Skip to content

Bump the cargo group across 1 directory with 5 updates - #4

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/cargo-b2ce5bdee4
Open

Bump the cargo group across 1 directory with 5 updates#4
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/cargo-b2ce5bdee4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 14, 2026

Copy link
Copy Markdown

Bumps the cargo group with 5 updates in the / directory:

Package From To
tokio 1.38.0 1.38.2
sqlx 0.7.4 0.8.1
bytes 1.6.0 1.11.1
openssl 0.10.64 0.10.77
rsa 0.9.6 0.9.10

Updates tokio from 1.38.0 to 1.38.2

Release notes

Sourced from tokio's releases.

Tokio v1.38.2

This release fixes a soundness issue in the broadcast channel. The channel accepts values that are Send but !Sync. Previously, the channel called clone() on these values without synchronizing. This release fixes the channel by synchronizing calls to .clone() (Thanks Austin Bonander for finding and reporting the issue).

Fixed

  • sync: synchronize clone() call in broadcast channel (#7232)

#7232: tokio-rs/tokio#7232

Tokio v1.38.1

1.38.1 (July 16th, 2024)

This release fixes the bug identified as (#6682), which caused timers not to fire when they should.

Fixed

  • time: update wake_up while holding all the locks of sharded time wheels (#6683)

#6682: tokio-rs/tokio#6682 #6683: tokio-rs/tokio#6683

Commits

Updates sqlx from 0.7.4 to 0.8.1

Changelog

Sourced from sqlx's changelog.

0.8.1 - 2024-08-23

16 pull requests were merged this release cycle.

This release contains a fix for [RUSTSEC-2024-0363].

Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated: launchbadge/sqlx#3440

MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.

Added

  • [#3421]: correct spelling of MySqlConnectOptions::no_engine_substitution() [[@​kolinfluence]]
    • Deprecates MySqlConnectOptions::no_engine_subsitution() (oops) in favor of the correctly spelled version.

Changed

  • [#3376]: doc: hide spec_error module [[@​abonander]]
    • This is a helper module for the macros and was not meant to be exposed.
    • It is not expected to receive any breaking changes for the 0.8.x release, but is not designed as a public API. Use at your own risk.
  • [#3382]: feat: bumped to libsqlite3-sys=0.30.1 to support sqlite 3.46 [[@​CommanderStorm]]
  • [#3385]: chore(examples):Migrated the pg-chat example to ratatui [[@​CommanderStorm]]
  • [#3399]: Upgrade to rustls 0.23 [[@​djc]]
    • RusTLS now has pluggable cryptography providers: ring (the existing implementation), and aws-lc-rs which has optional FIPS certification.
    • The existing features activating RusTLS (runtime-tokio-rustls, runtime-async-std-rustls, tls-rustls) enable the ring provider of RusTLS to match the existing behavior so this should not be a breaking change.
    • Switch to the tls-rustls-aws-lc-rs feature to use the aws-lc-rs provider.
      • If using runtime-tokio-rustls or runtime-async-std-rustls, this will necessitate switching to the appropriate non-legacy runtime feature: runtime-tokio or runtime-async-std
    • See the RusTLS README for more details: https://github.com/rustls/rustls?tab=readme-ov-file#cryptography-providers

Fixed

#2786: launchbadge/sqlx#2786 #3354: launchbadge/sqlx#3354 #3371: launchbadge/sqlx#3371

... (truncated)

Commits
  • 9c94ce8 chore: prepare release 0.8.1
  • 0aa0676 chore(mysql): create regression test for RUSTSEC-2024-0363
  • 791433a chore(sqlite): create regression test for RUSTSEC-2024-0363
  • b1539b6 chore(postgres): create regression test for RUSTSEC-2024-0363
  • 9e3ece4 fix(postgres): use checked decrement on pending_ready_for_query_count
  • 823261a fix(mysql): don't use an arbitrary cfg for one test
  • b5c218e fix(postgres): fix missing inversion on PgNumeric::is_valid_digit()
  • 394a7e8 fix(sqlite): fix unit and doctests
  • 27c5730 fix(mysql): fix doctests
  • 71f72e2 fix(mysql): add sqlx as a dev-dependency for doctests
  • Additional commits viewable in compare view

Updates bytes from 1.6.0 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)

Bytes v1.10.1

1.10.1 (March 5th, 2025)

Fixed

  • Fix memory leak when using to_vec with Bytes::from_owner (#773)

#773: tokio-rs/bytes#773

Bytes v1.10.0

1.10.0 (February 3rd, 2025)

Added

  • Add feature to support platforms without atomic CAS (#467)
  • try_get_* methods for Buf trait (#753)
  • Implement Buf::chunks_vectored for Take (#617)
  • Implement Buf::chunks_vectored for VecDeque<u8> (#708)

Fixed

  • Remove incorrect guarantee for chunks_vectored (#754)
  • Ensure that tests pass under panic=abort (#749)

... (truncated)

Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)

1.10.1 (March 5th, 2025)

Fixed

  • Fix memory leak when using to_vec with Bytes::from_owner (#773)

1.10.0 (February 3rd, 2025)

Added

  • Add feature to support platforms without atomic CAS (#467)
  • try_get_* methods for Buf trait (#753)
  • Implement Buf::chunks_vectored for Take (#617)
  • Implement Buf::chunks_vectored for VecDeque<u8> (#708)

Fixed

  • Remove incorrect guarantee for chunks_vectored (#754)
  • Ensure that tests pass under panic=abort (#749)

1.9.0 (November 27, 2024)

Added

  • Add Bytes::from_owner to enable externally-allocated memory (#742)

Documented

... (truncated)

Commits

Updates openssl from 0.10.64 to 0.10.77

Release notes

Sourced from openssl's releases.

openssl-v0.10.77

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.76...openssl-v0.10.77

openssl-v0.10.76

What's Changed

New Contributors

... (truncated)

Commits
  • 78efb65 Release openssl v0.10.77 and openssl-sys v0.9.113 (#2590)
  • 5507b22 md_ctx: enable sign/verify/reset on BoringSSL, LibreSSL, and AWS-LC (#2589)
  • ba21087 Merge pull request #2588 from goffrie/bump
  • 9cc57fa Bump aws-lc-sys to 0.39
  • ee5c685 CI: Hash-pin all action usage, avoid credential persistence in actions/checko...
  • 6b94124 Release openssl v0.10.76 and openssl-sys v0.9.112 (#2582)
  • 30c3f2d Bump aws-lc-sys to 0.38 (#2581)
  • efc55bf Support pregenerated Rust bindings from AWS-LC installations (#2578)
  • 80cd420 Constify from_raw (#2580)
  • e64c352 Pin quote to 1.0.44 for min-version CI (#2579)
  • Additional commits viewable in compare view

Updates rsa from 0.9.6 to 0.9.10

Changelog

Sourced from rsa's changelog.

0.9.10 (2026-01-06)

Fixed

  • do not panic on a prime being 1 when loading a secret key (#624)

#624: RustCrypto/RSA#624

0.9.9 (2025-11-13)

Fixed

  • Support for cryptographic operations with larger keys (#594)

#594: RustCrypto/RSA#594

0.9.8 (2025-03-12)

Added

  • Doc comments to specify the rand version (#473)

#473: RustCrypto/RSA#473

0.9.7 (2024-11-26)

Fixed

  • always validate keys in from_components
  • do not crash when handling tiny keys in PKCS1v15
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the cargo group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.38.0` | `1.38.2` |
| [sqlx](https://github.com/launchbadge/sqlx) | `0.7.4` | `0.8.1` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.6.0` | `1.11.1` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.64` | `0.10.77` |
| [rsa](https://github.com/RustCrypto/RSA) | `0.9.6` | `0.9.10` |



Updates `tokio` from 1.38.0 to 1.38.2
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.38.0...tokio-1.38.2)

Updates `sqlx` from 0.7.4 to 0.8.1
- [Changelog](https://github.com/launchbadge/sqlx/blob/main/CHANGELOG.md)
- [Commits](transact-rs/sqlx@v0.7.4...v0.8.1)

Updates `bytes` from 1.6.0 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.6.0...v1.11.1)

Updates `openssl` from 0.10.64 to 0.10.77
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.64...openssl-v0.10.77)

Updates `rsa` from 0.9.6 to 0.9.10
- [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md)
- [Commits](RustCrypto/RSA@v0.9.6...v0.9.10)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.38.2
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: sqlx
  dependency-version: 0.8.1
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-version: 0.10.77
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rsa
  dependency-version: 0.9.10
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants