Skip to content

build(deps): bump the cargo group across 1 directory with 10 updates - #4263

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/solana/cargo-c17f56fd0b
Open

build(deps): bump the cargo group across 1 directory with 10 updates#4263
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/solana/cargo-c17f56fd0b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 10 updates in the /solana directory:

Package From To
ruint 1.16.0 1.17.1
bytes 1.11.0 1.12.1
keccak 0.1.5 0.1.6
openssl 0.10.75 0.10.81
quinn-proto 0.11.13 0.11.15
rand 0.8.5 0.8.8
rand 0.9.2 0.9.5
rustls-webpki 0.103.8 0.103.15
serde_with 3.16.1 3.22.0
tar 0.4.44 0.4.46
time 0.3.44 0.3.55

Updates ruint from 1.16.0 to 1.17.1

Release notes

Sourced from ruint's releases.

v1.17.1

What's Changed

Full Changelog: alloy-rs/ruint@v1.17.0...v1.17.1

v1.17.0

What's Changed

New Contributors

Full Changelog: alloy-rs/ruint@v1.16.0...v1.17.0

Changelog

Sourced from ruint's changelog.

[1.17.1] - 2025-12-26

Changed

  • Added unsafe to many unstable API functions in algorithms module, and documented their conditions of use (COU). (#552)

#552: alloy-rs/ruint#552

[1.17.0] - 2025-09-24

Added

  • Support for bincode 2 (#516)
  • Introduce ark-ff-05 feature flag for conversion to ark-ff@0.5 types (#526)

Changed

  • MSRV bumped to 1.85 (#503)
  • Made *next_power_of_two and *next_multiple_of const (#533)
  • Reimplemented TryFrom<f64> for Uint to speed it up, fixing edge cases and removing std requirements (#524)
  • Reimplemented From<Uint> for f64 and f32 to speed it up, fixing edge cases and removing std requirements (#535)

#503: alloy-rs/ruint#503 #516: alloy-rs/ruint#516 #526: alloy-rs/ruint#526 #533: alloy-rs/ruint#533 #524: alloy-rs/ruint#524

Commits
  • bc3fad7 Merge pull request #553 from Evalir/evalir/prestwich/rustsec-safety
  • 6d82291 chore: bump version
  • 51fdde2 chore: changelog
  • 8090e7f chore: update unsafe function and improve documentation and safety notes
  • 17c9b3e Merge pull request #544 from Evalir/evalir/prestwich-fix-codspeed
  • 370e2e5 fix: crates badge
  • d742cc0 lint: disable clippy incompatible msrv on nightly
  • 814020c chore: fix codspeed invocation in github action
  • 7732304 Merge pull request #539 from DaniPopes/release-1.17.0
  • c0bc595 Merge branch 'main' into release-1.17.0
  • Additional commits viewable in compare view

Updates bytes from 1.11.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve
Commits

Updates keccak from 0.1.5 to 0.1.6

Commits

Updates openssl from 0.10.75 to 0.10.81

Release notes

Sourced from openssl's releases.

openssl-v0.10.81

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.80...openssl-v0.10.81

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

... (truncated)

Commits
  • db9c9e2 Release openssl 0.10.81 and openssl-sys 0.9.117 (#2655)
  • 3a7fb56 Bump actions/checkout from 6.0.2 to 6.0.3 (#2653)
  • d059c43 Fix verify_mode() panic on unmodeled verify mode bits (#2651)
  • 8b1519e Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string (#2652)
  • d5713d6 add mldsa.h to the boringssl bindgen (#2650)
  • 9fac317 Merge pull request #2538 from ocdlroux/feat/crl-full
  • 4dae20b x509: adding minimal support for X509CrlBuilder
  • 47f7777 Add brainpoolP224r1 and brainpoolP224t1 NID constants (#2642)
  • 659da17 Bump aws-ls-sys to 0.41 (#2640)
  • 35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.15

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

quinn-proto 0.11.14

@​jxs reported a denial of service issue in quinn-proto 5 days ago:

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

Commits
  • a7499b8 Bump versions for release
  • 7c1970f proto: yield error on too many gaps in assembler
  • fe5ac49 congestion: avoid double-reducing CUBIC fast convergence
  • c1e903b fix(quinn): handle overdue timers without polling the async timer
  • b3b20e1 quinn-udp: allow to use windows-sys 0.61
  • 6f03ca3 quinn-proto: drop Initials silently when saturated
  • 41c8527 quinn: fix ref count logic for ConnectionRef and EndpointRef
  • 73ea1dd Remove RecvStreams from blocked_readers on stop
  • cf16bfd Early return in RecvStream::drop()
  • af2e4e5 Fix the (pre-existing) rightward drift by inverting conditions
  • Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.8.8

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

  • Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates rand from 0.9.2 to 0.9.5

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

  • Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates rustls-webpki from 0.103.8 to 0.103.15

Release notes

Sourced from rustls-webpki's releases.

v/0.103.15

Fixes docs.rs build errors.

What's Changed

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.14..v/0.103.15

v/0.103.14

What's Changed

Full Changelog: rustls/webpki@v/0.103.13...v/0.103.14

0.103.13

  • Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
  • For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

  • GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
  • GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

0.103.10

... (truncated)

Commits
  • c14836d Cargo: version 0.103.14 -> 0.103.15
  • 5c92308 Cargo: avoid all-features in docs.rs
  • 10a1514 Mark ML-DSA algorithms as FIPS submitted
  • 14cbaa1 Bump version to 0.103.14
  • cbb868a Support stable ML-DSA with aws-lc-rs
  • c782fd1 Update to aws-lc-rs 1.18
  • b250e31 Upgrade to base64 0.23
  • 99115b2 ci: sync cargo-check-external-types nightly
  • a82bfae crl: fix clippy::question_mark finding
  • 2879b2c Prepare 0.103.13
  • Additional commits viewable in compare view

Updates serde_with from 3.16.1 to 3.22.0

Release notes

Sourced from serde_with's releases.

serde_with v3.22.0

Added

  • Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

  • Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

Added

  • Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#943)

Fixed

serde_with v3.19.0

Added

... (truncated)

Commits
  • 88f576a Bump version to 3.22.0 (#991)
  • 931e664 Bump version to 3.22.0
  • e26930e Bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...
  • 92cd5a0 Bump github/codeql-action in the github-actions group
  • 32be66f Guard with_capacity_and_hasher against untrusted size_hint (DoS) (#971)
  • 33871cd Merge branch 'master' into fix/duplicate-key-impls-capacity-overflow
  • bb1e064 Change function position within impl (#968)
  • 202d3dd Improve the time unit macros to remove unnecessary repetition and make the co...
  • b347efb Move the use_duration_signed_ser/*_de macros utils
  • 6590545 chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2
  • Additional commits viewable in compare view

Updates tar from 0.4.44 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits
  • fc459c1 Release 0.4.46
  • 43e05a8 ci: Add crates.io trusted publishing workflow
  • bba5666 Update repo links
  • cd94c46 docs: Document TOCTOU / concurrent-mutation threat model
  • 1b4997c builder: Expand docs for follow_symlinks and append_dir_all
  • bab14dd archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm)
  • 2349b49 Add support of absolute paths
  • 39d0311 Update some links
  • 59d803e Update astral-tokio-tar requirement from 0.5 to 0.6
  • 8296b9a ci: Fix and re-enable reverse dependency testing (#444)
  • Additional commits viewable in compare view

Updates time from 0.3.44 to 0.3.55

Release notes

Sourced from time's releases.

v0.3.55

See the changelog for details.

v0.3.54

See the changelog for details.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.55 [2026-08-01]

Fixed

  • Avoid underflow in DateIter::nth, ensuring correct behavior.
  • Avoid overflow when deserializing timestamps.
  • Handle out-of-bounds data when deserializing.
  • Don't assume that the format being deserialized was generated by the serializer; this previously led to some valid values being parsed incorrectly and others being rejected.
  • No longer silence errors when deserializing UtcOffset.
  • OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.
  • OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.

0.3.54 [2026-07-20]

Added

  • PrimitiveDateTime has been renamed to PlainDateTime.
  • Duration has been renamed to SignedDuration.
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

  • The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

  • More gains when parsing RFC 2822.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result

... (truncated)

Commits
  • 857d9c4 v0.3.55 release
  • 2b72fcd Precise feature gating for macro
  • c1089eb Run check-targets, miri in parallel
  • f377fad Avoid range-validated ordinal => year in cascade
  • 2eacb0a Report miscellaneous tasks, overall status
  • 29621ac Speed up CI
  • 08de7ba Fix nano-timestamp validation
  • 3c3f046 Fix copy-paste error
  • 3c0c81c Cascade errors when deserializing UtcOffset

@dependabot
build(deps): bump the cargo group across 1 directory with 10 updates
5a36120 
Bumps the cargo group with 10 updates in the /solana directory:

| Package | From | To |
| --- | --- | --- |
| [ruint](https://github.com/alloy-rs/ruint) | `1.16.0` | `1.17.1` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.11.0` | `1.12.1` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.5` | `0.1.6` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.75` | `0.10.81` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.13` | `0.11.15` |
| [rand](https://github.com/rust-random/rand) | `0.8.5` | `0.8.8` |
| [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.9.5` |
| [rustls-webpki](https://github.com/rustls/webpki) | `0.103.8` | `0.103.15` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.16.1` | `3.22.0` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.44` | `0.4.46` |
| [time](https://github.com/time-rs/time) | `0.3.44` | `0.3.55` |



Updates `ruint` from 1.16.0 to 1.17.1
- [Release notes](https://github.com/alloy-rs/ruint/releases)
- [Changelog](https://github.com/alloy-rs/ruint/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/ruint@v1.16.0...v1.17.1)

Updates `bytes` from 1.11.0 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.11.0...v1.12.1)

Updates `keccak` from 0.1.5 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6)

Updates `openssl` from 0.10.75 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.75...openssl-v0.10.81)

Updates `quinn-proto` from 0.11.13 to 0.11.15
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.13...quinn-proto-0.11.15)

Updates `rand` from 0.8.5 to 0.8.8
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.8/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.8)

Updates `rand` from 0.9.2 to 0.9.5
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.8/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.8)

Updates `rustls-webpki` from 0.103.8 to 0.103.15
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.8...v/0.103.15)

Updates `serde_with` from 3.16.1 to 3.22.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.16.1...v3.22.0)

Updates `tar` from 0.4.44 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.44...0.4.46)

Updates `time` from 0.3.44 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.44...v0.3.55)

---
updated-dependencies:
- dependency-name: ruint
  dependency-version: 1.17.1
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-version: 0.10.81
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: quinn-proto
  dependency-version: 0.11.15
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.8.8
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.9.5
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rustls-webpki
  dependency-version: 0.103.15
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: serde_with
  dependency-version: 3.22.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team September 2, 2026 00:32
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 2, 2026
@dependabot dependabot Bot mentioned this pull request Sep 2, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants