Bump the rust group across 1 directory with 19 updates by dependabot[bot] · Pull Request #50 · rhs2/bowline

dependabot · 2026-10-15T14:46:35Z

Bumps the rust group with 19 updates in the /api directory:

Package	From	To
axum	`0.7.9`	`0.8.9`
tokio	`1.53.1`	`1.53.2`
tower-http	`0.6.11`	`0.7.1`
sqlx	`0.8.6`	`0.9.0`
serde_json	`1.0.151`	`1.0.154`
uuid	`1.26.0`	`1.28.0`
rust_decimal	`1.42.1`	`1.43.0`
argon2	`0.5.3`	`0.6.0`
jsonwebtoken	`9.3.1`	`11.1.0`
rand	`0.8.8`	`0.10.2`
sha2	`0.10.9`	`0.11.0`
validator	`0.20.0`	`0.21.0`
thiserror	`2.0.20`	`2.0.21`
utoipa	`5.5.0`	`6.0.0`
utoipa-scalar	`0.2.0`	`0.4.0`
axum-prometheus	`0.7.0`	`0.10.1`
metrics	`0.23.1`	`0.24.6`
aws-config	`1.11.0`	`1.12.0`
redis	`0.27.6`	`1.7.1`

Updates axum from 0.7.9 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)

changed: Update minimum rust version to 1.80 (#3620)

fixed: Set connect endpoint on correct field in MethodRouter (#3656)

fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

axum v0.8.8

Clarify documentation for Router::route_layer (#3567)

#3567: tokio-rs/axum#3567

axum v0.8.7

Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#3555)

Make it easier to visually scan for default features (#3550)

Fix some documentation typos

#3550: tokio-rs/axum#3550 #3555: tokio-rs/axum#3555

axum v0.8.5

fixed: Reject JSON request bodies with trailing characters after the JSON document (#3453)

added: Implement OptionalFromRequest for Multipart (#3220)

added: Getter methods Location::{status_code, location}

added: Support for writing arbitrary binary data into server-sent events (#3425)]

added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#3469)

added: impl FusedStream for WebSocket (#3443)

changed: The sse module and Sse type no longer depend on the tokio feature (#3154)

changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#3377)

changed: Update minimum rust version to 1.78 (#3412)

#3154: tokio-rs/axum#3154 #3220: tokio-rs/axum#3220 #3377: tokio-rs/axum#3377 #3412: tokio-rs/axum#3412 #3425: tokio-rs/axum#3425 #3443: tokio-rs/axum#3443 #3453: tokio-rs/axum#3453 #3469: tokio-rs/axum#3469

axum v0.8.4

added: Router::reset_fallback (#3320)

added: WebSocketUpgrade::selected_protocol (#3248)

fixed: Panic location for overlapping method routes (#3319)

fixed: Don't leak a tokio task when using serve without graceful shutdown (#3129)

... (truncated)

Commits

c59208c revert axum-core changelog changes
99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
23d7098 Revert "axum-core 0.5.6"
e8a39ad axum-macros 0.5.1
6e9a249 axum-extra 0.12.6
0ec9041 axum 0.8.9
c3fcebb axum-core 0.5.6
a8790fc update release notes
26ba7bb docs: consolidate state management docs in crate root (#3683)
9fc59ef Update to tokio-tungstenite 0.29 (#3689)
Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)

io: revert "always cleanup AsyncFd registration list on deregister" (#8540)

process: unregister Windows wait before closing child handle (#8564)

rt: drop blocking pool mutex before shutting down rejected task (#8562)

sync: fix mpsc index wraparound in block reclamation (#8546)

sync: forget mpsc Permit before sending value (#8560)

sync: validate MAX_PERMITS in Semaphore::acquire (#8548)

sync: wake broadcast Sender::closed outside mutex (#8558)

task: drop replaced waker outside lock in JoinSet (#8554)

time: drop timer lock before dropping waker in clear_entry (#8552)

time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

fs: clamp io_uring read length to u32::MAX (#8572)

rt: ignore current_thread task dumps from other runtimes (#8544)

rt: preserve io_uring context if a completion waker panics (#8566)

sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)

taskdump: restore deferred leaf wakes during capture (#8445)

time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

ff0c406 chore: prepare Tokio v1.53.2 (#8580)
a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
ec31a9f chore: prepare Tokio v1.51.5 (#8579)
625c851 sync: assign semaphore permits before emitting tracing event (#8542)
832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
9a47992 process: unregister Windows wait before closing child handle (#8564)
2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
Additional commits viewable in compare view

Updates tower-http from 0.6.11 to 0.7.1

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)

fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)

request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (#718)

decompression: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered (#722)

decompression: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 (#712)

fs: multipart range requests are now rejected before range validation, so they consistently return 416 Range Not Satisfiable with a Cannot serve multipart range requests body instead of a generic unsatisfiable-range response (#661)

fs: range error responses no longer carry representation headers such as Content-Type and Content-Encoding (#727)

set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader are now Clone regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 (#714)

#661: tower-rs/tower-http#661 #712: tower-rs/tower-http#712 #714: tower-rs/tower-http#714 #716: tower-rs/tower-http#716 #718: tower-rs/tower-http#718 #722: tower-rs/tower-http#722 #727: tower-rs/tower-http#727 #728: tower-rs/tower-http#728

All the changes

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in tower-rs/tower-http#708

fix(compression): reject non-empty data frames after codec is EOF by @seanmonstar in tower-rs/tower-http#712

Remove Clone derivations from SetMultipleResponseHeader* types by @skeet70 in tower-rs/tower-http#714

feat(request-id): Allow request-id constructor in const context by @tottoto in tower-rs/tower-http#716

fs: Avoid unnecessary conversions between SystemTime and HttpDate by @tottoto in tower-rs/tower-http#717

fs: Use HeaderValue::is_empty to check for empty values by @tottoto in tower-rs/tower-http#720

fs: Use HeaderValue::to_str for date headers by @tottoto in tower-rs/tower-http#721

... (truncated)

Commits

c941451 chore(release): prepare 0.7.1 (#729)
9697702 chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)
e2582e2 Allow ignoring multi-range requests (#727)
888f7fe feat(services): configure directory redirects (#728)
5ad7654 chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)
d154adb fix: reject multipart ranges before validation (#661)
d9e5c8a ci: Update to cargo-check-external-types 0.5.0 (#724)
90c072b Propagate ServeDir::try_call I/O errors (#718)
860922e fix(decompression): don't end the body on an empty data frame (#722)
8532252 docs(example)/custom future with multiple bodies (#711)
Additional commits viewable in compare view

Updates sqlx from 0.8.6 to 0.9.0

Changelog

Sourced from sqlx's changelog.

0.9.0 - 2026-05-06

Important Announcements

New Github Organization

Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization: https://github.com/transact-rs/

This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been informally transferred to the collective ownership of its principal authors. Moving the repository to a new organization makes this change more clear, and also allows for potentially inviting outside collaborators.

Cargo.lock Removed from Tracking

The Cargo.lock has been removed from tracking in Git. CI should now always test with the latest versions of all dependencies by default, alongside our pass that checks with cargo generate-lockfile -Z minimal-versions.

This should eliminate the need for any PRs that update dependencies to also update Cargo.lock or contend with an endless stream of merge conflicts against it.

N.B. cargo install --locked sqlx-cli will no longer work. However, cargo install sqlx-cli has always used the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran cargo update sporadically, so relying on SQLx's lockfile offered few guarantees anyway.

See [the manual page for cargo install][man-cargo-install] for details.

Breaking

As per our MSRV policy, the supported Rust version for this release cycle is 1.94.0.

[#3383]: feat: create sqlx.toml format [[@abonander]]

SQLx and sqlx-cli now support per-crate configuration files (sqlx.toml)

New functionality includes, but is not limited to:

Rename DATABASE_URL for a crate (for multi-database workspaces)

Set global type overrides for the macros (supporting custom types)

Rename or relocate the _sqlx_migrations table (for multiple crates using the same database)

Set characters to ignore when hashing migrations (e.g. ignore whitespace)

More to be implemented in future releases.

Enable feature sqlx-toml to use.

sqlx-cli has it enabled by default, but sqlx does not.

Default features of library crates can be hard to completely turn off because of [feature unification], so it's better to keep the default feature set as limited as possible. [This is something we learned the hard way.][preferred-crates]

Guide: see sqlx::_config module in documentation.

Reference: [Link]

Examples (written for Postgres but can be adapted to other databases; PRs welcome!):

Multiple databases using DATABASE_URL renaming and global type overrides: [Link]

Multi-tenant database using _sqlx_migrations renaming and multiple schemas: [Link]

Force use of chrono when time is enabled (e.g. when using tower-sessions-sqlx-store): [[Link][preferred-crates]]

Forcing bigdecimal when rust_decimal is enabled is also shown, but problems with chrono/time are more common.

... (truncated)

Commits

75bc048 Release 0.9.0 (#4256)
6956cef Prefer to give real data to .bind() in README.md (#4257)
45ba990 Add the possibility to skip migrations (#3846)
66533fa Ensure Deterministic Migration Order (#4136)
db47fe3 ci: check direct minimal versions (#4173)
9ecb76d Unescape PostgreSQL passfile password (#3993)
c0a3218 breaking(any+mysql): correctly convert text and blob types to AnyTypeInfo (...
d82b781 test(sqlite): add regression test for ORDER BY + LIMIT nullability (#4223)
b77ba16 chore: update to axum 0.8 (#4253)
c0ec9c0 fix(tls): potential deadlock in StdSocket::poll_ready() (#4251)
Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

Support preserve_order in no_std builds (#1333, thanks @razmser)

v1.0.153

Report invalid UTF-8 at the first bad byte (#1345, thanks @00200200)

v1.0.152

Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @yuxi-liu-wired)

Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @yuxi-liu-wired)

Commits

20572a6 Release 1.0.154
a91bfaf Fix RandomState links in map documentation
3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
4b2d726 Release 1.0.153
83335ee Touch up PR 1345
4b4810a Resolve range_plus_one pedantic clippy lint
8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
c9f1e3b Release 1.0.152
854fc70 Touch up PR 1347
Additional commits viewable in compare view

Updates uuid from 1.26.0 to 1.28.0

Release notes

Sourced from uuid's releases.

v1.28.0

What's Changed

Add optional serde format adapters by @RanaPriyansh in uuid-rs/uuid#916

Prepare for 1.28.0 release by @KodrAus in uuid-rs/uuid#918

New Contributors

@RanaPriyansh made their first contribution in uuid-rs/uuid#916

Full Changelog: uuid-rs/uuid@v1.27.0...v1.28.0

v1.27.0

What's Changed

Accept case-insensitive urn:uuid: prefixes when parsing by @jaideeppyne in uuid-rs/uuid#912

Fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos by @KodrAus in uuid-rs/uuid#915

Prepare for 1.27.0 release by @KodrAus in uuid-rs/uuid#917

New Contributors

@jaideeppyne made their first contribution in uuid-rs/uuid#912

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

v1.26.1

What's Changed

Seat the v7 counter below the version nibble by @lenamonj in uuid-rs/uuid#907

Don't panic in overflowing Timestamp to SystemTime conversion by @KodrAus in uuid-rs/uuid#909

Prepare for 1.26.1 release by @KodrAus in uuid-rs/uuid#910

New Contributors

@lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

Commits

276c236 Merge pull request #918 from uuid-rs/cargo/v1.28.0
4b3b9f5 prepare for 1.28.0 release
cbf9c81 Merge pull request #916 from RanaPriyansh/fix/optional-serde-adapters-840
784a022 Inline expected tokens in optional compact serde test
a5678c3 Simplify optional serde adapter tests to option tokens
638a518 Refactor optional serde adapter tests and share byte wrapper
b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
ffd8ec5 prepare for 1.27.0 release
654fa5b Add optional serde format adapters
4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
Additional commits viewable in compare view

Updates rust_decimal from 1.42.1 to 1.43.0

Release notes

Sourced from rust_decimal's releases.

1.43.0

What's Changed

Accumulated fixes backported from master by @paupino in paupino/rust-decimal#808

Various performance improvements by @paupino in paupino/rust-decimal#809

General clippy cleanup by @paupino in paupino/rust-decimal#813

Require rust_decimal_macros >=1.37 to avoid circular dependency by @momomuchu in paupino/rust-decimal#814

fix: add negative sign for array_string by @flisky in paupino/rust-decimal#823

Remove rkyv 0.7 from feature bridge and update rand 0.8 support by @paupino in paupino/rust-decimal#819

New Contributors

@momomuchu made their first contribution in paupino/rust-decimal#814

@flisky made their first contribution in paupino/rust-decimal#823

Full Changelog: paupino/rust-decimal@1.42.1...1.43.0

Commits

8592462 version 1.43.0
9be5917 Remove rkyv 0.7 from feature bridge and update rand 0.8 support (#819)
f017c8b Merge pull request #823 from flisky/v1
93bd26f fix: add negative sign for array_string
5c3bf3b Merge pull request #814 from momomuchu/fix/rust-decimal-macros-minimal-versio...
fe55209 fix: require rust_decimal_macros >=1.37 to avoid circular dependency
551be15 General clippy cleanup (#813)
f7272b5 Various performance improvements (#809)
b363729 Accumulated fixes backported from master (#808)
See full diff in compare view

Updates argon2 from 0.5.3 to 0.6.0

Commits

b1e0ad6 argon2 v0.6.0 (#931)
c0d2aca argon2: bump blake2 to v0.11 (#929)
d9c628b Cargo.lock: bump dependencies (#930)
0b31c1c Cargo.toml: use password-hash crate release (#920)
420cbc9 build(deps): bump rust-lang/crates-io-auth-action from 1.0.4 to 1.0.5 (#912)
3a88540 build(deps): bump actions/checkout from 6 to 7 (#913)
90b974f build(deps): bump the all-deps group with 5 updates (#914)
82c688f build(deps): bump the all-deps group across 1 directory with 18 updates (#911)
b2cef17 build(deps): bump the all-deps group with 6 updates (#902)
2c16e5a build(deps): bump the all-deps group with 7 updates (#901)
Additional commits viewable in compare view

Updates jsonwebtoken from 9.3.1 to 11.1.0

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

Add dangerous::insecure_decode_claims

11.0.0 (2026-07-24)

Add conversions between Algorithm and KeyAlgorithm

JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well

JWKs with unknown key types are now deserializable

BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive

BREAKING: Jwk.thumbprint now returns a Result<_>

BREAKING: Header.extras is now a struct that allows for deserialization to any T

BREAKING: Implicit features resulting from optional crates have been removed

BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead

BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed

BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

When constructing HMAC signers, the algorithm family must now be verified on construction

JwkUtils has been renamed to KeyUtils

compute_digest now returns a Result<_>

extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key

rsa_pub_components_from_public_key has been added

extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key

ed_pub_components_from_private_key has been added

10.4.0 (2026-05-11)

Fix incorrect encoding for Ed25519 JWK thumbprints

Make Algorithm.family public and add Validation.new_for_family

EncodingKey and DecodingKey are now partially zeroized on drop (the intermediate PemEncodedKey isn't so far)

10.3.0 (2026-01-27)

Export everything needed to define your own CryptoProvider

Fix type confusion with exp/nbf when not required

10.2.0 (2025-11-06)

Remove Clone bound from decode functions

10.1.0 (2025-10-18)

add dangerous::insecure_decode

Implement TryFrom &Jwk for DecodingKey

10.0.0 (2025-09-29)

BREAKING: now using traits for crypto backends, you have to choose between aws_lc_rs and rust_crypto

... (truncated)

Commits

4c0ae75 Ready for release
46690b5 Add insecure_decode_claims (#539)
900010f Bump v11
6aac5ae Allow deserializing unknown key type JWKs (#530)
e7ea8f0 Implement Default on JwkSet (#527)
249f5f7 Don't panic when computing thumbprint (#524)
b5d9c38 Prepare for v11 release (#522)
6086da7 Unify encoding and decoding key APIs (#515)
474728f Remove deprecated insecure_disable_signature_validation (#521)
31a1dc6 Feat: Added support for JWK decoding Ed25519 keys (#506)
Additional commits viewable in compare view

Updates rand from 0.8.8 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

Document required output order of fn partial_shuffle and apply #[must_use] (#1769)

Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

Document panic behavior of make_rng and add #[track_caller] (#1761)

Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).

Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)

Use Edition 2024 and MSRV 1.85 (#1653)

Let Fill be implemented for element types, not sliceable types (#1652)

Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)

Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)

Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)

Remove Clone support for StdRng, ReseedingRng (#1677)

Use postcard instead of bincode to test the serde feature (#1693)

Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)

Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)

Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)

Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)

Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)

Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

Removed ReseedingRng (#1722)

Removed unused feature "nightly" (#1732)

Removed feature small_rng (#1732)

... (truncated)

Commits

1540ea3 Prepare rand 0.10.2 (#1800)
a29964a Bump chacha20 from 0.10.0 to 0.10.1 in the all-deps group (#1801)
ced9491 Tweak docs for RngExt::random_range and SampleRange (#1798)
db14664 Check UniformChar validity on deser (#1790)
bea8620 Bump the all-deps group with 2 updates (#1796)
4f44932 Bump actions/cache from 5 to 6 (#1795)
b999a13 Bump actions/checkout from 6 to 7 (#1794)
aeab810 Avoid unsafe where safety depends on non-local values (#1791)
1896d7c Add typos CI job (#1789)
43eddee Bump the all-deps group with 2 updates (

Bumps the rust group with 19 updates in the /api directory: | Package | From | To | | --- | --- | --- | | [axum](https://github.com/tokio-rs/axum) | `0.7.9` | `0.8.9` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [tower-http](https://github.com/tower-rs/tower-http) | `0.6.11` | `0.7.1` | | [sqlx](https://github.com/launchbadge/sqlx) | `0.8.6` | `0.9.0` | | [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` | | [uuid](https://github.com/uuid-rs/uuid) | `1.26.0` | `1.28.0` | | [rust_decimal](https://github.com/paupino/rust-decimal) | `1.42.1` | `1.43.0` | | [argon2](https://github.com/RustCrypto/password-hashes) | `0.5.3` | `0.6.0` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `9.3.1` | `11.1.0` | | [rand](https://github.com/rust-random/rand) | `0.8.8` | `0.10.2` | | [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` | | [validator](https://github.com/Keats/validator) | `0.20.0` | `0.21.0` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.20` | `2.0.21` | | [utoipa](https://github.com/juhaku/utoipa) | `5.5.0` | `6.0.0` | | [utoipa-scalar](https://github.com/juhaku/utoipa) | `0.2.0` | `0.4.0` | | [axum-prometheus](https://github.com/Ptrskay3/axum-prometheus) | `0.7.0` | `0.10.1` | | [metrics](https://github.com/metrics-rs/metrics) | `0.23.1` | `0.24.6` | | [aws-config](https://github.com/smithy-lang/smithy-rs) | `1.11.0` | `1.12.0` | | [redis](https://github.com/redis-rs/redis-rs) | `0.27.6` | `1.7.1` | Updates `axum` from 0.7.9 to 0.8.9 - [Release notes](https://github.com/tokio-rs/axum/releases) - [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md) - [Commits](tokio-rs/axum@axum-v0.7.9...axum-v0.8.9) Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.2) Updates `tower-http` from 0.6.11 to 0.7.1 - [Release notes](https://github.com/tower-rs/tower-http/releases) - [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.1) Updates `sqlx` from 0.8.6 to 0.9.0 - [Changelog](https://github.com/transact-rs/sqlx/blob/main/CHANGELOG.md) - [Commits](transact-rs/sqlx@v0.8.6...v0.9.0) Updates `serde_json` from 1.0.151 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.151...v1.0.154) Updates `uuid` from 1.26.0 to 1.28.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.26.0...v1.28.0) Updates `rust_decimal` from 1.42.1 to 1.43.0 - [Release notes](https://github.com/paupino/rust-decimal/releases) - [Changelog](https://github.com/paupino/rust-decimal/blob/master/CHANGELOG.md) - [Commits](paupino/rust-decimal@1.42.1...1.43.0) Updates `argon2` from 0.5.3 to 0.6.0 - [Commits](RustCrypto/password-hashes@argon2-v0.5.3...argon2-v0.6.0) Updates `jsonwebtoken` from 9.3.1 to 11.1.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v9.3.1...v11.1.0) Updates `rand` from 0.8.8 to 0.10.2 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](rust-random/rand@0.8.8...0.10.2) Updates `sha2` from 0.10.9 to 0.11.0 - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0) Updates `validator` from 0.20.0 to 0.21.0 - [Changelog](https://github.com/Keats/validator/blob/master/CHANGELOG.md) - [Commits](https://github.com/Keats/validator/commits) Updates `thiserror` from 2.0.20 to 2.0.21 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.20...2.0.21) Updates `utoipa` from 5.5.0 to 6.0.0 - [Release notes](https://github.com/juhaku/utoipa/releases) - [Changelog](https://github.com/juhaku/utoipa/blob/master/utoipa-rapidoc/CHANGELOG.md) - [Commits](juhaku/utoipa@utoipa-5.5.0...utoipa-6.0.0) Updates `utoipa-scalar` from 0.2.0 to 0.4.0 - [Release notes](https://github.com/juhaku/utoipa/releases) - [Changelog](https://github.com/juhaku/utoipa/blob/master/utoipa-rapidoc/CHANGELOG.md) - [Commits](juhaku/utoipa@utoipa-scalar-0.2.0...utoipa-scalar-0.4.0) Updates `axum-prometheus` from 0.7.0 to 0.10.1 - [Release notes](https://github.com/Ptrskay3/axum-prometheus/releases) - [Changelog](https://github.com/Ptrskay3/axum-prometheus/blob/master/CHANGELOG.md) - [Commits](Ptrskay3/axum-prometheus@0.7.0...0.10.1) Updates `metrics` from 0.23.1 to 0.24.6 - [Changelog](https://github.com/metrics-rs/metrics/blob/main/release.toml) - [Commits](metrics-rs/metrics@metrics-v0.23.1...metrics-v0.24.6) Updates `aws-config` from 1.11.0 to 1.12.0 - [Release notes](https://github.com/smithy-lang/smithy-rs/releases) - [Changelog](https://github.com/smithy-lang/smithy-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-rs/commits) Updates `redis` from 0.27.6 to 1.7.1 - [Release notes](https://github.com/redis-rs/redis-rs/releases) - [Commits](redis-rs/redis-rs@redis-0.27.6...redis-1.7.1) --- updated-dependencies: - dependency-name: axum dependency-version: 0.8.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust - dependency-name: tower-http dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: sqlx dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust - dependency-name: uuid dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: rust_decimal dependency-version: 1.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: argon2 dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: jsonwebtoken dependency-version: 11.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust - dependency-name: rand dependency-version: 0.10.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: validator dependency-version: 0.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: thiserror dependency-version: 2.0.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: rust - dependency-name: utoipa dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust - dependency-name: utoipa-scalar dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: axum-prometheus dependency-version: 0.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: metrics dependency-version: 0.24.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: aws-config dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: rust - dependency-name: redis dependency-version: 1.7.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: rust ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 15, 2026

Navigation Menu

Repository navigation

Bump the rust group across 1 directory with 19 updates - #50

Bump the rust group across 1 directory with 19 updates#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/api/rust-94d63c8a75

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026

axum-v0.8.9

axum v0.8.8

axum v0.8.7

axum v0.8.5

axum v0.8.4

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

Fixed (unstable)

tower-http-0.7.1

Added

Changed

Fixed

All the changes

0.9.0 - 2026-05-06

Important Announcements

New Github Organization

Cargo.lock Removed from Tracking

Breaking

v1.0.154

v1.0.153

v1.0.152

v1.28.0

What's Changed

New Contributors

v1.27.0

What's Changed

New Contributors

v1.26.1

What's Changed

New Contributors

1.43.0

What's Changed

New Contributors

11.1.0 (2026-09-16)

11.0.0 (2026-07-24)

Changes for CryptoProviders

10.4.0 (2026-05-11)

10.3.0 (2026-01-27)

10.2.0 (2025-11-06)

10.1.0 (2025-10-18)

10.0.0 (2025-09-29)

[0.10.2] — 2026-07-02

Fixes

Changes

[0.10.1] — 2026-02-11

Changes

[0.10.0] - 2026-02-08

Changes

Additions

Removals

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`Cargo.lock` Removed from Tracking

Changes for `CryptoProvider`s