Skip to content

build(deps): bump the rust-dependencies group with 10 updates - #3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-a38cfe2d35
Open

build(deps): bump the rust-dependencies group with 10 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-a38cfe2d35

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown

Bumps the rust-dependencies group with 10 updates:

Package From To
axum 0.7.9 0.8.9
base64 0.22.1 0.23.0
ed25519-dalek 2.2.0 3.0.0
hmac 0.12.1 0.13.0
sha2 0.10.9 0.11.0
sha1 0.10.7 0.11.0
thiserror 1.0.69 2.0.19
toml 0.8.23 1.1.3+spec-1.1.0
tower-http 0.5.2 0.6.11
rusqlite 0.32.1 0.40.1

Updates axum from 0.7.9 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

axum v0.8.8

  • Clarify documentation for Router::route_layer (#3567)

#3567: tokio-rs/axum#3567

axum v0.8.7

  • Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#3555)
  • Make it easier to visually scan for default features (#3550)
  • Fix some documentation typos

#3550: tokio-rs/axum#3550 #3555: tokio-rs/axum#3555

axum v0.8.5

  • fixed: Reject JSON request bodies with trailing characters after the JSON document (#3453)
  • added: Implement OptionalFromRequest for Multipart (#3220)
  • added: Getter methods Location::{status_code, location}
  • added: Support for writing arbitrary binary data into server-sent events (#3425)]
  • added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#3469)
  • added: impl FusedStream for WebSocket (#3443)
  • changed: The sse module and Sse type no longer depend on the tokio feature (#3154)
  • changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#3377)
  • changed: Update minimum rust version to 1.78 (#3412)

#3154: tokio-rs/axum#3154 #3220: tokio-rs/axum#3220 #3377: tokio-rs/axum#3377 #3412: tokio-rs/axum#3412 #3425: tokio-rs/axum#3425 #3443: tokio-rs/axum#3443 #3453: tokio-rs/axum#3453 #3469: tokio-rs/axum#3469

axum v0.8.4

  • added: Router::reset_fallback (#3320)
  • added: WebSocketUpgrade::selected_protocol (#3248)
  • fixed: Panic location for overlapping method routes (#3319)
  • fixed: Don't leak a tokio task when using serve without graceful shutdown (#3129)

... (truncated)

Commits

Updates base64 from 0.22.1 to 0.23.0

Changelog

Sourced from base64's changelog.

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • 9d21a59 Merge pull request #304 from marshallpierce/mp/custom-padding-rebase
  • f70bad2 Support custom padding symbols
  • 684d79c Merge pull request #301 from marshallpierce/mp/simd-gardening
  • 5bf66f2 Merge pull request #284 from AbeZbm/add-tests
  • d3831cf Followups to SIMD work
  • Additional commits viewable in compare view

Updates ed25519-dalek from 2.2.0 to 3.0.0

Changelog

Sourced from ed25519-dalek's changelog.

3.0.0

  • Update the digest dependency to 0.9. This requires a major version because the digest traits are part of the public API, but there are otherwise no changes to the API.

2.1.0

  • Make Scalar::from_bits a const fn, allowing its use in const contexts.

2.0.0

  • Fix a data modeling error in the serde feature pointed out by Trevor Perrin which caused points and scalars to be serialized with length fields rather than as fixed-size 32-byte arrays. This is a breaking change, but it fixes compatibility with serde-json and ensures that the serde-bincode encoding matches the conventional encoding for X/Ed25519.
  • Update rand_core to 0.5, allowing use with new rand versions.
  • Switch from clear_on_drop to zeroize (by Tony Arcieri).
  • Require subtle = ^2.2.1 and remove the note advising nightly Rust, which is no longer required as of that version of subtle. See the subtle changelog for more details.
  • Update README.md for 2.x series.
  • Remove the build.rs hack which loaded the entire crate into its own build.rs to generate constants, and keep the constants in the source code.

The only significant change is the data model change to the serde feature; besides the rand_core version bump, there are no other user-visible changes.

1.2.4

  • Specify a semver bound for clear_on_drop rather than an exact version, addressing an issue where changes to inline assembly in rustc prevented clear_on_drop from working without an update.

1.2.3

  • Fix an issue identified by a Quarkslab audit (and Jack Grigg), where manually constructing unreduced Scalar values, as needed for X/Ed25519, and then performing scalar/scalar arithmetic could compute incorrect results.
  • Switch to upstream Rust intrinsics for the IFMA backend now that they exist in Rust and don't need to be defined locally.
  • Ensure that the NAF computation works correctly, even for parameters never used elsewhere in the codebase.
  • Minor refactoring to EdwardsPoint decompression.
  • Fix broken links in documentation.
  • Fix compilation on nightly broken due to changes to the #[doc(include)] path root (not quite correctly done in 1.2.2).

1.2.2

... (truncated)

Commits
  • 6d96eb7 Bump version to 3.0.0.
  • c68b30f Merge pull request #330 from isislovecruft/fix/move-coc
  • 2ee6193 Merge pull request #327 from huitseeker/digests-0.9
  • 91a0fae Move CoC section from CONTRIBUTING.md to new file.
  • 5038fcf Merge pull request #308 from isislovecruft/fix/pippenger-typo
  • 6afd8ff Update sha2, digest to 0.9
  • 3cc13a7 Merge branch 'master' into develop
  • c4824e1 Merge branch 'release/2.1.0'
  • 3fc47ef Bump version to 2.1.0
  • f04b830 Merge branch 'master' into develop
  • Additional commits viewable in compare view

Updates hmac from 0.12.1 to 0.13.0

Commits

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates sha1 from 0.10.7 to 0.11.0

Commits

Updates thiserror from 1.0.69 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

  • Update to syn 3

2.0.18

2.0.17

  • Use differently named __private module per patch release (#434)

2.0.16

  • Add to "no-std" crates.io category (#429)

2.0.15

  • Prevent Error::provide API becoming unavailable from a future new compiler lint (#427)

2.0.14

  • Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#426)

2.0.13

  • Documentation improvements

2.0.12

  • Prevent elidable_lifetime_names pedantic clippy lint in generated impl (#413)

2.0.11

2.0.10

  • Support errors containing a generic type parameter's associated type in a field (#408)

2.0.9

  • Work around missing_inline_in_public_items clippy restriction being triggered in macro-generated code (#404)

2.0.8

  • Improve support for macro-generated derive(Error) call sites (#399)

2.0.7

  • Work around conflict with #[deny(clippy::allow_attributes)] (#397, thanks @​zertosh)

2.0.6

  • Suppress deprecation warning on generated From impls (#396)

2.0.5

  • Prevent deprecation warning on generated impl for deprecated type (#394)

2.0.4

  • Eliminate needless_lifetimes clippy lint in generated From impls (#391, thanks @​matt-phylum)

2.0.3

  • Support the same Path field being repeated in both Debug and Display representation in error message (#383)

... (truncated)

Commits
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
  • c50e387 chore: improve thiserror maintenance path
  • d4a2507 Raise minimum tested compiler to rust 1.85
  • 99e8a6c Unpin CI miri toolchain
  • 9ac165c Pin CI miri to nightly-2026-02-11
  • Additional commits viewable in compare view

Updates toml from 0.8.23 to 1.1.3+spec-1.1.0

Commits

Updates tower-http from 0.5.2 to 0.6.11

Release notes

Sourced from tower-http's releases.

tower-http-0.6.11

Added

  • set-header: add SetMultipleResponseHeadersLayer and SetMultipleResponseHeader for setting multiple response headers at once. Supports overriding, appending, and if_not_present modes. Header values can be fixed or computed dynamically via closures (#672)

    use http::{Response, header::{self, HeaderValue}};
use http_body::Body as _;
use tower_http::set_header::response::SetMultipleResponseHeadersLayer;
let layer = SetMultipleResponseHeadersLayer::overriding(vec![
(header::X_FRAME_OPTIONS, HeaderValue::from_static("DENY")).into(),
(header::CONTENT_LENGTH, |res: &Response<MyBody>| {
res.body().size_hint().exact()
.map(|size| HeaderValue::from_str(&size.to_string()).unwrap())
}).into(),
]);

  • set-header: add SetMultipleRequestHeadersLayer and SetMultipleRequestHeaders for setting multiple request headers at once, mirroring the response-side API (#677)

  • classify: add From<i32> and From<NonZeroI32> impls for GrpcCode. Unrecognized status codes map to GrpcCode::Unknown (#506)

Changed

  • compression: compress application/grpc-web responses. Previously all application/grpc* content types were excluded from compression; now only application/grpc (non-web) is excluded (#408)

Fixed

  • fs: fix ServeDir returning 500 instead of 405 for non-GET/HEAD requests when call_fallback_on_method_not_allowed is enabled but no fallback service is configured (#587)
  • fs: remove duplicate cfg attribute on is_reserved_dos_name (#675)

#408: tower-rs/tower-http#408 #506: tower-rs/tower-http#506 #587: tower-rs/tower-http#587 #672: tower-rs/tower-http#672 #675: tower-rs/tower-http#675 #677: tower-rs/tower-http#677

All PRs

... (truncated)

Commits
  • 1d082ef v0.6.11
  • 9c3117d feat: set multiple request header (#677)
  • 667e7c7 Remove duplicate cfg attribute for is_reserved_dos_name (#675)
  • 7551a9b feat(set_header): refactor and improve multiple header middleware (#672)
  • 991e9ee add From<i32> impl for GrpcCode (#506)
  • 3962dba Do compress grpc-web responses (#408)
  • f0b3bb6 Fix serve_dir method not allowed handling when no fallback is configured (#587)
  • d1a571b ci: use static timeout in stress-test workflow (#671)
  • 309555a ci: fix flaky encoding test, add nightly stress test job (#670)
  • 4532fc2 v0.6.10
  • Additional commits viewable in compare view

Updates rusqlite from 0.32.1 to 0.40.1

Release notes

Sourced from rusqlite's releases.

0.40.1

What's Changed

  • Fix clippy warnings #1852
  • Bump bundled SQLite version to 3.53.2 #1853
  • Bump hashlink version #1855
  • Fix SQL injection when SAVEPOINT name is tainted #1854

Full Changelog: rusqlite/rusqlite@v0.40.0...v0.40.1

0.40.0

What's Changed

  • Breaking changes: Replace VTab macros by constructors #1823
  • Breaking changes: Fix VTab::best_index #1824
  • Asserts on VTab::connect aux and args #1825
  • Breaking changes: Fix VTab::connect / create #1826
  • Breaking changes: Allow opting out of using sqlite-wasm-rs on wasm32-unknown-unknown #1828, #1829
  • Derive Default for SeriesTabCursor/ArrayTabCursor #1830
  • Update link to pre-update hook #1831
  • Breaking changes: Fix VTab::connect #1832
  • impl From for FromSqlError #1833
  • Breaking changes: Fix vtab::dequote #1835
  • Bump bundled SQLCipher to version 4.14.0 #1837
  • sqlite3_set_errmsg #1752
  • Bump sqlite3-parser version #1838
  • Fix UB in ToSqlOutput::from_rc #1839
  • Ensure miri doesn't complain #1840
  • Bump to actions/checkout@v6 #1842
  • Add support to UtcDateTime #1843, #1844
  • Bump bundled SQLite version to 3.53.1 #1848
  • Replace some cfg(not by cfg_select #1850

Full Changelog: rusqlite/rusqlite@v0.39.0...v0.40.0

0.39.0

What's Changed

  • Fix constraints on VTab Aux data #1778, #1771
  • Fix docs.rs generation #1779
  • Fix a small typo in rollback_hook docstring #1780
  • Fix some warnings from Intellij #1781
  • Minimal doc for features #1783
  • Clear hooks only for owning connections #1785, #1784
  • Fix link to SQLite C Interface, Prepare Flags #1787
  • Comment functions which are not usable from a loadable extension #1789
  • Factorize code #1792
  • Update getrandom to 0.4 #1798
  • Update Cargo.toml #1800
  • Fix appveyor #1807
  • Add support to unix timestamp for chrono, jiff and time #1808, #1803
  • fix(trace): check that the sql string pointer is not NULL #1805
  • Bump bundled SQLite version to 3.51.3 #1818

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the rust-dependencies group with 10 updates
2c8ce54 
Bumps the rust-dependencies group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [axum](https://github.com/tokio-rs/axum) | `0.7.9` | `0.8.9` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.0` |
| [ed25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) | `2.2.0` | `3.0.0` |
| [hmac](https://github.com/RustCrypto/MACs) | `0.12.1` | `0.13.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [sha1](https://github.com/RustCrypto/hashes) | `0.10.7` | `0.11.0` |
| [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.19` |
| [toml](https://github.com/toml-rs/toml) | `0.8.23` | `1.1.3+spec-1.1.0` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.5.2` | `0.6.11` |
| [rusqlite](https://github.com/rusqlite/rusqlite) | `0.32.1` | `0.40.1` |


Updates `axum` from 0.7.9 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.9)

Updates `base64` from 0.22.1 to 0.23.0
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.0)

Updates `ed25519-dalek` from 2.2.0 to 3.0.0
- [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases)
- [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/3.0.0/CHANGELOG.md)
- [Commits](dalek-cryptography/curve25519-dalek@ed25519-2.2.0...3.0.0)

Updates `hmac` from 0.12.1 to 0.13.0
- [Commits](RustCrypto/MACs@hmac-v0.12.1...hmac-v0.13.0)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `sha1` from 0.10.7 to 0.11.0
- [Commits](RustCrypto/hashes@sha1-v0.10.7...sha1-v0.11.0)

Updates `thiserror` from 1.0.69 to 2.0.19
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@1.0.69...2.0.19)

Updates `toml` from 0.8.23 to 1.1.3+spec-1.1.0
- [Commits](toml-rs/toml@toml-v0.8.23...toml-v1.1.3)

Updates `tower-http` from 0.5.2 to 0.6.11
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.5.2...tower-http-0.6.11)

Updates `rusqlite` from 0.32.1 to 0.40.1
- [Release notes](https://github.com/rusqlite/rusqlite/releases)
- [Changelog](https://github.com/rusqlite/rusqlite/blob/master/Changelog.md)
- [Commits](rusqlite/rusqlite@v0.32.1...v0.40.1)

---
updated-dependencies:
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: base64
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: ed25519-dalek
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: hmac
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: sha1
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.19
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: toml
  dependency-version: 1.1.3+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: tower-http
  dependency-version: 0.6.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rusqlite
  dependency-version: 0.40.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants