deps: bump the deps-patches group with 4 updates

[dependabot]

Bumps the deps-patches group with 4 updates: toml, rustls, hickory-resolver and bestool-canopy.

Updates toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0

Commits

• e93ed4e chore: Release
• d23436d docs: Update changelog
• 151afcd fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat (#1211)
• 26a4050 fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat
• 232f136 chore(deps): Update Prek to v0.5.1 (#1209)
• 9ee4b4e chore(deps): Update crate-ci/typos digest to 4d9c206 (#1208)
• 525f352 chore(deps): Update crate-ci/committed digest to 800a04e (#1207)
• 46043ed chore(deps): Update crate-ci/typos digest to 4d9c206
• c00e894 chore(deps): Update crate-ci/committed digest to 800a04e
• 1ae0158 chore(deps): Update Prek to v0.5.0 (#1205)
• Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.44

Commits

• 64ad386 Bump version to 0.23.44
• 1efbf66 bogo: remove PostQuantum setup
• e78162f aws-lc-rs: add support for ML-DSA signatures
• d880772 bogo: extract Options::provider() helper
• 87201d6 bogo: force all callers to get provider from Options
• 93657e3 server: limit 1.2 certificate requests to 1.2-compatible signature schemes
• bbd3c9a client: avoid sending 1.3-only signature schemes if no cipher suites configured
• eb57688 tls12: require known signature algorithm
• e7a9cef tls12: send illegal_parameter alert for kx signed with wrong algorithm
• 06a546d bogo: take latest
• Additional commits viewable in compare view

Updates hickory-resolver from 0.26.1 to 0.26.2

Release notes

Sourced from hickory-resolver's releases.

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

• GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
• GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
• GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
• GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
• GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
• GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
• GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
• GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
• GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
• GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
• GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
• GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
• GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
• GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
• GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
• GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY
• GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names
• GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
• GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
• GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
• GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
• GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
• GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
• GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
• GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
• GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
• GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
• GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
• GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing
• GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies
• GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request
• GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit
• GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records
• GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS
• GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup
• GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL
• GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization

Special thanks go out to @​qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @​ATinyShoe, @​kirk-baird, @​thesmartshadow, @​BeaCox, @​jpds, @​N0zoM1z0, and @​JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @​djc for commercial support.

What's Changed

... (truncated)

Commits

• 48323ef Bump version to 0.26.2
• ccd6952 Only follow one CNAME record from each response
• c04ad2b Better distinguish NODATA response and wildcards
• 64b4291 Add test for bogus wildcard expansion
• 478998b proto: constrain peer-controlled allocation sizes
• 8392769 resolver: avoid caching empty nameserver pools
• e2d21d8 Replace use of SOA name with NSEC3 record parents
• 84fa8ab Check for correct zone name in covering NSEC3s too
• 09803ba Look for correct zone name in matching NSEC3s
• 26f45d3 Rename Nsec3RecordPair to Nsec3RecordInfo
• Additional commits viewable in compare view

Updates bestool-canopy from 0.7.10 to 0.7.11

Commits

• 24fa5eb repo: release
• 7d83120 fix(tamanu): create podman secrets without --replace
• 7617a18 refactor(canopy): swap bestool-canopy onto the bes-canopy-api crate (Y1)
• fcad74e repo: release
• f1471a2 fix(pgtune): size effective_cache_size from whole-box RAM
• 84c3e14 feat(canopy): chain follower backups and restore them as a pair (#854)
• dbbc894 follower review fixes
• 8e68018 gate the clobber on podman secrets
• 371d560 cover the podman secret round trip
• 33ce9d5 cover a secret key follower on windows
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/vitest

The overall line coverage in commit 4e5a39e in the dependabot/cargo/dep... branch remains at 66%, unchanged from commit 77fdb39 in the main branch.