Repository navigation
fix(deps): batch dependency updates (Oct 2026) - #29
Merged
Merged
Conversation
Bumps [cmov](https://github.com/RustCrypto/utils) from 0.5.3 to 0.5.4. - [Commits](RustCrypto/utils@cmov-v0.5.3...cmov-v0.5.4) --- updated-dependencies: - dependency-name: cmov dependency-version: 0.5.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit dea5c29)
Bumps [serde_with](https://github.com/jonasbb/serde_with) from 3.18.0 to 3.21.0. - [Release notes](https://github.com/jonasbb/serde_with/releases) - [Commits](jonasbb/serde_with@v3.18.0...v3.21.0) --- updated-dependencies: - dependency-name: serde_with dependency-version: 3.21.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit ae87236)
Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.14 to 0.11.16. - [Release notes](https://github.com/quinn-rs/quinn/releases) - [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.16) --- updated-dependencies: - dependency-name: quinn-proto dependency-version: 0.11.16 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit e86c439)
Bumps [postgres-protocol](https://github.com/rust-postgres/rust-postgres) from 0.6.11 to 0.6.12. - [Release notes](https://github.com/rust-postgres/rust-postgres/releases) - [Commits](rust-postgres/rust-postgres@postgres-protocol-v0.6.11...postgres-protocol-v0.6.12) --- updated-dependencies: - dependency-name: postgres-protocol dependency-version: 0.6.12 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit e9614cb)
Bumps [tokio-postgres](https://github.com/rust-postgres/rust-postgres) from 0.7.17 to 0.7.18. - [Release notes](https://github.com/rust-postgres/rust-postgres/releases) - [Commits](rust-postgres/rust-postgres@tokio-postgres-v0.7.17...tokio-postgres-v0.7.18) --- updated-dependencies: - dependency-name: tokio-postgres dependency-version: 0.7.18 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit e2c3a55)
Update every semver-compatible dependency, skipping releases from the last seven days except where they carry the only fix for an advisory. Security fixes: - rustls 0.23.38 to 0.23.46 (RUSTSEC-2026-0285, 0346, 0348, 0349) - rustls-webpki 0.103.13 to 0.103.16 (RUSTSEC-2026-0382) - webpki-roots and webpki-root-certs 1.0.7 to 1.0.10 (RUSTSEC-2026-0381, 0383) - quinn-proto 0.11.16 to 0.11.19 (RUSTSEC-2026-0338 through 0342) - h2 0.4.13 to 0.4.20 (RUSTSEC-2026-0258) - ctutils 0.4.2 to 0.4.4 (RUSTSEC-2026-0385) - tokio 1.52.1 to 1.53.3 (RUSTSEC-2026-0386) - anyhow 1.0.102 to 1.0.104 (RUSTSEC-2026-0190) - event-listener 5.4.1 to 5.4.2 (RUSTSEC-2026-0221) - yanked chacha20 0.10.0 and spin 0.9.8 replaced async-trait 0.1.92 also fixes the clippy::double_must_use error that Rust 1.99 reports on the #[async_trait] expansion in src/state.rs.
Align every workflow on the same pinned release of each action, including actions/checkout v7.0.1 in ci.yml (was v4), and refresh dtolnay/rust-toolchain to the current stable branch commit.
gcr.io/distroless/cc-debian12 is deprecated and no longer rebuilt, so the runtime image stopped receiving Debian security updates. Switch the runtime to distroless/cc-debian13:nonroot and the builder to rust:1-trixie (Rust 1.99.1) so the binary links against the same glibc it runs with.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Cargo.lockagainst currentmain. This resolves every open Dependabot alert, including the high-severitypostgres-protocolSCRAM iteration DoS (GHSA-5x78-73v4-xg6w) andquinn-protostream reassembly memory exhaustion (GHSA-4w2j-m93h-cj5j).rustls0.23.38 to 0.23.46 (RUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348, RUSTSEC-2026-0349)rustls-webpki0.103.13 to 0.103.16 (RUSTSEC-2026-0382), pluswebpki-rootsandwebpki-root-certs1.0.7 to 1.0.10 (RUSTSEC-2026-0381, RUSTSEC-2026-0383)quinn-proto0.11.19, because the 0.11.16 from chore(deps): bump quinn-proto from 0.11.14 to 0.11.16 #25 is still affected by RUSTSEC-2026-0338 through RUSTSEC-2026-0342h20.4.20 (RUSTSEC-2026-0258),ctutils0.4.4 (RUSTSEC-2026-0385),tokio1.53.3 (RUSTSEC-2026-0386),anyhow1.0.104, andevent-listener5.4.2; the yankedchacha200.10.0 andspin0.9.8 are gonemain(clippy::double_must_useon the#[async_trait]expansion insrc/state.rs, which is also why chore: Configure Renovate #28 is red).async-trait0.1.92 emits code that no longer triggers the lint, so no source change is needed.tokio1.54.1,redis1.8.0,cc1.10.0,smallvec1.16.4,ureq3.5.0, and the ICU 2.4 crates). The exceptions are the only patched releases for an advisory:ctutils0.4.4,rustls-webpki0.103.16, andwebpki-rootsandwebpki-root-certs1.0.10.ci.ymlmoves fromactions/checkoutv4 to v7.0.1,release-binaries.ymlcatches up toupload-artifactv7.0.2,download-artifactv8.0.2, andattest-build-provenancev4.2.2, and the Docker workflow actions,crates-io-auth-action, anddtolnay/rust-toolchainare refreshed.gcr.io/distroless/cc-debian12is deprecated and was last rebuilt on 2026-08-21, so the image no longer received Debian security fixes. The runtime moves todistroless/cc-debian13:nonrootand the builder torust:1-trixie(Rust 1.99.1, which fixes an x86_64 FFIboolmiscompilation), so the binary links against the glibc it runs with.rsa0.9.10 has RUSTSEC-2023-0071 (Marvin timing side channel) with no patched release; it is a direct dependency used for DPoP signing.paste(throughboa_engine) andunsafe-libyaml(throughserde_yaml_ng) are flagged unmaintained. Newer majors exist forjsonwebtoken,rusqlite,sysinfo,async-nats,boa_*,testcontainers, andsha2, but those need code changes and are out of scope for a lockfile batch.Closes #23, closes #24, closes #25, closes #26, closes #27.
Test plan
cargo fmt -- --checkcargo clippy --all-targets --all-features -- -D warningson Rust 1.99.0cargo check --all-targetswith and without--all-featurescargo doc --all-features --no-depscargo test --all-features(255 tests pass)cargo test --features testcontainers --test integration_testcontainersagainst Redis and Postgrescargo audit(only RUSTSEC-2023-0071 remains)zizmor --pedantic .github/workflows(no new findings versusmain)docker build .on Debian 13; the image runshelr --versionas UID 65532grype --only-fixed --fail-on criticalon the built image: no vulnerabilities found