Skip to content

deps: bump the rust-dependencies group across 1 directory with 33 updates - #989

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-1a9ff7dbfb
Open

deps: bump the rust-dependencies group across 1 directory with 33 updates#989
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-1a9ff7dbfb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group with 30 updates in the / directory:

Package From To
serde_json 1.0.150 1.0.151
thiserror 2.0.18 2.0.20
serde 1.0.228 1.0.229
futures 0.3.32 0.3.34
tokio-stream 0.1.18 0.1.19
tokio 1.52.3 1.53.1
anyhow 1.0.103 1.0.104
uuid 1.23.3 1.26.0
bytes 1.12.0 1.12.1
http-body-util 0.1.3 0.1.5
base64 0.22.1 0.23.1
moka 0.12.15 0.12.16
bhttp 0.7.2 0.8.0
tokio-util 0.7.18 0.7.19
axum-test 20.1.0 21.0.0
deadpool-postgres 0.14.1 0.14.2
ed25519-dalek 2.2.0 3.0.0
rand 0.10.1 0.10.2
async-trait 0.1.89 0.1.92
serial_test 3.5.0 4.0.1
rustls 0.23.41 0.23.43
aes-gcm 0.10.3 0.11.1
regex 1.12.4 1.13.1
chacha20poly1305 0.10.1 0.11.0
flate2 1.1.9 1.1.10
getrandom 0.4.1 0.4.3
rmcp 1.8.0 3.1.4
jsonwebtoken 10.4.0 11.0.0
dcap-qvl 0.5.2 0.5.3
mockall 0.14.0 0.15.0

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • See full diff in compare view

Updates thiserror from 2.0.18 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)

2.0.19

  • Update to syn 3
Commits
  • b1d5db5 Release 2.0.20
  • c4c3ebd Merge pull request #454 from dtolnay/clippy
  • 2266152 Suppress redundant_field_names clippy lint
  • 2901cfd Raise minimum tested compiler to rust 1.88
  • aa9d91f Update ui tests for version 2.0.19
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates futures from 0.3.32 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits

Updates tokio-stream from 0.1.18 to 0.1.19

Commits
  • bc0933c chore: prepare tokio-stream v0.1.19 (#8310)
  • e3786d0 readme: remove obsolete TokioConf notices (#8311)
  • f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
  • 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
  • ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
  • 75fef53 chore: prepare Tokio v1.53.1 (#8303)
  • ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
  • eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
  • 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
  • a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
  • Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

  • signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

  • time: fix alt timer cancellation and insertion race (#8252)

Documented

  • runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

Updates anyhow from 1.0.103 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

  • Update syn dev-dependency to version 3
Commits

Updates uuid from 1.23.3 to 1.26.0

Release notes

Sourced from uuid's releases.

v1.26.0

What's Changed

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

... (truncated)

Commits
  • cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
  • 34e4f49 don't test macros under miri
  • d9e7242 update nightly used for miri
  • ec16819 prepare for 1.26.0 release
  • 162cd20 Merge pull request #904 from ChrisJr404/v7-additional-precision-bits
  • 97eceff Add ContextV7::with_additional_precision_bits for microsecond clocks
  • 302e0bf Merge pull request #903 from uuid-rs/cargo/1.25.0
  • b7ccde8 prepare for 1.25.0 release
  • c62dffb Merge pull request #902 from ChrisJr404/serde-bytes-module
  • 8c198b2 Add a serde::bytes module that encodes as a byte string
  • Additional commits viewable in compare view

Updates bytes from 1.12.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Commits

Updates http-body-util from 0.1.3 to 0.1.5

Release notes

Sourced from http-body-util's releases.

http-body-util-v0.1.4

What's Changed

  • Add Fused body combinator that always returns None once completed.
  • Add BodyExt::into_stream() to convert a body into a Stream.
  • Add Full::into_inner() to get the full Buf.
  • Add InspectFrame and InspectErr combinators.
Commits

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates moka from 0.12.15 to 0.12.16

Release notes

Sourced from moka's releases.

v0.12.16

Version 0.12.16

Fixed

  • Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592gh-pull-0592 by @​kim-jhyeon, reported in #590gh-issue-0590):
    • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
    • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
    • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

Changed

  • Worked around a ThreadSanitizer false positive (#602gh-pull-0602):
    • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
    • std::sync::Arc has a similar workaround.
  • Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603gh-pull-0603):
    • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
    • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.
Changelog

Sourced from moka's changelog.

Version 0.12.16

Fixed

  • Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592[gh-pull-0592] by [@​kim-jhyeon][gh-kim-jhyeon], reported in #590[gh-issue-0590]):
    • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
    • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
    • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

Changed

  • Worked around a ThreadSanitizer false positive (#602[gh-pull-0602]):
    • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
    • std::sync::Arc has a similar workaround.
  • Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603[gh-pull-0603]):
    • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
    • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.
Commits
  • a616ec1 Merge pull request #604 from moka-rs/chore/bump-v0.12.16
  • 3b140a6 Bump the version to v0.12.16
  • 51b802d Merge pull request #603 from moka-rs/bump-crossbeam-epoch-floor
  • 4f90716 Raise the minimum crossbeam-epoch version to 0.9.20
  • 08d0e04 Merge pull request #602 from moka-rs/gh600-tsan-workaround
  • 14447a7 Restructure the v0.12.16 TSan workaround CHANGELOG entry
  • 7b14c37 Avoid a TSan false positive by replacing the fence in MiniArc::drop
  • 05b37c6 Merge pull request #599 from moka-rs/gh590-deterministic-tests
  • fc31858 Replace private doc references in gh590 test comments
  • 5743592 Improve the v0.12.16 CHANGELOG entry
  • Additional commits viewable in compare view

Updates bhttp from 0.7.2 to 0.8.0

Commits
  • 84f59d0 Update version to 0.8.0
  • e18790c Merge pull request #90 from martinthomson/hpke-update
  • 7ad4f7b Fix MSRV in CI
  • e9c0c0c Add X-Wing support to that batch of changes
  • a767165 Take some of rozbb's updates
  • ab10b68 Reformat debug check
  • b97e089 Minor fixes
  • 9a988f3 Merge pull request #95 from m-kus/feat/p-256-kem
  • 4eb64ff Add support for DHKEM(P-256, HKDF-SHA256)
  • 600931b Automatically work out what the MSRV is for pre-commit
  • Additional commits viewable in compare view

Updates futures-util from 0.3.32 to 0.3.34

Release notes

Sourced from futures-util's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures-util's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits

Updates tokio-util from 0.7.18 to 0.7.19

Commits
  • f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
  • 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
  • ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
  • 75fef53 chore: prepare Tokio v1.53.1 (#8303)
  • ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
  • eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
  • 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
  • a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
  • be689a3 chore: prepare Tokio v1.53.0 (#8294)
  • 50f76c7 chore: prepare tokio-macros v2.7.1 (#8295)
  • Additional commits viewable in compare view

Updates axum-test from 20.1.0 to 21.0.0

Commits

Updates deadpool-postgres from 0.14.1 to 0.14.2

Commits
  • bba260f Release all deadpool crates
  • f417aa5 Bump up MSRV of deadpool-redis and redis
  • 2c9ed6f Update async-memcached dependency to version 0.7
  • 7b09e63 Bump up MSRV of deadpool-diesel
  • a37ba58 Update itertools dependency to version 0.15
  • 85d3405 Coalesce concurrent statement preparation
  • f2728ab Extract statement cache into its own module
  • 790881b Add script for running cargo for all crates
  • f7a5037 Add script for checking reexports
  • 256801a Fix "variable does not need to be mutable" warning
  • Additional commits viewable in compare view

Updates ed25519-dalek from 2.2.0 to 3.0.0

Changelog

Sourced from ed25519-dalek's changelog.

3.0.0

  • Update the digest dependency to 0.9. This requires a major version because the digest traits are part of the public API, but there are otherwise no changes to the API.

2.1.0

  • Make Scalar::from_bits a const fn, allowing its use in const contexts.

2.0.0

  • Fix a data modeling error in the serde feature pointed out by Trevor Perrin which caused points and scalars to be serialized with length fields rather than as fixed-size 32-byte arrays. This is a breaking change, but it fixes compatibility with serde-json and ensures that the serde-bincode encoding matches the conventional encoding for X/Ed25519.
  • Update rand_core to 0.5, allowing use with new rand versions.
  • Switch from clear_on_drop to zeroize (by Tony Arcieri).
  • Require subtle = ^2.2.1 and remove the note advising nightly Rust, which is no longer required as of that version of subtle. See the subtle changelog for more details.
  • Update README.md for 2.x series.
  • Remove the build.rs hack which loaded the entire crate into its own build.rs to generate constants, and keep the constants in the source code.

The only significant change is the data model change to the serde feature; besides the rand_core version bump, there are no other user-visible changes.

1.2.4

  • Specify a semver bound for clear_on_drop rather than an exact version, addressing an issue where changes to inline assembly in rustc prevented clear_on_drop from working without an update.

1.2.3

  • Fix an issue identified by a Quarkslab audit (and Jack Grigg), where manually constructing unreduced Scalar values, as needed for X/Ed25519, and then performing scalar/scalar arithmetic could compute incorrect results.
  • Switch to upstream Rust intrinsics for the IFMA backend now that they exist in Rust and don't need to be defined locally.
  • Ensure that the NAF computation works correctly, even for parameters never used elsewhere in the codebase.
  • Minor refactoring to EdwardsPoint decompression.
  • Fix broken links in documentation.
  • Fix compilation on nightly broken due to changes to the #[doc(include)] path root (not quite correctly done in 1.2.2).

1.2.2

... (truncated)

Commits
  • 6d96eb7 Bump version to 3.0.0.
  • c68b30f Merge pull request #330 from isislovecruft/fix/move-coc
  • 2ee6193 Merge pull request #327 from huitseeker/digests-0.9
  • 91a0fae Move CoC section from CONTRIBUTING.md to new file.
  • 5038fcf Merge pull request #308 from isislovecruft/fix/pippenger-typo
  • 6afd8ff Update sha2, digest to 0.9
  • 3cc13a7 Merge branch 'master' into develop
  • c4824e1 Merge branch 'release/2.1.0'
  • 3fc47ef Bump version to 2.1.0
  • f04b830 Merge branch 'master' into develop
  • Additional commits viewable in compare view

Updates rand from 0.10.1 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

Description has been truncated

@dependabot
deps: bump the rust-dependencies group across 1 directory with 33 upd…
ce4ce01 
…ates

Bumps the rust-dependencies group with 30 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.20` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [futures](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.34` |
| [tokio-stream](https://github.com/tokio-rs/tokio) | `0.1.18` | `0.1.19` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.103` | `1.0.104` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.3` | `1.26.0` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.12.0` | `1.12.1` |
| [http-body-util](https://github.com/hyperium/http-body) | `0.1.3` | `0.1.5` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [moka](https://github.com/moka-rs/moka) | `0.12.15` | `0.12.16` |
| [bhttp](https://github.com/martinthomson/ohttp) | `0.7.2` | `0.8.0` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.18` | `0.7.19` |
| [axum-test](https://github.com/JosephLenton/axum-test) | `20.1.0` | `21.0.0` |
| [deadpool-postgres](https://github.com/deadpool-rs/deadpool) | `0.14.1` | `0.14.2` |
| [ed25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) | `2.2.0` | `3.0.0` |
| [rand](https://github.com/rust-random/rand) | `0.10.1` | `0.10.2` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.92` |
| [serial_test](https://github.com/palfrey/serial_test) | `3.5.0` | `4.0.1` |
| [rustls](https://github.com/rustls/rustls) | `0.23.41` | `0.23.43` |
| [aes-gcm](https://github.com/RustCrypto/AEADs) | `0.10.3` | `0.11.1` |
| [regex](https://github.com/rust-lang/regex) | `1.12.4` | `1.13.1` |
| [chacha20poly1305](https://github.com/RustCrypto/AEADs) | `0.10.1` | `0.11.0` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` |
| [getrandom](https://github.com/rust-random/getrandom) | `0.4.1` | `0.4.3` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `1.8.0` | `3.1.4` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` |
| [dcap-qvl](https://github.com/Phala-Network/dcap-qvl) | `0.5.2` | `0.5.3` |
| [mockall](https://github.com/asomers/mockall) | `0.14.0` | `0.15.0` |



Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `thiserror` from 2.0.18 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.20)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `futures` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `tokio-stream` from 0.1.18 to 0.1.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-stream-0.1.18...tokio-stream-0.1.19)

Updates `tokio` from 1.52.3 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1)

Updates `anyhow` from 1.0.103 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.103...1.0.104)

Updates `uuid` from 1.23.3 to 1.26.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.3...v1.26.0)

Updates `bytes` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.12.0...v1.12.1)

Updates `http-body-util` from 0.1.3 to 0.1.5
- [Release notes](https://github.com/hyperium/http-body/releases)
- [Commits](hyperium/http-body@http-body-util-v0.1.3...http-body-util-v0.1.5)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `moka` from 0.12.15 to 0.12.16
- [Release notes](https://github.com/moka-rs/moka/releases)
- [Changelog](https://github.com/moka-rs/moka/blob/main/CHANGELOG.md)
- [Commits](moka-rs/moka@v0.12.15...v0.12.16)

Updates `bhttp` from 0.7.2 to 0.8.0
- [Commits](martinthomson/ohttp@v0.7.2...v0.8.0)

Updates `futures-util` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `tokio-util` from 0.7.18 to 0.7.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-util-0.7.18...tokio-util-0.7.19)

Updates `axum-test` from 20.1.0 to 21.0.0
- [Release notes](https://github.com/JosephLenton/axum-test/releases)
- [Commits](https://github.com/JosephLenton/axum-test/commits)

Updates `deadpool-postgres` from 0.14.1 to 0.14.2
- [Changelog](https://github.com/deadpool-rs/deadpool/blob/main/release.toml)
- [Commits](deadpool-rs/deadpool@deadpool-postgres-v0.14.1...deadpool-postgres-v0.14.2)

Updates `ed25519-dalek` from 2.2.0 to 3.0.0
- [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases)
- [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/3.0.0/CHANGELOG.md)
- [Commits](dalek-cryptography/curve25519-dalek@ed25519-2.2.0...3.0.0)

Updates `rand` from 0.10.1 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.10.1...0.10.2)

Updates `async-trait` from 0.1.89 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.89...0.1.92)

Updates `serial_test` from 3.5.0 to 4.0.1
- [Release notes](https://github.com/palfrey/serial_test/releases)
- [Commits](palfrey/serial_test@v3.5.0...v4.0.1)

Updates `rustls` from 0.23.41 to 0.23.43
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.41...v/0.23.43)

Updates `aes-gcm` from 0.10.3 to 0.11.1
- [Commits](RustCrypto/AEADs@aes-gcm-v0.10.3...aes-gcm-v0.11.1)

Updates `regex` from 1.12.4 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.4...1.13.1)

Updates `futures-core` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `http` from 1.4.1 to 1.5.0
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](hyperium/http@v1.4.1...v1.5.0)

Updates `chacha20poly1305` from 0.10.1 to 0.11.0
- [Commits](RustCrypto/AEADs@chacha20poly1305-v0.10.1...chacha20poly1305-v0.11.0)

Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.9...1.1.10)

Updates `getrandom` from 0.4.1 to 0.4.3
- [Changelog](https://github.com/rust-random/getrandom/blob/master/CHANGELOG.md)
- [Commits](rust-random/getrandom@v0.4.1...v0.4.3)

Updates `rmcp` from 1.8.0 to 3.1.4
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v1.8.0...rmcp-v3.1.4)

Updates `jsonwebtoken` from 10.4.0 to 11.0.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0)

Updates `dcap-qvl` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/Phala-Network/dcap-qvl/releases)
- [Commits](Phala-Network/dcap-qvl@v0.5.2...v0.5.3)

Updates `mockall` from 0.14.0 to 0.15.0
- [Changelog](https://github.com/asomers/mockall/blob/master/CHANGELOG.md)
- [Commits](asomers/mockall@v0.14.0...v0.15.0)

---
updated-dependencies:
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: futures
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tokio-stream
  dependency-version: 0.1.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: uuid
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: http-body-util
  dependency-version: 0.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: moka
  dependency-version: 0.12.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: bhttp
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: futures-util
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tokio-util
  dependency-version: 0.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: axum-test
  dependency-version: 21.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: deadpool-postgres
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: ed25519-dalek
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: async-trait
  dependency-version: 0.1.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serial_test
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: rustls
  dependency-version: 0.23.43
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: aes-gcm
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: futures-core
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: http
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: chacha20poly1305
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: getrandom
  dependency-version: 0.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: rmcp
  dependency-version: 3.1.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: jsonwebtoken
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: dcap-qvl
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: mockall
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 31, 2026
@dependabot
dependabot Bot had a problem deploying to Cloud API test env August 31, 2026 14:01 Failure
@ironloopai

ironloopai Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Review · Status

🟩 Completed

IronLoop completed the review and posted it to GitHub.

Result

Open submitted review →

Run details
  • Run: 71ab8a16-d0c4-4cdb-a32d-edf4493c1bd9
  • Base: main at 753ea3e
  • Head: dependabot/cargo/rust-dependencies-1a9ff7dbfb at ce4ce01
  • Created: 2026-08-31 14:06 UTC
  • Updated: 2026-08-31 14:24 UTC

Automatic trigger · attempt 1 of 3 · completed in 18m 4s

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

✅ OpenCodeReview: Review failed: 0 finding(s); 5 of 5 selected item(s) failed.

ironloopai[bot]
ironloopai Bot reviewed Aug 31, 2026
View reviewed changes

@ironloopai ironloopai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review · Summary

The dependency bump introduces five build-blocking compatibility regressions across services, database, and test targets.

Findings: 🔴 High 3 · 🟠 Medium 2

Code-specific findings are attached to the diff.

Validation
  • ❌ Declared Rust compatibility — Rust 1.92.0 rejects serial_test 4.0.1 because that release requires Rust 1.93.1.
  • ❌ Dependency API build — Source-level compilation past the version gate fails in services due to the rmcp, aes-gcm, and ed25519-dalek upgrades.
  • ❌ Deadpool version compatibility — The resolved deadpool 0.12/0.13 split reproduces incompatible Runtime types at the database pool boundary.
Review details
  • Run: 71ab8a16-d0c4-4cdb-a32d-edf4493c1bd9
  • Attempts: 1

Comment thread crates/services/Cargo.toml
tokio-stream = "0.1"
# MCP protocol
rmcp = { version = "1.5", features = [
rmcp = { version = "3.1", features = [

@ironloopai ironloopai Bot Aug 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Migrate the MCP model type before upgrading rmcp

rmcp 3 no longer exports rmcp::model::Content, but the services MCP ports still re-export and implement helpers for that type. This makes the services crate fail to compile and blocks downstream crates. Keep the 1.x dependency or complete the migration to rmcp 3’s content model.

Comment thread crates/services/Cargo.toml
aws-sdk-s3 = { version = "1.134", default-features = false, features = ["sigv4a", "http-1x", "default-https-client", "rt-tokio"] }
# Encryption for file storage
aes-gcm = "0.10"
aes-gcm = "0.11"

@ironloopai ironloopai Bot Aug 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Update the AES-GCM randomness import for 0.11

aes-gcm 0.11 no longer exposes OsRng from aes_gcm::aead, while the existing services file-encryption code still imports it there (and database field encryption has the same import). The services crate therefore has an unresolved import whenever it builds. Migrate the entropy source/API in both crates or retain a compatible aes-gcm version.

Comment thread Cargo.lock
"async-trait",
"deadpool",
"getrandom 0.2.16",
"deadpool 0.13.1",

@ironloopai ironloopai Bot Aug 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Keep the direct deadpool dependency aligned

This lockfile update makes deadpool-postgres use deadpool 0.13.1 while the database crate directly uses deadpool 0.12. Database code passes deadpool::Runtime and QueueMode into deadpool-postgres APIs, so the values now come from distinct crate versions and fail type checking. Upgrade and migrate the direct dependency together, or retain the prior deadpool-postgres resolution.

Comment thread crates/services/Cargo.toml
dstack-sdk = "0.1.3"
dstack-sdk-types = "0.1.2"
ed25519-dalek = { version = "2.1", features = ["rand_core"] }
ed25519-dalek = { version = "3.0", features = ["rand_core"] }

@ironloopai ironloopai Bot Aug 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Medium · Align rand_core with ed25519-dalek 3

ed25519-dalek 3 expects its RNG traits from rand_core 0.10, but services still passes rand_core 0.6’s OsRng to SigningKey::generate in the debug/test signing-key path. The incompatible traits cause debug and test builds to fail. Upgrade and migrate the RNG dependency/API together, or keep a compatible dalek version.

Comment thread crates/config/Cargo.toml
[dev-dependencies]
tempfile = "3.27"
serial_test = "3.4"
serial_test = "4.0"

@ironloopai ironloopai Bot Aug 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Medium · Do not select serial_test 4 with Rust 1.92

The repository declares Rust 1.92.0, but the newly locked serial_test 4.0.1 requires Rust 1.93.1. Cargo rejects the dependency graph before the config and inference-provider test targets compile. Keep a compatible 3.x release or raise the repository toolchain in a coordinated change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ironloopai ironloopai[bot] ironloopai[bot] left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants