Skip to content

build(deps): bump the major-updates group across 1 directory with 14 updates - #412

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/major-updates-eaff646462
Open

build(deps): bump the major-updates group across 1 directory with 14 updates#412
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/major-updates-eaff646462

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the major-updates group with 13 updates in the / directory:

Package From To
tower-http 0.6.11 0.7.0
tikv-jemallocator 0.6.1 0.7.0
jsonwebtoken 10.4.0 11.0.0
base64 0.22.1 0.23.1
num-bigint 0.4.6 0.5.1
pollster 0.4.0 1.0.1
validator 0.20.0 0.21.0
astral-tokio-tar 0.6.2 0.6.4
aws-lc-fips-sys 0.13.14 0.13.16
quinn-udp 0.5.14 0.5.15
spin 0.9.8 0.9.9
syn 2.0.118 2.0.119
yaml-rust2 0.11.0 0.11.1

Updates tower-http from 0.6.11 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

  • csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

    use tower::ServiceBuilder;
    use tower_http::csrf::CsrfLayer;
    // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
    // an Origin allow-list, and an Origin/Host fallback. No per-request
    // token state required.
    let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
    let service = ServiceBuilder::new().layer(layer).service_fn(handler);

  • timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

    Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

    use std::time::Duration;
    use tower::ServiceBuilder;
    use tower_http::timeout::RequestBodyDeadlineLayer;
    // Abort the request body transfer after 30s total, regardless of how
    // frequently data arrives.
    let service = ServiceBuilder::new()
    .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
    .service_fn(handler);

  • fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

  • fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

    use tower_http::services::fs::ServeDir;
    // MyBackend implements tower_http::services::fs::Backend.
    // The default ServeDir::new() continues to use TokioBackend (local FS).
    let service = ServeDir::with_backend("assets", MyBackend::new());

  • fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

  • fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

  • validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

  • body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

  • limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits
  • b194fcf v0.7.0
  • af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
  • 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
  • 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
  • 8508716 Add redirect_path_prefix option (#486)
  • 56327b2 Add Windows drive-prefix path regression test (#705)
  • 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
  • 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
  • fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
  • 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
  • Additional commits viewable in compare view

Updates tikv-jemallocator from 0.6.1 to 0.7.0

Release notes

Sourced from tikv-jemallocator's releases.

0.7.0

  • Reverse order of MAKEFLAGS priority (#152)
  • Define ALIGNOF_MAX_ALIGN_T for riscv32 (#153)
  • Remove build directory once build of jemalloc-sys finishes (#119)
  • Fix cross-compile for tier-3 riscv64a23 target (#141)
  • sys: support *-windows-gnullvm targets (#150)
  • Propagate LDFLAGS, if present (#155)
  • jemalloc-ctl: fix invalid update implementation
  • add new free ffi
  • Update jemalloc to 5.3.1 (#161)
  • Add profiling_libunwind feature (#159)
  • passthrough cc env/args using native cc features (#158)
Changelog

Sourced from tikv-jemallocator's changelog.

0.7.0 - 2026-05-25

  • Reverse order of MAKEFLAGS priority (#152)
  • Define ALIGNOF_MAX_ALIGN_T for riscv32 (#153)
  • Remove build directory once build of jemalloc-sys finishes (#119)
  • Fix cross-compile for tier-3 riscv64a23 target (#141)
  • sys: support *-windows-gnullvm targets (#150)
  • Propagate LDFLAGS, if present (#155)
  • jemalloc-ctl: fix invalid update implementation
  • add new free ffi
  • Update jemalloc to 5.3.1 (#161)
  • Add profiling_libunwind feature (#159)
  • passthrough cc env/args using native cc features (#158)
Commits

Updates jsonwebtoken from 10.4.0 to 11.0.0

Changelog

Sourced from jsonwebtoken's changelog.

11.0.0 (2026-07-24)

  • Add conversions between Algorithm and KeyAlgorithm
  • JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
  • JWKs with unknown key types are now deserializable
  • BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
  • BREAKING: Jwk.thumbprint now returns a Result<_>
  • BREAKING: Header.extras is now a struct that allows for deserialization to any T
  • BREAKING: Implicit features resulting from optional crates have been removed
  • BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
  • BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
  • BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

  • When constructing HMAC signers, the algorithm family must now be verified on construction
  • JwkUtils has been renamed to KeyUtils
    • compute_digest now returns a Result<_>
    • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
    • rsa_pub_components_from_public_key has been added
    • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
    • ed_pub_components_from_private_key has been added
Commits

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates num-bigint from 0.4.6 to 0.5.1

Changelog

Sourced from num-bigint's changelog.

Release 0.5.1 (2026-07-04)

Contributors: @​cuviper

Release 0.5.0 (2026-07-02)

  • Upgrade to rand v0.10 and/or v0.9, and split rand_core.
    • The former rand feature is now split into multiple features, rand_0_9, rand_core_0_9, rand_0_10, and rand_core_0_10, depending on the version and feature set you need.
    • The RandBigInt extension trait is now split into BigRng09 and BigRng010 for each version.
    • The gen_* methods are deprecated in favor of new random_* methods.
    • This is also a value-breaking release, as rand defines it.

Contributors: @​bionicles, @​cuviper, @​divergentdave

Release 0.4.8 (2026-07-04)

Contributors: @​cuviper

Release 0.4.7 (2026-07-02)

Contributors: @​cp289, @​cuviper, @​hkalbasi, @​mikem8891, @​pRizz, @​tyilo, @​xtqqczze

Commits
  • 33c59ba Merge pull request #348 from cuviper/bz-alg2-step3b
  • 38b68f6 Release 0.5.1
  • f4a43f5 Fix the missing part of the Burnikel-Ziegler algorithm
  • ebfd89a Add failing tests for a bug in B-Z division
  • 0ab95df Merge pull request #338 from cuviper/rand-0.10
  • 33d6998 Release 0.5.0
  • 84d05b7 Clean up manifests of ci crates
  • f8daf56 Allow clippy::duplicate_mod where intended
  • 022310a Rearrange the rand features to support both 0.9 and 0.10
  • 537a036 ci: use the fallback resolver for deps
  • Additional commits viewable in compare view

Updates pollster from 0.4.0 to 1.0.1

Changelog

Sourced from pollster's changelog.

[1.0.1] - 2026-07-10

Fixed

  • Use doc_cfg instead of doc_auto_cfg for docsrs builds

[1.0.0] - 2026-07-09

Changed

  • FutureExt is now implemented for IntoFuture, not just Future
Commits

Updates validator from 0.20.0 to 0.21.0

Changelog

Sourced from validator's changelog.

0.21.0 (2026/07/09)

  • Replace dep proc-macro-error2 with proc-macro-error3
  • Edition 2024
Commits

Updates astral-tokio-tar from 0.6.2 to 0.6.4

Release notes

Sourced from astral-tokio-tar's releases.

astral-tokio-tar v0.6.4

What's Changed

New Contributors

Full Changelog: astral-sh/tokio-tar@v0.6.2...v0.6.4

v0.6.3

What's Changed

Full Changelog: astral-sh/tokio-tar@v0.6.2...v0.6.3

Commits
  • 42052ee Bump version to 0.6.4 (#104)
  • 3c4dcd1 Align the release workflow with other Astral projects (#103)
  • ea61e74 Fix nanosecond conversion on 32-bit Unix (#101)
  • ebeb337 Use clear instead of truncate(0) (#102)
  • b6fa50e Bump the github-actions group across 1 directory with 2 updates (#89)
  • 1c72181 Update rustix dependency from 0.38 to 1.0 (#97)
  • 6cd40fe Bump version to 0.6.3 (#96)
  • 97c5c2e Report sparse data positions after continuation headers
  • 5fe6899 Reject empty local PAX values
  • 972c52d Test last-record precedence for PAX owner metadata
  • Additional commits viewable in compare view

Updates aws-lc-fips-sys from 0.13.14 to 0.13.16

Commits
  • 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
  • d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
  • 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
  • f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
  • deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
  • aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
  • 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
  • 997202f ci: only run push-triggered workflows on main (#1163)
  • e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
  • 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
  • Additional commits viewable in compare view

Updates pollster-macro from 0.4.0 to 1.0.1

Changelog

Sourced from pollster-macro's changelog.

[1.0.1] - 2026-07-10

Fixed

  • Use doc_cfg instead of doc_auto_cfg for docsrs builds

[1.0.0] - 2026-07-09

Changed

  • FutureExt is now implemented for IntoFuture, not just Future
Commits

Updates quinn-udp from 0.5.14 to 0.5.15

Release notes

Sourced from quinn-udp's releases.

quinn-udp 0.5.15

What's Changed

Commits
  • a96949f Take semver-compatible update for anyhow
  • 5429f60 udp: bump version to 0.5.15
  • 262a493 proto: bump version to 0.11.16
  • c19b63a Upgrade rustls-platform-verifier to 0.7
  • aff3652 Disable default features for fastbloom
  • 01b2eee Upgrade fastbloom to 0.17
  • 2c82013 Switch BBR RNG to PCG
  • 544dd9e Upgrade to rand 0.10.1
  • a7499b8 Bump versions for release
  • 7c1970f proto: yield error on too many gaps in assembler
  • Additional commits viewable in compare view

Updates spin from 0.9.8 to 0.9.9

Updates syn from 2.0.118 to 2.0.119

Release notes

Sourced from syn's releases.

2.0.119

  • Preserve attributes on tail-call expressions in statement position (#1994)
  • Parse field-representing types builtin in type position (#1996)
Commits
  • 3295f9e Release 2.0.119
  • 6ae9c18 Merge pull request #1996 from dtolnay/fieldrepresenting
  • 8ebd963 Parse field-representing types builtin
  • 540ccf8 Drop unneeded lifetime on covariant Cursor in verbatim::between
  • aa05887 Merge pull request #1995 from dtolnay/cursor
  • b7160d3 Reduce forking for Verbatim construction
  • efdc925 Merge pull request #1994 from dtolnay/tailcall
  • de6424c Preserve attribute on tail-call expression in statement position
  • 050dd73 Stricter const move closure grammar
  • c7d514b Merge pull request #1992 from dtolnay/scanconstmove
  • Additional commits viewable in compare view

Updates yaml-rust2 from 0.11.0 to 0.11.1

Changelog

Sourced from yaml-rust2's changelog.

v0.11.1

Changes:

  • (#78) Fix parsing short YAML documents to avoid infinite loops.
Commits
  • 8316be6 yaml-rust2 v0.11.1
  • 4d61e99 CHANGELOG: update for v0.11.1
  • b3d6734 tools: remove gen_large_yaml
  • f93c866 yaml; fix infinite loop in YamlDecoder on short multibyte input
  • 9f39918 tests: fix clippy warnings
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…updates

Bumps the major-updates group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.6.11` | `0.7.0` |
| [tikv-jemallocator](https://github.com/tikv/jemallocator) | `0.6.1` | `0.7.0` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [num-bigint](https://github.com/rust-num/num-bigint) | `0.4.6` | `0.5.1` |
| [pollster](https://github.com/zesterer/pollster) | `0.4.0` | `1.0.1` |
| [validator](https://github.com/Keats/validator) | `0.20.0` | `0.21.0` |
| [astral-tokio-tar](https://github.com/astral-sh/tokio-tar) | `0.6.2` | `0.6.4` |
| [aws-lc-fips-sys](https://github.com/aws/aws-lc-rs) | `0.13.14` | `0.13.16` |
| [quinn-udp](https://github.com/quinn-rs/quinn) | `0.5.14` | `0.5.15` |
| spin | `0.9.8` | `0.9.9` |
| [syn](https://github.com/dtolnay/syn) | `2.0.118` | `2.0.119` |
| [yaml-rust2](https://github.com/Ethiraric/yaml-rust2) | `0.11.0` | `0.11.1` |



Updates `tower-http` from 0.6.11 to 0.7.0
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.0)

Updates `tikv-jemallocator` from 0.6.1 to 0.7.0
- [Release notes](https://github.com/tikv/jemallocator/releases)
- [Changelog](https://github.com/tikv/jemallocator/blob/main/CHANGELOG.md)
- [Commits](tikv/jemallocator@0.6.1...0.7.0)

Updates `jsonwebtoken` from 10.4.0 to 11.0.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `num-bigint` from 0.4.6 to 0.5.1
- [Changelog](https://github.com/rust-num/num-bigint/blob/main/RELEASES.md)
- [Commits](rust-num/num-bigint@num-bigint-0.4.6...num-bigint-0.5.1)

Updates `pollster` from 0.4.0 to 1.0.1
- [Changelog](https://github.com/zesterer/pollster/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zesterer/pollster/commits)

Updates `validator` from 0.20.0 to 0.21.0
- [Changelog](https://github.com/Keats/validator/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Keats/validator/commits)

Updates `astral-tokio-tar` from 0.6.2 to 0.6.4
- [Release notes](https://github.com/astral-sh/tokio-tar/releases)
- [Changelog](https://github.com/astral-sh/tokio-tar/blob/main/CHANGELOG.md)
- [Commits](astral-sh/tokio-tar@v0.6.2...v0.6.4)

Updates `aws-lc-fips-sys` from 0.13.14 to 0.13.16
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@aws-lc-fips-sys/v0.13.14...aws-lc-fips-sys/v0.13.16)

Updates `pollster-macro` from 0.4.0 to 1.0.1
- [Changelog](https://github.com/zesterer/pollster/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zesterer/pollster/commits)

Updates `quinn-udp` from 0.5.14 to 0.5.15
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-udp-0.5.14...quinn-udp-0.5.15)

Updates `spin` from 0.9.8 to 0.9.9

Updates `syn` from 2.0.118 to 2.0.119
- [Release notes](https://github.com/dtolnay/syn/releases)
- [Commits](dtolnay/syn@2.0.118...2.0.119)

Updates `yaml-rust2` from 0.11.0 to 0.11.1
- [Release notes](https://github.com/Ethiraric/yaml-rust2/releases)
- [Changelog](https://github.com/Ethiraric/yaml-rust2/blob/master/CHANGELOG.md)
- [Commits](Ethiraric/yaml-rust2@v0.11.0...v0.11.1)

---
updated-dependencies:
- dependency-name: tower-http
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-updates
- dependency-name: tikv-jemallocator
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-updates
- dependency-name: jsonwebtoken
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-updates
- dependency-name: num-bigint
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-updates
- dependency-name: pollster
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: validator
  dependency-version: 0.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: major-updates
- dependency-name: astral-tokio-tar
  dependency-version: 0.6.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: major-updates
- dependency-name: aws-lc-fips-sys
  dependency-version: 0.13.16
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: major-updates
- dependency-name: pollster-macro
  dependency-version: 1.0.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: major-updates
- dependency-name: quinn-udp
  dependency-version: 0.5.15
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: major-updates
- dependency-name: spin
  dependency-version: 0.9.9
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: major-updates
- dependency-name: syn
  dependency-version: 2.0.119
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: major-updates
- dependency-name: yaml-rust2
  dependency-version: 0.11.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: major-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 31, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) August 31, 2026 20:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants