Repository navigation
Commit ef776c7
![endform-renovate[bot]](https://avatars.githubusercontent.com/u/183991818?v=4&size=40){kind=avatar}
fix(deps): update rust minor and patch (#7)
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
| [anyhow](https://redirect.github.com/dtolnay/anyhow) |
workspace.dependencies | patch | `1.0.102` → `1.0.104` | |
| [async-trait](https://redirect.github.com/dtolnay/async-trait) |
workspace.dependencies | patch | `0.1.86` → `0.1.92` | |
| [chrono](https://redirect.github.com/chronotope/chrono) | dependencies
| patch | `0.4` → `0.4.45` | |
| [clap](https://redirect.github.com/clap-rs/clap) | dependencies |
patch | `4.6.1` → `4.6.7` | |
| [clap_complete](https://redirect.github.com/clap-rs/clap) |
dependencies | patch | `4.6.5` → `4.6.11` | |
| [env_logger](https://redirect.github.com/rust-cli/env_logger) |
dependencies | patch | `0.11.10` → `0.11.11` | |
| [flate2](https://redirect.github.com/rust-lang/flate2-rs) |
dependencies | patch | `1.1.9` → `1.1.10` | |
| [futures](https://rust-lang.github.io/futures-rs)
([source](https://redirect.github.com/rust-lang/futures-rs)) |
workspace.dependencies | patch | `0.3.32` → `0.3.34` | |
| [getrandom](https://redirect.github.com/rust-random/getrandom) |
dependencies | patch | `0.4.2` → `0.4.3` | |
| [hickory-resolver](https://hickory-dns.org/)
([source](https://redirect.github.com/hickory-dns/hickory-dns)) |
dependencies | patch | `0.26.1` → `0.26.3` | |
| [hickory-server](https://hickory-dns.org/)
([source](https://redirect.github.com/hickory-dns/hickory-dns)) |
dependencies | patch | `0.26.1` → `0.26.3` | |
| [http](https://redirect.github.com/hyperium/http) | dependencies |
minor | `1` → `1.5.0` | |
| [http](https://redirect.github.com/hyperium/http) |
workspace.dependencies | minor | `1.4.0` → `1.5.0` | |
| [http-body](https://redirect.github.com/hyperium/http-body) |
dependencies | minor | `1.0.1` → `1.1.0` | |
| [hyper-rustls](https://redirect.github.com/rustls/hyper-rustls) |
dependencies | patch | `0.27.9` → `0.27.10` | |
| [hyper-util](https://hyper.rs)
([source](https://redirect.github.com/hyperium/hyper-util)) |
dependencies | patch | `0.1.10` → `0.1.21` | |
| [indicatif](https://redirect.github.com/console-rs/indicatif) |
dependencies | patch | `0.18.4` → `0.18.6` | |
| [log](https://redirect.github.com/rust-lang/log) | dependencies |
patch | `0.4.29` → `0.4.34` | |
| [percent-encoding](https://redirect.github.com/servo/rust-url) |
dependencies | patch | `2.1.0` → `2.3.2` | |
| [rand](https://rust-random.github.io/book)
([source](https://redirect.github.com/rust-random/rand)) |
workspace.dependencies | patch | `0.10.1` → `0.10.3` | |
| [rcgen](https://redirect.github.com/rustls/rcgen) | dependencies |
patch | `0.14.8` → `0.14.10` | |
| [regex](https://redirect.github.com/rust-lang/regex) |
workspace.dependencies | minor | `1.12.3` → `1.13.1` | |
| [reqwest](https://redirect.github.com/seanmonstar/reqwest) |
workspace.dependencies | patch | `0.13.2` → `0.13.5` | |
| [rustls](https://redirect.github.com/rustls/rustls) |
workspace.dependencies | patch | `0.23.40` → `0.23.45` | |
|
[rustls-native-certs](https://redirect.github.com/rustls/rustls-native-certs)
| dependencies | patch | `0.8.3` → `0.8.4` | |
| [serde](https://serde.rs)
([source](https://redirect.github.com/serde-rs/serde)) | dependencies |
patch | `1.0` → `1.0.229` | |
| [serde](https://serde.rs)
([source](https://redirect.github.com/serde-rs/serde)) |
workspace.dependencies | patch | `1.0.228` → `1.0.229` | |
| [serde_json](https://redirect.github.com/serde-rs/json) | dependencies
| patch | `1.0` → `1.0.151` | `1.0.154` (+2) |
| [serde_json](https://redirect.github.com/serde-rs/json) |
workspace.dependencies | patch | `1.0.149` → `1.0.151` | `1.0.154` (+2)
|
| [serde_with](https://redirect.github.com/jonasbb/serde_with) |
dependencies | minor | `3` → `3.24.0` | |
| [serde_yaml](https://redirect.github.com/dtolnay/serde-yaml) |
dependencies | patch | `0.9.34-deprecated` → `0.9.34` | |
| [sysinfo](https://redirect.github.com/GuillaumeGomez/sysinfo) |
dependencies | patch | `0.39.1` → `0.39.6` | |
| [tar](https://redirect.github.com/composefs/tar-rs) | dependencies |
patch | `0.4.45` → `0.4.46` | |
| [thiserror](https://redirect.github.com/dtolnay/thiserror) |
dependencies | patch | `2` → `2.0.21` | |
| [thiserror](https://redirect.github.com/dtolnay/thiserror) |
workspace.dependencies | patch | `2.0.18` → `2.0.21` | |
| [tokio](https://tokio.rs)
([source](https://redirect.github.com/tokio-rs/tokio)) |
workspace.dependencies | minor | `1.52.3` → `1.53.2` | |
| [url](https://redirect.github.com/servo/rust-url) | dependencies |
patch | `2.2` → `2.5.8` | |
| [uuid](https://redirect.github.com/uuid-rs/uuid) | dependencies |
minor | `1.23` → `1.27.0` | `1.28.0` |
---
### Release Notes
<details>
<summary>dtolnay/anyhow (anyhow)</summary>
###
[`v1.0.104`](https://redirect.github.com/dtolnay/anyhow/releases/tag/1.0.104)
[Compare
Source](https://redirect.github.com/dtolnay/anyhow/compare/1.0.103...1.0.104)
- Update `syn` dev-dependency to version 3
###
[`v1.0.103`](https://redirect.github.com/dtolnay/anyhow/releases/tag/1.0.103)
[Compare
Source](https://redirect.github.com/dtolnay/anyhow/compare/1.0.102...1.0.103)
- Fix Stacked Borrows violation (UB) in `Error::downcast_mut`
([#​451](https://redirect.github.com/dtolnay/anyhow/issues/451),
[#​452](https://redirect.github.com/dtolnay/anyhow/issues/452))
</details>
<details>
<summary>dtolnay/async-trait (async-trait)</summary>
###
[`v0.1.92`](https://redirect.github.com/dtolnay/async-trait/releases/tag/0.1.92)
[Compare
Source](https://redirect.github.com/dtolnay/async-trait/compare/0.1.91...0.1.92)
- Resolve double\_must\_use clippy lint in generated code
([#​303](https://redirect.github.com/dtolnay/async-trait/issues/303))
###
[`v0.1.91`](https://redirect.github.com/dtolnay/async-trait/releases/tag/0.1.91)
[Compare
Source](https://redirect.github.com/dtolnay/async-trait/compare/0.1.90...0.1.91)
- Update to syn 3
([#​299](https://redirect.github.com/dtolnay/async-trait/issues/299))
- Fix mutability for by-reference receivers
([#​301](https://redirect.github.com/dtolnay/async-trait/issues/301))
###
[`v0.1.90`](https://redirect.github.com/dtolnay/async-trait/releases/tag/0.1.90)
[Compare
Source](https://redirect.github.com/dtolnay/async-trait/compare/0.1.89...0.1.90)
*(yanked)*
</details>
<details>
<summary>chronotope/chrono (chrono)</summary>
###
[`v0.4.45`](https://redirect.github.com/chronotope/chrono/releases/tag/v0.4.45):
0.4.45
[Compare
Source](https://redirect.github.com/chronotope/chrono/compare/v0.4.44...v0.4.45)
#### What's Changed
- fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by
[@​SAY-5](https://redirect.github.com/SAY-5) in
[#​1787](https://redirect.github.com/chronotope/chrono/pull/1787)
- tz\_data: fix tzdata locations on Android by
[@​caruschalalamove](https://redirect.github.com/caruschalalamove)
in
[#​1789](https://redirect.github.com/chronotope/chrono/pull/1789)
</details>
<details>
<summary>clap-rs/clap (clap)</summary>
###
[`v4.6.7`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#467---2026-09-14)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.6.6...v4.6.7)
##### Features
- *(derive)* Add `#[command(defer = <bool>)]` attribute to opt-in to
lazy initialisation of subcommands
###
[`v4.6.6`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#466---2026-08-06)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.6.5...v4.6.6)
##### Features
- Add `Command::get_overridden_usage`
###
[`v4.6.5`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#465---2026-07-31)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.6.4...v4.6.5)
##### Fixes
- *(help)* Correctly mark which `value_names` are optional with
`num_args`
###
[`v4.6.4`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#464---2026-07-21)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.6.3...v4.6.4)
##### Internal
- Update to syn v3
###
[`v4.6.3`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#463---2026-07-20)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.6.2...v4.6.3)
##### Fixes
- *(derive)* Allow `"literal".function()` as attribute values
###
[`v4.6.2`](https://redirect.github.com/clap-rs/clap/blob/HEAD/CHANGELOG.md#462---2026-07-15)
[Compare
Source](https://redirect.github.com/clap-rs/clap/compare/v4.6.1...v4.6.2)
##### Fixes
- *(help)* Say `alias` when there is only one
</details>
<details>
<summary>rust-cli/env_logger (env_logger)</summary>
###
[`v0.11.11`](https://redirect.github.com/rust-cli/env_logger/blob/HEAD/CHANGELOG.md#01111---2026-06-25)
[Compare
Source](https://redirect.github.com/rust-cli/env_logger/compare/v0.11.10...v0.11.11)
##### Internal
- Updated `env_filter`
</details>
<details>
<summary>rust-lang/flate2-rs (flate2)</summary>
###
[`v1.1.10`](https://redirect.github.com/rust-lang/flate2-rs/releases/tag/1.1.10)
[Compare
Source](https://redirect.github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10)
#### What's Changed
- feat: reuse zlib's decoder buffer by
[@​Vaiz](https://redirect.github.com/Vaiz) in
[#​532](https://redirect.github.com/rust-lang/flate2-rs/pull/532)
- feat: add reset method for read::GzDecoder and buffered::GzDecoder by
[@​Vaiz](https://redirect.github.com/Vaiz) in
[#​534](https://redirect.github.com/rust-lang/flate2-rs/pull/534)
- Drop cloudflare-zlib by
[@​kornelski](https://redirect.github.com/kornelski) in
[#​539](https://redirect.github.com/rust-lang/flate2-rs/pull/539)
- Add a wrapper for the `Crc` struct by
[@​MikkelPaulson](https://redirect.github.com/MikkelPaulson) in
[#​540](https://redirect.github.com/rust-lang/flate2-rs/pull/540)
- Bump miniz\_oxide to 0.9 by
[@​oscargus](https://redirect.github.com/oscargus) in
[#​543](https://redirect.github.com/rust-lang/flate2-rs/pull/543)
- Upgrade miniz\_oxide and add unit tests of the different flush kinds
by [@​fintelia](https://redirect.github.com/fintelia) in
[#​498](https://redirect.github.com/rust-lang/flate2-rs/pull/498)
- Fix infinite loop in writing gzip header/footer by
[@​Shnatsel](https://redirect.github.com/Shnatsel) in
[#​547](https://redirect.github.com/rust-lang/flate2-rs/pull/547)
- test: generate corrupt gzip fixture at runtime by
[@​nanookclaw](https://redirect.github.com/nanookclaw) in
[#​550](https://redirect.github.com/rust-lang/flate2-rs/pull/550)
- Reject oversized gzip extra fields by
[@​Byron](https://redirect.github.com/Byron) in
[#​553](https://redirect.github.com/rust-lang/flate2-rs/pull/553)
- Reject incomplete deflate streams at EOF by
[@​Guflly](https://redirect.github.com/Guflly) in
[#​556](https://redirect.github.com/rust-lang/flate2-rs/pull/556)
- Include `README.md` in a private module by
[@​bushrat011899](https://redirect.github.com/bushrat011899) in
[#​562](https://redirect.github.com/rust-lang/flate2-rs/pull/562)
- Add `no_std` support using nightly `alloc_io` by
[@​bushrat011899](https://redirect.github.com/bushrat011899) in
[#​559](https://redirect.github.com/rust-lang/flate2-rs/pull/559)
- Update `get_mut()` documentation to make clear how 'inner\` can be
used by [@​Byron](https://redirect.github.com/Byron) in
[#​558](https://redirect.github.com/rust-lang/flate2-rs/pull/558)
#### New Contributors
- [@​Vaiz](https://redirect.github.com/Vaiz) made their first
contribution in
[#​532](https://redirect.github.com/rust-lang/flate2-rs/pull/532)
- [@​MikkelPaulson](https://redirect.github.com/MikkelPaulson)
made their first contribution in
[#​540](https://redirect.github.com/rust-lang/flate2-rs/pull/540)
- [@​oscargus](https://redirect.github.com/oscargus) made their
first contribution in
[#​543](https://redirect.github.com/rust-lang/flate2-rs/pull/543)
- [@​nanookclaw](https://redirect.github.com/nanookclaw) made
their first contribution in
[#​550](https://redirect.github.com/rust-lang/flate2-rs/pull/550)
- [@​Guflly](https://redirect.github.com/Guflly) made their first
contribution in
[#​556](https://redirect.github.com/rust-lang/flate2-rs/pull/556)
- [@​bushrat011899](https://redirect.github.com/bushrat011899)
made their first contribution in
[#​562](https://redirect.github.com/rust-lang/flate2-rs/pull/562)
**Full Changelog**:
<https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10>
</details>
<details>
<summary>rust-lang/futures-rs (futures)</summary>
###
[`v0.3.34`](https://redirect.github.com/rust-lang/futures-rs/blob/HEAD/CHANGELOG.md#0334---2026-08-11)
[Compare
Source](https://redirect.github.com/rust-lang/futures-rs/compare/0.3.33...0.3.34)
- Preserve cloned waker identity.
([#​3032](https://redirect.github.com/rust-lang/futures-rs/issues/3032))
- Updato `syn` to 3.
([#​3028](https://redirect.github.com/rust-lang/futures-rs/issues/3028))
###
[`v0.3.33`](https://redirect.github.com/rust-lang/futures-rs/blob/HEAD/CHANGELOG.md#0333---2026-07-18)
[Compare
Source](https://redirect.github.com/rust-lang/futures-rs/compare/0.3.32...0.3.33)
- Fix `ReadLine`'s soundness issue regarding to exception safety.
([#​3020](https://redirect.github.com/rust-lang/futures-rs/issues/3020))
- Fix unsound `Send` impl for `IterPinRef` and `Iter`.
([#​3003](https://redirect.github.com/rust-lang/futures-rs/issues/3003))
- Fix stacked borrows violation in `compat01as03` implementation.
([#​3012](https://redirect.github.com/rust-lang/futures-rs/issues/3012))
- Fix memory leak in `FuturesUnordered::IntoIter`.
([#​3005](https://redirect.github.com/rust-lang/futures-rs/issues/3005))
- Add `portable-atomic-alloc` feature and use it in `FuturesUnordered`.
([#​3007](https://redirect.github.com/rust-lang/futures-rs/issues/3007))
- Re-export `alloc::task::Wake`.
([#​3010](https://redirect.github.com/rust-lang/futures-rs/issues/3010))
- Update `spin` to 0.12.
([#​3014](https://redirect.github.com/rust-lang/futures-rs/issues/3014))
</details>
<details>
<summary>rust-random/getrandom (getrandom)</summary>
###
[`v0.4.3`](https://redirect.github.com/rust-random/getrandom/blob/HEAD/CHANGELOG.md#043---2026-06-17)
[Compare
Source](https://redirect.github.com/rust-random/getrandom/compare/v0.4.2...v0.4.3)
##### Added
- `wasm64-unknown-unknown` target support for `wasm_js` backend
[#​848]
##### Changed
- Drop `wasip2` and `wasip3` dependencies in favor of manual bindings
[#​830]
[0.4.3]:
https://redirect.github.com/rust-random/getrandom/compare/v0.4.2...v0.4.3
[#​830]:
https://redirect.github.com/rust-random/getrandom/pull/830
[#​848]:
https://redirect.github.com/rust-random/getrandom/pull/848
</details>
<details>
<summary>hickory-dns/hickory-dns (hickory-resolver)</summary>
###
[`v0.26.3`](https://redirect.github.com/hickory-dns/hickory-dns/releases/tag/v0.26.3)
[Compare
Source](https://redirect.github.com/hickory-dns/hickory-dns/compare/v0.26.2...v0.26.3)
This release fixes regressions introduced in v0.26.2 related to DNSSEC
verification, QUIC servers, HTTP/3 servers, and minimum dependency
versions.
##### What's Changed
- Fix warnings (release/0.26) by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3877](https://redirect.github.com/hickory-dns/hickory-dns/pull/3877)
- resolver: use lenient resolv.conf parsing by
[@​djc](https://redirect.github.com/djc) in
[#​3879](https://redirect.github.com/hickory-dns/hickory-dns/pull/3879)
- backport: Fix multi rrsig validation 0.26 by
[@​MartB](https://redirect.github.com/MartB) in
[#​3892](https://redirect.github.com/hickory-dns/hickory-dns/pull/3892)
- Bump version to 0.26.3 by
[@​djc](https://redirect.github.com/djc) in
[#​3895](https://redirect.github.com/hickory-dns/hickory-dns/pull/3895)
- Exclude accepting QUIC connections from timeouts - 0.26 branch by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3906](https://redirect.github.com/hickory-dns/hickory-dns/pull/3906)
- \[0.26] net: fix insecure ancestor delegation by
[@​djc](https://redirect.github.com/djc) in
[#​3907](https://redirect.github.com/hickory-dns/hickory-dns/pull/3907)
**Full Changelog**:
<https://github.com/hickory-dns/hickory-dns/compare/v0.26.2...v0.26.3>
###
[`v0.26.2`](https://redirect.github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2)
[Compare
Source](https://redirect.github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2)
This release fixes a large number of security vulnerabilities. Most of
the issues were related to DNSSEC validation, denial of service and
resource consumption attacks, and reachable panics in parsers. Other
issues were related to UDP spoofing defenses, caching issues, and
general DNS protocol correctness issues.
This is our first post-vulnpocalypse release, and most of these
vulnerabilities were discovered through LLM-based workflows. The sheer
volume of reports has been a challenge for our volunteer maintainers.
Resolved advisories:
-
[GHSA-2vgh-3wfw-qj7c](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c):
RRSIG Signer's Name not checked against the RRset's zone
-
[GHSA-57pw-897j-v4j6](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6):
Improper check of signature validity of NSEC and NSEC3 records
-
[GHSA-wjgj-fvg9-65w9](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9):
DNSSEC validation ignores bogus records with a DNS class other than IN
-
[GHSA-588m-chg6-8jqj](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj):
Inverted NSEC3 comparison allows forgery of proofs of nonexistence
-
[GHSA-qw83-5pm2-ggp5](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5):
DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC
records
-
[GHSA-3jvh-8vj5-65rq](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3jvh-8vj5-65rq):
NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
-
[GHSA-3r6v-f3jh-vvqm](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3r6v-f3jh-vvqm):
ancestor-delegation NSEC accepted as proof of nonexistence below the
zone cut
-
[GHSA-624w-vvww-xvpw](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw):
ancestor-delegation NSEC3 accepted as proof of nonexistence at and below
the zone cut
-
[GHSA-7php-9j59-g3ch](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-7php-9j59-g3ch):
DNSSEC validation is missing RFC 6840 §4.4 checks
-
[GHSA-vrv5-968r-5ggm](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vrv5-968r-5ggm):
DNSSEC validation accepts bogus positive response with wildcard
expansion
-
[GHSA-p2jv-r3m3-7wf4](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4):
Nonexistence proof forgery due to insufficient checks on NSEC3 record
names
-
[GHSA-86vr-jm6c-7cpg](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-86vr-jm6c-7cpg):
NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the
covering NSEC proves exists
-
[GHSA-8hq4-5836-w6q4](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-8hq4-5836-w6q4):
Server does not check validation status of SOA record in negative
responses
-
[GHSA-5j98-2g5x-46v6](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6):
Resolver::lookup() and Resolver::lookup\_ip() APIs obscure DNSSEC
validation failures
-
[GHSA-929p-gjf6-5hqj](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj):
DNSSEC validation accepts responses with the wrong RRset as a positive
answer
-
[GHSA-j2rc-wxwh-62g9](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9):
`TrustAnchors` does not check name of DNSKEY
-
[GHSA-rx82-4p2j-j5cv](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-rx82-4p2j-j5cv):
`Name::hash` discards label boundaries; `ValidationCacheKey(u64)` reuses
the digest in `Eq` implementation, leaking an Insecure DNSSEC verdict
across distinct owner names
-
[GHSA-2hxp-x833-73f7](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7):
Hickory DNS recursor: ghost domain attack via child-side NS RRset
queries
-
[GHSA-x962-5xwx-fr8x](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-x962-5xwx-fr8x):
Unchecked subtraction in TSIG RDATA decoding panics when overflow checks
are enabled
-
[GHSA-wgfr-mphw-j5g4](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4):
Panic in zone file parser for SVCB and HTTPS
-
[GHSA-hx8c-fjhc-hmf5](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5):
Panic in zone file parser for SVCB and HTTPS
-
[GHSA-4rph-pmrw-mwpw](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw):
Zone file parser panics when parsing long lines
-
[GHSA-3w89-7rx5-hpwx](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3w89-7rx5-hpwx):
Responses with QDCOUNT=0 bypass check for matching question section
-
[GHSA-vcjp-57rr-mpfw](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw):
Out-of-bailiwick filtering is not applied to negative responses
-
[GHSA-6w6g-hm98-mhgm](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm):
Unbounded TC-retry loop in `NameServerPool::try_send`
(resource-exhaustion DoS)
-
[GHSA-cx5j-p54p-q756](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756):
Cyclic sibling domain name server referrals without glue records cause
exponential upstream query amplification in the recursor
-
[GHSA-6h5c-jjg5-wj59](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59):
Glueless-NS referral fan-out without per-query work budget
-
[GHSA-v44v-c8m4-gc43](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-v44v-c8m4-gc43):
Denial of service of client UDP connections via spoofed malformed
responses
-
[GHSA-67wc-6jq8-ghrc](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc):
Remote memory-amplification DoS via attacker-controlled RR counts in DNS
message parsing
-
[GHSA-2f4m-fq7w-mrgx](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2f4m-fq7w-mrgx):
Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC
request bodies
-
[GHSA-g8wg-4mwh-fjfv](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g8wg-4mwh-fjfv):
DoQ server has no timeout when reading request
-
[GHSA-5r56-v84h-c3w5](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5r56-v84h-c3w5):
DoH request body is buffered without a size limit
-
[GHSA-6f2x-v7q7-m7m5](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5):
Resolver follows irrelevant CNAME records
-
[GHSA-xv7c-h5g9-x25x](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-xv7c-h5g9-x25x):
transient DS-fetch error inappropriately cached as BOGUS
-
[GHSA-9px7-7m25-f6q2](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-9px7-7m25-f6q2):
Recursive resolver: Empty connection pool is cached after failed IP
lookup
-
[GHSA-29q9-p769-j8gq](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-29q9-p769-j8gq):
Bogus answers cached for the attacker-supplied record TTL
-
[GHSA-4jwp-xjwm-333g](https://redirect.github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4jwp-xjwm-333g):
Missing IPv4-Mapped IPv6 address canonicalization
Special thanks go out to
[@​qifan-sailboat](https://redirect.github.com/qifan-sailboat) and
Palo Alto Networks for their research and for reporting the bulk of
these vulnerabilities. Thanks to
[@​ATinyShoe](https://redirect.github.com/ATinyShoe),
[@​kirk-baird](https://redirect.github.com/kirk-baird),
[@​thesmartshadow](https://redirect.github.com/thesmartshadow),
[@​BeaCox](https://redirect.github.com/BeaCox),
[@​jpds](https://redirect.github.com/jpds),
[@​N0zoM1z0](https://redirect.github.com/N0zoM1z0), and
[@​JasonPap](https://redirect.github.com/JasonPap) for reporting
vulnerabilities as well.
If your organization is interested in coordinated disclosure of future
security vulnerabilities, please contact
[@​djc](https://redirect.github.com/djc) for commercial support.
##### What's Changed
- Reintroduce LookupIp into\_iter by
[@​tisonkun](https://redirect.github.com/tisonkun) in
[#​3639](https://redirect.github.com/hickory-dns/hickory-dns/pull/3639)
- fix(resolver): thread bind\_addr through TLS and HTTPS connections
(backport to 0.26) by
[@​kakarot-dev](https://redirect.github.com/kakarot-dev) in
[#​3654](https://redirect.github.com/hickory-dns/hickory-dns/pull/3654)
- Raise minimum versions of dependencies by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3661](https://redirect.github.com/hickory-dns/hickory-dns/pull/3661)
- Canonicalize addresses consistently - 0.26 backport by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3687](https://redirect.github.com/hickory-dns/hickory-dns/pull/3687)
- fix: apply per-request timeout for DoH, DoQ, and DoH3 (0.26 backport)
by [@​dsundquist](https://redirect.github.com/dsundquist) in
[#​3686](https://redirect.github.com/hickory-dns/hickory-dns/pull/3686)
- fix(proto): verify RSASHA1-NSEC3-SHA1 (alg 7) with the same crypto as
RSASHA1 (0.26 backport) by
[@​edevil](https://redirect.github.com/edevil) in
[#​3693](https://redirect.github.com/hickory-dns/hickory-dns/pull/3693)
- Add simple constructor for ResolverConfig by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3710](https://redirect.github.com/hickory-dns/hickory-dns/pull/3710)
- resolver: reconnect once when a reused pooled connection was closed
(backport to 0.26) by
[@​cf-rhett](https://redirect.github.com/cf-rhett) in
[#​3719](https://redirect.github.com/hickory-dns/hickory-dns/pull/3719)
- Update quinn-proto - backport by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3748](https://redirect.github.com/hickory-dns/hickory-dns/pull/3748)
- server: return NXDOMAIN for SOA queries on non-existent names
(backport to 0.26) by
[@​eyupcanakman](https://redirect.github.com/eyupcanakman) in
[#​3724](https://redirect.github.com/hickory-dns/hickory-dns/pull/3724)
- Remove recursion from domain::name::read\_inner (backport to 0.26) by
[@​aochagavia](https://redirect.github.com/aochagavia) in
[#​3752](https://redirect.github.com/hickory-dns/hickory-dns/pull/3752)
- Update anyhow to 1.0.103 - backport by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3761](https://redirect.github.com/hickory-dns/hickory-dns/pull/3761)
- add drop\_privileges config option to skip privilege dropping -
backport by [@​Webrowse](https://redirect.github.com/Webrowse) in
[#​3763](https://redirect.github.com/hickory-dns/hickory-dns/pull/3763)
- Server: copy the DO bit of the query in the response (backport to
0.26) by [@​aochagavia](https://redirect.github.com/aochagavia) in
[#​3766](https://redirect.github.com/hickory-dns/hickory-dns/pull/3766)
- tests: fix
[`Ed25519`](https://redirect.github.com/hickory-dns/hickory-dns/commit/Ed25519)
key encoding (0.26 backport) by
[@​djc](https://redirect.github.com/djc) in
[#​3772](https://redirect.github.com/hickory-dns/hickory-dns/pull/3772)
- Update crossbeam-epoch - backport by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3777](https://redirect.github.com/hickory-dns/hickory-dns/pull/3777)
- Fix Clippy lints - backport by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3780](https://redirect.github.com/hickory-dns/hickory-dns/pull/3780)
- fix(server): backport CNAME answer section fix to 0.26 by
[@​mortn](https://redirect.github.com/mortn) in
[#​3783](https://redirect.github.com/hickory-dns/hickory-dns/pull/3783)
- backport r0.26: Fix DS::from\_key not using DNSKEY RDATA by
[@​AlveElde](https://redirect.github.com/AlveElde) in
[#​3787](https://redirect.github.com/hickory-dns/hickory-dns/pull/3787)
- release/0.26 backport: Include CNAME records when calculating minimum
TTL for caching purposes by
[@​sejoker](https://redirect.github.com/sejoker) in
[#​3794](https://redirect.github.com/hickory-dns/hickory-dns/pull/3794)
- resolver: parse packed system search domains (backport to 0.26) by
[@​cf-rhett](https://redirect.github.com/cf-rhett) in
[#​3803](https://redirect.github.com/hickory-dns/hickory-dns/pull/3803)
- bin: better error when a store type needs a disabled Cargo feature by
[@​Webrowse](https://redirect.github.com/Webrowse) in
[#​3810](https://redirect.github.com/hickory-dns/hickory-dns/pull/3810)
- release/0.26 backport: recursor: add config for qname minimization
with relaxed mode. by [@​avnyu](https://redirect.github.com/avnyu)
in
[#​3809](https://redirect.github.com/hickory-dns/hickory-dns/pull/3809)
- resolver: Export per-connection query metrics (backport to 0.26) by
[@​pdelong](https://redirect.github.com/pdelong) in
[#​3821](https://redirect.github.com/hickory-dns/hickory-dns/pull/3821)
- backport r0.26: Limit non-EDNS UDP responses to 512 by
[@​AlveElde](https://redirect.github.com/AlveElde) in
[#​3825](https://redirect.github.com/hickory-dns/hickory-dns/pull/3825)
- proto: Implement size\_hint for RecordSet iterators (backport to 0.26)
by [@​WinterCore](https://redirect.github.com/WinterCore) in
[#​3826](https://redirect.github.com/hickory-dns/hickory-dns/pull/3826)
- Update h2 to 0.4.16 - backport by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3840](https://redirect.github.com/hickory-dns/hickory-dns/pull/3840)
- Fix CI on release/0.26 branch by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3862](https://redirect.github.com/hickory-dns/hickory-dns/pull/3862)
- Allow absolute blocklist paths (0.26 backport) by
[@​liff](https://redirect.github.com/liff) in
[#​3864](https://redirect.github.com/hickory-dns/hickory-dns/pull/3864)
- Security fixes (release/0.26, part 1) by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3870](https://redirect.github.com/hickory-dns/hickory-dns/pull/3870)
- Security fixes (release/0.26, part 2) by
[@​divergentdave](https://redirect.github.com/divergentdave) in
[#​3871](https://redirect.github.com/hickory-dns/hickory-dns/pull/3871)
##### New Contributors
- [@​dsundquist](https://redirect.github.com/dsundquist) made
their first contribution in
[#​3686](https://redirect.github.com/hickory-dns/hickory-dns/pull/3686)
- [@​sejoker](https://redirect.github.com/sejoker) made their
first contribution in
[#​3794](https://redirect.github.com/hickory-dns/hickory-dns/pull/3794)
**Full Changelog**:
<https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2>
</details>
<details>
<summary>hyperium/http (http)</summary>
###
[`v1.5.0`](https://redirect.github.com/hyperium/http/blob/HEAD/CHANGELOG.md#150-July-29-2026)
[Compare
Source](https://redirect.github.com/hyperium/http/compare/v1.4.2...v1.5.0)
- Add `Method::QUERY` constant for the new QUERY method defined in RFC
10008.
- Fix `uri::Builder::path_and_query()` to allow empty strings to mean no
path.
- Fix `uri::PathAndQuery` parsing to enforce URI max length.
###
[`v1.4.2`](https://redirect.github.com/hyperium/http/blob/HEAD/CHANGELOG.md#142-June-8-2026)
[Compare
Source](https://redirect.github.com/hyperium/http/compare/v1.4.1...v1.4.2)
- Fix `uri::Builder` to allow `"*"` as the path when scheme and
authority are also set, used in HTTP/2 requests.
- Fix `Uri` to properly reject `DEL` characters.
###
[`v1.4.1`](https://redirect.github.com/hyperium/http/blob/HEAD/CHANGELOG.md#141-May-25-2026)
[Compare
Source](https://redirect.github.com/hyperium/http/compare/v1.4.0...v1.4.1)
- Fix `PathAndQuery::from_static()` and `from_shared()` to reject inputs
that do not start with `/`.
- Fix `Extend` for `HeaderMap` to clamp max size hint and not overflow.
- Fix `header::IntoIter` that could use-after-free if the generic value
type could panic on drop.
- Fix `header::{IterMut, ValuesIterMut}` to not violate stacked borrows.
</details>
<details>
<summary>hyperium/http-body (http-body)</summary>
###
[`v1.1.0`](https://redirect.github.com/hyperium/http-body/releases/tag/v1.1.0)
[Compare
Source](https://redirect.github.com/hyperium/http-body/compare/v1.0.1...v1.1.0)
#### tl;dr
- Implement `Add` for `SizeHint`.
- Implement `Copy` for `SizeHint`.
</details>
<details>
<summary>hyperium/hyper-util (hyper-util)</summary>
###
[`v0.1.21`](https://redirect.github.com/hyperium/hyper-util/blob/HEAD/CHANGELOG.md#0121-2026-09-24)
[Compare
Source](https://redirect.github.com/hyperium/hyper-util/compare/v0.1.20...v0.1.21)
This release bumps the minimal supported Rust version (MSRV) from 1.64
to 1.85.
This release bumps the rust edition from 2021 to 2024.
#### Additions
- Add crate-level documentation.
([#​327](https://redirect.github.com/hyperium/hyper-util/pull/327))
- Add `client::legacy::Builder::http2_header_table_size()` method.
([#​274](https://redirect.github.com/hyperium/hyper-util/pull/274))
- Add `client::legacy::Builder::http2_max_concurrent_streams()` method.
([#​274](https://redirect.github.com/hyperium/hyper-util/pull/274))
- Add `client::legacy::Builder::http2_max_local_error_reset_streams()`
method.
([#​277](https://redirect.github.com/hyperium/hyper-util/pull/277))
- Add `client::legacy::connect::HttpConnector::set_mark()` method.
([#​303](https://redirect.github.com/hyperium/hyper-util/pull/303))
- Add `rt::tracing::WithSpanExecutor<E>`,
`hyper_util::rt::tracing::CurrentSpanExecutor<E>`, and
`hyper_util::rt::tracing::MkSpanExecutor<E, F>` executors.
([#​323](https://redirect.github.com/hyperium/hyper-util/pull/323))
#### Fixes
- Fix `client::legacy::Client` so that it properly validates CONNECT
responses.
([#​315](https://redirect.github.com/hyperium/hyper-util/pull/315))
- Fix `client::legacy::Client` to cancel the idle interval once its pool
empties.
([#​292](https://redirect.github.com/hyperium/hyper-util/pull/292))
- Fix `client::legacy::Client` to properly handle IPv6 addresses when
using a SOCKS proxy.
([#​302](https://redirect.github.com/hyperium/hyper-util/pull/302))
- Fix `client::pool::cache` to preserve readiness with clones.
([#​297](https://redirect.github.com/hyperium/hyper-util/pull/297))
- Fix `client::pool::cache` to wake its waiters in FIFO order.
([#​298](https://redirect.github.com/hyperium/hyper-util/pull/298))
- Fix `client::pool::singleton::Singleton` to properly handle
cancellation.
([#​299](https://redirect.github.com/hyperium/hyper-util/pull/299))
- Fix `client::pool::singleton::Singleton` to share errors with all
waiters.
([#​296](https://redirect.github.com/hyperium/hyper-util/pull/296))
- Fix `client::proxy::matcher` handling for IP wildcards.
([#​309](https://redirect.github.com/hyperium/hyper-util/pull/309))
- The `tokio/net` feature is narrowed to the `client-legacy` feature
flag, from the `client` feature flag.
([#​276](https://redirect.github.com/hyperium/hyper-util/pull/276))
- Various fixes to the `client::legacy::Client`'s SOCKS proxying.
([#​302](https://redirect.github.com/hyperium/hyper-util/pull/302))
([#​307](https://redirect.github.com/hyperium/hyper-util/pull/307))
([#​308](https://redirect.github.com/hyperium/hyper-util/pull/308))
([#​310](https://redirect.github.com/hyperium/hyper-util/pull/310))
#### Changes
This release contains a minor behavioral change for users of the
`tracing`
feature flag to be aware of.
This feature flag was introduced in v0.1.11. When enabled,
`rt::TokioExecutor<E>` began propagating the currently active
`tracing::Span`
to spawned tasks when `hyper::rt::Executor::execute()` is called. This
caused
issues for some users, due to background tasks keeping a span open for
the
duration of a long-lived connection.
This behavior has now been removed from `rt::TokioExecutor<E>`
([#​322](https://redirect.github.com/hyperium/hyper-util/pull/322))
by default. A
collection of executor wrappers have been added to a new `rt::tracing`
submodule, to provide facilities for instrumenting a client or server's
spawned
tasks. See the module-level documentation of `rt::tracing` for more
information.
To temporarily preserve the previous `rt::TokioExecutor<E>` span
propagation
behavior, enable the `rt-tracing-exec-force` feature. Note that this
feature
flag will be removed in a future release.
</details>
<details>
<summary>console-rs/indicatif (indicatif)</summary>
###
[`v0.18.6`](https://redirect.github.com/console-rs/indicatif/releases/tag/0.18.6)
[Compare
Source](https://redirect.github.com/console-rs/indicatif/compare/0.18.5...0.18.6)
#### What's Changed
- fix: correctly detect dumb terminal on Windows by
[@​ugur-eren](https://redirect.github.com/ugur-eren) in
[#​818](https://redirect.github.com/console-rs/indicatif/pull/818)
###
[`v0.18.5`](https://redirect.github.com/console-rs/indicatif/releases/tag/0.18.5)
[Compare
Source](https://redirect.github.com/console-rs/indicatif/compare/0.18.4...0.18.5)
#### What's Changed
- Upgrade to rand 0.10 by [@​djc](https://redirect.github.com/djc)
in
[#​768](https://redirect.github.com/console-rs/indicatif/pull/768)
- multi: document common MultiProgress bugs + behavior
([#​595](https://redirect.github.com/console-rs/indicatif/issues/595))
by [@​chris-laplante](https://redirect.github.com/chris-laplante)
in
[#​786](https://redirect.github.com/console-rs/indicatif/pull/786)
- Use `div_duration_f64` by
[@​ChrisDenton](https://redirect.github.com/ChrisDenton) in
[#​792](https://redirect.github.com/console-rs/indicatif/pull/792)
- Clear the rest of line after drawing to the terminal by
[@​ChrisDenton](https://redirect.github.com/ChrisDenton) in
[#​790](https://redirect.github.com/console-rs/indicatif/pull/790)
- Fix `ProgressDrawTarget.is_stderr()` for `MultiProgress` by
[@​kojiishi](https://redirect.github.com/kojiishi) in
[#​803](https://redirect.github.com/console-rs/indicatif/pull/803)
- Fix height and filler when wrapped at the middle of wide characters by
[@​kojiishi](https://redirect.github.com/kojiishi) in
[#​799](https://redirect.github.com/console-rs/indicatif/pull/799)
- fix: respect NO\_COLOR and TERM=dumb environment variable by
[@​ValentinLeTallec](https://redirect.github.com/ValentinLeTallec)
in
[#​808](https://redirect.github.com/console-rs/indicatif/pull/808)
- Fix stray comma after minus sign in HumanFloatCount by
[@​sueun-dev](https://redirect.github.com/sueun-dev) in
[#​815](https://redirect.github.com/console-rs/indicatif/pull/815)
- Fix HumanFloatCount dropping the fractional part by
[@​greymoth-jp](https://redirect.github.com/greymoth-jp) in
[#​816](https://redirect.github.com/console-rs/indicatif/pull/816)
- style module cleanup by [@​djc](https://redirect.github.com/djc)
in
[#​813](https://redirect.github.com/console-rs/indicatif/pull/813)
- Drop screenshots from MultiProgress documentation by
[@​djc](https://redirect.github.com/djc) in
[#​817](https://redirect.github.com/console-rs/indicatif/pull/817)
</details>
<details>
<summary>rust-lang/log (log)</summary>
###
[`v0.4.34`](https://redirect.github.com/rust-lang/log/blob/HEAD/CHANGELOG.md#0434---2026-08-22)
[Compare
Source](https://redirect.github.com/rust-lang/log/compare/0.4.33...0.4.34)
###
[`v0.4.33`](https://redirect.github.com/rust-lang/log/blob/HEAD/CHANGELOG.md#0433---2026-06-20)
[Compare
Source](https://redirect.github.com/rust-lang/log/compare/0.4.32...0.4.33)
###
[`v0.4.32`](https://redirect.github.com/rust-lang/log/blob/HEAD/CHANGELOG.md#0432---2026-06-04)
[Compare
Source](https://redirect.github.com/rust-lang/log/compare/0.4.31...0.4.32)
##### What's Changed
- Support `Value` -> string conversions with `kv` + `std` features
instead of `kv_std` by
[@​tisonkun](https://redirect.github.com/tisonkun) in
[#​729](https://redirect.github.com/rust-lang/log/pull/729)
**Full Changelog**:
<https://github.com/rust-lang/log/compare/0.4.31...0.4.32>
###
[`v0.4.31`](https://redirect.github.com/rust-lang/log/blob/HEAD/CHANGELOG.md#0432---2026-06-04)
[Compare
Source](https://redirect.github.com/rust-lang/log/compare/0.4.30...0.4.31)
##### What's Changed
- Support `Value` -> string conversions with `kv` + `std` features
instead of `kv_std` by
[@​tisonkun](https://redirect.github.com/tisonkun) in
[#​729](https://redirect.github.com/rust-lang/log/pull/729)
**Full Changelog**:
<https://github.com/rust-lang/log/compare/0.4.31...0.4.32>
###
[`v0.4.30`](https://redirect.github.com/rust-lang/log/blob/HEAD/CHANGELOG.md#0431---2026-06-02)
[Compare
Source](https://redirect.github.com/rust-lang/log/compare/0.4.29...0.4.30)
##### What's Changed
- Leverage static str key when possible by
[@​tisonkun](https://redirect.github.com/tisonkun) in
[#​727](https://redirect.github.com/rust-lang/log/pull/727)
##### New Contributors
- [@​Isvane](https://redirect.github.com/Isvane) made their first
contribution in
[#​726](https://redirect.github.com/rust-lang/log/pull/726)
**Full Changelog**:
<https://github.com/rust-lang/log/compare/0.4.30...0.4.31>
</details>
<details>
<summary>rustls/rcgen (rcgen)</summary>
###
[`v0.14.10`](https://redirect.github.com/rustls/rcgen/releases/tag/v0.14.10):
0.14.10
#### What's Changed
- Spec compliance bug fixes by
[@​cpu](https://redirect.github.com/cpu) in
[#​445](https://redirect.github.com/rustls/rcgen/pull/445)
- Take advantage of stable ML-DSA in aws-lc-rs by
[@​djc](https://redirect.github.com/djc) in
[#​447](https://redirect.github.com/rustls/rcgen/pull/447)
</details>
<details>
<summary>rust-lang/regex (regex)</summary>
###
[`v1.13.1`](https://redirect.github.com/rust-lang/regex/blob/HEAD/CHANGELOG.md#1131-2026-07-15)
[Compare
Source](https://redirect.github.com/rust-lang/regex/compare/1.13.0...1.13.1)
\===================
This is a release that fixes a bug where incorrect regex match offsets
could be
reported. Note that this doesn't impact whether a match occurs or not,
just
where it occurs. The match offsets are still valid for slicing, they
just may
not refer to the correct leftmost-first match. See
[#​1364](https://redirect.github.com/rust-lang/regex/pull/1364)
for (many) more details.
Bug fixes:
-
[#​1354](https://redirect.github.com/rust-lang/regex/issues/1354):
Fixes previously unsound reverse suffix and inner optimizations.
###
[`v1.13.0`](https://redirect.github.com/rust-lang/regex/blob/HEAD/CHANGELOG.md#1130-2026-07-09)
[Compare
Source](https://redirect.github.com/rust-lang/regex/compare/1.12.4...1.13.0)
\===================
This release includes a new API, a `regex!` macro, for lazy compilation
of
a regex from a string literal. If you use regexes a lot, it's likely
you've
already written one exactly like it. The new macro can be used like
this:
```rust
use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using `Regex::new` here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);
```
Improvements:
- [#​709](https://redirect.github.com/rust-lang/regex/issues/709):
Add a new `regex!` macro for efficient and automatic reuse of a compiled
regex.
###
[`v1.12.4`](https://redirect.github.com/rust-lang/regex/blob/HEAD/CHANGELOG.md#1124-2026-06-09)
[Compare
Source](https://redirect.github.com/rust-lang/regex/compare/1.12.3...1.12.4)
\===================
This release includes a performance optimization for compilation of
regexes
with very large character classes.
Improvements:
- [#​1308](https://redirect.github.com/rust-lang/regex/pull/1308):
Avoid re-canonicalizing the entire interval set when pushing new class
ranges.
</details>
<details>
<summary>seanmonstar/reqwest (reqwest)</summary>
###
[`v0.13.5`](https://redirect.github.com/seanmonstar/reqwest/blob/HEAD/CHANGELOG.md#v0135)
[Compare
Source](https://redirect.github.com/seanmonstar/reqwest/compare/v0.13.4...v0.13.5)
- Add `Error::is_dns()` to identify errors caused by DNS resolution
failures.
- Add `ClientBuilder::http1_max_headers(usize)` to configure the maximum
number of headers accepted in an HTTP/1 response (default 100).
- Add TLS version to `TlsInfo` extension.
- Fix hickory-dns feature to use `Ipv6AndIpv4` strategy to prefer IPv6.
- Fix sending wrong proxy-auth if multiple proxies intercept a given
URL.
###
[`v0.13.4`](https://redirect.github.com/seanmonstar/reqwest/blob/HEAD/CHANGELOG.md#v0134)
[Compare
Source](https://redirect.github.com/seanmonstar/reqwest/compare/v0.13.3...v0.13.4)
- Add `ClientBuilder::tls_sslkeylogfile(bool)` option to allow using the
related environment variable.
- Add `ClientBuilder::http2_keep_alive_*` options for the `blocking`
client.
- Add TLS 1.3 support when using `native-tls` backend.
- Fix redirect handling to strip sensitive headers when the scheme
changes.
- Fix HTTP/3 happy-eyeball connection creation.
- Upgrade hickory-resolver to 0.26.
###
[`v0.13.3`](https://redirect.github.com/seanmonstar/reqwest/blob/HEAD/CHANGELOG.md#v0133)
[Compare
Source](https://redirect.github.com/seanmonstar/reqwest/compare/v0.13.2...v0.13.3)
- Fix CertificateRevocationList parsing of PEM values.
- Fix logging in resolver to only show host, not full URL.
- Fix hickory-dns to fallback to a default if `/etc/resolv.conf` fails.
- Fix HTTP/3 to handle `STOP_SENDING` as not an error.
- Fix HTTP/3 pool to remove timed out QUIC connections.
- Fix HTTP/3 connection establishment picking IPv4 and IPv6.
- Upgrade rustls-platform-verifier.
- (wasm) Only use wasm-bindgen on unknown-\* targets.
</details>
<details>
<summary>serde-rs/serde (serde)</summary>
###
[`v1.0.229`](https://redirect.github.com/serde-rs/serde/releases/tag/v1.0.229)
[Compare
Source](https://redirect.github.com/serde-rs/serde/compare/v1.0.228...v1.0.229)
- Update to syn 3
</details>
<details>
<summary>serde-rs/json (serde_json)</summary>
###
[`v1.0.151`](https://redirect.github.com/serde-rs/json/releases/tag/v1.0.151)
[Compare
Source](https://redirect.github.com/serde-rs/json/compare/v1.0.150...v1.0.151)
- Add RawValue::from\_string\_unchecked
([#​1331](https://redirect.github.com/serde-rs/json/issues/1331),
thanks
[@​WonderLawrence](https://redirect.github.com/WonderLawrence))
###
[`v1.0.150`](https://redirect.github.com/serde-rs/json/releases/tag/v1.0.150)
[Compare
Source](https://redirect.github.com/serde-rs/json/compare/v1.0.149...v1.0.150)
- Reject non-string enum object keys
([#​1324](https://redirect.github.com/serde-rs/json/issues/1324),
thanks
[@​puneetdixit200](https://redirect.github.com/puneetdixit200))
</details>
<details>
<summary>jonasbb/serde_with (serde_with)</summary>
###
[`v3.24.0`](https://redirect.github.com/jonasbb/serde_with/releases/tag/v3.24.0):
serde_with v3.24.0
[Compare
Source](https://redirect.github.com/jonasbb/serde_with/compare/v3.23.0...v3.24.0)
##### Added
- Implement `JsonSchemaAs` for `NoneAsEmptyString`, so fields using it
compile with the `schemars_*` features
([#​1014](https://redirect.github.com/jonasbb/serde_with/issues/1014))
##### Changed
- Make `with_prefix!` and `with_suffix!` available with the `alloc`
feature, instead of only with `std`
([#​1008](https://redirect.github.com/jonasbb/serde_with/issues/1008))
##### Fixed
- Handle potential panics in deserialization of chrono and time
DateTimes.
This was privately reported by
[@​NotAFlightRisk](https://redirect.github.com/NotAFlightRisk).
###
[`v3.23.0`](https://redirect.github.com/jonasbb/serde_with/releases/tag/v3.23.0):
serde_with v3.23.0
[Compare
Source](https://redirect.github.com/jonasbb/serde_with/compare/v3.22.0...v3.23.0)
##### Changed
- Update `syn` and `darling` dependencies to use `syn` v3
([#​992](https://redirect.github.com/jonasbb/serde_with/issues/992))
- Update dev-dependencies to newer versions
([#​993](https://redirect.github.com/jonasbb/serde_with/issues/993))
- Update `base64` to a newer version. This should not have any API
change, but some error messages might change.
([#​993](https://redirect.github.com/jonasbb/serde_with/issues/993))
- `serde_as` can now parse `cfg_attr(true, ...)` and `cfg_attr(false,
...)`
([#​995](https://redirect.github.com/jonasbb/serde_with/issues/995))
`true`/`false` are new literals as of Rust 1.88 but need to be parsed
explicitly with the `syn` types.
This is used when emitting `schemars` annotations.
###
[`v3.22.0`](https://redirect.github.com/jonasbb/serde_with/releases/tag/v3.22.0):
serde_with v3.22.0
[Compare
Source](https://redirect.github.com/jonasbb/serde_with/compare/v3.21.0...v3.22.0)
##### Added
- Add support for `jiff` v0.2 behind the new `jiff_0_2` feature flag
([#​936](https://redirect.github.com/jonasbb/serde_with/issues/936))
`jiff::SignedDuration` works with `DurationSeconds` and its variants.
`jiff::Timestamp`, `jiff::Zoned`, and `jiff::civil::DateTime` work with
`TimestampSeconds` and its variants.
Deserializing a `jiff::Zoned` uses the system time zone, like
`chrono::DateTime<Local>`.
##### Fixed
- Extend the
[GHSA-7gcf-g7xr-8hxj](https://redirect.github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj)
fix to the duplicate-key-prevention collections.
The `rust::sets_duplicate_value_is_error`,
`rust::maps_duplicate_key_is_error`, `rust::sets_last_value_wins`, and
`rust::maps_first_key_wins` adapters created their backing sets/maps
with `with_capacity_and_hasher` using the raw deserializer `size_hint`,
bypassing the `size_hint_cautious` cap added in
[#​966](https://redirect.github.com/jonasbb/serde_with/issues/966)
(the `clippy.toml` `disallowed_methods` lint only covers
`Vec::with_capacity`, not `with_capacity_and_hasher`, so these sites
were not flagged).
Attacker-controlled input claiming a huge length could panic with `Hash
table capacity overflow` before a single element was read. All such
constructions now route through `size_hint_cautious`.
###
[`v3.21.0`](https://redirect.github.com/jonasbb/serde_with/releases/tag/v3.21.0):
serde_with v3.21.0
[Compare
Source](https://redirect.github.com/jonasbb/serde_with/compare/v3.20.0...v3.21.0)
##### Security
-
[GHSA-7gcf-g7xr-8hxj](https://redirect.github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj):
KeyValueMap serialization panics on empty sequence or map entries
Bad or attacker controlled values could cause a panic while allocating
too large values.
Fixed in
[#​966](https://redirect.github.com/jonasbb/serde_with/issues/966)
by setting a maximum allocation size during the creation of collections
like `Vec` or sets.
Thanks to [@​7thParkk](https://redirect.github.com/7thParkk) for
reporting the issue.
##### Added
- Add `NoneAsZero` adapter that maps `Option<NonZero*>` to a plain
integer, encoding `None` as `0` by
[@​SAY-5](https://redirect.github.com/SAY-5)
([#​486](https://redirect.github.com/jonasbb/serde_with/issues/486))
##### Changed
- Re-enable link-to-definition on docs.rs
([#​964](https://redirect.github.com/jonasbb/serde_with/issues/964))
##### Fixed
- Fix some doc links to point to the correct types
([#​963](https://redirect.github.com/jonasbb/serde_with/issues/963))
- Re-enable `unused_qualifications` and fix the resulting findings by
[@​lms0806](https://redirect.github.com/lms0806)
([#​962](https://redirect.github.com/jonasbb/serde_with/issues/962))
</details>
<details>
<summary>GuillaumeGomez/sysinfo (sysinfo)</summary>
###
[`v0.39.6`](https://redirect.github.com/GuillaumeGomez/sysinfo/blob/HEAD/CHANGELOG.md#0396)
[Compare
Source](https://redirect.github.com/GuillaumeGomez/sysinfo/compare/v0.39.5...v0.39.6)
- NetBSD: Add support for disk I/O usage.
- NetBSD: Improve retrieval of disk information.
###
[`v0.39.5`](https://redirect.github.com/GuillaumeGomez/sysinfo/blob/HEAD/CHANGELOG.md#0395)
[Compare
Source](https://redirect.github.com/GuillaumeGomez/sysinfo/compare/v0.39.4...v0.39.5)
- macOS: Fix build for apple app store
###
[`v0.39.4`](https://redirect.github.com/GuillaumeGomez/sysinfo/blob/HEAD/CHANGELOG.md#0394)
[Compare
Source](https://redirect.github.com/GuillaumeGomez/sysinfo/compare/v0.39.3...v0.39.4)
- Unix: Fix soundness issue when retrieving user's groups.
- macOS: Add new macOS version name.
- macOS: Fix inaccurate `open_files` returned value.
###
[`v0.39.3`](https://redirect.github.com/GuillaumeGomez/sysinfo/blob/HEAD/CHANGELOG.md#0393)
[Compare
Source](https://redirect.github.com/GuillaumeGomez/sysinfo/compare/v0.39.2...v0.39.3)
- Unix: Fix retrieval of `Network::mac_addr`.
- Linux: Improve retrieval of process information if process terminates
while doing so.
###
[`v0.39.2`](https://redirect.github.com/GuillaumeGomez/sysinfo/blob/HEAD/CHANGELOG.md#0392)
[Compare
Source](https://redirect.github.com/GuillaumeGomez/sysinfo/compare/v0.39.1...v0.39.2)
- Windows: Greatly improve performance of
`System::refresh_cpu_specifics` when CPU usage is not requested.
- iOS: Fix compilation error when `user` feature is enabled.
- Linux: Correctly set thread information for processes.
</details>
<details>
<summary>composefs/tar-rs (tar)</summary>
###
[`v0.4.46`](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)
[Compare
Source](https://redirect.github.com/composefs/tar-rs/compare/0.4.45...0.4.46)
#### Security
- archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by
[@​cgwalters](https://redirect.github.com/cgwalters) in
[#​454](https://redirect.github.com/composefs/tar-rs/pull/454)
See also
<https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm>
#### Other changes
- ci: Fix and re-enable reverse dependency testing by
[@​cgwalters](https://redirect.github.com/cgwalters) in
[#​444](https://redirect.github.com/composefs/tar-rs/pull/444)
- Update astral-tokio-tar requirement from 0.5 to 0.6 by
[@​dependabot](https://redirect.github.com/dependabot)\[bot] in
[#​446](https://redirect.github.com/composefs/tar-rs/pull/446)
- Update some links by
[@​atouchet](https://redirect.github.com/atouchet) in
[#​445](https://redirect.github.com/composefs/tar-rs/pull/445)
- Add support of absolute paths by
[@​zxvfc](https://redirect.github.com/zxvfc) in
[#​426](https://redirect.github.com/composefs/tar-rs/pull/426)
- docs: Expand notes on concurrent mutations and following symlinks by
[@​cgwalters](https://redirect.github.com/cgwalters) in
[#​453](https://redirect.github.com/composefs/tar-rs/pull/453)
- Update repo links by
[@​cgwalters](https://redirect.github.com/cgwalters) in
[#​451](https://redirect.github.com/composefs/tar-rs/pull/451)
- ci: Add crates.io trusted publishing workflow by
[@​cgwalters](https://redirect.github.com/cgwalters) in
[#​456](https://redirect.github.com/composefs/tar-rs/pull/456)
- Release 0.4.46 by
[@​cgwalters](https://redirect.github.com/cgwalt
> ✂ **Note**
>
> PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Mend
Renovate](https://redirect.github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODguMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJydXN0Il19-->
Co-authored-by: endform-renovate[bot] <268196524+endform-renovate[bot]@users.noreply.github.com>
Co-authored-by: Augusto Silva <augusto@acfs.se>1 parent 225e8cd commit ef776c7
7 files changed
Lines changed: 224 additions & 410 deletions
File tree
- cloudflare
- linkup-clients
- linkup-cli
- local-server
- worker
0 commit comments