Skip to content

deps(deps): bump the cargo-patch-minor group with 25 updates - #546

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-patch-minor-392cd8264d
Closed

deps(deps): bump the cargo-patch-minor group with 25 updates#546
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-patch-minor-392cd8264d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the cargo-patch-minor group with 25 updates:

Package From To
alloy-primitives 1.5.4 1.6.0
tokio 1.49.0 1.52.3
serde_json 1.0.149 1.0.150
serde_with 3.16.1 3.21.0
tracing-subscriber 0.3.22 0.3.23
blake3 1.8.3 1.8.5
uuid 1.20.0 1.23.5
clap 4.5.57 4.6.1
futures-util 0.3.31 0.3.32
regex 1.12.3 1.13.0
once_cell 1.21.3 1.21.4
libc 0.2.180 0.2.186
semver 1.0.27 1.0.28
zeroize 1.8.2 1.9.0
data-encoding 2.10.0 2.11.0
tempfile 3.24.0 3.27.0
fastrand 2.3.0 2.4.1
aws-sdk-s3 1.120.0 1.121.0
rust_decimal 1.40.0 1.42.1
time 0.3.49 0.3.53
clap_complete 4.5.65 4.6.7
shellexpand 3.1.1 3.1.2
self_update 1.0.0-rc.2 1.0.0-rc.5
tar 0.4.45 0.4.46
serial_test 3.4.0 3.5.0

Updates alloy-primitives from 1.5.4 to 1.6.0

Release notes

Sourced from alloy-primitives's releases.

alloy-core v1.6.0

What's Changed

New Contributors

Full Changelog: alloy-rs/core@v1.5.7...v1.6.0

alloy-core v1.5.7

What's Changed

Full Changelog: alloy-rs/core@v1.5.6...v1.5.7

alloy-core v1.5.6

What's Changed

Full Changelog: alloy-rs/core@v1.5.5...v1.5.6

alloy-core v1.5.5

What's Changed

Full Changelog: alloy-rs/core@v1.5.4...v1.5.5

Changelog

Sourced from alloy-primitives's changelog.

1.6.0 - 2026-05-14

Bug Fixes

  • [syn-solidity] Parse delete statement as expression, not variable declaration (#1087)
  • [sol-types] Remove unsound unwrap_unchecked in suffix_offset (#1083)
  • [dyn-abi] Handle short data in decode_error without panicking (#1084)
  • Nightly clippy fixes (#1085)

Dependencies

  • [deps] Bump all (#1098)
  • Harden supply chain — pin actions, lock permissions, deny git deps (#1092)
  • Bump winnow, proptest-derive, macro-string (#1088)

Features

  • Add optional secp256k1 backend for ECDSA operations (#1104)
  • [sol-macro] Helper builders for errors and events (#1080)

Miscellaneous Tasks

  • Release 1.6.0

Performance

  • Add Token::head_append_many for batch encoding (#1090)
  • Add Token::decode_many_from for batch decoding (#1089)

1.5.7 - 2026-02-27

Bug Fixes

  • [sol-macro] Prevent direct String usage in expanded code (#1076)

Miscellaneous Tasks

1.5.6 - 2026-02-12

Dependencies

  • [deps] Bump fixed-cache (#1073)

Miscellaneous Tasks

  • Release 1.5.6
  • Fix changelog

... (truncated)

Commits
  • f811a54 chore: release 1.6.0
  • 45dfd95 feat: add optional secp256k1 backend for ECDSA operations (#1104)
  • 00ee366 chore(deps): bump all (#1098)
  • 2ebfa5b ci: harden supply chain — pin actions, lock permissions, deny git deps (#1092)
  • 68b1c44 feat(sol-macro): helper builders for errors and events (#1080)
  • f3651f2 perf: add Token::head_append_many for batch encoding (#1090)
  • 9a19cde perf: add Token::decode_many_from for batch decoding (#1089)
  • 90e19be chore: bump winnow, proptest-derive, macro-string (#1088)
  • 2a11c42 fix(syn-solidity): parse delete statement as expression, not variable decla...
  • 05c1658 fix(sol-types): remove unsound unwrap_unchecked in suffix_offset (#1083)
  • Additional commits viewable in compare view

Updates tokio from 1.49.0 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

  • sync: fix underflow in mpsc channel len() (#8062)
  • sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
  • sync: require that an RwLock has max_readers != 0 (#8076)
  • sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Tokio v1.52.1

1.52.1 (April 16th, 2026)

Fixed

  • runtime: revert #7757 to fix [a regression]#8056 that causes spawn_blocking to hang (#8057)

#7757: tokio-rs/tokio#7757 #8056: tokio-rs/tokio#8056 #8057: tokio-rs/tokio#8057

Tokio v1.52.0

1.52.0 (April 14th, 2026)

Added

  • io: AioSource::register_borrowed for I/O safety support (#7992)
  • net: add try_io function to unix::pipe sender and receiver types (#8030)

Added (unstable)

  • runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#8010)
  • taskdump: add trace_with() for customized task dumps (#8025)
  • taskdump: allow impl FnMut() in trace_with instead of just fn() (#8040)
  • fs: support io_uring in AsyncRead for File (#7907)

... (truncated)

Commits

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

Commits
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • dc8003a Raise required compiler for preserve_order feature to 1.85
  • a42fa98 Unpin CI miri toolchain
  • 684a60e Pin CI miri to nightly-2026-02-11
  • 7c7da33 Raise required compiler to Rust 1.71
  • acf4850 Simplify Number::is_f64
  • 6b8ceab Resolve unnecessary_map_or clippy lint
  • Additional commits viewable in compare view

Updates serde_with from 3.16.1 to 3.21.0

Release notes

Sourced from serde_with's releases.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

Added

  • Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#943)

Fixed

serde_with v3.19.0

Added

  • Add support for hashbrown v0.17 (#940)

    This extends the existing support for hashbrown to the newly released version.

serde_with v3.18.0

Added

  • Support OneOrMany with more sequence and set types (#929)

Changed

  • Bump MSRV to 1.88 due to the darling dependency

serde_with v3.17.0

Added

... (truncated)

Commits
  • 0f4ca67 Update changelog for 3.21.0 (#967)
  • 7654841 Update changelog for 3.21.0
  • c8a1d82 Protect all collection creations against capacity overflow by using `size_hin...
  • 6ad5fa5 Properly feature gate the vec_with_capacity_cautious function
  • ef7d141 Protect all collection creations against capacity overflow by using `size_hin...
  • a348da3 Add serde_as deserialize_as explain (#958)
  • 2e5bc20 Bump the github-actions group with 3 updates (#965)
  • 927a3d6 Bump the github-actions group with 3 updates
  • 62d14ec Enable link-to-definition on docs.rs again, after the upstream issue was reso...
  • 4584d94 Enable link-to-definition on docs.rs again, after the upstream issue was reso...
  • Additional commits viewable in compare view

Updates tracing-subscriber from 0.3.22 to 0.3.23

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.23

Fixed

  • Allow ansi sanitization to be disabled (#3484)

#3484: tokio-rs/tracing#3484

Commits

Updates blake3 from 1.8.3 to 1.8.5

Release notes

Sourced from blake3's releases.

1.8.5

version 1.8.5

Changes since 1.8.4:

  • Forcibly disable LTO when compiling C intrinsics from the Rust build. This fixes a build break on Arch Linux ARM: BLAKE3-team/BLAKE3#550

1.8.4

version 1.8.4

Changes since 1.8.3:

  • Updated the digest dependency from v0.10 to v0.11. THIS IS A POTENTIALLY BREAKING CHANGE for callers using the traits-preview Cargo feature. But this is not considered a breaking change for the blake3 crate itself; see the docs for traits-preview.
  • Performance for WASM SIMD targets is improved by ~20% when the wasm32_simd feature is enabled. Contributed by @​lamb356.
Commits
  • 93a431c version 1.8.5
  • 299b1e2 fix LTO builds by disabling LTO
  • 6a45fee add LTO builds to CI
  • 15e83a5 c: Use correct SIMD flags when compiling with Clang-Cl (#549)
  • 2e3727d cargo fmt everywhere
  • b97a24f version 1.8.4
  • 0ebe469 update to new rustcrypto trait releases
  • d4b005a wasm32_simd: use i8x16_shuffle for rot8 and rot16
  • 6eebbbd fix a struct size mismatch in tests
  • fb1411e c: use SIZE_MAX instead of -1 for size_t sentinels, add <stdint.h>
  • See full diff in compare view

Updates uuid from 1.20.0 to 1.23.5

Release notes

Sourced from uuid's releases.

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

v1.23.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.0...v1.23.1

... (truncated)

Commits
  • 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
  • 5a7dfe5 prepare for 1.23.5 release
  • 9b4bfc8 Merge pull request #894 from geeknoid/main
  • 5acc5a5 perf: Optimize UUID hex parsing and formatting
  • 1e5d867 Merge pull request #891 from frostyplanet/doc
  • 49310f0 doc: Fix broken link
  • 3296d64 Merge pull request #890 from uuid-rs/cargo/v1.23.4
  • cba53d0 prepare for 1.23.4 release
  • e347af4 Merge pull request #889 from frostyplanet/main
  • e9bf55c doc: Fix broken link warnings
  • Additional commits viewable in compare view

Updates clap from 4.5.57 to 4.6.1

Release notes

Sourced from clap's releases.

v4.6.1

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed

v4.5.60

[4.5.60] - 2026-02-19

Fixes

  • (help) Quote empty default values, possible values

v4.5.59

[4.5.59] - 2026-02-16

Fixes

  • Command::ignore_errors no longer masks help/version on subcommands

v4.5.58

[4.5.58] - 2026-02-11

Changelog

Sourced from clap's changelog.

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed

[4.6.0] - 2026-03-12

Compatibility

  • Update MSRV to 1.85

[4.5.61] - 2026-03-12

Internal

  • Update dependencies

[4.5.60] - 2026-02-19

Fixes

  • (help) Quote empty default values, possible values

[4.5.59] - 2026-02-16

Fixes

  • Command::ignore_errors no longer masks help/version on subcommands

[4.5.58] - 2026-02-11

Commits
  • 1420275 chore: Release
  • d2c817d docs: Update changelog
  • f88c94e Merge pull request #6341 from epage/sep
  • acbb822 fix(complete): Reduce risk of conflict with actual subcommands
  • a49fadb refactor(complete): Pull out subcommand separator
  • ddc008b Merge pull request #6332 from epage/update
  • 497dc50 chore: Update compatible dependencies
  • dca2326 Merge pull request #6331 from clap-rs/renovate/j178-prek-action-2.x
  • 54bdaa3 chore(deps): Update j178/prek-action action to v2
  • f0d30d9 chore: Release
  • Additional commits viewable in compare view

Updates futures-util from 0.3.31 to 0.3.32

Release notes

Sourced from futures-util's releases.

0.3.32

  • Bump MSRV of utility crates to 1.71. (#2989)
  • Soft-deprecate ready! macro in favor of std::task::ready! added in Rust 1.64 (#2925)
  • Soft-deprecate pin_mut! macro in favor of std::pin::pin! added in Rust 1.68 (#2929)
  • Add FuturesOrdered::clear (#2927)
  • Add mpsc::*Receiver::recv (#2947)
  • Add mpsc::*Receiver::try_recv and deprecate mpsc::*Receiver::::try_next (#2944)
  • Implement FusedStream for sink::With (#2948)
  • Add no_std support for shared (#2868)
  • Make Mutex::new() const (#2956)
  • Add #[clippy::has_significant_drop] to guards (#2967)
  • Remove dependency to pin-utils (#2929)
  • Remove dependency on num_cpus (#2946)
  • Performance improvements (#2983)
  • Documentation improvements (#2925, #2926, #2940, #2971)
Changelog

Sourced from futures-util's changelog.

0.3.32 - 2026-02-15

  • Bump MSRV of utility crates to 1.71. (#2989)
  • Soft-deprecate ready! macro in favor of std::task::ready! added in Rust 1.64 (#2925)
  • Soft-deprecate pin_mut! macro in favor of std::pin::pin! added in Rust 1.68 (#2929)
  • Add FuturesOrdered::clear (#2927)
  • Add mpsc::*Receiver::recv (#2947)
  • Add mpsc::*Receiver::try_recv and deprecate mpsc::*Receiver::::try_next (#2944)
  • Implement FusedStream for sink::With (#2948)
  • Add no_std support for shared (#2868)
  • Make Mutex::new() const (#2956)
  • Add #[clippy::has_significant_drop] to guards (#2967)
  • Remove dependency to pin-utils (#2929)
  • Remove dependency on num_cpus (#2946)
  • Performance improvements (#2983)
  • Documentation improvements (#2925, #2926, #2940, #2971)
Commits
  • d9bba94 Release 0.3.32
  • 151e0b9 Add comments on rust-version field in Cargo.toml
  • 4aaf00c Bump MSRV of utility crates to 1.71
  • a4cce12 perf: improve AtomicWaker::wake performance (#2983)
  • ba9d102 Add #[clippy::has_significant_drop] to guards (#2967)
  • 20396a8 Fix rustdoc::broken_intra_doc_links warning
  • 815f6eb Fix documentation of BiLock::lock (#2971)
  • 0f0db04 futures-util: make Mutex::new() const (#2956)
  • 5d6fc5e ci: Test big-endian target (s390x Linux)
  • 9f739fe Ignore dead_code lint on Fn1 trait
  • Additional commits viewable in compare view

Updates regex from 1.12.3 to 1.13.0

Changelog

Sourced from regex's changelog.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

  • #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes with very large character classes.

