chore(deps): bump the cargo group across 1 directory with 7 updates by dependabot[bot] · Pull Request #756 · EVWorth/sqlpilot

dependabot · 2026-10-11T21:07:54Z

Bumps the cargo group with 7 updates in the /src-tauri directory:

Package	From	To
dirs	`6.0.0`	`7.0.0`
reqwest	`0.12.28`	`0.13.4`
rmcp	`3.4.0`	`3.5.0`
thiserror	`2.0.20`	`2.0.21`
tokio	`1.53.1`	`1.53.2`
uuid	`1.26.0`	`1.27.0`
db-keystore	`0.5.2`	`0.6.0`

Updates dirs from 6.0.0 to 7.0.0

Updates reqwest from 0.12.28 to 0.13.4

Release notes

Sourced from reqwest's releases.

v0.13.4

tl;dr

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

What's Changed

fix(tls): improve rustls-no-provider panic message and add module docs by @smythg4 in seanmonstar/reqwest#3021

fix: do not lose the url in error when decoding json by @Dushistov in seanmonstar/reqwest#3026

Add tls_sslkeylogfile builder method by @passcod in seanmonstar/reqwest#2923

fix(redirect): strip sensitive headers on scheme change across redirects by @SAY-5 in seanmonstar/reqwest#3034

chore: upgrade MSRV to 1.85 by @seanmonstar in seanmonstar/reqwest#3038

chore: clean up minimal-versions CI job by @seanmonstar in seanmonstar/reqwest#3039

fix(http3): use happy eyeballs for h3 connect by @lyuzichong in seanmonstar/reqwest#3030

fix: update hickory-resolver to 0.26 and adjust code accordingly by @seanmonstar in seanmonstar/reqwest#3040

fix: remove unwrap in hickory initialization by @mat813 in seanmonstar/reqwest#3041

feat(https): support TLS 1.3 as min version under native-tls 🎉 by @AverageHelper in seanmonstar/reqwest#2975

Expose keep alive configurations in blocking client by @aeb-dev in seanmonstar/reqwest#3043

Prepare v0.13.4 by @seanmonstar in seanmonstar/reqwest#3046

New Contributors

@smythg4 made their first contribution in seanmonstar/reqwest#3021

@Dushistov made their first contribution in seanmonstar/reqwest#3026

@SAY-5 made their first contribution in seanmonstar/reqwest#3034

@mat813 made their first contribution in seanmonstar/reqwest#3041

@AverageHelper made their first contribution in seanmonstar/reqwest#2975

@aeb-dev made their first contribution in seanmonstar/reqwest#3043

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

v0.13.3

tl;dr

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

Update docs.rs Features by @JamesWiresmith in seanmonstar/reqwest#2961

fix: fallback to hickory_resolver's default config if reading /etc/resolv.conf fails by @monosans in seanmonstar/reqwest#2797

fix: remove timeout con by @cuiweixie in seanmonstar/reqwest#2967

http3: handle stop_sending without error by @anuraaga in seanmonstar/reqwest#2978

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.4

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

v0.13.3

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Fixes compiling with rustls on Android targets.

v0.13.0

Breaking changes:

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)

For example, prefer tls_backend_rustls() over use_rustls_tls().

Commits

11489b3 v0.13.4
d31ffbb feat: Expose HTTP2 keep alive configurations in blocking client (#3043)
79ed0d7 feat: support TLS 1.3 as min version under native-tls 🎉 (#2975)
fb7bf6a fix: remove unwrap in hickory initialization (#3041)
3da616f fix: update hickory-resolver to 0.26 and adjust code accordingly (#3040)
c77e7b2 fix(http3): use happy eyeballs for h3 connect (#3030)
9cbb65b chore: clean up minimal-versions CI job (#3039)
17a7dc5 chore: upgrade MSRV to 1.85 (#3038)
03db63a fix(redirect): strip sensitive headers on scheme change across redirects (#3034)
4b813a8 feat: add tls_sslkeylogfile builder method (#2923)
Additional commits viewable in compare view

Updates rmcp from 3.4.0 to 3.5.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.5.0

Fixed

(macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.0

Added

update LATEST and add LATEST_WITH_INITIALIZE (#1105)

Fixed

(model) decode float fields through serde_json::Number (#1300)

(rmcp) reject duplicate sep-2243 headers (#1274)

(transport) match explicit default ports in Origin allowlist (#1270)

(rmcp) tolerate empty cacheScope instead of silently dropping the whole result (#1281)

(model) preserve explicit null structuredContent in CallToolResult (#1295)

Other

cargo fmt fixes on validate_standard_headers changes (#1275)

rmcp-macros-v3.4.1

Fixed

(macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.4.1

Fixed

(transport) fall back after JSON discover rejections (#1288)

(macros) accept const paths and concat! in tool/prompt descriptions (#1243)

Other

(deps) update rstest requirement from 0.26.1 to 0.27.0 (#1276)

Commits

0cde3c5 chore: release v3.5.0 (#1296)
e02efbf fix(model): decode float fields through serde_json::Number (#1300)
972af86 feat: update LATEST and add LATEST_WITH_INITIALIZE (#1105)
6e47ca3 chore(deps): bump the github-actions group with 2 updates (#1297)
6255c37 chore: reduce dependency update noise (#1293)
22ef52a fix(rmcp): reject duplicate sep-2243 headers (#1274)
26f3b2e fix(transport): match explicit default ports in Origin allowlist (#1270)
6677eee style: cargo fmt fixes on validate_standard_headers changes (#1275)
fbed447 fix(rmcp): tolerate empty cacheScope instead of silently dropping the whole r...
90516bf fix(model): preserve explicit null structuredContent in CallToolResult (#1295)
Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

Fix parsing of generic unit variants in display expressions (#459)

Commits

b1827ee Release 2.0.21
58037b5 Merge pull request #459 from dtolnay/turbofish
f82a0cf Keep track of nested turbofish depth
72ea492 Raise required compiler to Rust 1.77
72eea0d Resolve io_other_error clippy lint in tests
07f09a2 Raise required compiler to Rust 1.74
2715388 Update ui test suite to nightly-2026-09-22
5a306c7 Update ui test suite to nightly-2026-09-05
ef9383b Update ui test suite to nightly-2026-08-22
8336b84 Update ui tests for version 2.0.20
See full diff in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)

io: revert "always cleanup AsyncFd registration list on deregister" (#8540)

process: unregister Windows wait before closing child handle (#8564)

rt: drop blocking pool mutex before shutting down rejected task (#8562)

sync: fix mpsc index wraparound in block reclamation (#8546)

sync: forget mpsc Permit before sending value (#8560)

sync: validate MAX_PERMITS in Semaphore::acquire (#8548)

sync: wake broadcast Sender::closed outside mutex (#8558)

task: drop replaced waker outside lock in JoinSet (#8554)

time: drop timer lock before dropping waker in clear_entry (#8552)

time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

fs: clamp io_uring read length to u32::MAX (#8572)

rt: ignore current_thread task dumps from other runtimes (#8544)

rt: preserve io_uring context if a completion waker panics (#8566)

sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)

taskdump: restore deferred leaf wakes during capture (#8445)

time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

ff0c406 chore: prepare Tokio v1.53.2 (#8580)
a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
ec31a9f chore: prepare Tokio v1.51.5 (#8579)
625c851 sync: assign semaphore permits before emitting tracing event (#8542)
832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
9a47992 process: unregister Windows wait before closing child handle (#8564)
2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
Additional commits viewable in compare view

Updates uuid from 1.26.0 to 1.27.0

Release notes

Sourced from uuid's releases.

v1.27.0

What's Changed

Accept case-insensitive urn:uuid: prefixes when parsing by @jaideeppyne in uuid-rs/uuid#912

Fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos by @KodrAus in uuid-rs/uuid#915

Prepare for 1.27.0 release by @KodrAus in uuid-rs/uuid#917

New Contributors

@jaideeppyne made their first contribution in uuid-rs/uuid#912

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

v1.26.1

What's Changed

Seat the v7 counter below the version nibble by @lenamonj in uuid-rs/uuid#907

Don't panic in overflowing Timestamp to SystemTime conversion by @KodrAus in uuid-rs/uuid#909

Prepare for 1.26.1 release by @KodrAus in uuid-rs/uuid#910

New Contributors

@lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

Commits

b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
ffd8ec5 prepare for 1.27.0 release
4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
a1aa126 Merge pull request #912 from jaideeppyne/fix/urn-prefix-case-insensitive
4639d67 fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos
2723703 bump MSRV to 1.89.0
a3e64fa refactor: simplify URN prefix parsing
5055fd4 refactor: inline case-insensitive URN prefix checks
cb8b1d5 refactor: simplify case-insensitive URN parsing
285967d Accept case-insensitive urn:uuid: prefixes when parsing
Additional commits viewable in compare view

Updates db-keystore from 0.5.2 to 0.6.0

Changelog

Sourced from db-keystore's changelog.

0.6.0

Changed

bumped turso to 0.8.1

tighten rust lints and clippy lints: forbid unsafe, deny pedantic, deny nursery.

New non-default feature flag "cli", required for building maintenance tool. Not used for library-only builds, to keep clap and a few others out of the dependency tree.

db-keystore does not set the process global allocator. In db-keystore through 0.5.x, the embedded turso library forced the allocator to jemalloc. In 0.6.0+, the app chooses (as it should be; libraries should not impose a default process-wide allocator). By default, you get the rust standard allocator, or an app can select one with #[global_allocator]. See https://doc.rust-lang.org/std/alloc/index.html.

bumped rust toolchain to 1.98.1

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the cargo group with 7 updates in the /src-tauri directory: | Package | From | To | | --- | --- | --- | | dirs | `6.0.0` | `7.0.0` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.28` | `0.13.4` | | [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `3.4.0` | `3.5.0` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.20` | `2.0.21` | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [uuid](https://github.com/uuid-rs/uuid) | `1.26.0` | `1.27.0` | | [db-keystore](https://github.com/stevelr/db-keystore) | `0.5.2` | `0.6.0` | Updates `dirs` from 6.0.0 to 7.0.0 Updates `reqwest` from 0.12.28 to 0.13.4 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.12.28...v0.13.4) Updates `rmcp` from 3.4.0 to 3.5.0 - [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml) - [Commits](modelcontextprotocol/rust-sdk@rmcp-v3.4.0...rmcp-v3.5.0) Updates `thiserror` from 2.0.20 to 2.0.21 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.20...2.0.21) Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.2) Updates `uuid` from 1.26.0 to 1.27.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.26.0...v1.27.0) Updates `db-keystore` from 0.5.2 to 0.6.0 - [Changelog](https://github.com/stevelr/db-keystore/blob/main/CHANGELOG.md) - [Commits](https://github.com/stevelr/db-keystore/commits) --- updated-dependencies: - dependency-name: dirs dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: reqwest dependency-version: 0.13.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: rmcp dependency-version: 3.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: thiserror dependency-version: 2.0.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: uuid dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: db-keystore dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

Version bump across the three manifests and the two lockfile entries that record the app's own version. What 1.2.1 contains since 1.2.0: - rustls 0.23.46 for RUSTSEC-2026-0346..0349 (#759) - Tauri 2.12.3, tauri-plugin-updater 2.13.3 and tauri-plugin-shell 2.5.0 on both the npm and Rust sides (#758) - Dependency roll-ups: cargo group (#756), npm group (#755), dprint plugins (#754) - cargo audit: the zip advisories reached only through the Windows updater are accepted pending upstream, tracked in #760 (#759) Claude-Session: https://claude.ai/code/session_01WTypK4RjzzdjoFxd3qk14g Co-authored-by: Claude <noreply@anthropic.com>

dependabot Bot added dependencies Dependency updates rust Rust/Cargo updates labels Oct 11, 2026

EVWorth merged commit 88492d7 into main Oct 17, 2026
12 checks passed

EVWorth deleted the dependabot/cargo/src-tauri/cargo-5e0ad6840a branch October 17, 2026 19:29

EVWorth mentioned this pull request Oct 18, 2026

release: 1.2.1 #761

Merged

Navigation Menu

Repository navigation

chore(deps): bump the cargo group across 1 directory with 7 updates - #756

chore(deps): bump the cargo group across 1 directory with 7 updates#756
EVWorth merged 1 commit into
mainfrom
dependabot/cargo/src-tauri/cargo-5e0ad6840a

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 11, 2026

v0.13.4

tl;dr

What's Changed

New Contributors

v0.13.3

tl;dr

What's Changed

v0.13.4

v0.13.3

v0.13.2

v0.13.1

v0.13.0

rmcp-macros-v3.5.0

Fixed

rmcp-v3.5.0

Added

Fixed

Other

rmcp-macros-v3.4.1

Fixed

rmcp-v3.4.1

Fixed

Other

2.0.21

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

Fixed (unstable)

v1.27.0

What's Changed

New Contributors

v1.26.1

What's Changed

New Contributors

0.6.0

Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant