Skip to content

build(deps): Bump the cargo-minor-patch group across 1 directory with 12 updates - #298

Merged
pmaxhogan merged 2 commits into
mainfrom
dependabot/cargo/cargo-minor-patch-8e730a01cc
Aug 17, 2026
Merged

build(deps): Bump the cargo-minor-patch group across 1 directory with 12 updates#298
pmaxhogan merged 2 commits into
mainfrom
dependabot/cargo/cargo-minor-patch-8e730a01cc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo-minor-patch group with 12 updates in the / directory:

Package From To
thiserror 2.0.19 2.0.20
serde 1.0.228 1.0.229
async-trait 0.1.91 0.1.92
keyring 4.1.5 4.1.6
base64 0.23.0 0.23.1
ignore 0.4.31 0.4.33
blake3 1.8.5 1.8.6
rusty-s3 0.10.1 0.10.2
russh 0.62.5 0.62.6
zbus 5.18.0 5.19.0
futures-util 0.3.33 0.3.34
thirtyfour 0.37.4 0.37.5

Updates thiserror from 2.0.19 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)
Commits

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates async-trait from 0.1.91 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

  • Resolve double_must_use clippy lint in generated code (#303)
Commits

Updates keyring from 4.1.5 to 4.1.6

Release notes

Sourced from keyring's releases.

v4.1.6: fix concurrent initialization bug

This release fixes #343, a bug in concurrent initialization of the v1 default credential store (thanks @​bbmediaco for reporting this). As part of this fix, there's an added feature: you can now query the exact result of the default credential store creation, as well as force it to happen without creating an entry.

What's Changed

Full Changelog: open-source-cooperative/keyring-rs@v4.1.5...v4.1.6

Commits

Updates base64 from 0.23.0 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures
Commits

Updates ignore from 0.4.31 to 0.4.33

Commits
  • 3fce3b5 ignore-0.4.33
  • 5055264 globset-0.4.20
  • 020687a ignore,globset: increase pool capacity
  • 5ed408e ignore-0.4.32
  • 435f59f ignore: skip loading unreachable ignore files
  • f9c05a9 index: remove incorrect README
  • 8372866 index: add some initial indexing scaffolding
  • d99ac34 core: add index module
  • 2ed0c00 flags: disable many flags when indexing is enabled
  • See full diff in compare view

Updates blake3 from 1.8.5 to 1.8.6

Release notes

Sourced from blake3's releases.

1.8.6

version 1.8.6

Changes since 1.8.5:

  • update_mmap and update_mmap_rayon (and by extension b3sum) now use seek rather than metadata to get the length of a file/mapping, and they tolerate mmap failures. That means b3sum will now memory map e.g. Linux block devices, which support mapping despite reporting length 0 in metadata. Hashing NUL files on Windows also works now, where previously it was an error unless you used --no-mmap or <. This change was originally proposed by @​nabijaczleweli.
Commits

Updates rusty-s3 from 0.10.1 to 0.10.2

Release notes

Sourced from rusty-s3's releases.

v0.10.2

What's Changed

Full Changelog: paolobarbolini/rusty-s3@v0.10.1...v0.10.2

Commits
  • d62c047 build: release v0.10.2
  • 6a52bf5 build(deps): upgrade base64 to v0.23
  • 386ed84 build(deps): upgrade semver compatible Rust dependencies
  • See full diff in compare view

Updates russh from 0.62.5 to 0.62.6

Release notes

Sourced from russh's releases.

v0.62.6

Security fixes

GHSA-g6xm-f9xp-qq35 - server-side max_auth_attempts was not enforced - f8fd0b1

Config::max_auth_attempts was not being properly enforced by russh server implementation.

Fixes

  • c66837e: Fix deadlock when handling open channel on contended handler (#734) (Eric Rodrigues Pires) #734

Changes

  • c465e3f: accept a single trailing comma in SSH name-lists (#743) (PokAhonTAS911) #743
  • add Motor OS support (#742) #742 (lasiotus)
Commits

Updates zbus from 5.18.0 to 5.19.0

Release notes

Sourced from zbus's releases.

zbus-5.19.0

Added

  • ✨ Add Builder::async_io_unix_stream and async_io_tcp_stream.
  • ✨ Make the tokio and async-io features additive.

Changed

  • ♻️ Remove unnecessary clones.

Deprecated

  • 🗑️ Deprecate unix_stream/tcp_stream when tokio is disabled.

Documentation

  • 📝 Document the tokio and async-io runtime selection.

Fixed

  • 🥅 throw Error::Connection on connection failure.
  • 🥅 Add new error variant Error::Connection.

Other

  • ✏️ Fix a typo in the executor docs.

Testing

  • ✅ Test runtime selection with both backends enabled.
  • ✅ add tests for Error::Connection.

zbus_macros-5.19.0

Dependencies

  • ⬆️ Bump syn to 3.0.
Commits
  • 7518d73 Merge pull request #1894 from zeenix/claude/split-str-zstr-crate-j76d2p
  • c145014 💥 zu: Bump version to 4.0.0
  • d8117ca Merge pull request #1893 from zeenix/releases
  • 09be35e 🔖 zb: Release 5.19
  • 2031d24 🔖 zv: Release 5.14
  • c19cf0d Merge pull request #1891 from zeenix/claude/split-str-zstr-crate-j76d2p
  • 9778174 ♻️ zv: Use zcheapstr for the Str type
  • f71c49d ➕ zv: Add zcheapstr dependency
  • 22c278f Merge pull request #1890 from z-galaxy/renovate/jamesives-github-pages-deploy...
  • cb40643 ⬆️ Update JamesIves/github-pages-deploy-action action to v4.9.0
  • Additional commits viewable in compare view

Updates futures-util from 0.3.33 to 0.3.34

Release notes

Sourced from futures-util's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)
Changelog

Sourced from futures-util's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)
Commits

Updates thirtyfour from 0.37.4 to 0.37.5

Release notes

Sourced from thirtyfour's releases.

v0.37.5

What's Changed

Full Changelog: stevepryde/thirtyfour@v0.37.4...v0.37.5

Commits
  • da2c45a Merge pull request #363 from stevepryde/codex/await-managed-driver-shutdown
  • 89279a4 Await managed driver shutdown
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the cargo-minor-patch group across 1 directory with…
b2e9a2a 
… 12 updates

Bumps the cargo-minor-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.19` | `2.0.20` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.91` | `0.1.92` |
| [keyring](https://github.com/open-source-cooperative/keyring-rs) | `4.1.5` | `4.1.6` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.23.0` | `0.23.1` |
| [ignore](https://github.com/BurntSushi/ripgrep) | `0.4.31` | `0.4.33` |
| [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.5` | `1.8.6` |
| [rusty-s3](https://github.com/paolobarbolini/rusty-s3) | `0.10.1` | `0.10.2` |
| [russh](https://github.com/warp-tech/russh) | `0.62.5` | `0.62.6` |
| [zbus](https://github.com/z-galaxy/zbus) | `5.18.0` | `5.19.0` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.33` | `0.3.34` |
| [thirtyfour](https://github.com/stevepryde/thirtyfour) | `0.37.4` | `0.37.5` |



Updates `thiserror` from 2.0.19 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.19...2.0.20)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `async-trait` from 0.1.91 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.91...0.1.92)

Updates `keyring` from 4.1.5 to 4.1.6
- [Release notes](https://github.com/open-source-cooperative/keyring-rs/releases)
- [Commits](open-source-cooperative/keyring-rs@v4.1.5...v4.1.6)

Updates `base64` from 0.23.0 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.23.0...v0.23.1)

Updates `ignore` from 0.4.31 to 0.4.33
- [Release notes](https://github.com/BurntSushi/ripgrep/releases)
- [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/ripgrep@ignore-0.4.31...ignore-0.4.33)

Updates `blake3` from 1.8.5 to 1.8.6
- [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases)
- [Commits](BLAKE3-team/BLAKE3@1.8.5...1.8.6)

Updates `rusty-s3` from 0.10.1 to 0.10.2
- [Release notes](https://github.com/paolobarbolini/rusty-s3/releases)
- [Commits](paolobarbolini/rusty-s3@v0.10.1...v0.10.2)

Updates `russh` from 0.62.5 to 0.62.6
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.62.5...v0.62.6)

Updates `zbus` from 5.18.0 to 5.19.0
- [Release notes](https://github.com/z-galaxy/zbus/releases)
- [Changelog](https://github.com/z-galaxy/zbus/blob/main/release-plz.toml)
- [Commits](z-galaxy/zbus@zbus-5.18.0...zbus-5.19.0)

Updates `futures-util` from 0.3.33 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.33...0.3.34)

Updates `thirtyfour` from 0.37.4 to 0.37.5
- [Release notes](https://github.com/stevepryde/thirtyfour/releases)
- [Commits](stevepryde/thirtyfour@v0.37.4...v0.37.5)

---
updated-dependencies:
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: async-trait
  dependency-version: 0.1.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: keyring
  dependency-version: 4.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: ignore
  dependency-version: 0.4.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: blake3
  dependency-version: 1.8.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: rusty-s3
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: russh
  dependency-version: 0.62.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: zbus
  dependency-version: 5.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: futures-util
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: thirtyfour
  dependency-version: 0.37.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 17, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Driven Aug 17, 2026
@pmaxhogan @claude
fix: keep keyring pinned at 4.1.5, drop the 4.1.6 bump from this batch
bbe756f 
keyring 4.1.6 changed keyring::Entry::new's one-time platform-store
latch from an AtomicBool ("attempt set_credential_store() once,
tolerate failure") to a LazyLock<Result<()>> that permanently caches
the *outcome* of that first attempt (keyring-4.1.6/src/v1.rs). If the
native store construction fails on the first call, every subsequent
keyring::Entry::new() now short-circuits to Err(NoDefaultStore) before
ever consulting keyring_core's current default store - it no longer
matters that driven_test_fixtures::keychain::isolated() installs the
in-memory mock as the default store afterward.

On GitHub's ubuntu-latest runners there is no D-Bus session bus and no
Secret Service provider, so zbus_secret_service_keyring_store::Store::new()
always fails there (reproduced locally in a headless Debian container,
confirmed a running D-Bus session alone is not enough without an actual
secrets-service daemon). That makes the LazyLock permanently Err for the
whole test process, which is exactly what
crypto_provider_impl::tests::the_test_suite_is_isolated_from_the_os_keychain
guards against - and would break every other keychain-touching test in
driven-crypto/driven-drive the same way once cargo test reached them.

Making the mock the effective default again would require either a real
secret-service daemon in CI (heavier infra than a dependency-bump PR
should carry) or dropping the `keyring` v1 facade from driven-crypto/
driven-drive in favor of hand-rolling the store-selection latch
ourselves against keyring-core + the platform-native store crates
directly. Neither is a reasonable fix for this PR, so keyring stays at
4.1.5 (Cargo.toml's `keyring = "4"` constraint already allows this) and
the CHANGELOG-relevant regression is left for a follow-up. The other 11
crates in the cargo-minor-patch group are unaffected and still bumped.

Verified: `cargo test --workspace` and `cargo clippy --workspace
--all-targets -- -D warnings` both pass locally on macOS; Cargo.lock
edit is the minimal keyring-only diff, checked with
`cargo check --workspace --locked`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019xKUm9vH4ifb5LHR5szy1v
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Coverage

Area main this PR delta
Rust (lib crates) 84.56% 84.55% -0.01 (OK)
UI (vue/ts) 93.04% 93.04% +0.00 (OK)

Gate: passed - no coverage regression (epsilon 0.1 pp).

@pmaxhogan
pmaxhogan merged commit 2bb1e3d into main Aug 17, 2026
18 checks passed
@pmaxhogan
pmaxhogan deleted the dependabot/cargo/cargo-minor-patch-8e730a01cc branch August 17, 2026 19:07
@github-project-automation github-project-automation Bot moved this from Todo to Done in Driven Aug 17, 2026
@pmaxhogan pmaxhogan mentioned this pull request Aug 18, 2026
Merged
pmaxhogan added a commit that referenced this pull request Aug 18, 2026
@pmaxhogan @claude
ci(deps): ignore the regressed keyring 4.1.6 in dependabot (#319)
91e903d 
keyring 4.1.6 caches the first native-store construction failure forever
(LazyLock latch), which defeats the test suite's in-memory store
isolation and panics the_test_suite_is_isolated_from_the_os_keychain on
headless ubuntu CI. It was pinned back to 4.1.5 in #298; this stops
dependabot re-offering the same broken version every week. Drop the
ignore when an upstream fix ships.

README checked, no changes needed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_019xKUm9vH4ifb5LHR5szy1v

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

Driven
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pmaxhogan