Skip to content

deps(deps): bump the cargo-patch-minor group across 1 directory with 30 updates - #556

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-patch-minor-4215428a5a
Open

deps(deps): bump the cargo-patch-minor group across 1 directory with 30 updates#556
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-patch-minor-4215428a5a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown

Bumps the cargo-patch-minor group with 30 updates in the / directory:

Package From To
alloy-primitives 1.5.4 1.6.1
tokio 1.49.0 1.50.0
tokio-util 0.7.18 0.7.19
async-trait 0.1.89 0.1.92
anyhow 1.0.103 1.0.104
serde 1.0.228 1.0.229
serde_json 1.0.149 1.0.151
serde_with 3.16.1 3.22.0
tracing-subscriber 0.3.22 0.3.23
blake3 1.8.3 1.8.6
uuid 1.20.0 1.24.0
clap 4.5.57 4.6.6
futures-util 0.3.31 0.3.33
regex 1.12.3 1.13.1
once_cell 1.21.3 1.21.4
libc 0.2.180 0.2.189
semver 1.0.27 1.0.28
zeroize 1.8.2 1.9.0
data-encoding 2.10.0 2.11.1
tempfile 3.24.0 3.27.0
tokio-stream 0.1.18 0.1.19
fastrand 2.3.0 2.5.0
aws-sdk-s3 1.120.0 1.121.0
rust_decimal 1.40.0 1.42.1
time 0.3.49 0.3.55
clap_complete 4.5.65 4.6.9
shellexpand 3.1.1 3.1.2
pyo3 0.29.0 0.29.2
self_update 1.0.0-rc.2 1.0.0-rc.6
tar 0.4.45 0.4.46

Updates alloy-primitives from 1.5.4 to 1.6.1

Release notes

Sourced from alloy-primitives's releases.

alloy-core v1.6.1

What's Changed

New Contributors

Full Changelog: alloy-rs/core@v1.6.0...v1.6.1

alloy-core v1.6.0

What's Changed

... (truncated)

Changelog

Sourced from alloy-primitives's changelog.

1.6.1 - 2026-07-16

Bug Fixes

  • [sol-macro] Derive namespaced custom types (#1152)
  • [syn-solidity] Strip namespaces from custom types in EIP-712 formatting (#1146)
  • [json-abi] Dedup canonical signatures (#1151)
  • [dyn-abi] Correct packed encoded size for Function (#1149)
  • [sol-macro] Fix UDT NAME constant generation stringify typo (#1145)
  • Fix(dyn-abi): avoid nested zero-sized
  • [json-abi] Preserve anonymous event full signatures (#1141)
  • [sol-macro] Derive Default for dynamic arrays of non-Default elements (#1129)
  • [sol-macro] Derive builtin traits on overloaded event/error enums (#1118)
  • [primitives] Reject underflowing native signed ints (#1139)
  • [dyn-abi] Error on primitive EIP-712 data (#1138)
  • [dyn-abi] Require tuple match arity (#1137)
  • [dyn-abi] Enforce signed int string width (#1136)
  • [dyn-abi] Validate EIP-712 fixed bytes length (#1135)
  • [sol-macro-expander] Propagate extra_derives to the functions enum (#1124)
  • [dyn-abi] Validate event topic count before decoding body (#1122)
  • Switch to proc-macro-error3 (#1121)
  • Reject extra event topics during decoding (#1112)
  • Disable proptest default features (#1110)
  • [EIP-712] PropDef::parse supports extra whitespaces (#1102)
  • [dyn-abi] Allow self-referential struct types in EIP-712 canonicalize (#1103) (#1105)

Dependencies

  • [deps] Bump actions/checkout from 6.0.2 to 7.0.0 in the ci-weekly group across 1 directory (#1130)

Features

  • [primitives] Use foldhash for fixed-size maps (#1153)
  • Allow customizing keccak cache size (#1115)
  • Keccak cache stats (#1114)
  • [primitives] Add Signature v_byte helper (#1111)

Miscellaneous Tasks

  • Release 1.6.1
  • Disable rustc-hash nightly feature (#1132)
  • Group weekly dependabot updates (#1127)

Other

  • Set rust-toolchain inputs explicitly (#1131)

Performance

  • Optimize bloom membership checks (#1134)

... (truncated)

Commits
  • ae40cc4 chore: release 1.6.1
  • 24e3053 fix(sol-macro): derive namespaced custom types (#1152)
  • 3203fa6 fix(syn-solidity): strip namespaces from custom types in EIP-712 formatting (...
  • ca7508b fix(json-abi): dedup canonical signatures (#1151)
  • e63cf6f feat(primitives): use foldhash for fixed-size maps (#1153)
  • 7dc38ba fix(dyn-abi): correct packed encoded size for Function (#1149)
  • 2df1477 fix(sol-macro): fix UDT NAME constant generation stringify typo (#1145)
  • c133daf fix(dyn-abi): avoid nested zero-sized
  • cd07f92 fix(json-abi):
  • ea33d7a fix(sol-macro): derive Default for dynamic arrays of non-Default elements (#1...
  • Additional commits viewable in compare view

Updates tokio from 1.49.0 to 1.50.0

Release notes

Sourced from tokio's releases.

Tokio v1.50.0

1.50.0 (Mar 3rd, 2026)

Added

  • net: add TcpStream::set_zero_linger (#7837)
  • rt: add is_rt_shutdown_err (#7771)

Changed

  • io: add optimizer hint that memchr returns in-bounds pointer (#7792)
  • io: implement vectored writes for write_buf (#7871)
  • runtime: panic when event_interval is set to 0 (#7838)
  • runtime: shorten default thread name to fit in Linux limit (#7880)
  • signal: remember the result of SetConsoleCtrlHandler (#7833)
  • signal: specialize windows Registry (#7885)

Fixed

  • io: always cleanup AsyncFd registration list on deregister (#7773)
  • macros: remove (most) local use declarations in tokio::select! (#7929)
  • net: fix GET_BUF_SIZE constant for target_os = "android" (#7889)
  • runtime: avoid redundant unpark in current_thread scheduler (#7834)
  • runtime: don't park in current_thread if before_park defers waker (#7835)
  • io: fix write readiness on ESP32 on short writes (#7872)
  • runtime: wake deferred tasks before entering block_in_place (#7879)
  • sync: drop rx waker when oneshot receiver is dropped (#7886)
  • runtime: fix double increment of num_idle_threads on shutdown (#7910, #7918, #7922)

Unstable

  • fs: check for io-uring opcode support (#7815)
  • runtime: avoid lock acquisition after uring init (#7850)

Documented

  • docs: update outdated unstable features section (#7839)
  • io: clarify the behavior of AsyncWriteExt::shutdown() (#7908)
  • io: explain how to flush stdout/stderr (#7904)
  • io: fix incorrect and confusing AsyncWrite documentation (#7875)
  • rt: clarify the documentation of Runtime::spawn (#7803)
  • rt: fix missing quotation in docs (#7925)
  • runtime: correct the default thread name in docs (#7896)
  • runtime: fix event_interval doc (#7932)
  • sync: clarify RwLock fairness documentation (#7919)
  • sync: clarify that recv returns None once closed and no more messages (#7920)
  • task: clarify when to use spawn_blocking vs dedicated threads (#7923)
  • task: doc that task drops before JoinHandle completion (#7825)
  • signal: guarantee that listeners never return None (#7869)
  • task: fix task module feature flags in docs (#7891)

... (truncated)

Commits

Updates tokio-util from 0.7.18 to 0.7.19

Commits
  • f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
  • 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
  • ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
  • 75fef53 chore: prepare Tokio v1.53.1 (#8303)
  • ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
  • eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
  • 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
  • a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
  • be689a3 chore: prepare Tokio v1.53.0 (#8294)
  • 50f76c7 chore: prepare tokio-macros v2.7.1 (#8295)
  • Additional commits viewable in compare view

Updates async-trait from 0.1.89 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

  • Resolve double_must_use clippy lint in generated code (#303)

0.1.91

  • Update to syn 3 (#299)
  • Fix mutability for by-reference receivers (#301)

0.1.90

(yanked)

Commits
  • 82e7e9e Release 0.1.92
  • 9a35cb8 Merge pull request #303 from dtolnay/mustuse
  • 875ceec Resolve double_must_use clippy lint
  • 62993a5 Raise minimum tested compiler to rust 1.88
  • d049ee0 Release 0.1.91
  • 7a0961f Merge pull request #301 from dtolnay/mutability
  • 740f86f Ignore mut_mut pedantic clippy lint in test
  • 4699cd3 Fix mutability for by-reference receivers
  • 6dd3573 Add regression test for issue 300
  • 2371797 Release 0.1.90
  • Additional commits viewable in compare view

Updates anyhow from 1.0.103 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

  • Update syn dev-dependency to version 3
Commits

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

v1.0.150

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • Additional commits viewable in compare view

Updates serde_with from 3.16.1 to 3.22.0

Release notes

Sourced from serde_with's releases.

serde_with v3.22.0

Added

  • Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

  • Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

Added

  • Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#943)

Fixed

serde_with v3.19.0

Added

... (truncated)

Commits
  • 88f576a Bump version to 3.22.0 (#991)
  • 931e664 Bump version to 3.22.0
  • e26930e Bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...
  • 92cd5a0 Bump github/codeql-action in the github-actions group
  • 32be66f Guard with_capacity_and_hasher against untrusted size_hint (DoS) (#971)
  • 33871cd Merge branch 'master' into fix/duplicate-key-impls-capacity-overflow
  • bb1e064 Change function position within impl (#968)
  • 202d3dd Improve the time unit macros to remove unnecessary repetition and make the co...
  • b347efb Move the use_duration_signed_ser/*_de macros utils
  • 6590545 chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2
  • Additional commits viewable in compare view

Updates tracing-subscriber from 0.3.22 to 0.3.23

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.23

Fixed

  • Allow ansi sanitization to be disabled (#3484)

#3484: tokio-rs/tracing#3484

Commits

Updates blake3 from 1.8.3 to 1.8.6

Release notes

Sourced from blake3's releases.

1.8.6

version 1.8.6

Changes since 1.8.5:

  • update_mmap and update_mmap_rayon (and by extension b3sum) now use seek rather than metadata to get the length of a file/mapping, and they tolerate mmap failures. That means b3sum will now memory map e.g. Linux block devices, which support mapping despite reporting length 0 in metadata. Hashing NUL files on Windows also works now, where previously it was an error unless you used --no-mmap or <. This change was originally proposed by @​nabijaczleweli.

1.8.5

version 1.8.5

Changes since 1.8.4:

  • Forcibly disable LTO when compiling C intrinsics from the Rust build. This fixes a build break on Arch Linux ARM: BLAKE3-team/BLAKE3#550

1.8.4

version 1.8.4

Changes since 1.8.3:

  • Updated the digest dependency from v0.10 to v0.11. THIS IS A POTENTIALLY BREAKING CHANGE for callers using the traits-preview Cargo feature. But this is not considered a breaking change for the blake3 crate itself; see the docs for traits-preview.
  • Performance for WASM SIMD targets is improved by ~20% when the wasm32_simd feature is enabled. Contributed by @​lamb356.
Commits

Updates uuid from 1.20.0 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

v1.23.1

What's Changed

... (truncated)

Commits
  • 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
  • e6db8ec prepare for 1.24.0 release
  • 606f236 Merge pull request #892 from weifanglab/main
  • ab848db feat(fmt): support encoding into MaybeUninit buffers
  • 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
  • 5a7dfe5 prepare for 1.23.5 release
  • 9b4bfc8 Merge pull request #894 from geeknoid/main
  • 5acc5a5 perf: Optimize UUID hex parsing and formatting
  • 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
  • 1e5d867 Merge pull request #891 from frostyplanet/doc
  • Additional commits viewable in compare view

Updates clap from 4.5.57 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one

v4.6.1

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed

v4.5.60

[4.5.60] - 2026-02-19

Fixes

  • (help) Quote empty default values, possible values

v4.5.59

... (truncated)

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

  • Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

  • (help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

  • Update to syn v3

[4.6.3] - 2026-07-20

Fixes

  • (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed

[4.6.0] - 2026-03-12

Compatibility

  • Update MSRV to 1.85

[4.5.61] - 2026-03-12

Internal

  • Update dependencies

[4.5.60] - 2026-02-19

... (truncated)

Commits
  • 348cff3 chore: Release
  • d478377 docs: Update changelog
  • 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
  • 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
  • f90a966 fix(complete): Use spaces for indentation in fish
  • dd4997b fix(complete): Don't glob-expand bash positionals
  • 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
  • 8141e11 chore(deps): Update compatible (dev) (#6398)
  • 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
  • 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
  • Additional commits viewable in compare view

Updates futures-util from 0.3.31 to 0.3.33

Release notes

Sourced from futures-util's releases.

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)

0.3.32

  • Bump MSRV of utility crates to 1.71. (#2989)
  • Soft-deprecate ready! macro in favor of std::task::ready! added in Rust 1.64 (#2925)
  • Soft-deprecate pin_mut! macro in favor of std::pin::pin! added in Rust 1.68 (#2929)
  • Add FuturesOrdered::clear (#2927)
  • Add mpsc::*Receiver::recv (#2947)
  • Add mpsc::*Receiver::try_recv and deprecate mpsc::*Receiver::::try_next (#2944)
  • Implement FusedStream for sink::With (#2948)
  • Add no_std support for shared (#2868)
  • Make Mutex::new() const (#2956)
  • Add #[clippy::has_significant_drop] to...

    Description has been truncated

@dependabot
deps(deps): bump the cargo-patch-minor group across 1 directory with …
1747977 
…30 updates

Bumps the cargo-patch-minor group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [alloy-primitives](https://github.com/alloy-rs/core) | `1.5.4` | `1.6.1` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.49.0` | `1.50.0` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.18` | `0.7.19` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.92` |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.103` | `1.0.104` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.151` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.16.1` | `3.22.0` |
| [tracing-subscriber](https://github.com/tokio-rs/tracing) | `0.3.22` | `0.3.23` |
| [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.3` | `1.8.6` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.24.0` |
| [clap](https://github.com/clap-rs/clap) | `4.5.57` | `4.6.6` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.31` | `0.3.33` |
| [regex](https://github.com/rust-lang/regex) | `1.12.3` | `1.13.1` |
| [once_cell](https://github.com/matklad/once_cell) | `1.21.3` | `1.21.4` |
| [libc](https://github.com/rust-lang/libc) | `0.2.180` | `0.2.189` |
| [semver](https://github.com/dtolnay/semver) | `1.0.27` | `1.0.28` |
| [zeroize](https://github.com/RustCrypto/utils) | `1.8.2` | `1.9.0` |
| [data-encoding](https://github.com/ia0/data-encoding) | `2.10.0` | `2.11.1` |
| [tempfile](https://github.com/Stebalien/tempfile) | `3.24.0` | `3.27.0` |
| [tokio-stream](https://github.com/tokio-rs/tokio) | `0.1.18` | `0.1.19` |
| [fastrand](https://github.com/smol-rs/fastrand) | `2.3.0` | `2.5.0` |
| [aws-sdk-s3](https://github.com/awslabs/aws-sdk-rust) | `1.120.0` | `1.121.0` |
| [rust_decimal](https://github.com/paupino/rust-decimal) | `1.40.0` | `1.42.1` |
| [time](https://github.com/time-rs/time) | `0.3.49` | `0.3.55` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.5.65` | `4.6.9` |
| [shellexpand](https://gitlab.com/ijackson/rust-shellexpand) | `3.1.1` | `3.1.2` |
| [pyo3](https://github.com/pyo3/pyo3) | `0.29.0` | `0.29.2` |
| [self_update](https://github.com/jaemk/self_update) | `1.0.0-rc.2` | `1.0.0-rc.6` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.45` | `0.4.46` |



Updates `alloy-primitives` from 1.5.4 to 1.6.1
- [Release notes](https://github.com/alloy-rs/core/releases)
- [Changelog](https://github.com/alloy-rs/core/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/core@v1.5.4...v1.6.1)

Updates `tokio` from 1.49.0 to 1.50.0
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.49.0...tokio-1.50.0)

Updates `tokio-util` from 0.7.18 to 0.7.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-util-0.7.18...tokio-util-0.7.19)

Updates `async-trait` from 0.1.89 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.89...0.1.92)

Updates `anyhow` from 1.0.103 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.103...1.0.104)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.149 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.149...v1.0.151)

Updates `serde_with` from 3.16.1 to 3.22.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.16.1...v3.22.0)

Updates `tracing-subscriber` from 0.3.22 to 0.3.23
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-subscriber-0.3.22...tracing-subscriber-0.3.23)

Updates `blake3` from 1.8.3 to 1.8.6
- [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases)
- [Commits](BLAKE3-team/BLAKE3@1.8.3...1.8.6)

Updates `uuid` from 1.20.0 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.20.0...v1.24.0)

Updates `clap` from 4.5.57 to 4.6.6
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.57...clap_complete-v4.6.6)

Updates `futures-util` from 0.3.31 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.31...0.3.33)

Updates `regex` from 1.12.3 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.3...1.13.1)

Updates `once_cell` from 1.21.3 to 1.21.4
- [Changelog](https://github.com/matklad/once_cell/blob/master/CHANGELOG.md)
- [Commits](matklad/once_cell@v1.21.3...v1.21.4)

Updates `libc` from 0.2.180 to 0.2.189
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.189/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.180...0.2.189)

Updates `semver` from 1.0.27 to 1.0.28
- [Release notes](https://github.com/dtolnay/semver/releases)
- [Commits](dtolnay/semver@1.0.27...1.0.28)

Updates `zeroize` from 1.8.2 to 1.9.0
- [Commits](RustCrypto/utils@zeroize-v1.8.2...zeroize-v1.9.0)

Updates `data-encoding` from 2.10.0 to 2.11.1
- [Commits](ia0/data-encoding@v2.10.0...v2.11.1)

Updates `tempfile` from 3.24.0 to 3.27.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.24.0...v3.27.0)

Updates `tokio-stream` from 0.1.18 to 0.1.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-stream-0.1.18...tokio-stream-0.1.19)

Updates `fastrand` from 2.3.0 to 2.5.0
- [Release notes](https://github.com/smol-rs/fastrand/releases)
- [Changelog](https://github.com/smol-rs/fastrand/blob/master/CHANGELOG.md)
- [Commits](smol-rs/fastrand@v2.3.0...v2.5.0)

Updates `aws-sdk-s3` from 1.120.0 to 1.121.0
- [Release notes](https://github.com/awslabs/aws-sdk-rust/releases)
- [Commits](https://github.com/awslabs/aws-sdk-rust/commits)

Updates `rust_decimal` from 1.40.0 to 1.42.1
- [Release notes](https://github.com/paupino/rust-decimal/releases)
- [Changelog](https://github.com/paupino/rust-decimal/blob/master/CHANGELOG.md)
- [Commits](paupino/rust-decimal@1.40.0...1.42.1)

Updates `time` from 0.3.49 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.49...v0.3.55)

Updates `clap_complete` from 4.5.65 to 4.6.9
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.65...clap_complete-v4.6.9)

Updates `shellexpand` from 3.1.1 to 3.1.2
- [Commits](https://gitlab.com/ijackson/rust-shellexpand/compare/shellexpand-3.1.1...shellexpand-3.1.2)

Updates `pyo3` from 0.29.0 to 0.29.2
- [Release notes](https://github.com/pyo3/pyo3/releases)
- [Changelog](https://github.com/PyO3/pyo3/blob/main/CHANGELOG.md)
- [Commits](PyO3/pyo3@v0.29.0...v0.29.2)

Updates `self_update` from 1.0.0-rc.2 to 1.0.0-rc.6
- [Release notes](https://github.com/jaemk/self_update/releases)
- [Changelog](https://github.com/jaemk/self_update/blob/master/CHANGELOG.md)
- [Commits](jaemk/self_update@v1.0.0-rc.2...v1.0.0-rc.6)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

---
updated-dependencies:
- dependency-name: alloy-primitives
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tokio
  dependency-version: 1.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tokio-util
  dependency-version: 0.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: async-trait
  dependency-version: 0.1.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: serde_with
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tracing-subscriber
  dependency-version: 0.3.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: blake3
  dependency-version: 1.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: clap
  dependency-version: 4.6.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: futures-util
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: once_cell
  dependency-version: 1.21.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: libc
  dependency-version: 0.2.189
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: semver
  dependency-version: 1.0.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: zeroize
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: data-encoding
  dependency-version: 2.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tempfile
  dependency-version: 3.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: tokio-stream
  dependency-version: 0.1.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: fastrand
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: aws-sdk-s3
  dependency-version: 1.121.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: rust_decimal
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: clap_complete
  dependency-version: 4.6.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-patch-minor
- dependency-name: shellexpand
  dependency-version: 3.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: pyo3
  dependency-version: 0.29.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: self_update
  dependency-version: 1.0.0-rc.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-patch-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 24, 2026
@covenant-talos

covenant-talos Bot commented Aug 24, 2026

Copy link
Copy Markdown

Walkthrough

Dependabot bumps 30 cargo dependencies in the patch-minor group, updating only Cargo.lock. The updates span runtime (tokio family), serialization (serde family), CLI tooling (clap), crypto primitives (alloy-primitives, blake3, zeroize), and various utility crates. Several transitive dependencies are added or removed as a side effect of these bumps, including new syn 3.0.4, jiff, sha3 0.11.0, and secp256k1 0.31.1 pulled in by alloy-primitives and serde, while bit-set, rusty-fork, and quick-error are dropped.

Changes

Cohort / File(s) Change Summary
Async runtime — Cargo.lock (tokio, tokio-util, tokio-stream, async-trait, futures-util) Patches the tokio ecosystem and async-trait to latest minor versions; futures-util drops pin-utils dep and tokio-util gains a libc dependency.
Serialization — Cargo.lock (serde, serde_json, serde_with) Bumps serde/serde_json to syn-3 compatible releases; serde_with jumps 3.16→3.22 adding bs58, jiff, and a DoS-fix for allocation caps.
CLI — Cargo.lock (clap, clap_complete) Updates clap to 4.6.x and clap_complete to 4.6.9, pulling in newer anstream 1.0, anstyle-parse 1.0, clap_lex 1.1, and shlex 2.0.1.
Crypto/primitives — Cargo.lock (alloy-primitives, blake3, zeroize) Bumps alloy-primitives 1.5→1.6 (adds fixed-cache, secp256k1 0.31, sha3 0.11, foldhash/hashbrown 0.17), blake3 to 1.8.6 (drops arrayref), and zeroize to 1.9.0.
Utility crates — Cargo.lock (anyhow, uuid, regex, once_cell, libc, semver, data-encoding, fastrand, tempfile, shellexpand) Minor/patch bumps across common utilities; uuid moves to getrandom 0.4, tempfile follows, and regex updates its automata and syntax sub-crates.
Domain-specific — Cargo.lock (aws-sdk-s3, rust_decimal, time, pyo3, self_update, tar, tracing-subscriber) Patches AWS S3 SDK, rust_decimal (gains wasm-bindgen), time, pyo3 0.29.2, self_update rc.6, tar 0.4.46, and tracing-subscriber 0.3.23.

Estimated review effort: 1/5 (automated lockfile-only bump with no source changes).

Instant overview - a deep technical review follows as a separate comment.

@covenant-talos

covenant-talos Bot commented Aug 24, 2026

Copy link
Copy Markdown

PR #556: deps(deps): bump the cargo-patch-minor group across 1 directory with 30 updates

Summary

Dependabot grouped bump of 30 Cargo dependencies. The diff touches only Cargo.lock — no workspace manifests changed, so every new version satisfies existing semver ranges. The bump lands several genuinely valuable fixes: serde_with 3.21/3.22 remediates GHSA-7gcf-g7xr-8hxj (attacker-controlled size_hint causing capacity-overflow panic during collection deserialization), futures-util 0.3.33+ fixes multiple soundness bugs (unsound Send impls, stacked-borrows violation, ReadLine exception safety, FuturesUnordered leak), tokio 1.50 fixes scheduler/shutdown races, and uuid fixes a parser panic on empty input. The main review risk is alloy-primitives 1.5.4 → 1.6.1, a minor bump with stricter ABI/EIP-712/event-decoding validation and new transitive crypto dependencies, plus a set of newly pinned crates (jiff, defmt, bs58) arriving via serde_with.

Architecture

No structural impact. Lockfile-only change; no component, flow, or manifest is modified. The dependency tree shape changes (new transitive crates, additional duplicate majors) but no architecture-ilities are directly altered.

Issues Found

CRITICAL Issues (Must Fix Before Merge)

None found.

HIGH Severity Issues (Advised to Fix Before Merge)

None found.

MEDIUM Severity Issues (Optional to Fix Before Merge)

  1. Verify EVM/ABI/EIP-712 decoding and signing paths against alloy-primitives 1.6.1 before merging
    Functional Correctness | Medium | Effort: involved
    • Why: The alloy-primitives hunk (Cargo.lock: version = "1.5.4" → "1.6.1", plus new deps fixed-cache, secp256k1 0.31.1, sha3 0.11.0, hashbrown 0.17.1) ships behavior-tightening fixes quoted from its changelog: "Reject extra event topics during decoding (#1112)", "validate event topic count before decoding body (#1122)", "enforce signed int string width (#1136)", "reject underflowing native signed ints (#1139)", "validate EIP-712 fixed bytes length (#1135)". Inputs that 1.5.4 silently accepted now produce errors. In a system that verifies on-chain events and signatures, any path that relied on the lenient behavior (event-log parsing, signature recovery, EIP-712 payloads from third parties) can regress at runtime, not compile time. The bump also adds a third secp256k1 major (0.31.1 + secp256k1-sys 0.11.0) and the very young crate fixed-cache into the crypto stack.
    • How: Run the integration/e2e suites that touch chain event decoding and signature verification (payment settlement, EVM signature auth); grep for alloy_primitives log/Log/decode usage and confirm error paths handle rejection of previously-accepted encodings; note fixed-cache for cargo vet/cargo audit triage.
  2. Confirm the workspace toolchain satisfies the new MSRV floor (clap 4.6 requires rustc 1.85)
    Stability & Availability | Medium | Effort: quick win
    • Why: The clap changelog quoted in the PR states "[4.6.0] Compatibility: Update MSRV to 1.85", and the lockfile resolves clap 4.6.1/clap_builder 4.6.0/clap_lex 1.1.0/anstream 1.0.0. Notably, the lock holds clap 4.6.1 and tempfile 3.25.0 while the PR table advertises 4.6.6 and 3.27.0 — consistent with rust-version-aware resolution selecting older MSRV-compatible versions, which would imply the workspace rust-version is already exerting constraint pressure. If any CI or developer toolchain is below 1.85, this merge breaks the build. I cannot see the workspace rust-version, so this is stated with uncertainty.
    • How: Check rust-version in the workspace Cargo.toml and CI images are ≥ 1.85; if MSRV must stay lower, pin clap = "~4.5" (and audit the other bumps for MSRV bumps, e.g. tempfile/getrandom 0.4).
  3. Audit whether serde_with's new optional jiff/bs58 dependency tree is actually being compiled
    Maintainability & Coherency | Medium | Effort: quick win
    • Why: The serde_with 3.22.0 lock entry gained "bs58" and "jiff", and the lockfile now pins jiff 0.2.35 (with edges to defmt, log, portable-atomic, jiff-tzdb-platform), jiff-tzdb (the full IANA tz database), jiff-static, jiff-core, and the defmt 1.1.1/defmt-macros/defmt-parser stack. These sit behind serde_with features (jiff_0_2, base58) that did not exist in 3.16.1, and no manifest changed in this PR — so nothing in the workspace can be requesting them. If they are merely pinned (lockfile records optional deps), this is harmless; if feature unification has activated them, a server build is compiling an embedded-systems logging framework (defmt) and an embedded tz database for no reason. I cannot determine which from the lockfile alone — flagging with stated uncertainty.
    • How: Run cargo tree -i jiff --edges features and cargo tree -i defmt; if active, locate the enabling feature and prune it from the serde_with dependency spec; if inactive, no action needed beyond awareness.

LOW Severity Issues (Minor Improvements)

  1. Reconcile the PR description table with the actual locked versions
    Operability | Low | Effort: quick win
    • Why: The lockfile disagrees with the description's "From → To" table: blake3 is locked at 1.8.7 (table says 1.8.6), uuid at 1.25.0 (table says 1.24.0), clap at 4.6.1 (table says 4.6.6), tempfile at 3.25.0 (table says 3.27.0). For blake3 and uuid the locked versions are newer than the release notes included in this PR, meaning those deltas are unreviewed here — mildly undesirable for a content-hashing crate (blake3 also drops arrayref and moves to cpufeatures 0.3.0).
    • How: Skim the blake3 1.8.7 and uuid 1.25.0 changelogs before merge; treat the description table as stale metadata.
  2. Track the growing set of duplicate major versions in the crypto/build stack
    Maintainability & Coherency | Low | Effort: involved
    • Why: This bump adds or widens duplication: secp256k1 now exists at three majors (existing entries with secp256k1-sys 0.9.2/0.10.1, plus new 0.31.1/0.11.0), sha3 0.10.8 + 0.11.0, keccak 0.1.5 + 0.2.2, digest 0.10.7 + 0.11.3, syn 2.0.118 + 3.0.4 (via serde_derive, async-trait, futures-macro), getrandom 0.3.4 + 0.4.3, darling 0.20.x + 0.23.0, shlex 1.3.0 + 2.0.1, and four windows-sys majors (0.48/0.59/0.60/0.61). Each duplicated cryptographic primitive is extra audit surface in a financial system.
    • How: Add cargo tree --duplicates to CI visibility and a cargo-deny bans policy; file a follow-up issue to converge secp256k1/sha3 as upstreams allow.
  3. Run payment/pricing/weight-math tests explicitly for the rust_decimal 1.40 → 1.42.1 bump
    Testing & Docs | Low | Effort: quick win
    • Why: rust_decimal is on the financial-calculation path, and this is a two-minor jump (its lock entry also gains a wasm-bindgen edge). No breaking change is indicated, but decimal semantics are load-bearing for billing/payouts.
    • How: Confirm CI exercises decimal arithmetic paths; if any property tests exist for payout math, run them against this branch.
  4. Grep for event_interval(0) before adopting tokio 1.50
    Functional Correctness | Low | Effort: quick win
    • Why: Tokio 1.50.0 changelog: "runtime: panic when event_interval is set to 0 (#7838)". If any runtime builder in the workspace sets this, the upgrade turns a config no-op into a startup panic.
    • How: rg "event_interval" across the workspace; expect zero hits.
  5. Note the self_update rc.2 → rc.6 jump on the binary self-update path
    Security | Low | Effort: quick win
    • Why: self_update is a pre-release line (1.0.0-rc.2 → 1.0.0-rc.6, four RCs) in a code path that downloads, extracts (tar/flate2, both in this bump), and replaces the running binary — an RCE-shaped surface if release verification is misused. The diff shows no change to how it's invoked, so risk is low.
    • How: Confirm the updater call sites enforce checksum/signature verification and that updater tests still pass on rc.6.

Security Review

Sweep of the diff's actual surface (lockfile-only; no code, manifests, or network/config changes):

  • Trust boundaries / input validation: improved — serde_with 3.21.0/3.22.0 fixes GHSA-7gcf-g7xr-8hxj (panic via attacker-claimed collection lengths; the 3.22.0 fix extends the size_hint_cautious cap to the duplicate-key-prevention adapters, closing a bypass of the original fix). serde_json 1.0.150 rejects non-string enum object keys; alloy-primitives tightens ABI/EIP-712 validation (see finding 1); uuid 1.23.3 fixed a parser panic on empty input.
  • Authn/authz: no changes. Note only that alloy's stricter signature/EIP-712 handling sits adjacent to any signature-based auth flows (finding 1).
  • Secret and key handling: zeroize 1.8.2 → 1.9.0 (with zeroize_derive 1.5.0) touches secret zeroization; no adversarial signal in the bump, but it warrants a changelog skim given hotkey/key material handling. New secp256k1 0.31.1 compiles upstream C (secp256k1-sys 0.11.0) — reputable source, but adds a third copy (finding 5).
  • Injection surfaces (SQL/shell/template/deserialization): none introduced; deserialization hardening is net-positive as above.
  • Dependency / supply chain: 30 direct bumps plus new transitive crates — fixed-cache (new, low-maturity, in alloy's keccak path), jiff family, defmt family, bs58, getrandom 0.4.3, r-efi 6.0.0, sha3 0.11.0/keccak 0.2.2, syn 3.0.4. Two crates (blake3 1.8.7, uuid 1.25.0) are locked beyond the release notes quoted in the PR (finding 4). cargo audit/cargo vet coverage is recommended.
  • Crypto and randomness: getrandom 0.4.3 now backs uuid v4 and tempfile; blake3 patch-level; alloy's "global secp256k1 context" change is performance-only. No red flags.
  • Resource exhaustion / DoS: net improvement (serde_with advisory fixed; tokio shutdown/num_idle_threads race fixed; AsyncFd deregister cleanup). One new config foot-gun: tokio panics on event_interval(0) (finding 7).
  • Self-update channel: self_update + tar 0.4.46 + flate2 form the binary-replacement path; verification behavior not visible in this diff (finding 8).

Suggestions for Improvements

  • Split crypto-financial crates (alloy-*, secp256k1, blake3, zeroize, rust_decimal) into a dedicated dependabot group so they get focused review instead of riding a 30-crate batch.
  • Add cargo audit + cargo deny bans (and optionally cargo vet) to CI to manage advisory response and duplicate-major growth surfaced in finding 5.
  • Consider a CI smoke job that exercises chain-event decoding/signature verification so future alloy-family bumps are machine-gated rather than reviewer-gated.

Positive Observations

  • Lands a real security fix (serde_with GHSA-7gcf-g7xr-8hxj) and multiple upstream soundness fixes (futures-util unsound Send impls, stacked-borrows fix, ReadLine exception-safety fix, FuturesUnordered memory leak).
  • Tokio 1.50 fixes genuine runtime races (blocking-pool shutdown, block_in_place deferred wakeups) valuable to long-running validators/executors.
  • Lockfile-only change: every bump respects existing semver ranges — coherent with the manifests, no version-pin churn.
  • Net dependency removals: bit-set, bit-vec, quick-error, rusty-fork are gone from the tree (proptest default features were disabled upstream in alloy #1110), and blake3 sheds arrayref.
  • The Dependabot commit title (deps(deps): bump the cargo-patch-minor group ...) structurally conforms to the type(scope): description convention.

Recommendation and Next Steps

COMMENT — merge once CI is green on the workspace's pinned toolchain and the three spot-checks are done: alloy-primitives decoding/signature integration tests (finding 1), MSRV ≥ 1.85 confirmation (finding 2), and a cargo tree check that jiff/defmt/bs58 are pinned-but-not-compiled (finding 3); the bump is otherwise low-risk and delivers real security and soundness fixes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants