Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 34 updates - #139

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/production-dependencies-e859ea749c
Open

chore(deps): bump the production-dependencies group across 1 directory with 34 updates#139
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/production-dependencies-e859ea749c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 33 updates in the / directory:

Package From To
reqwest 0.12.28 0.13.4
regress 0.10.5 0.11.1
serde 1.0.228 1.0.229
serde_json 1.0.150 1.0.151
tokio 1.52.3 1.53.0
uuid 1.23.3 1.24.0
base64 0.21.7 0.22.1
sha2 0.10.9 0.11.0
hpke 0.12.0 0.13.0
rand 0.8.6 0.9.4
spki 0.7.3 0.8.0
der 0.7.10 0.8.1
thiserror 2.0.18 2.0.19
futures 0.3.32 0.3.33
lru 0.16.4 0.18.1
alloy-primitives 1.6.0 1.6.1
async-trait 0.1.89 0.1.91
zeroize 1.8.2 1.9.0
jsonwebtoken 9.3.1 10.3.0
anyhow 1.0.102 1.0.104
rand_chacha 0.3.1 0.9.0
solana-sdk 3.0.0 4.0.1
solana-system-interface 2.0.0 3.1.0
bincode 1.3.3 3.0.0
secp256k1 0.30.0 0.31.1
sha3 0.10.9 0.11.0
prettyplease 0.2.37 0.3.0
progenitor 0.11.2 0.12.0
quote 1.0.45 1.0.47
syn 2.0.117 3.0.2
proc-macro2 1.0.106 1.0.107
bytes 1.11.1 1.12.1
progenitor-client 0.11.2 0.12.0

Updates reqwest from 0.12.28 to 0.13.4

Release notes

Sourced from reqwest's releases.

v0.13.4

tl;dr

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

v0.13.3

tl;dr

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.4

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

v0.13.3

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

  • Fix HTTP/2 and native-tls ALPN feature combinations.
  • Fix HTTP/3 to send h3 ALPN.
  • (wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

  • Fixes compiling with rustls on Android targets.

v0.13.0

  • Breaking changes:
    • rustls is now the default TLS backend, instead of native-tls.
    • rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)
    • rustls-tls has been renamed to rustls.
    • rustls roots features removed, rustls-platform-verifier is used by default.
      • To use different roots, call tls_certs_only(your_roots).
    • native-tls now includes ALPN. To disable, use native-tls-no-alpn.
    • query and form are now crate features, disabled by default.
    • Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).
  • Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)
    • For example, prefer tls_backend_rustls() over use_rustls_tls().
Commits
  • 11489b3 v0.13.4
  • d31ffbb feat: Expose HTTP2 keep alive configurations in blocking client (#3043)
  • 79ed0d7 feat: support TLS 1.3 as min version under native-tls 🎉 (#2975)
  • fb7bf6a fix: remove unwrap in hickory initialization (#3041)
  • 3da616f fix: update hickory-resolver to 0.26 and adjust code accordingly (#3040)
  • c77e7b2 fix(http3): use happy eyeballs for h3 connect (#3030)
  • 9cbb65b chore: clean up minimal-versions CI job (#3039)
  • 17a7dc5 chore: upgrade MSRV to 1.85 (#3038)
  • 03db63a fix(redirect): strip sensitive headers on scheme change across redirects (#3034)
  • 4b813a8 feat: add tls_sslkeylogfile builder method (#2923)
  • Additional commits viewable in compare view

Updates regress from 0.10.5 to 0.11.1

Release notes

Sourced from regress's releases.

v0.11.1

Fixed

  • Fix incorrectly faililng to match with certain long literal sequences within lookbehind assertions

New Contributors

Full Changelog: ridiculousfish/regress@v0.11.0...v0.11.1

v0.11.0

This release adds support for duplicate named capture groups and includes a set of correctness fixes around Unicode case folding, word-character handling, and capture-group indexing. Unicode data has also been updated to Unicode 17.

Added

  • Implement TC39 duplicate named capturing groups support, allowing the same group name in disjoint alternations.
  • Update Unicode data tables to Unicode 17.

Fixed

  • Fix incorrect ASCII executor behavior when Unicode mode and case-insensitive matching were combined.
  • Fix Unicode case-insensitive word-character handling for characters such as U+212A and U+017F (in fact the only such characters).
  • Fix a panic for character classes for certain script extensions

New Contributors

Full Changelog: ridiculousfish/regress@v0.10.4...v0.11.0

Commits
  • 7e64ad5 Bump version to 0.11.1
  • b63f21d Factor out emit_byte_sequence from the emitter
  • ef1f51c Fix overlong byte sequences in lookbehinds
  • 576b29c fix typo in Flags::dot_all docs (#145)
  • 2465bdc Bump version to 0.11.0
  • 5cf0d0c Add test for non-capturing group indexing fix
  • 5b010a5 Support multiple named group indices in backreferences
  • 89e71c1 Properly support Unicode + icase word characters
  • 85d041f Fix non-capturing group indexing
  • 431d9c6 Fix ASCII unicode case folding
  • Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • See full diff in compare view

Updates tokio from 1.52.3 to 1.53.0

Release notes

Sourced from tokio's releases.

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)
  • time (alt timer): ensure timers stay in the same runtime after .reset() (#8169)

IO uring (unstable)

  • fs: use io-uring for fs::try_exists (#8080)
  • fs: use io-uring for renaming files (#7800)
  • rt: flush io-uring CQE in case of CQE overflow (#8277)

Documented

  • docs: clarify cancel safety wording (#8181)
  • fs: clarify create_dir_all succeeds if path exists (#8149)
  • io: add warning about stdout reordering with multiple handles (#8276)
  • net: document pipe try_read*/try_write* readiness behavior (#8032)
  • runtime: document interaction with fork() (#8202)
  • sync: clarify broadcast lagging semantics (#8239)
  • sync: document memory ordering guarantees for Semaphore (#8119)
  • task: explain why yield_now defers its waker (#8254)
  • time: add panic docs to timeout_at() (#8077)

... (truncated)

Commits

Updates uuid from 1.23.3 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

Commits
  • 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
  • e6db8ec prepare for 1.24.0 release
  • 606f236 Merge pull request #892 from weifanglab/main
  • ab848db feat(fmt): support encoding into MaybeUninit buffers
  • 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
  • 5a7dfe5 prepare for 1.23.5 release
  • 9b4bfc8 Merge pull request #894 from geeknoid/main
  • 5acc5a5 perf: Optimize UUID hex parsing and formatting
  • 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
  • 1e5d867 Merge pull request #891 from frostyplanet/doc
  • Additional commits viewable in compare view

Updates base64 from 0.21.7 to 0.22.1

Changelog

Sourced from base64's changelog.

0.22.1

  • Correct the symbols used for the predefined alphabet::BIN_HEX.

0.22.0

  • DecodeSliceError::OutputSliceTooSmall is now conservative rather than precise. That is, the error will only occur if the decoded output cannot fit, meaning that Engine::decode_slice can now be used with exactly-sized output slices. As part of this, Engine::internal_decode now returns DecodeSliceError instead of DecodeError, but that is not expected to affect any external callers.
  • DecodeError::InvalidLength now refers specifically to the number of valid symbols being invalid (i.e. len % 4 == 1), rather than just the number of input bytes. This avoids confusing scenarios when based on interpretation you could make a case for either InvalidLength or InvalidByte being appropriate.
  • Decoding is somewhat faster (5-10%)
Commits
  • e144006 v0.22.1
  • 64cca59 Merge pull request #271 from JobanSD/patch-1
  • 838355e Correct BinHex 4.0 alphabet according to specifications
  • bf15ccf Merge pull request #270 from marshallpierce/mp/clippy
  • fc6aabe Appease clippy
  • 9a518a2 Merge pull request #267 from bdura/patch-1
  • d96c80f Merge branch 'marshallpierce:master' into patch-1
  • 5d70ba7 Merge pull request #269 from marshallpierce/mp/decode-precisely
  • efb6c00 Release notes
  • 2b91084 Add some tests to boost coverage
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates hpke from 0.12.0 to 0.13.0

Changelog

Sourced from hpke's changelog.

[0.13.0] - 2025-02-19

Changes

  • Made PskBundle require an explicit constructor that performs validation on inputs
  • Updated rand and rand_core to 0.9
Commits

Updates rand from 0.8.6 to 0.9.4

Changelog

Sourced from rand's changelog.

[0.9.4] — 2026-04-13

Fixes

#1766: rust-random/rand#1766

[0.9.3] — 2026-04-11

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1764)
  • Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

[0.9.2] — 2025-07-20

Deprecated

  • Deprecate rand::rngs::mock module and StepRng generator (#1634)

Additions

  • Enable WeightedIndex<usize> (de)serialization (#1646)

[0.9.1] - 2025-04-17

Security and unsafe

  • Revise "not a crypto library" policy again (#1565)
  • Remove zerocopy dependency from rand (#1579)

Fixes

  • Fix feature simd_support for recent nightly rust (#1586)

Changes

  • Allow fn rand::seq::index::sample_weighted and fn IndexedRandom::choose_multiple_weighted to return fewer than amount results (#1623), reverting an undocumented change (#1382) to the previous release.

Additions

  • Add rand::distr::Alphabetic distribution. (#1587)
  • Re-export rand_core (#1604)

[0.9.0] - 2025-01-27

Security and unsafe

  • Policy: "rand is not a crypto library" (#1514)
  • Remove fork-protection from ReseedingRng and ThreadRng. Instead, it is recommended to call ThreadRng::reseed on fork. (#1379)
  • Use zerocopy to replace some unsafe code (#1349, #1393, #1446, #1502)

Dependencies

  • Bump the MSRV to 1.63.0 (#1207, #1246, #1269, #1341, #1416, #1536); note that 1.60.0 may work for dependents when using --ignore-rust-version
  • Update to rand_core v0.9.0 (#1558)

Features

  • Support std feature without getrandom or rand_chacha (#1354)
  • Enable feature small_rng by default (#1455)

... (truncated)

Commits

Updates spki from 0.7.3 to 0.8.0

Commits

Updates der from 0.7.10 to 0.8.1

Commits

Updates thiserror from 2.0.18 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

  • Update to syn 3
Commits
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
  • c50e387 chore: improve thiserror maintenance path
  • d4a2507 Raise minimum tested compiler to rust 1.85
  • 99e8a6c Unpin CI miri toolchain
  • 9ac165c Pin CI miri to nightly-2026-02-11
  • Additional commits viewable in compare view

Updates futures from 0.3.32 to 0.3.33

Release notes

Sourced from futures's releases.

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures's changelog.

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits
  • 89cc254 Release 0.3.33
  • cd9f5be ci: Update release workflow
  • d79a499 Resolve rustdoc::broken_intra_doc_links warning
  • 95bbcf8 Resolve rustdoc ambiguous link error
  • 303c165 Resolve rustdoc::redundant_explicit_links warning
  • f34e3f5 ci: Cleanup
  • 66591a2 Enable Miri for more tests
  • ab1072f Simplify target_has_atomic cfg in utility crates
  • cf5d23b Fix unsound compat01as03 implementation (fixes #2514) (#3012)
  • 8ae794f Add portable-atomic-alloc feature and use it in FuturesUnordered (#3007)
  • Additional commits viewable in compare view

Updates lru from 0.16.4 to 0.18.1

Changelog

Sourced from lru's changelog.

v0.18.1 - 2026-07-09

  • Add find_and_promote method.

v0.18.0 - 2026-04-27

  • Fix unconstrained lifetime in get_or_insert_mut_ref.

v0.17.0 - 2026-04-14

  • Upgrade hashbrown to 0.17.0 and update MSRV to 1.85.0.
Commits
  • c6620d1 Merge pull request #237 from jeromefroe/jerome/prepare-0-18-1-release
  • da3c0fc Prepare 0.18.1 release
  • 1166263 Merge pull request #236 from pixmaip/find-and-promote

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
7deb99d 
…y with 34 updates

Bumps the production-dependencies group with 33 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.28` | `0.13.4` |
| [regress](https://github.com/ridiculousfish/regress) | `0.10.5` | `0.11.1` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.0` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.3` | `1.24.0` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.21.7` | `0.22.1` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [hpke](https://github.com/rozbb/rust-hpke) | `0.12.0` | `0.13.0` |
| [rand](https://github.com/rust-random/rand) | `0.8.6` | `0.9.4` |
| [spki](https://github.com/RustCrypto/formats) | `0.7.3` | `0.8.0` |
| [der](https://github.com/RustCrypto/formats) | `0.7.10` | `0.8.1` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.19` |
| [futures](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.33` |
| [lru](https://github.com/jeromefroe/lru-rs) | `0.16.4` | `0.18.1` |
| [alloy-primitives](https://github.com/alloy-rs/core) | `1.6.0` | `1.6.1` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.91` |
| [zeroize](https://github.com/RustCrypto/utils) | `1.8.2` | `1.9.0` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `9.3.1` | `10.3.0` |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.102` | `1.0.104` |
| [rand_chacha](https://github.com/rust-random/rand) | `0.3.1` | `0.9.0` |
| [solana-sdk](https://github.com/anza-xyz/solana-sdk) | `3.0.0` | `4.0.1` |
| [solana-system-interface](https://github.com/anza-xyz/solana-sdk) | `2.0.0` | `3.1.0` |
| [bincode](https://github.com/bincode-org/bincode) | `1.3.3` | `3.0.0` |
| [secp256k1](https://github.com/rust-bitcoin/rust-secp256k1) | `0.30.0` | `0.31.1` |
| [sha3](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [prettyplease](https://github.com/dtolnay/prettyplease) | `0.2.37` | `0.3.0` |
| [progenitor](https://github.com/oxidecomputer/progenitor) | `0.11.2` | `0.12.0` |
| [quote](https://github.com/dtolnay/quote) | `1.0.45` | `1.0.47` |
| [syn](https://github.com/dtolnay/syn) | `2.0.117` | `3.0.2` |
| [proc-macro2](https://github.com/dtolnay/proc-macro2) | `1.0.106` | `1.0.107` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.11.1` | `1.12.1` |
| [progenitor-client](https://github.com/oxidecomputer/progenitor) | `0.11.2` | `0.12.0` |



Updates `reqwest` from 0.12.28 to 0.13.4
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.12.28...v0.13.4)

Updates `regress` from 0.10.5 to 0.11.1
- [Release notes](https://github.com/ridiculousfish/regress/releases)
- [Commits](ridiculousfish/regress@v0.10.5...v0.11.1)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `tokio` from 1.52.3 to 1.53.0
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.0)

Updates `uuid` from 1.23.3 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.3...v1.24.0)

Updates `base64` from 0.21.7 to 0.22.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.21.7...v0.22.1)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `hpke` from 0.12.0 to 0.13.0
- [Changelog](https://github.com/rozbb/rust-hpke/blob/main/CHANGELOG.md)
- [Commits](rozbb/rust-hpke@v0.12.0...v0.13.0)

Updates `rand` from 0.8.6 to 0.9.4
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.4/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.6...0.9.4)

Updates `spki` from 0.7.3 to 0.8.0
- [Commits](RustCrypto/formats@spki/v0.7.3...spki/v0.8.0)

Updates `der` from 0.7.10 to 0.8.1
- [Commits](RustCrypto/formats@der/v0.7.10...der/v0.8.1)

Updates `thiserror` from 2.0.18 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.19)

Updates `futures` from 0.3.32 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.33)

Updates `lru` from 0.16.4 to 0.18.1
- [Changelog](https://github.com/jeromefroe/lru-rs/blob/master/CHANGELOG.md)
- [Commits](jeromefroe/lru-rs@0.16.4...0.18.1)

Updates `alloy-primitives` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/alloy-rs/core/releases)
- [Changelog](https://github.com/alloy-rs/core/blob/main/CHANGELOG.md)
- [Commits](alloy-rs/core@v1.6.0...v1.6.1)

Updates `async-trait` from 0.1.89 to 0.1.91
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.89...0.1.91)

Updates `zeroize` from 1.8.2 to 1.9.0
- [Commits](RustCrypto/utils@zeroize-v1.8.2...zeroize-v1.9.0)

Updates `jsonwebtoken` from 9.3.1 to 10.3.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v9.3.1...v10.3.0)

Updates `anyhow` from 1.0.102 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.102...1.0.104)

Updates `rand_chacha` from 0.3.1 to 0.9.0
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@rand_chacha-0.3.1...0.9.0)

Updates `solana-sdk` from 3.0.0 to 4.0.1
- [Release notes](https://github.com/anza-xyz/solana-sdk/releases)
- [Commits](https://github.com/anza-xyz/solana-sdk/compare/sdk@v3.0.0...sdk@v4.0.1)

Updates `solana-system-interface` from 2.0.0 to 3.1.0
- [Release notes](https://github.com/anza-xyz/solana-sdk/releases)
- [Commits](https://github.com/anza-xyz/solana-sdk/compare/address@v2.0.0...msg@v3.1.0)

Updates `bincode` from 1.3.3 to 3.0.0
- [Commits](https://github.com/bincode-org/bincode/commits)

Updates `secp256k1` from 0.30.0 to 0.31.1
- [Changelog](https://github.com/rust-bitcoin/rust-secp256k1/blob/master/CHANGELOG.md)
- [Commits](rust-bitcoin/rust-secp256k1@secp256k1-0.30.0...secp256k1-0.31.1)

Updates `sha3` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha3-v0.10.9...sha3-v0.11.0)

Updates `prettyplease` from 0.2.37 to 0.3.0
- [Release notes](https://github.com/dtolnay/prettyplease/releases)
- [Commits](dtolnay/prettyplease@0.2.37...0.3.0)

Updates `progenitor` from 0.11.2 to 0.12.0
- [Changelog](https://github.com/oxidecomputer/progenitor/blob/main/CHANGELOG.adoc)
- [Commits](oxidecomputer/progenitor@v0.11.2...v0.12.0)

Updates `quote` from 1.0.45 to 1.0.47
- [Release notes](https://github.com/dtolnay/quote/releases)
- [Commits](dtolnay/quote@1.0.45...1.0.47)

Updates `syn` from 2.0.117 to 3.0.2
- [Release notes](https://github.com/dtolnay/syn/releases)
- [Commits](dtolnay/syn@2.0.117...3.0.2)

Updates `proc-macro2` from 1.0.106 to 1.0.107
- [Release notes](https://github.com/dtolnay/proc-macro2/releases)
- [Commits](dtolnay/proc-macro2@1.0.106...1.0.107)

Updates `bytes` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.11.1...v1.12.1)

Updates `futures-core` from 0.3.32 to 0.3.33
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.33)

Updates `progenitor-client` from 0.11.2 to 0.12.0
- [Changelog](https://github.com/oxidecomputer/progenitor/blob/main/CHANGELOG.adoc)
- [Commits](oxidecomputer/progenitor@v0.11.2...v0.12.0)

---
updated-dependencies:
- dependency-name: reqwest
  dependency-version: 0.13.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: regress
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: tokio
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: base64
  dependency-version: 0.22.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hpke
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: rand
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: spki
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: der
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: futures
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lru
  dependency-version: 0.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: alloy-primitives
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: async-trait
  dependency-version: 0.1.91
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zeroize
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: jsonwebtoken
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: rand_chacha
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: solana-sdk
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: solana-system-interface
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: bincode
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: secp256k1
  dependency-version: 0.31.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sha3
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: prettyplease
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: progenitor
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: quote
  dependency-version: 1.0.47
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: syn
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: proc-macro2
  dependency-version: 1.0.107
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: futures-core
  dependency-version: 0.3.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: progenitor-client
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 20, 2026
@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedtokio@​1.52.3 ⏵ 1.53.05810093100100
Updatedprogenitor@​0.11.2 ⏵ 0.12.01001009310070
Updatedprogenitor-client@​0.11.2 ⏵ 0.12.01001009310070
Updatedthiserror@​2.0.18 ⏵ 2.0.198010093100100
Addedreqwest@​0.13.48010093100100
Updatedproc-macro2@​1.0.106 ⏵ 1.0.1078010093100100
Updatedanyhow@​1.0.102 ⏵ 1.0.1048110093100100
Updatedserde@​1.0.228 ⏵ 1.0.2298110093100100
Updatedquote@​1.0.45 ⏵ 1.0.478210093100100
Updatedserde_json@​1.0.150 ⏵ 1.0.1518210093100100
Addedprettyplease@​0.3.08210093100100
Addedbincode@​3.0.010010093100100
Addedder@​0.8.110010093100100
Addedsha2@​0.11.010010093100100
Addedsolana-system-interface@​3.1.010010093100100
Addedspki@​0.8.010010093100100
Updatedalloy-primitives@​1.6.0 ⏵ 1.6.110010093100100
Updatedasync-trait@​0.1.89 ⏵ 0.1.9110010093100100
Updatedbytes@​1.11.1 ⏵ 1.12.110010093100100
Updatedfutures@​0.3.32 ⏵ 0.3.3310010093100100
Updatedfutures-core@​0.3.32 ⏵ 0.3.3310010093100100
Updatedlru@​0.16.4 ⏵ 0.18.110010093100100
Updatedsolana-sdk@​3.0.0 ⏵ 4.0.110010093100100
Updateduuid@​1.23.3 ⏵ 1.24.010010093100100
Updatedzeroize@​1.8.2 ⏵ 1.9.010010093100100
Updatedregress@​0.10.5 ⏵ 0.11.110010094 +1100100
Updatedjsonwebtoken@​9.3.1 ⏵ 10.3.0100100 +297100100
Updatedsyn@​2.0.117 ⏵ 3.0.2100 +1100100100100
Updatedhpke@​0.12.0 ⏵ 0.13.0100100100100100

View full report

@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: cargo tokio is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: Cargo.lock → cargo/tokio@1.53.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.53.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants