files (#6289)
  • 0120c59 unblock CI via a uv constraint (#6295)
  • 3161efc build(deps): bump CodSpeedHQ/action from 4 to 5.0.1 (#6286)
  • Additional commits viewable in compare view

Updates pyo3-build-config from 0.29.1 to 0.29.2

Release notes

Sourced from pyo3-build-config's releases.

PyO3 0.29.2

This patch fixes a regression in PyO3 0.29.1 which broke PyPy 3.11 compatibility (#[pyclass] types would crash PyPy on instance deletion).

A few further fixes have also landed with similar themes to PyO3 0.29.1: fixes to minor reference counting bugs, rough edges which would cause crashes, issues which would cause failed builds, and fixes to experimental-inspect type stub generation.

For a full list of the exact fixes please consult the CHANGELOG.

Thank you to the following contributors for the improvements:

@​davidhewitt @​dependabot[bot] @​ImFeH2 @​musicinmybrain @​Tpt @​WaterWhisperer

Changelog

Sourced from pyo3-build-config's changelog.

[0.29.2] - 2026-08-05

Packaging

  • Add PYO3_USE_RAW_DYLIB=0 opt-out of raw-dylib linking for Windows. #6185

Fixed

  • Fix PyO3 0.29 regression with failure to link under Cygwin / MSYS2. #6185
  • Fix stubs generation for field getters (#[pyo3(get)]) when IntoPyObject is only implemented on references of t...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Rust implementation work. labels Aug 9, 2026
@dependabot
dependabot Bot requested a review from jeremi as a code owner August 9, 2026 04:45
@dependabot dependabot Bot added rust Rust implementation work. dependencies Pull requests that update a dependency file labels Aug 9, 2026
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Aug 9, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 318dc8b7c8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
serde = { version = "1", features = ["derive"] }
serde_json = { version = "1" }
schemars = { version = "=1.2.1" }
schemars = { version = "=1.2.2" }

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the required DCO sign-off

The reviewed commit message has no Signed-off-by: trailer, so it does not satisfy the repository's DCO requirement even though the dependency changes are otherwise committed. Please recommit with git commit -s or otherwise add the trailer before merging.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
serde = { version = "1", features = ["derive"] }
serde_json = { version = "1" }
schemars = { version = "=1.2.1" }
schemars = { version = "=1.2.2" }

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Regenerate the registryctl DTO shape contract

With this line resolving workspace schemars to 1.2.2, registryctl's byte-exact DTO-shape test still asserts that the root Cargo.toml contains schemars = { version = "=1.2.1" }, and the committed crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json still records generator version 1.2.1. Any cargo test -p registryctl --lib run that reaches committed_dto_shape_contract_is_byte_exact_generated_output will fail immediately, so update the hard-coded generator metadata and regenerate the contract as part of the bump.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-minor-patch-fb3f562203 branch from 318dc8b to acc8971 Compare August 9, 2026 05:08
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Aug 9, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: acc8971a1e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.lock Outdated
[[package]]
name = "aws-lc-rs"
version = "1.17.0"
version = "1.17.3"

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Refresh the platform fuzz lock with the crypto bump

When this root lockfile moves aws-lc-rs/aws-lc-sys to 1.17.3/0.43.0, the platform fuzz workspace still pins 1.17.0/0.41.0 in products/platform/fuzz/Cargo.lock, and its README documents that this lockfile is independent of the main workspace lockfile. Because the CI platform fuzz smoke runs from products/platform and the older versions still satisfy the loose aws-lc-rs = "1" requirement, these crypto/signing dependency changes are not exercised by the advertised platform fuzz gate; refresh the platform fuzz lockfile as part of the bump.

Useful? React with 👍 / 👎.

Comment thread Cargo.lock Outdated
[[package]]
name = "aws-lc-rs"
version = "1.17.0"
version = "1.17.3"

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add security-review notes for the crypto bump

When this line moves aws-lc-rs/aws-lc-sys, it changes the crypto backend used by registry-platform-crypto for signing and verification. I don't see a Registry Stack review note documenting the local impact/risk of this signing-path dependency change, only upstream release notes, so please add the explicit review note required for signing-sensitive changes.

Useful? React with 👍 / 👎.

Comment thread Cargo.lock
[[package]]
name = "serde"
version = "1.0.228"
version = "1.0.229"

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Refresh the manifest fuzz lockfile

When serde/serde_json resolve to 1.0.229/1.0.151 here, products/manifest/fuzz/Cargo.lock remains on 1.0.228/1.0.150 even though that fuzz workspace documents and uses its own lockfile. The nightly manifest fuzz job runs from products/manifest with cargo +nightly fuzz run --fuzz-dir fuzz, so the parser smoke keeps exercising the old serialization stack while the real workspace uses the new one; regenerate that fuzz lock along with the root dependency bump.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-minor-patch-fb3f562203 branch 4 times, most recently from 1e1bb70 to 040a0d8 Compare August 10, 2026 21:58
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 10, 2026

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-minor-patch-fb3f562203 branch 3 times, most recently from 6b5322d to 385ae9a Compare August 11, 2026 03:38
@dependabot
chore(deps): bump the cargo-minor-patch group across 1 directory with…
181f7a5 
… 24 updates

Bumps the cargo-minor-patch group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.103` | `1.0.104` |
| [arc-swap](https://github.com/vorner/arc-swap) | `1.9.1` | `1.9.2` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.92` |
| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.17.0` | `1.18.0` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.12.0` | `1.12.1` |
| [calamine](https://github.com/tafia/calamine) | `0.36.0` | `0.36.1` |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.6` |
| [futures](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.33` |
| [http](https://github.com/hyperium/http) | `1.4.2` | `1.5.0` |
| [hyper](https://github.com/hyperium/hyper) | `1.10.1` | `1.11.0` |
| [ipnet](https://github.com/krisprice/ipnet) | `2.12.0` | `2.12.1` |
| [pyo3](https://github.com/pyo3/pyo3) | `0.29.1` | `0.29.2` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [schemars](https://github.com/GREsau/schemars) | `1.2.1` | `1.2.2` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.20` |
| [time](https://github.com/time-rs/time) | `0.3.51` | `0.3.55` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.18` | `0.7.19` |
| [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.4+spec-1.1.0` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.4` | `1.24.0` |
| [regex](https://github.com/rust-lang/regex) | `1.12.4` | `1.13.1` |



Updates `anyhow` from 1.0.103 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.103...1.0.104)

Updates `arc-swap` from 1.9.1 to 1.9.2
- [Changelog](https://github.com/vorner/arc-swap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/arc-swap/commits)

Updates `async-trait` from 0.1.89 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.89...0.1.92)

Updates `aws-lc-rs` from 1.17.0 to 1.18.0
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@v1.17.0...v1.18.0)

Updates `bytes` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.12.0...v1.12.1)

Updates `calamine` from 0.36.0 to 0.36.1
- [Release notes](https://github.com/tafia/calamine/releases)
- [Changelog](https://github.com/tafia/calamine/blob/master/Changelog.md)
- [Commits](tafia/calamine@v0.36.0...v0.36.1)

Updates `clap` from 4.6.1 to 4.6.6
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.6)

Updates `futures` from 0.3.32 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.33)

Updates `futures-core` from 0.3.32 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.33)

Updates `http` from 1.4.2 to 1.5.0
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](hyperium/http@v1.4.2...v1.5.0)

Updates `hyper` from 1.10.1 to 1.11.0
- [Release notes](https://github.com/hyperium/hyper/releases)
- [Changelog](https://github.com/hyperium/hyper/blob/master/CHANGELOG.md)
- [Commits](hyperium/hyper@v1.10.1...v1.11.0)

Updates `ipnet` from 2.12.0 to 2.12.1
- [Release notes](https://github.com/krisprice/ipnet/releases)
- [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md)
- [Commits](https://github.com/krisprice/ipnet/commits)

Updates `pyo3` from 0.29.1 to 0.29.2
- [Release notes](https://github.com/pyo3/pyo3/releases)
- [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md)
- [Commits](PyO3/pyo3@v0.29.1...v0.29.2)

Updates `pyo3-build-config` from 0.29.1 to 0.29.2
- [Release notes](https://github.com/pyo3/pyo3/releases)
- [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md)
- [Commits](PyO3/pyo3@v0.29.1...v0.29.2)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `schemars` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/GREsau/schemars/releases)
- [Changelog](https://github.com/GREsau/schemars/blob/master/CHANGELOG.md)
- [Commits](GREsau/schemars@v1.2.1...v1.2.2)

Updates `thiserror` from 2.0.18 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.20)

Updates `time` from 0.3.51 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.51...v0.3.55)

Updates `tokio` from 1.52.3 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1)

Updates `tokio-util` from 0.7.18 to 0.7.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-util-0.7.18...tokio-util-0.7.19)

Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.4+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.2...toml-v1.1.4)

Updates `uuid` from 1.23.4 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.4...v1.24.0)

Updates `regex` from 1.12.4 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.4...1.13.1)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: arc-swap
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: async-trait
  dependency-version: 0.1.91
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: aws-lc-rs
  dependency-version: 1.17.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: calamine
  dependency-version: 0.36.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: clap
  dependency-version: 4.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: futures
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: futures-core
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: http
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: hyper
  dependency-version: 1.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: ipnet
  dependency-version: 2.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: pyo3
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: pyo3-build-config
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: schemars
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: tokio-util
  dependency-version: 0.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: toml
  dependency-version: 1.1.4+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-minor-patch-fb3f562203 branch from 385ae9a to 181f7a5 Compare August 11, 2026 10:58
@dependabot @github

dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 11, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-minor-patch-fb3f562203 branch August 11, 2026 15:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@jeremi jeremi Awaiting requested review from jeremi jeremi is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Rust implementation work.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants