Skip to content

Bump the dependencies group across 1 directory with 17 updates#245

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/dependencies-10f99fee59
Open

Bump the dependencies group across 1 directory with 17 updates#245
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/dependencies-10f99fee59

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dependencies group with 17 updates in the / directory:

Package From To
h2 0.4.14 0.4.15
tokio 1.51.1 1.52.3
io-uring 0.7.12 0.7.13
anyhow 1.0.102 1.0.103
toml 1.1.2+spec-1.1.0 1.1.3+spec-1.1.0
bytes 1.11.1 1.12.1
socket2 0.6.4 0.6.5
http 1.4.1 1.4.2
http-body-util 0.1.3 0.1.4
quiche 0.29.1 0.29.2
tokio-quiche 0.19.0 0.19.1
rustls 0.23.40 0.23.42
rustls-pki-types 1.14.1 1.15.0
rand 0.10.1 0.10.2
aya 0.13.1 0.14.0
aya-obj 0.2.1 0.3.0
arc-swap 1.9.1 1.9.2

Updates h2 from 0.4.14 to 0.4.15

Release notes

Sourced from h2's releases.

v0.4.15

What's Changed

New Contributors

Full Changelog: hyperium/h2@v0.4.14...v0.4.15

Changelog

Sourced from h2's changelog.

0.4.15 (June 15, 2026)

  • Fix closing a connection when header size is "way too large" (currently x4 configured limit).
  • Fix overflow calculating padding length if a DATA frame had 255 bytes of padding.
  • Fix ignoring library-initiated resets in the connection state loop.
  • Fix decoding panic with an absurd amount of headers and no limit to now use try_append().
  • Fix rejecting frames on streams whose HEADERS have not been sent.
  • Fix poll_capacity() to not return Some(Ok(0)).
  • Fix discarding of buffered DATA frames when a reset is scheduled.
Commits
  • 21211d0 v0.4.15
  • 29e209d fix: close connection when header size is way too large (#915)
  • 9231cb0 fix: remove padded_len() u8 overflow in DATA frame padding release (#914)
  • d351036 fix: ignore library resets at connection poll loop level (#913)
  • 4f51fff fix: use HeaderMap::try_append to prevent panics on absurd amounts of headers...
  • c813cc8 refactor: remove unnecessary clones (#911)
  • 810f5ae chore(ci): update actions/checkout to v6 (#910)
  • d361b75 fix: Reject frames on streams whose HEADERS haven't been sent (#899)
  • 93ccead fix: poll_capacity must not return Ready(Some(Ok(0))) (#898)
  • 733bba7 fix: Discard buffered DATA when a scheduled reset is pending (#896)
  • See full diff in compare view

Updates tokio from 1.51.1 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

  • sync: fix underflow in mpsc channel len() (#8062)
  • sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
  • sync: require that an RwLock has max_readers != 0 (#8076)
  • sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Tokio v1.52.1

1.52.1 (April 16th, 2026)

Fixed

  • runtime: revert #7757 to fix [a regression]#8056 that causes spawn_blocking to hang (#8057)

#7757: tokio-rs/tokio#7757 #8056: tokio-rs/tokio#8056 #8057: tokio-rs/tokio#8057

Tokio v1.52.0

1.52.0 (April 14th, 2026)

Added

  • io: AioSource::register_borrowed for I/O safety support (#7992)
  • net: add try_io function to unix::pipe sender and receiver types (#8030)

Added (unstable)

  • runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#8010)
  • taskdump: add trace_with() for customized task dumps (#8025)
  • taskdump: allow impl FnMut() in trace_with instead of just fn() (#8040)
  • fs: support io_uring in AsyncRead for File (#7907)

... (truncated)

Commits

Updates io-uring from 0.7.12 to 0.7.13

Commits

Updates anyhow from 1.0.102 to 1.0.103

Release notes

Sourced from anyhow's releases.

1.0.103

  • Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)
Commits
  • 5bdb0e2 Release 1.0.103
  • e621bd3 Merge pull request #452 from dtolnay/downcast
  • 6e8c000 Eliminate pointer->reference->pointer during downcast
  • 67c4abd Add regression test for issue 451
  • 917a169 Update actions/upload-artifact@v6 -> v7
  • d9dc3fa Update actions/checkout@v6 -> v7
  • 841522b Raise minimum tested compiler to rust 1.85
  • See full diff in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

Updates bytes from 1.11.1 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)
Commits

Updates socket2 from 0.6.4 to 0.6.5

Changelog

Sourced from socket2's changelog.

0.6.5

Commits

Updates http from 1.4.1 to 1.4.2

Changelog

Sourced from http's changelog.

1.4.2 (June 8, 2026)

  • Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.
  • Fix Uri to properly reject DEL characters.
Commits

Updates http-body-util from 0.1.3 to 0.1.4

Release notes

Sourced from http-body-util's releases.

http-body-util-v0.1.4

What's Changed

  • Add Fused body combinator that always returns None once completed.
  • Add BodyExt::into_stream() to convert a body into a Stream.
  • Add Full::into_inner() to get the full Buf.
  • Add InspectFrame and InspectErr combinators.
Commits

Updates quiche from 0.29.1 to 0.29.2

Release notes

Sourced from quiche's releases.

🛡️ 0.29.2

⚠️ Security:

  • Fixed a use-after-free in quiche_connection_id_iter_next(), which is part of quiche's C FFI API. The iterator previously returned a pointer to a cloned connection ID whose backing storage was dropped before the caller could read it. It now returns pointers to connection IDs owned by the iterator.
  • Fixed a use-after-free in quiche_conn_retired_scid_next(), which is also part of the C FFI API. The function previously returned a pointer to a retired source connection ID whose backing storage was dropped before the caller could read it. It has been replaced by quiche_conn_retired_scid_iter(), which drains retired source connection IDs into an iterator before exposing them to callers.

The C FFI API is disabled by default via the ffi feature. The normal Rust API is not affected by these issues.

Breaking changes:

  • The C API function quiche_conn_retired_scid_next() was removed and replaced with quiche_conn_retired_scid_iter() to avoid returning pointers to temporary memory. Applications using quiche_conn_retired_scid_next() should call quiche_conn_retired_scid_iter(conn), iterate with quiche_connection_id_iter_next(), and release the iterator with quiche_connection_id_iter_free().

Highlights:

  • Fixed stream send-buffer accounting so congestion controller app-limited detection and Stats::tx_buffered_state track the actual bytes buffered in stream send buffers. This avoids buffered byte-count drift across retransmissions, ACKs, and stream shutdown/reset paths.

Full changelog at 0.29.1...0.29.2

Commits
  • 839b23d quiche: release 0.29.2
  • f2db946 ffi: fix use-after-free in quiche_conn_retired_scid_next
  • 386ad63 ffi: fix use-after-free in quiche_connection_id_iter_next
  • 65a85fb Fix tx_buffered computation so it matches the sum of bytes in stream buffers ...
  • 6b5a13c Remove unused imports in qlog-dancer component (#2511)
  • See full diff in compare view

Updates tokio-quiche from 0.19.0 to 0.19.1

Release notes

Sourced from tokio-quiche's releases.

🛡️ 0.19.1

⚠️ Security:

  • Added a limit to how many PATH_CHALLENGE frames are queued. Without the limit an attacker could cause a server to queue an unbounded number of frames, leading to a slow but steady increase in memory usage (CVE-2023-6193).

Full changelog at cloudflare/quiche@0.19.0...0.19.1

Commits
  • 09b125d tokio-quiche: release 0.19.1
  • 55886df quiche: release 0.29.3
  • 985473a octets: release 0.3.6
  • 439795b fix: bound PathEvent queue by deferring events until path insertion
  • f61d62d h3: incrementally allocate state buffer for large frames
  • 8215ecd qpack: fix size calculation when decoding
  • 9be0e4f h3: implement a default for SETTINGS_MAX_FIELD_SECTION_SIZE
  • 1b52c6b h3: add configurable max size for PRIORITY_UPDATE frames
  • 1e0e537 h3: avoid allocating state buffer when skipping unknown frames
  • b732cbf h3: enforce frames size limit early
  • Additional commits viewable in compare view

Updates rustls from 0.23.40 to 0.23.42

Commits
  • 411fb02 Bump version to 0.23.42
  • aff9845 implement rfc 9149 ticket_request extension
  • 8bd3d1b server: add max_tls13_tickets configuration
  • 4cce222 Address new std_instead_of_core in nightly
  • d3ffdc1 Address new std_instead_of_core in nightly
  • 75d1b7a Take semver-compatible dependency updates
  • 642a103 ci: drop Taplo job
  • 752c144 Drop nightly clippy tests
  • 8d8611a Fix new clippy::useless-borrows-in-formatting
  • ebf3297 Fix new clippy::manual_clear
  • Additional commits viewable in compare view

Updates rustls-pki-types from 1.14.1 to 1.15.0

Release notes

Sourced from rustls-pki-types's releases.

v/1.15.0

New feature: add a constructor for FipsStatus::Certified.

What's Changed

Full Changelog: rustls/pki-types@v/1.14.1...v/1.15.0

Commits

Updates rand from 0.10.1 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

Commits

Updates aya from 0.13.1 to 0.14.0

Release notes

Sourced from aya's releases.

aya-v0.14.0

Full Changelog: aya-rs/aya@aya-obj-v0.3.0...aya-v0.14.0

Commits
  • 302985c Release aya v0.14.0, aya-build v0.2.0, aya-ebpf-cty v0.3.0, aya-ebpf-bindings...
  • 269dfaf chore: Release aya-obj v0.3.0
  • 168f9c3 chore(public-api): Regenerate
  • 64928dd fix(integration-test): Appease Clippy's future_not_send lint
  • bf18994 fix(aya/test_helpers): Prevent NetNsGuard from crossing threads
  • e2ab3ee fix(aya/test_helpers): Clean up after errors in NetNsGuard::new()
  • 8d1d15b refactor(aya/test_helpers): Return an error instead of panicking
  • 745065a chore(aya/netlink): Add a docstring for NetlinkError::raw_os_error()
  • b9b92ce refactor(test): Move utils.rs from the integration-test crate to aya
  • 996485a doc(test/utils): Add docstrings
  • Additional commits viewable in compare view

Updates aya-obj from 0.2.1 to 0.3.0

Release notes

Sourced from aya-obj's releases.

aya-obj-v0.3.0

What's Changed

... (truncated)

Commits
  • 269dfaf chore: Release aya-obj v0.3.0
  • 168f9c3 chore(public-api): Regenerate
  • 64928dd fix(integration-test): Appease Clippy's future_not_send lint
  • bf18994 fix(aya/test_helpers): Prevent NetNsGuard from crossing threads
  • e2ab3ee fix(aya/test_helpers): Clean up after errors in NetNsGuard::new()
  • 8d1d15b refactor(aya/test_helpers): Return an error instead of panicking
  • 745065a chore(aya/netlink): Add a docstring for NetlinkError::raw_os_error()
  • b9b92ce refactor(test): Move utils.rs from the integration-test crate to aya
  • 996485a doc(test/utils): Add docstrings
  • 23b5359 feat(integration-test): Search for a cgroup2 mount
  • Additional commits viewable in compare view

Updates arc-swap from 1.9.1 to 1.9.2

Changelog

Sourced from arc-swap's changelog.

1.9.2

  • Document RefCnt must not panic (#208).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dependencies group across 1 directory with 17 updates
2ab991b 
Bumps the dependencies group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [h2](https://github.com/hyperium/h2) | `0.4.14` | `0.4.15` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.51.1` | `1.52.3` |
| [io-uring](https://github.com/tokio-rs/io-uring) | `0.7.12` | `0.7.13` |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.102` | `1.0.103` |
| [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.3+spec-1.1.0` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.11.1` | `1.12.1` |
| [socket2](https://github.com/rust-lang/socket2) | `0.6.4` | `0.6.5` |
| [http](https://github.com/hyperium/http) | `1.4.1` | `1.4.2` |
| [http-body-util](https://github.com/hyperium/http-body) | `0.1.3` | `0.1.4` |
| [quiche](https://github.com/cloudflare/quiche) | `0.29.1` | `0.29.2` |
| [tokio-quiche](https://github.com/cloudflare/quiche) | `0.19.0` | `0.19.1` |
| [rustls](https://github.com/rustls/rustls) | `0.23.40` | `0.23.42` |
| [rustls-pki-types](https://github.com/rustls/pki-types) | `1.14.1` | `1.15.0` |
| [rand](https://github.com/rust-random/rand) | `0.10.1` | `0.10.2` |
| [aya](https://github.com/aya-rs/aya) | `0.13.1` | `0.14.0` |
| [aya-obj](https://github.com/aya-rs/aya) | `0.2.1` | `0.3.0` |
| [arc-swap](https://github.com/vorner/arc-swap) | `1.9.1` | `1.9.2` |



Updates `h2` from 0.4.14 to 0.4.15
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/master/CHANGELOG.md)
- [Commits](hyperium/h2@v0.4.14...v0.4.15)

Updates `tokio` from 1.51.1 to 1.52.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.51.1...tokio-1.52.3)

Updates `io-uring` from 0.7.12 to 0.7.13
- [Commits](tokio-rs/io-uring@v0.7.12...v0.7.13)

Updates `anyhow` from 1.0.102 to 1.0.103
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.102...1.0.103)

Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.2...toml-v1.1.3)

Updates `bytes` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.11.1...v1.12.1)

Updates `socket2` from 0.6.4 to 0.6.5
- [Release notes](https://github.com/rust-lang/socket2/releases)
- [Changelog](https://github.com/rust-lang/socket2/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/socket2/commits/v0.6.5)

Updates `http` from 1.4.1 to 1.4.2
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](hyperium/http@v1.4.1...v1.4.2)

Updates `http-body-util` from 0.1.3 to 0.1.4
- [Release notes](https://github.com/hyperium/http-body/releases)
- [Commits](hyperium/http-body@http-body-util-v0.1.3...http-body-util-v0.1.4)

Updates `quiche` from 0.29.1 to 0.29.2
- [Release notes](https://github.com/cloudflare/quiche/releases)
- [Commits](cloudflare/quiche@0.29.1...0.29.2)

Updates `tokio-quiche` from 0.19.0 to 0.19.1
- [Release notes](https://github.com/cloudflare/quiche/releases)
- [Commits](cloudflare/quiche@tokio-quiche-0.19.0...tokio-quiche-0.19.1)

Updates `rustls` from 0.23.40 to 0.23.42
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.40...v/0.23.42)

Updates `rustls-pki-types` from 1.14.1 to 1.15.0
- [Release notes](https://github.com/rustls/pki-types/releases)
- [Commits](rustls/pki-types@v/1.14.1...v/1.15.0)

Updates `rand` from 0.10.1 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.10.1...0.10.2)

Updates `aya` from 0.13.1 to 0.14.0
- [Release notes](https://github.com/aya-rs/aya/releases)
- [Changelog](https://github.com/aya-rs/aya/blob/main/RELEASE.md)
- [Commits](aya-rs/aya@aya-v0.13.1...aya-v0.14.0)

Updates `aya-obj` from 0.2.1 to 0.3.0
- [Release notes](https://github.com/aya-rs/aya/releases)
- [Changelog](https://github.com/aya-rs/aya/blob/main/RELEASE.md)
- [Commits](aya-rs/aya@aya-obj-v0.2.1...aya-obj-v0.3.0)

Updates `arc-swap` from 1.9.1 to 1.9.2
- [Changelog](https://github.com/vorner/arc-swap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vorner/arc-swap/commits)

---
updated-dependencies:
- dependency-name: h2
  dependency-version: 0.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: tokio
  dependency-version: 1.52.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: io-uring
  dependency-version: 0.7.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: anyhow
  dependency-version: 1.0.103
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: toml
  dependency-version: 1.1.3+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: socket2
  dependency-version: 0.6.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: http
  dependency-version: 1.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: http-body-util
  dependency-version: 0.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: quiche
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: tokio-quiche
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: rustls
  dependency-version: 0.23.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: rustls-pki-types
  dependency-version: 1.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: aya
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: aya-obj
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: arc-swap
  dependency-version: 1.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies rust Pull requests that update rust code labels Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants