Skip to content

chore(deps): bump the cargo-security group across 1 directory with 5 updates - #33

Merged
rldyourmnd merged 3 commits into
mainfrom
dependabot/cargo/cargo-security-20929a6c8c
Sep 2, 2026
Merged

chore(deps): bump the cargo-security group across 1 directory with 5 updates#33
rldyourmnd merged 3 commits into
mainfrom
dependabot/cargo/cargo-security-20929a6c8c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo-security group with 5 updates in the / directory:

Package From To
crossbeam-channel 0.5.13 0.5.16
rand 0.8.5 0.10.2
rustls-webpki 0.103.3 0.103.15
time 0.3.36 0.3.55
tracing-subscriber 0.3.19 0.3.23

Updates crossbeam-channel from 0.5.13 to 0.5.16

Release notes

Sourced from crossbeam-channel's releases.

crossbeam-channel 0.5.16

  • Improve support for rust-analyzer auto-completion of code inside select!/select_biased! macro. (#1240)
  • Make never const. (#1250)

crossbeam-channel 0.5.15

  • Fix regression introduced in 0.5.12 that can lead to a double free when dropping unbounded channel. (#1187)

crossbeam-channel 0.5.14

  • Fix stack overflow when sending large value to unbounded channel. (#1146, #1147)
  • Add Select::new_biased function. (#1150)
  • Remove inefficient spinning. (#1154)
  • Suppress buggy clippy::zero_repeat_side_effects lint in macro generated code. (#1123)
Commits
  • 9b56303 Prepare for the next release
  • a078b17 ci: Sync config with main
  • 508c29d Remove crossbeam-skiplist which is not published from this branch from worksp...
  • 6a20e57 tests: Fix mismatched_lifetime_syntaxes
  • c2d674f epoch: Fix rustdoc::invalid_rust_codeblocks
  • bd6563e Update no_atomic.rs
  • d3e1e36 Make CachePadded<T> have C repr to allow casting to and from T (#1270)
  • c0c466e channel: Use non-poison Mutex
  • 8b3940f Add missing word to docs (#1208)
  • df6eec0 docs: Link select_biased! from select! macro (#1202)
  • Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

  • Document panic behavior of make_rng and add #[track_caller] (#1761)
  • Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

  • The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
  • Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
  • Use Edition 2024 and MSRV 1.85 (#1653)
  • Let Fill be implemented for element types, not sliceable types (#1652)
  • Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
  • Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
  • Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
  • Remove Clone support for StdRng, ReseedingRng (#1677)
  • Use postcard instead of bincode to test the serde feature (#1693)
  • Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
  • Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
  • Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

  • Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
  • Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
  • Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
  • Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

  • Removed ReseedingRng (#1722)
  • Removed unused feature "nightly" (#1732)
  • Removed feature small_rng (#1732)

... (truncated)

Commits

Updates rustls-webpki from 0.103.3 to 0.103.15

Release notes

Sourced from rustls-webpki's releases.

v/0.103.15

Fixes docs.rs build errors.

What's Changed

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.14..v/0.103.15

v/0.103.14

What's Changed

Full Changelog: rustls/webpki@v/0.103.13...v/0.103.14

0.103.13

  • Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
  • For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

  • GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
  • GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

0.103.10

... (truncated)

Commits
  • c14836d Cargo: version 0.103.14 -> 0.103.15
  • 5c92308 Cargo: avoid all-features in docs.rs
  • 10a1514 Mark ML-DSA algorithms as FIPS submitted
  • 14cbaa1 Bump version to 0.103.14
  • cbb868a Support stable ML-DSA with aws-lc-rs
  • c782fd1 Update to aws-lc-rs 1.18
  • b250e31 Upgrade to base64 0.23
  • 99115b2 ci: sync cargo-check-external-types nightly
  • a82bfae crl: fix clippy::question_mark finding
  • 2879b2c Prepare 0.103.13
  • Additional commits viewable in compare view

Updates time from 0.3.36 to 0.3.55

Release notes

Sourced from time's releases.

v0.3.55

See the changelog for details.

v0.3.54

See the changelog for details.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

v0.3.44

See the changelog for details.

v0.3.43

See the changelog for details.

v0.3.42

See the changelog for details.

v0.3.41

See the changelog for details.

v0.3.40

See the changelog for details.

v0.3.39

See the changelog for details.

v0.3.38

See the changelog for details.

... (truncated)

Changelog

Sourced from time's changelog.

0.3.55 [2026-08-01]

Fixed

  • Avoid underflow in DateIter::nth, ensuring correct behavior.
  • Avoid overflow when deserializing timestamps.
  • Handle out-of-bounds data when deserializing.
  • Don't assume that the format being deserialized was generated by the serializer; this previously led to some valid values being parsed incorrectly and others being rejected.
  • No longer silence errors when deserializing UtcOffset.
  • OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.
  • OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.

0.3.54 [2026-07-20]

Added

  • PrimitiveDateTime has been renamed to PlainDateTime.
  • Duration has been renamed to SignedDuration.
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

  • The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

  • More gains when parsing RFC 2822.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result

... (truncated)

Commits
  • 857d9c4 v0.3.55 release
  • 2b72fcd Precise feature gating for macro
  • c1089eb Run check-targets, miri in parallel
  • f377fad Avoid range-validated ordinal => year in cascade
  • 2eacb0a Report miscellaneous tasks, overall status
  • 29621ac Speed up CI
  • 08de7ba Fix nano-timestamp validation
  • 3c3f046 Fix copy-paste error
  • 3c0c81c Cascade errors when deserializing UtcOffset
  • c21acd5 Handle more deserializations of SignedDuration
  • Additional commits viewable in compare view

Updates tracing-subscriber from 0.3.19 to 0.3.23

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.23

Fixed

  • Allow ansi sanitization to be disabled (#3484)

#3484: tokio-rs/tracing#3484

tracing-subscriber 0.3.22

Important

The previous release [0.3.21] was yanked as it depended explicitly on [tracing-0.1.42], which was yanked due to a breaking change (see #3424 for details). This release contains all the changes from the previous release, plus an update to the newer version of tracing.

Changed

  • tracing: updated to 0.1.43 (#3427)

#3424: tokio-rs/tracing#3424 #3427: tokio-rs/tracing#3427 [0.3.21]: https://github.com/tokio-rs/tracing/releases/tag/tracing-subscriber-0.3.21 [tracing-0.1.42]: https://github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42

tracing-subscriber 0.3.21

Fixed

  • Change registry exit to decrement local span ref only (#3331)
  • Make Layered propagate on_register_dispatch (#3379)

Changed

  • tracing: updated to 0.1.42 (#3418)

Performance

  • Remove clone_span on enter (#3289)

Documented

  • Fix a few small things in the format module (#3339)
  • Fix extra closing brace in layer docs (#3350)
  • Fix link in FmtSpan docs (#3411)

#3289: tokio-rs/tracing#3289 #3331: tokio-rs/tracing#3331 #3339: tokio-rs/tracing#3339 #3350: tokio-rs/tracing#3350 #3379: tokio-rs/tracing#3379 #3411: tokio-rs/tracing#3411

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the cargo-security group across 1 directory with 5 …
e738b6d 
…updates

Bumps the cargo-security group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam) | `0.5.13` | `0.5.16` |
| [rand](https://github.com/rust-random/rand) | `0.8.5` | `0.10.2` |
| [rustls-webpki](https://github.com/rustls/webpki) | `0.103.3` | `0.103.15` |
| [time](https://github.com/time-rs/time) | `0.3.36` | `0.3.55` |
| [tracing-subscriber](https://github.com/tokio-rs/tracing) | `0.3.19` | `0.3.23` |



Updates `crossbeam-channel` from 0.5.13 to 0.5.16
- [Release notes](https://github.com/crossbeam-rs/crossbeam/releases)
- [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/main/CHANGELOG.md)
- [Commits](crossbeam-rs/crossbeam@crossbeam-channel-0.5.13...crossbeam-channel-0.5.16)

Updates `rand` from 0.8.5 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.10.2)

Updates `rustls-webpki` from 0.103.3 to 0.103.15
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.3...v/0.103.15)

Updates `time` from 0.3.36 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.36...v0.3.55)

Updates `tracing-subscriber` from 0.3.19 to 0.3.23
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-subscriber-0.3.19...tracing-subscriber-0.3.23)

---
updated-dependencies:
- dependency-name: crossbeam-channel
  dependency-version: 0.5.16
  dependency-type: indirect
  dependency-group: cargo-security
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  dependency-group: cargo-security
- dependency-name: rustls-webpki
  dependency-version: 0.103.15
  dependency-type: indirect
  dependency-group: cargo-security
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: indirect
  dependency-group: cargo-security
- dependency-name: tracing-subscriber
  dependency-version: 0.3.23
  dependency-type: indirect
  dependency-group: cargo-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 2, 2026
@rldyourmnd
rldyourmnd enabled auto-merge September 2, 2026 18:47
@rldyourmnd rldyourmnd mentioned this pull request Sep 2, 2026
Merged
@rldyourmnd
rldyourmnd merged commit 9cbf65b into main Sep 2, 2026
23 checks passed
@rldyourmnd
rldyourmnd deleted the dependabot/cargo/cargo-security-20929a6c8c branch September 2, 2026 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rldyourmnd