Skip to content

chore(deps): Bump the rust-security-and-maintenance group with 9 updates #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): Bump the rust-security-and-maintenance group with 9 updates #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
499 changes: 133 additions & 366 deletions Cargo.lock
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion crates/crustcore-dev/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ crustcore-netproto = { workspace = true }

# The heavy web stack — OPTIONAL, enabled ONLY by the `serve` feature. The default
# CI build links none of these; the deterministic core is tested without them.
axum = { version = "0.7", optional = true, default-features = false, features = [
axum = { version = "0.8", optional = true, default-features = false, features = [
"http1",
"tokio",
"query",
Expand Down
4 changes: 2 additions & 2 deletions crates/crustcore-index-rag/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ crustcore-types = { workspace = true }
# Never default, never linked into nano (off-by-default `dep:` deps are not selected by
# the nano graph). tree-sitter brings its own (audited, upstream) `unsafe` C bindings; our
# code stays `#![forbid(unsafe_code)]`-safe and only walks the parsed tree.
tree-sitter = { version = "0.25", optional = true }
tree-sitter = { version = "0.26", optional = true }
tree-sitter-rust = { version = "0.24", optional = true }

# OPTIONAL: the external vector-store HTTP clients (`qdrant` / `lancedb` features only).
Expand All @@ -32,7 +32,7 @@ tree-sitter-rust = { version = "0.24", optional = true }
# `serde_json` shapes the request/response bodies. Both are off-by-default and gated to the
# external-store features, so the default build and the nano graph link neither (proven by
# `cargo xtask forbidden-deps` and the default-tree check below).
ureq = { version = "2.12", optional = true }
ureq = { version = "3.3", optional = true }
serde_json = { version = "1", optional = true }

[features]
Expand Down
2 changes: 1 addition & 1 deletion crates/crustcore-index/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ crustcore-netproto = { workspace = true }
# tree-sitter brings its own (audited, upstream) `unsafe` C bindings; our code stays
# `#![forbid(unsafe_code)]`-safe and only walks the parsed tree with an explicit cursor.
# Pinned to the same versions crustcore-index-rag's C5-ast backend uses.
tree-sitter = { version = "0.25", optional = true }
tree-sitter = { version = "0.26", optional = true }
tree-sitter-rust = { version = "0.24", optional = true }

[features]
Expand Down
2 changes: 1 addition & 1 deletion crates/crustcore-mcp/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ serde_json = "1"
# powers the remote `HttpMcp` JSON-RPC transport (P13-net-http). The default build
# links no HTTP/TLS stack — the envelope build + response parse are CI-tested without
# network, and the live POST is `#[ignore]`d. (Matches the `ureq` pin in crustcore-net.)
ureq = { version = "2.12", optional = true }
ureq = { version = "3.3", optional = true }

[features]
# The remote HTTP MCP transport ([`HttpMcp`]). Off by default: a default
Expand Down
2 changes: 1 addition & 1 deletion crates/crustcore-net/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ serde_json = "1"
# the sync `Provider::complete` contract (no async runtime). `forbidden-deps` asserts
# the default crustcore-net build links no ureq/rustls. The live Telegram Bot API
# client reuses this same `UreqClient` (no new HTTP stack).
ureq = { version = "2", optional = true }
ureq = { version = "3", optional = true }

# RS256 JWT minting for GitHub App auth (P10/B2-gh-app), behind the `github-app`
# feature ONLY — all three OPTIONAL so the default build (workspace + CI + the mock
Expand Down
6 changes: 3 additions & 3 deletions crates/crustcore-secrets/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ crustcore-zeroize = { workspace = true }
# pulls NO crypto crate. AES-256-GCM AEAD + scrypt KDF + OS RNG; all RustCrypto /
# std-adjacent and well-maintained. `xtask forbidden-deps` asserts none of these
# enter the nano dependency graph. (docs/secrets.md §6; CLAUDE.md §5.1.)
aes-gcm = { version = "0.10", optional = true }
scrypt = { version = "0.11", default-features = false, optional = true }
getrandom = { version = "0.2", optional = true }
aes-gcm = { version = "0.11", optional = true }
scrypt = { version = "0.12", default-features = false, optional = true }
getrandom = { version = "0.4", optional = true }
zeroize = { version = "1.9", features = ["alloc"], optional = true }

[features]
Expand Down
2 changes: 1 addition & 1 deletion crates/crustcore-telemetry/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ crustcore-secrets = { workspace = true }
# shapes the OTLP/HTTP JSON body. This is a non-nano sidecar crate the nano binary never
# links — `xtask forbidden-deps` proves ureq/serde_json never enter the nano graph
# (CLAUDE.md §5.1, invariants 19, 20).
ureq = { version = "2.12", optional = true }
ureq = { version = "3.3", optional = true }
serde_json = { version = "1", optional = true }

[features]
Expand Down
Loading