Improvements:

  • #1308: Avoid re-canonicalizing the entire interval set when pushing new class ranges.
Commits
  • 926af2e 1.13.0
  • 7d941a9 regex-automata-0.4.15
  • e358341 api: add regex! macro for lazy compilation
  • c420333 automata: disable miri on a couple doc tests
  • b9d2cf7 github: add FUNDING link
  • 0858006 docs: add AI policy for contributors
  • 468fc64 automata: reject dense DFA start states that are match states
  • 7b96fdc 1.12.4
  • 7b89cf0 deps: update to regex-syntax 0.8.11
  • 1401679 regex-syntax-0.8.11
  • Additional commits viewable in compare view

Updates once_cell from 1.21.3 to 1.21.4

Changelog

Sourced from once_cell's changelog.

1.21.4

  • Fix unsoundness in OnceCell::wait under --features=parking_lot, #295.

    If thread A calls wait, while thread B calls get_or_try_init(f), and, furthermore, f panics, the wait incorrectly returns and thread A observes uninitialized memory.

    Kudos to @​meng-xu-cs for a nice find!

Commits
  • 80fe900 Merge pull request #296 from matklad/matklad/plfix
  • a5e09c9 release 1.21.4
  • 2426d45 Merge pull request #295 from matklad/matklad/plfix
  • a144121 Merge pull request #290 from alexanderkjall/run-tests-with-no-default-features
  • 232a1a4 Merge pull request #292 from phil-opp/doc-fix
  • d31767b fix OnceCell::wait with features=parking_lot
  • 28d29ae Fix: sync::OnceCell::try_insert docs should import sync variant
  • 0f78fb0 make the command 'cargo test --no-default-features' work
  • fda60a6 Merge pull request #287 from AbeZbm/add-tests
  • b5b98c0 Add tests for OnceRef
  • See full diff in compare view

Updates libc from 0.2.180 to 0.2.186

Release notes

Sourced from libc's releases.

0.2.186

Added

  • Apple: Add KEVENT_FLAG_* constants (#5070)
  • Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#5060)

Changed

  • CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#5058)

0.2.185

Added

  • EspIDF: Add espidf_picolibc cfg for picolibc O_* flag values (#5035)
  • Hexagon: add missing constants and fix types for linux-musl (#5042)
  • Redox: Add semaphore functions (#5051)
  • Windows: Add sprintf, snprintf, and the scanf family (#5024)

Fixed

  • Hexagon: Decouple time64 types from musl symbol redirects (#5040)
  • Horizon: Change POLL constants from c_short to c_int (#5045)

0.2.184

MSRV

This release increases the MSRV of libc to 1.65. With this update, you can now always use the core::ffi::c_* types with libc definitions, since libc has been changed to reexport from core rather than redefining them. (This usually worked before but had edge cases.) (#4972)

Added

  • BSD: Add IP_MINTTL to bsd (#5026)
  • Cygwin: Add TIOCM_DSR (#5031)
  • FreeBSD: Added xfile structe and file descriptor types (#5002)
  • Linux: Add CAN netlink bindings (#5011)
  • Linux: Add struct ethhdr (#4239)
  • Linux: Add struct ifinfomsg (#5012)
  • Linux: Define max_align_t for riscv64 (#5029)
  • NetBSD: Add missing CLOCK_ constants (#5020)
  • NuttX: Add _SC_HOST_NAME_MAX (#5004)
  • VxWorks: Add flock and F_*LCK constants (#4043)
  • WASI: Add all _SC_* sysconf constants (#5023)

Deprecated

The remaining fixed-width integer aliases, __uint128_t, __uint128, __int128_t, and __int128, have been deprecated. Use i128 and u128 instead. (#4343)

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.186 - 2026-04-24

Added

  • Apple: Add KEVENT_FLAG_* constants (#5070)
  • Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#5060)

Changed

  • CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#5058)

0.2.185 - 2026-04-13

Added

  • EspIDF: Add espidf_picolibc cfg for picolibc O_* flag values (#5035)
  • Hexagon: add missing constants and fix types for linux-musl (#5042)
  • Redox: Add semaphore functions (#5051)
  • Windows: Add sprintf, snprintf, and the scanf family (#5024)

Fixed

  • Hexagon: Decouple time64 types from musl symbol redirects (#5040)
  • Horizon: Change POLL constants from c_short to c_int (#5045)

0.2.184 - 2026-04-01

MSRV

This release increases the MSRV of libc to 1.65. With this update, you can now always use the core::ffi::c_* types with libc definitions, since libc has been changed to reexport from core rather than redefining them. (This usually worked before but had edge cases.) (#4972)

Added

  • BSD: Add IP_MINTTL to bsd (#5026)
  • Cygwin: Add TIOCM_DSR (#5031)
  • FreeBSD: Added xfile structe and file descriptor types (#5002)
  • Linux: Add CAN netlink bindings (#5011)
    • ...

    Description has been truncated

@dependabot
deps(deps): bump the cargo-patch-minor group with 25 updates
7da6f41 
Bumps the cargo-patch-minor group with 25 updates:

| Package | From | To |
| --- | --- | --- |
| [alloy-primitives](https://github.com/alloy-rs/core) | `1.5.4` | `1.6.0` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.49.0` | `1.52.3` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.150` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.16.1` | `3.21.0` |
| [tracing-subscriber](https://github.com/tokio-rs/tracing) | `0.3.22` | `0.3.23` |
| [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.3` | `1.8.5` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.23.5` |
| [clap](https://github.com/clap-rs/clap) | `4.5.57` | `4.6.1` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.31` | `0.3.32` |
| [regex](https://github.com/rust-lang/regex) | `1.12.3` | `1.13.0` |
| [once_cell](https://github.com/matklad/once_cell) | `1.21.3` | `1.21.4` |
| [libc](https://github.com/rust-lang/libc) | `0.2.180` | `0.2.186` |
| [semver](https://github.com/dtolnay/semver) | `1.0.27` | `1.0.28` |
| [zeroize](https://github.com/RustCrypto/utils) | `1.8.2` | `1.9.0` |
| [data-encoding](https://github.com/ia0/data-encoding) | `2.10.0` | `2.11.0` |
| [tempfile](https://github.com/Stebalien/tempfile) | `3.24.0` | `3.27.0` |
| [fastrand](https://github.com/smol-rs/fastrand) | `2.3.0` | `2.4.1` |
| [aws-sdk-s3](https://github.com/awslabs/aws-sdk-rust) | `1.120.0` | `1.121.0` |
| [rust_decimal](https://github.com/paupino/rust-decimal) | `1.40.0` | `1.42.1` |
| [time](https://github.com/time-rs/time) | `0.3.49` | `0.3.53` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.5.65` | `4.6.7` |
| [shellexpand](https://gitlab.com/ijackson/rust-shellexpand) | `3.1.1` | `3.1.2` |
| [self_update](https://github.com/jaemk/self_update) | `1.0.0-rc.2` | `1.0.0-rc.5` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.45` | `0.4.46` |
| [serial_test](https://github.com/palfrey/serial_test) | `3.4.0` | `3.5.0` |


Updates `alloy-primitives` from 1.5.4 to 1.6.0
- [Release notes](https://github.com/alloy-rs/core/releases)
- [Changelog](https://github.com/alloy-rs/core/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/core@v1.5.4...v1.6.0)

Updates `tokio` from 1.49.0 to 1.52.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.49.0...tokio-1.52.3)

Updates `serde_json` from 1.0.149 to 1.0.150
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.149...v1.0.150)

Updates `serde_with` from 3.16.1 to 3.21.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.16.1...v3.21.0)

Updates `tracing-subscriber` from 0.3.22 to 0.3.23
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-subscriber-0.3.22...tracing-subscriber-0.3.23)

Updates `blake3` from 1.8.3 to 1.8.5
- [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases)
- [Commits](BLAKE3-team/BLAKE3@1.8.3...1.8.5)

Updates `uuid` from 1.20.0 to 1.23.5
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.20.0...v1.23.5)

Updates `clap` from 4.5.57 to 4.6.1
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.57...clap_complete-v4.6.1)

Updates `futures-util` from 0.3.31 to 0.3.32
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.31...0.3.32)

Updates `regex` from 1.12.3 to 1.13.0
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.3...1.13.0)

Updates `once_cell` from 1.21.3 to 1.21.4
- [Changelog](https://github.com/matklad/once_cell/blob/master/CHANGELOG.md)
- [Commits](matklad/once_cell@v1.21.3...v1.21.4)

Updates `libc` from 0.2.180 to 0.2.186
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.186/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.180...0.2.186)

Updates `semver` from 1.0.27 to 1.0.28
- [Release notes](https://github.com/dtolnay/semver/releases)
- [Commits](dtolnay/semver@1.0.27...1.0.28)

Updates `zeroize` from 1.8.2 to 1.9.0
- [Commits](RustCrypto/utils@zeroize-v1.8.2...zeroize-v1.9.0)

Updates `data-encoding` from 2.10.0 to 2.11.0
- [Commits](ia0/data-encoding@v2.10.0...v2.11.0)

Updates `tempfile` from 3.24.0 to 3.27.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.24.0...v3.27.0)

Updates `fastrand` from 2.3.0 to 2.4.1
- [Release notes](https://github.com/smol-rs/fastrand/releases)
- [Changelog](https://github.com/smol-rs/fastrand/blob/master/CHANGELOG.md)
- [Commits](smol-rs/fastrand@v2.3.0...v2.4.1)

