[dependabot]

Bumps the rust-deps group with 7 updates in the / directory:

Package	From	To
serde	1.0.228	1.0.229
serde_json	1.0.150	1.0.151
thiserror	2.0.19	2.0.20
ipnet	2.12.0	2.12.2
hickory-resolver	0.26.1	0.26.2
testcontainers	0.27.3	0.28.0
http	1.4.2	1.5.0

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

• Add RawValue::from_string_unchecked (#1331, thanks @​WonderLawrence)

Commits

• de85007 Release 1.0.151
• 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
• 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
• cf16f75 Add RawValue::from_string_unchecked
• 827a315 Update actions/upload-artifact@v6 -> v7
• cea36a5 Update actions/checkout@v6 -> v7
• See full diff in compare view

Updates thiserror from 2.0.19 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

• Suppress redundant_field_names clippy lint in generated code (#454)

Commits

• b1d5db5 Release 2.0.20
• c4c3ebd Merge pull request #454 from dtolnay/clippy
• 2266152 Suppress redundant_field_names clippy lint
• 2901cfd Raise minimum tested compiler to rust 1.88
• aa9d91f Update ui tests for version 2.0.19
• See full diff in compare view

Updates ipnet from 2.12.0 to 2.12.2

Release notes

Sourced from ipnet's releases.

Fix issue #70: IpSubnets(0, MAX-1, 0) incorrectly including MAX

• Fixes bug where Ipv4Subnets(0.0.0.0, u32::MAX-1, 0) and Ipv6Subnets(::, u128::MAX-1, 0) incorrectly included u32::MAX and u128::MAX. See issue #70.
• Fixes some typos in documentation and error messages

Changelog

Sourced from ipnet's changelog.

Version 2.12.2

• Fixes bug with IpNet::aggregate() where if a network containing u32::MAX-1 or u128::MAX-1 is provided, then u32::MAX and u128::MAX respectively are always included in the output. See issue #71.

Version 2.12.1

• Fixes bug where Ipv4Subnets(0.0.0.0, u32::MAX-1, 0) and Ipv6Subnets(::, u128::MAX-1, 0) incorrectly included u32::MAX and u128::MAX. See issue #70.
• Fixes some typos in documentation and error messages

Commits

• See full diff in compare view

Updates hickory-resolver from 0.26.1 to 0.26.2

Release notes

Sourced from hickory-resolver's releases.

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

• GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
• GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
• GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
• GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
• GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
• GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
• GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
• GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
• GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
• GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
• GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
• GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
• GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
• GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
• GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
• GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY
• GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names
• GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
• GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
• GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
• GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
• GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
• GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
• GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
• GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
• GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
• GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
• GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
• GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing
• GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies
• GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request
• GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit
• GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records
• GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS
• GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup
• GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL
• GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization

Special thanks go out to @​qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @​ATinyShoe, @​kirk-baird, @​thesmartshadow, @​BeaCox, @​jpds, @​N0zoM1z0, and @​JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @​djc for commercial support.

What's Changed

... (truncated)

Commits

• 48323ef Bump version to 0.26.2
• ccd6952 Only follow one CNAME record from each response
• c04ad2b Better distinguish NODATA response and wildcards
• 64b4291 Add test for bogus wildcard expansion
• 478998b proto: constrain peer-controlled allocation sizes
• 8392769 resolver: avoid caching empty nameserver pools
• e2d21d8 Replace use of SOA name with NSEC3 record parents
• 84fa8ab Check for correct zone name in covering NSEC3s too
• 09803ba Look for correct zone name in matching NSEC3s
• 26f45d3 Rename Nsec3RecordPair to Nsec3RecordInfo
• Additional commits viewable in compare view

Updates testcontainers from 0.27.3 to 0.28.0

Release notes

Sourced from testcontainers's releases.

v0.28.0

Details

Miscellaneous Tasks

• Update astral-tokio-tar from 0.6.0 to 0.6.1 (#940)
• Update parse-display requirement from 0.9.0 to 0.11.0 (#942)
• Bump testcontainers/sshd image from 1.3.0 to 1.4.0 (#952)
• Update russh requirement from 0.60.0 to 0.61.2 (#950)
• [❗] Update bollard 0.20 to 0.21 (#943)
• Update docker-compose-types requirement from 0.23 to 0.24 (#951)

Changelog

Sourced from testcontainers's changelog.

[0.28.0] - 2026-08-06

Details

Miscellaneous Tasks

• Update astral-tokio-tar from 0.6.0 to 0.6.1 (#940)
• Update parse-display requirement from 0.9.0 to 0.11.0 (#942)
• Bump testcontainers/sshd image from 1.3.0 to 1.4.0 (#952)
• Update russh requirement from 0.60.0 to 0.61.2 (#950)
• [❗] Update bollard 0.20 to 0.21 (#943)
• Update docker-compose-types requirement from 0.23 to 0.24 (#951)

Commits

• 59792c3 chore: release v0.28.0 (#964)
• 5331a2a docs(site): add missing languages and reorder docs navigation (#955)
• 7d8f95a ci(deps): bump actions/checkout from 6 to 7 (#953)
• 936a3b6 chore(deps): update docker-compose-types requirement from 0.23 to 0.24 (#951)
• 7588345 chore(deps)!: update bollard 0.20 to 0.21 (#943)
• b06dd31 chore(deps): update russh requirement from 0.60.0 to 0.61.2 (#950)
• 24027d4 chore: bump testcontainers/sshd image from 1.3.0 to 1.4.0 (#952)
• 3067fcd chore(deps): update parse-display requirement from 0.9.0 to 0.11.0 (#942)
• 5632380 chore(deps): update astral-tokio-tar from 0.6.0 to 0.6.1 (#940)
• See full diff in compare view

Updates http from 1.4.2 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

• feat(method): add QUERY method by @​seanmonstar in hyperium/http#798
• fix(uri): allow empty paths in uri::Builder by @​seanmonstar in hyperium/http#853
• perf(header,uri): faster value validation, URI parse/format, map inserts by @​geeknoid in hyperium/http#852
• fix(uri): enforce max length in PathAndQuery by @​seanmonstar in hyperium/http#856

New Contributors

• @​geeknoid made their first contribution in hyperium/http#852

Full Changelog: hyperium/http@v1.4.2...v1.5.0

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

Commits

• 16fc9a7 v1.5.0
• e559023 fix(uri): enforce max length in PathAndQuery (#856)
• 2178e17 perf(header,uri): faster value validation, URI parse/format, map inserts (#852)
• 03c8cd7 fix(uri): allow empty paths in uri::Builder (#853)
• bb8705b feat(method): add QUERY method (#798)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mostafa]

Superseded by #74.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml