deps: bump the deps-patches group with 7 updates

[dependabot]

Bumps the deps-patches group with 7 updates:

Package	From	To
duct	1.1.1	1.1.2
hickory-resolver	0.26.1	0.26.2
tokio-rustls	0.26.4	0.26.5
binstalk-downloader	0.13.45	0.13.46
detect-targets	0.1.90	0.1.91
toml	1.1.4+spec-1.1.0	1.1.5+spec-1.1.0
indexmap	2.14.1	2.14.2

Updates duct from 1.1.1 to 1.1.2

Commits

• 0195544 version 1.1.2
• 781f545 Clippy fixes
• e85aafd document that wait_timeout panics on overflow
• ba535d5 comment updates
• 9c71ebe docs formatting fix
• See full diff in compare view

Updates hickory-resolver from 0.26.1 to 0.26.2

Release notes

Sourced from hickory-resolver's releases.

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

• GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
• GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
• GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
• GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
• GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
• GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
• GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
• GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
• GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
• GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
• GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
• GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
• GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
• GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
• GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
• GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY
• GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names
• GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
• GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
• GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
• GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
• GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
• GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
• GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
• GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
• GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
• GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
• GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
• GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing
• GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies
• GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request
• GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit
• GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records
• GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS
• GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup
• GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL
• GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization

Special thanks go out to @​qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @​ATinyShoe, @​kirk-baird, @​thesmartshadow, @​BeaCox, @​jpds, @​N0zoM1z0, and @​JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @​djc for commercial support.

What's Changed

... (truncated)

Commits

• 48323ef Bump version to 0.26.2
• ccd6952 Only follow one CNAME record from each response
• c04ad2b Better distinguish NODATA response and wildcards
• 64b4291 Add test for bogus wildcard expansion
• 478998b proto: constrain peer-controlled allocation sizes
• 8392769 resolver: avoid caching empty nameserver pools
• e2d21d8 Replace use of SOA name with NSEC3 record parents
• 84fa8ab Check for correct zone name in covering NSEC3s too
• 09803ba Look for correct zone name in matching NSEC3s
• 26f45d3 Rename Nsec3RecordPair to Nsec3RecordInfo
• Additional commits viewable in compare view

Updates tokio-rustls from 0.26.4 to 0.26.5

Release notes

Sourced from tokio-rustls's releases.

0.26.5

What's Changed

• Exclude bad test keys from the published package by @​weiznich in rustls/tokio-rustls#140
• chore: improve code comments clarity by @​xibeiyoumian in rustls/tokio-rustls#152
• client/server timeout examples, doc pass hinting towards timeouts. by @​cpu in rustls/tokio-rustls#187
• return more data at once from TlsStream::poll_read by @​trinity-1686a in rustls/tokio-rustls#198

Commits

• f8832d2 Bump version to 0.26.5
• c0fad2f return more data at once from TlsStream::poll_read (#198)
• edc7306 build(deps): bump futures-util from 0.3.33 to 0.3.34
• baeadaa build(deps): bump rcgen from 0.14.8 to 0.14.9
• 1e138ad build(deps): bump taiki-e/cache-cargo-install-action from 3.0.7 to 3.0.8
• b4ecff6 build(deps): bump taiki-e/cache-cargo-install-action from 3 to 3.0.7
• f47a689 build(deps): bump rustls from 0.23.42 to 0.23.43
• e25578e build(deps): bump tokio from 1.53.0 to 1.53.1
• d2a6d98 server: add rustdoc hinting towards timeout wrapping
• c2e9b4a client: add rustdoc hinting towards timeout wrapping
• Additional commits viewable in compare view

Updates binstalk-downloader from 0.13.45 to 0.13.46

Release notes

Sourced from binstalk-downloader's releases.

binstalk-downloader-v0.13.46

Other

• (deps) bump astral-tokio-tar from 0.6.4 to 0.7.0 in the deps group (#2654)

Commits

• 92a3953 chore: release (#2648)
• 5baa196 fix: prefix human-readable logs with cargo-binstall (#2645)
• bbdafe4 build(deps): bump astral-tokio-tar from 0.6.4 to 0.7.0 in the deps group (#2654)
• 9ef12fa dep: Upgrade transitive dependencies (#2653)
• 5aafaac dep: Upgrade transitive dependencies (#2647)
• 75b4bfa release: cargo-binstall v1.22.0 (#2640)
• See full diff in compare view

Updates detect-targets from 0.1.90 to 0.1.91

Release notes

Sourced from detect-targets's releases.

detect-targets-v0.1.91

Other

• update Cargo.lock dependencies

Commits

• 92a3953 chore: release (#2648)
• 5baa196 fix: prefix human-readable logs with cargo-binstall (#2645)
• bbdafe4 build(deps): bump astral-tokio-tar from 0.6.4 to 0.7.0 in the deps group (#2654)
• 9ef12fa dep: Upgrade transitive dependencies (#2653)
• 5aafaac dep: Upgrade transitive dependencies (#2647)
• 75b4bfa release: cargo-binstall v1.22.0 (#2640)
• See full diff in compare view

Updates toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0

Commits

• e93ed4e chore: Release
• d23436d docs: Update changelog
• 151afcd fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat (#1211)
• 26a4050 fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat
• 232f136 chore(deps): Update Prek to v0.5.1 (#1209)
• 9ee4b4e chore(deps): Update crate-ci/typos digest to 4d9c206 (#1208)
• 525f352 chore(deps): Update crate-ci/committed digest to 800a04e (#1207)
• 46043ed chore(deps): Update crate-ci/typos digest to 4d9c206
• c00e894 chore(deps): Update crate-ci/committed digest to 800a04e
• 1ae0158 chore(deps): Update Prek to v0.5.0 (#1205)
• Additional commits viewable in compare view

Updates indexmap from 2.14.1 to 2.14.2

Changelog

Sourced from indexmap's changelog.

2.14.2 (2026-09-04)

• Fix item hygiene in map and set macros. Previously, an internal const CAP could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and indexset_with_default!. The hasher may also be omitted if it's inferrable.

Commits

• 41a8708 Merge pull request #450 from cuviper/macros
• 0fb7b5c Release 2.14.2
• 55e6b28 Improve the empty macro cases
• c067355 Fix item hygiene in user macros
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.