Updates `aws-sdk-s3` from 1.120.0 to 1.121.0
- [Release notes](https://github.com/awslabs/aws-sdk-rust/releases)
- [Commits](https://github.com/awslabs/aws-sdk-rust/commits)

Updates `rust_decimal` from 1.40.0 to 1.42.1
- [Release notes](https://github.com/paupino/rust-decimal/releases)
- [Changelog](https://github.com/paupino/rust-decimal/blob/master/CHANGELOG.md)
- [Commits](paupino/rust-decimal@1.40.0...1.42.1)

Updates `time` from 0.3.49 to 0.3.53
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.49...v0.3.53)

Updates `clap_complete` from 4.5.65 to 4.6.7
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.65...clap_complete-v4.6.7)

Updates `shellexpand` from 3.1.1 to 3.1.2
- [Commits](https://gitlab.com/ijackson/rust-shellexpand/compare/shellexpand-3.1.1...shellexpand-3.1.2)

Updates `self_update` from 1.0.0-rc.2 to 1.0.0-rc.5
- [Release notes](https://github.com/jaemk/self_update/releases)
- [Changelog](https://github.com/jaemk/self_update/blob/master/CHANGELOG.md)
- [Commits](jaemk/self_update@v1.0.0-rc.2...v1.0.0-rc.5)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `serial_test` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/palfrey/serial_test/releases)
- [Commits](palfrey/serial_test@v3.4.0...v3.5.0)

---
updated-dependencies:
- dependency-name: alloy-primitives
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tokio
  dependency-version: 1.52.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: serde_json
  dependency-version: 1.0.150
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: serde_with
  dependency-version: 3.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tracing-subscriber
  dependency-version: 0.3.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: blake3
  dependency-version: 1.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: uuid
  dependency-version: 1.23.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: clap
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: futures-util
  dependency-version: 0.3.32
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: regex
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: once_cell
  dependency-version: 1.21.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: libc
  dependency-version: 0.2.186
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: semver
  dependency-version: 1.0.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: zeroize
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: data-encoding
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tempfile
  dependency-version: 3.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: fastrand
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: aws-sdk-s3
  dependency-version: 1.121.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: rust_decimal
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: time
  dependency-version: 0.3.53
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: clap_complete
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: shellexpand
  dependency-version: 3.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: self_update
  dependency-version: 1.0.0-rc.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: serial_test
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 28, 2026
This was referenced Jul 28, 2026
Closed
Closed
Closed
Closed
Closed
@covenant-talos

covenant-talos Bot commented Jul 28, 2026

Copy link
Copy Markdown

Walkthrough

This is an automated Dependabot batch bumping 25 Cargo dependencies to their latest patch/minor versions, touching only Cargo.lock. Notable upgrades include tokio (1.49→1.52, with mpsc and RwLock bug fixes), serde_with (3.16→3.21, including a security fix for KeyValueMap capacity overflow), once_cell (1.21.3→1.21.4, fixing unsoundness in OnceCell::wait under the parking_lot feature), alloy-primitives (1.5.4→1.6.x, adding a secp256k1 backend and new transitive deps), and clap/clap_complete crossing into 4.6.x. Several transitive crates are added (fixed-cache, hashbrown 0.17, secp256k1 0.31, keccak 0.2, sha3 0.11, getrandom 0.4, r-efi 6.0, shlex 2.0) or removed (bit-set, bit-vec, rusty-fork, quick-error, scc, sdd) as upstream dependency graphs shift. No application source code changes are present.

Changes

Cohort / File(s) Change Summary
Direct dependency bumps — Cargo.lock Bumps 25 declared crate versions (tokio, serde_json, serde_with, tracing-subscriber, blake3, uuid, clap, clap_complete, futures-util, regex, once_cell, libc, semver, zeroize, data-encoding, tempfile, fastrand, aws-sdk-s3, rust_decimal, time, shellexpand, self_update, tar, serial_test, alloy-primitives) to latest patch/minor releases.
Transitive additions/removals — Cargo.lock Adds new transitive crates (fixed-cache, hashbrown 0.17.1, secp256k1 0.31.1/secp256k1-sys 0.11, keccak 0.2.0, sha3 0.11.0, getrandom 0.4.3, r-efi 6.0.0, shlex 2.0.1) and removes stale ones (bit-set, bit-vec, rusty-fork, quick-error, scc, sdd) reflecting upstream graph changes in alloy-primitives, proptest, serial_test, tempfile, and friends.
Security-relevant fixes — Cargo.lock serde_with 3.21 fixes GHSA-7gcf-g7xr-8hxj (KeyValueMap capacity-overflow panic); once_cell 1.21.4 fixes unsound OnceCell::wait under parking_lot; tokio 1.52.3 fixes mpsc len() underflow and OwnedPermit::release() notification.

Estimated review effort: 1/5 (lockfile-only dependency bump; verify CI builds and that no new MSRV or feature-gate issues surface from the clap 4.6 and serde_with 3.21 bumps).

Instant overview - a deep technical review follows as a separate comment.

@covenant-talos

covenant-talos Bot commented Jul 28, 2026

Copy link
Copy Markdown

PR #546: deps(deps): bump the cargo-patch-minor group with 25 updates

Summary

This Dependabot PR updates 25 crates in the cargo-patch-minor group, touching only Cargo.lock. The bump brings in several security- and correctness-relevant fixes — notably serde_with 3.21.0 (GHSA-7gcf-g7xr-8hxj, attacker-controlled allocation DoS), once_cell 1.21.4 (unsoundness in OnceCell::wait under parking_lot), alloy-primitives 1.6.x (removes an unsound unwrap_unchecked), uuid (empty-input parser panic), and tokio (mpsc len() underflow) — while also introducing new transitive dependencies (secp256k1 0.31.1, sha3 0.11.0, getrandom 0.4.3, fixed-cache, bs58, darling 0.23.0) and pruning dead ones (bit-set, rusty-fork, quick-error, scc, pin-utils).

Architecture

No structural impact. The change is a lockfile-only dependency resolution update within existing semver constraints; no source, manifest, or Kubernetes/network topology changes.

Issues Found

CRITICAL Issues (Must Fix Before Merge)

None found.

HIGH Severity Issues (Advised to Fix Before Merge)

None found.

MEDIUM Severity Issues (Optional to Fix Before Merge)

  1. Reconcile the resolved lockfile versions with the PR description before merging
    Stability & Availability | MEDIUM | Effort: quick win

    • Why: The description table states tokio 1.49.0 → 1.52.3 and tempfile 3.24.0 → 3.27.0, but the diff resolves them lower: tokio -version = "1.49.0" +version = "1.50.0" and tempfile -version = "3.24.0" +version = "3.25.0". Other rows also drift (uuid 1.23.5→lockfile 1.24.0, self_update rc.5→rc.6, serde_json 1.0.150→1.0.151, alloy-primitives 1.6.0→1.6.1, libc 0.2.186→0.2.189, fastrand 2.4.1→2.5.0). This is most plausibly a stale description vs. a re-run update, but I cannot verify the live head from the provided diff. It matters specifically for tokio: the description's own release notes document a spawn_blocking hang regression in 1.52.0/1.52.1 (fixed in 1.52.3), so which tokio actually ships is operationally significant for a financial service.
    • How: Confirm the head commit's Cargo.lock is what CI actually tested. If the description is stale, @dependabot rebase regenerates it. If something (MSRV-aware resolution, a Cargo.toml constraint) legitimately caps tokio at 1.50.0, note that in the PR so the merged state is deliberate.

  2. Avoid compiling a third secp256k1 backend pulled in by alloy-primitives 1.6
    Security | MEDIUM | Effort: involved

    • Why: The lockfile adds secp256k1 0.31.1 + secp256k1-sys 0.11.0 to alloy-primitives' deps, while the context lines show secp256k1-sys 0.9.2 and 0.10.1 already in the tree — three copies of the libsecp256k1 C code in one binary. The same hunk adds sha3 0.11.0/keccak 0.2.0/cpufeatures 0.3.0 alongside the existing sha3 0.10.8/keccak 0.1.5/cpufeatures 0.2.17, and getrandom 0.4.3 alongside 0.3.4. Duplicated crypto primitives enlarge the audit and vulnerability surface with no functional gain if unused. The alloy-core 1.6.0 release notes quoted in the description state this backend is optional ("feat: add optional secp256k1 backend for ECDSA operations"), implying it is likely enabled via default features.
    • How: Run cargo tree -i secp256k1@0.31.1 -e features to find the activation path; if basilica doesn't use the new backend, disable it via default-features = false/feature pruning on the alloy dependency. Add cargo deny check bans in CI to make new duplicates visible. The sha3/keccak 0.10→0.11 split can only be resolved as the substrate-side deps upgrade — track it.

  3. Smoke-test the CLI self-update path after self_update 1.0.0-rc.2 → rc.6
    Operability | MEDIUM | Effort: quick win

    • Why: The lockfile hunk at the CLI crate (basilica-cli, ~line 1405) shows self_update as a direct dependency, bumped four release-candidate versions (-version = "1.0.0-rc.2" +version = "1.0.0-rc.6"). This component downloads and replaces the running binary — a supply-chain-critical path — and rc-series hops can change release-asset resolution, archive handling, or checksum behavior. CI almost never exercises a real update cycle.
    • How: Review the rc.3–rc.6 changelogs and run the CLI's update command against a staging/test release before the next CLI release ships.

LOW Severity Issues (Minor Improvements)

  1. Confirm the pinned toolchain satisfies the new MSRV floor of 1.88
    Maintainability & Coherency | LOW | Effort: quick win

    • Why: The description's changelogs document MSRV raises: serde_with 3.18+ → Rust 1.88 (via the new darling 0.23.0 in the lockfile), clap 4.6 → 1.85, libc 0.2.184 → 1.65, futures-util 0.3.32 → 1.71. If rust-toolchain.toml or CI pins anything below 1.88, builds break.
    • How: Check the toolchain pin; CI on this PR should already catch it.

  2. Verify the diff is complete — same-version dependency-list changes suggest feature-resolution drift
    Maintainability & Coherency | LOW | Effort: quick win

    • Why: proptest stays at version = "1.9.0" yet loses bit-set, bit-vec, rusty-fork, and tempfile from its dependency list, and wasm-bindgen-backend gains serde with no version line change visible. Same-version dep-list changes imply either Cargo.toml/feature changes not present in the provided diff, or the lockfile was regenerated with a different Cargo than the repo standard. The net effect (fewer dev-build crates) is benign, but the cause should be understood.
    • How: Confirm no Cargo.toml changes were omitted from the diff and that the lockfile was produced with the repo's standard toolchain.

  3. Check why rust_decimal 1.42.1 now pulls wasm-bindgen
    Performance | LOW | Effort: quick win

    • Why: The rust_decimal lockfile entry gains "wasm-bindgen" in its dependency list. For server-side binaries this is dead weight in the build graph.
    • How: cargo tree -i wasm-bindgen -e features to find the enabling feature; disable it if unintended.

Commit standards: the title/commit deps(deps): bump the cargo-patch-minor group with 25 updates satisfies the type(scope): description format; deps is Dependabot's conventional type. No finding.

Security Review

No code-level trust boundaries change in this diff; the security surface is entirely supply-chain delta.

  • Trust boundaries / input validation: Improved — serde_with 3.21.0 fixes GHSA-7gcf-g7xr-8hxj (panic via oversized allocation on attacker-controlled input), serde_json 1.0.15x rejects non-string enum object keys, uuid fixes an empty-input parser panic.
  • Authn/authz: No changes.
  • Secret/key handling: zeroize 1.8.2 → 1.9.0 (routine). New secp256k1 0.31.1 copy — see Finding 2.
  • Injection surfaces (SQL/shell/template/deserialization): None introduced; deserialization hardening noted above.
  • Dependency/supply chain: New crates entering the tree: fixed-cache 0.1.10, bs58, getrandom 0.4.3, r-efi 6.0.0, secp256k1 0.31.1/secp256k1-sys 0.11.0, sha3 0.11.0, keccak 0.2.0, cpufeatures 0.3.0, hashbrown 0.17.1, shlex 2.0.1, darling 0.23.0, anstream 1.0.0, clap_lex 1.1.0 — all from mainstream rust-lang/tokio/alloy/RustCrypto/clap ecosystems. Removed: rusty-fork, quick-error, scc, sdd, bit-set, bit-vec, pin-utils (net surface reduction). self_update (binary auto-download/replace) bumped — see Finding 3.
  • Crypto/randomness: Duplicated Keccak/SHA3 and secp256k1 backends (Finding 2); getrandom 0.4.3 added alongside 0.3.4 — both are legitimate releases.
  • Resource exhaustion/DoS: once_cell 1.21.4 fixes an unsoundness that could expose uninitialized memory; tokio sync fixes reduce channel-state corruption risk.

Suggestions for Improvements

  • Add cargo deny check advisories bans to CI so grouped bumps surface new duplicate versions and known advisories automatically.
  • Keep grouped Dependabot PRs rebased immediately before merge so the description table always matches the head lockfile.
  • Open a tracking item for the sha3/keccak/digest 0.10→0.11 and windows-sys 0.59/0.60/0.61 deduplication as upstream crates upgrade.

Positive Observations

  • Lands real security fixes (serde_with GHSA-7gcf-g7xr-8hxj, once_cell unsoundness, alloy unsound unwrap_unchecked removal) with zero code churn.
  • Prunes seven stale crates from the dependency tree, including the fork-exec-based rusty-fork.
  • Patch/minor-only grouping keeps the semver risk bounded; lockfile-only diff is easy to audit.

Recommendation and Next Steps

COMMENT — No blocking defects, but before merge verify that the head Cargo.lock (particularly tokio 1.50.0 vs the described 1.52.3) is the CI-tested artifact, and smoke-test the self_update rc.6 upgrade path given its binary-replacement role.

@dependabot @github

dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 24, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-patch-minor-392cd8264d branch August 24, 2026 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants