Skip to content

build(deps): Bump the rust-dependencies group across 1 directory with 11 updates#51

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-8878bfe497
Open

build(deps): Bump the rust-dependencies group across 1 directory with 11 updates#51
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-8878bfe497

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 11, 2026 •
edited
Loading

Bumps the rust-dependencies group with 11 updates in the / directory:

Package From To
tokio 1.51.1 1.52.3
rustls 0.23.38 0.23.40
rustls-pki-types 1.14.0 1.14.1
reqwest 0.13.2 0.13.3
hickory-resolver 0.25.2 0.26.1
sha2 0.10.9 0.11.0
rcgen 0.14.7 0.14.8
uuid 1.23.0 1.23.1
test-log 0.2.19 0.2.20
webpki-roots 1.0.6 1.0.7
rmcp 1.4.0 1.6.0

Updates tokio from 1.51.1 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

  • sync: fix underflow in mpsc channel len() (#8062)
  • sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
  • sync: require that an RwLock has max_readers != 0 (#8076)
  • sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Tokio v1.52.1

1.52.1 (April 16th, 2026)

Fixed

  • runtime: revert #7757 to fix [a regression]#8056 that causes spawn_blocking to hang (#8057)

#7757: tokio-rs/tokio#7757 #8056: tokio-rs/tokio#8056 #8057: tokio-rs/tokio#8057

Tokio v1.52.0

1.52.0 (April 14th, 2026)

Added

  • io: AioSource::register_borrowed for I/O safety support (#7992)
  • net: add try_io function to unix::pipe sender and receiver types (#8030)

Added (unstable)

  • runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#8010)
  • taskdump: add trace_with() for customized task dumps (#8025)
  • taskdump: allow impl FnMut() in trace_with instead of just fn() (#8040)
  • fs: support io_uring in AsyncRead for File (#7907)

... (truncated)

Commits

Updates rustls from 0.23.38 to 0.23.40

Commits
  • b44c09f Prepare 0.23.40
  • e7a555f Prefer Ord::max to core::cmp
  • c0005be ech: base inner name padding on actual extension
  • 4e49529 ech: test inner name padding
  • 3e06ef1 ech: add both name and "gross" padding
  • c574ffd ech: avoid short-lived allocation for padding
  • 8bf935c ech: pop comment from match arm
  • 9088004 ech: expand maximum_name_length to usize ASAP
  • a612901 Default require_ems based on CryptoProvider FIPS status
  • 0541605 Cargo: version 0.23.38 -> 0.23.39
  • Additional commits viewable in compare view

Updates rustls-pki-types from 1.14.0 to 1.14.1

Release notes

Sourced from rustls-pki-types's releases.

1.14.1

Parsing PEM will now error for PEM sections larger than 256 MB in size, to avoid running out of memory during parsing. The limit was chosen based on historical data from large certificate revocation lists from the web PKI.

What's Changed

Commits
  • bb3c1da Adjust PEM size limit to account for huge CRLs
  • 20bcfe1 Bump version to 1.14.1
  • b796d3d pem: error for sections that are too large
  • 422d8cf Update ECH reference to RFC 9849
  • 14ce65c Remove mention of rustls-pemfile from docs
  • See full diff in compare view

Updates reqwest from 0.13.2 to 0.13.3

Release notes

Sourced from reqwest's releases.

v0.13.3

tl;dr

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.2...v0.13.3

Changelog

Sourced from reqwest's changelog.

v0.13.3

  • Fix CertificateRevocationList parsing of PEM values.
  • Fix logging in resolver to only show host, not full URL.
  • Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
  • Fix HTTP/3 to handle STOP_SENDING as not an error.
  • Fix HTTP/3 pool to remove timed out QUIC connections.
  • Fix HTTP/3 connection establishment picking IPv4 and IPv6.
  • Upgrade rustls-platform-verifier.
  • (wasm) Only use wasm-bindgen on unknown-* targets.
Commits

Updates hickory-resolver from 0.25.2 to 0.26.1

Release notes

Sourced from hickory-resolver's releases.

v0.26.1

This point release for the 0.26 release series brings in several bug fixes, and no user-facing changes. Two security reports are addressed: RUSTSEC-2026-0120 and RUSTSEC-2026-0119.

What's Changed

Full Changelog: hickory-dns/hickory-dns@v0.26.0...v0.26.1

0.26.0

13 months after the release of 0.25.0, we finally have a bigger feature release of Hickory DNS, the suite of DNS libraries and authoritative/recursive name servers written in pure Rust. A lot of work has gone into this release, so we wanted to take a moment to release this before we continue work on deploying the Hickory DNS recursive resolver at Let's Encrypt (and did you see that Hickory is being used in some of Google's Pixel devices?). Because of the ongoing work, we expect that 0.27.0 might happen quite a bit sooner than in 13 months from now.

These release notes describe a number of high-level improvements as well as API changes that are likely to break a larger fraction of our downstream users. Feedback (both on these notes and the release itself) is always welcome in our issue tracker or via our Discord server.

Most of the following notes are broken up by specific components: the server binary and our library crates. However, for this release we've made several changes to the structure of our crates itself:

  • Network protocol support has moved out of the hickory-proto crate, into a new hickory-net crate (#3394); this allows the hickory-proto crate to cleanly focus on message encoding and decoding.
  • The hickory-client crate has been subsumed into hickory-net, in the client module (#3366). No future releases of the hickory-client crate are expected.
  • The hickory-recursor crate has been merged into hickory-resolver (#3370), guarded by a recursor feature which must be enabled explicitly. The recursor implementation was already tightly coupled to the resolver internals, so keeping it separate didn't really make sense.

Additionally, substantial cross-crate changes have been made to improve our error handling:

hickory-dns (the server binary)

hickory-server (the library API)

... (truncated)

Commits
  • f093210 Limit number of names that may be compressed
  • a9b884b Skip search when name compression is disabled
  • 6e70e93 Limit number of name pointers stored in BinEncoder
  • c2bdb8c Add benchmark for encoding message with many names
  • 9e0b528 Bump version to 0.26.1
  • 14cc3c8 net: respect caller timeout for DoT TCP connect
  • fc2e3f4 resolver: release connections lock before TCP/TLS handshake
  • bbdfcd2 Add tests combining NSEC and NSEC3 via CNAME chain
  • 994076b Update rustls-webpki to 0.103.13
  • 3b265fb net: check query name is in zone when building encloser candidates
  • Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates rcgen from 0.14.7 to 0.14.8

Release notes

Sourced from rcgen's releases.

0.14.8

What's Changed

Commits
  • a70f083 Bump version to 0.14.8
  • a32fdb1 Fix encoding of directoryName constraints
  • 7111a79 update key_pair to signing_key
  • 10664c9 Take semver-compatible dependency updates
  • 0ec4d09 Add testing of CSR serializing basic constraints
  • 5f94ef9 Add support for serializing BasicConstraints in CSR's
  • fb835c1 Add writing basic constraints logic
  • 0cf161d Bump codecov/codecov-action from 5 to 6
  • 4909041 Add testing of CSR Params parsing Basic Constraints variants
  • 6675a94 Add support for is_ca in CSR Params
  • Additional commits viewable in compare view

Updates uuid from 1.23.0 to 1.23.1

Release notes

Sourced from uuid's releases.

v1.23.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.0...v1.23.1

Commits
  • ca0c85f Merge pull request #879 from uuid-rs/cargo/v1.23.1
  • b4db015 prepare for 1.23.1 release
  • 771069d Merge pull request #878 from aznashwan/fix-from-gregorian-deprecation-note
  • 80994a2 fix: Timestamp::from_gregorian deprecation note
  • 90c5be8 Merge pull request #877 from guybedford/remove-wasm-bindgen-msrv
  • 8b8c4f4 Remove deprecated feature from wasm-bindgen dependency
  • See full diff in compare view

Updates test-log from 0.2.19 to 0.2.20

Release notes

Sourced from test-log's releases.

v0.2.20

  • Factored out test-log-core crate to facilitate better testing

Full Changelog: d-e-s-o/test-log@v0.2.19...v0.2.20

Changelog

Sourced from test-log's changelog.

0.2.20

  • Factored out test-log-core crate to facilitate better testing
Commits
  • e32ac30 Bump version to 0.2.20
  • d50d529 Simplify 'publish' workflow version detection logic
  • f5f2531 Add output verification tests for log and trace backends
  • 7d6aff4 Add negative tests for invalid #[test_log(...)] attributes
  • 8320310 Add snapshot tests for macro expansion
  • 69da29b Extract core logic into test-log-core library crate
  • a260502 Extend CI to test various feature combinations
  • 053f7cc Use cargo publish --workspace in publish workflow
  • ff7c143 Use cargo-add compliant dependency syntax
  • 16e126d Add direct link to documentation
  • Additional commits viewable in compare view

Updates webpki-roots from 1.0.6 to 1.0.7

Release notes

Sourced from webpki-roots's releases.

1.0.7

For their April 2026 root store changes, Mozilla has made more changes than usual:

These changes are part of Mozilla’s ongoing root store maintenance under the Mozilla Root Store Policy (MRSP), including §7.4 (Root CA Lifecycles) and §7.5.3 (Transition Plans). They reflect a combination of lifecycle-based transitions, CA operator requests, and alignment with intended certificate usage, including retiring older or less suitable root certificates, enforcing clear separation of trust purposes (e.g., TLS vs. S/MIME), and reducing unnecessary trust surface in the Web PKI ecosystem. Collectively, these actions help to ensure that root certificates are relied upon only for their intended and actively maintained use cases, or are retired in accordance with established distrust timelines.

This removes:

  • CN=Certigna O=Dhimyotis
  • CN=COMODO Certification Authority O=COMODO CA Limited
  • CN=DigiCert Assured ID Root CA O=DigiCert Inc OU=www.digicert.com
  • CN=DigiCert Global Root CA O=DigiCert Inc OU=www.digicert.com
  • CN=DigiCert High Assurance EV Root CA O=DigiCert Inc OU=www.digicert.com
  • CN=FIRMAPROFESIONAL CA ROOT-A WEB O=Firmaprofesional SA
  • CN=GTS Root R2 O=Google Trust Services LLC
  • CN=QuoVadis Root CA 2 O=QuoVadis Limited
  • CN=QuoVadis Root CA 3 O=QuoVadis Limited
  • CN=Secure Global CA O=SecureTrust Corporation
  • CN=SecureTrust CA O=SecureTrust Corporation
  • CN=SwissSign Gold CA - G2 O=SwissSign AG
  • CN=TeliaSonera Root CA v1 O=TeliaSonera
  • CN=Trustwave Global Certification Authority O=Trustwave Holdings, Inc.
  • CN=Trustwave Global ECC P256 Certification Authority O=Trustwave Holdings, Inc.
  • CN=Trustwave Global ECC P384 Certification Authority O=Trustwave Holdings, Inc.
  • O=certSIGN OU=certSIGN ROOT CA

See their announcement for more details.

What's Changed

Full Changelog: rustls/webpki-roots@v/1.0.6...v/1.0.7

Commits

Updates rmcp from 1.4.0 to 1.6.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v1.6.0

Fixed

  • (docs) use correct Parameters syntax in tool examples (#814)

Other

  • add systemprompt-template to Built with rmcp (#820)

rmcp-v1.6.0

Added

  • (http) log Host/Origin rejections (#826)
  • (http) add Origin header validation (#823)
  • (router) support runtime disabling of tools (#809)
  • optional session store (resumabillity support) (#775)

Fixed

  • add init_timeout for streamable-http sessions (#811)
  • (http) fall back to :authority for HTTP/2 (#827)
  • (docs) use correct Parameters syntax in tool examples (#814)

Other

  • add systemprompt-template to Built with rmcp (#820)

rmcp-macros-v1.5.0

Fixed

  • (macros) respect local feature in #[prompt] macro — omit + Send bound (#803)

rmcp-v1.5.0

Added

  • (transport) add constructors for non_exhaustive error types (#806)
  • add 2025-11-25 protocol version support (#802)

Fixed

  • treat resource metadata JSON parse failure as soft error (#810)
  • include http_request_id in request-wise priming event IDs (#799)
  • (http) drain SSE stream for connection reuse (#790)

Other

  • (deps) update which requirement from 7 to 8 (#807)
Commits
  • 014fb2e chore: release v1.6.0 (#818)
  • c1e0ead fix: add init_timeout for streamable-http sessions (#811)
  • ef74147 fix(http): fall back to :authority for HTTP/2 (#827)
  • 4cf7873 feat(http): log Host/Origin rejections (#826)
  • fffe138 docs: add systemprompt-template to Built with rmcp (#820)
  • 9753d61 feat(http): add Origin header validation (#823)
  • 63583b1 feat(router): support runtime disabling of tools (#809)
  • 8f696e6 feat: optional session store (resumabillity support) (#775)
  • f6893a7 ci: add semver check job for pull requests (#819)
  • 7eb252a fix(docs): use correct Parameters<T> syntax in tool examples (#814)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): Bump the rust-dependencies group across 1 directory with…
866517c 
… 11 updates

Bumps the rust-dependencies group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.51.1` | `1.52.3` |
| [rustls](https://github.com/rustls/rustls) | `0.23.38` | `0.23.40` |
| [rustls-pki-types](https://github.com/rustls/pki-types) | `1.14.0` | `1.14.1` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.2` | `0.13.3` |
| [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.25.2` | `0.26.1` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [rcgen](https://github.com/rustls/rcgen) | `0.14.7` | `0.14.8` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.0` | `1.23.1` |
| [test-log](https://github.com/d-e-s-o/test-log) | `0.2.19` | `0.2.20` |
| [webpki-roots](https://github.com/rustls/webpki-roots) | `1.0.6` | `1.0.7` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `1.4.0` | `1.6.0` |



Updates `tokio` from 1.51.1 to 1.52.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.51.1...tokio-1.52.3)

Updates `rustls` from 0.23.38 to 0.23.40
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.38...v/0.23.40)

Updates `rustls-pki-types` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/rustls/pki-types/releases)
- [Commits](rustls/pki-types@v/1.14.0...v/1.14.1)

Updates `reqwest` from 0.13.2 to 0.13.3
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.13.2...v0.13.3)

Updates `hickory-resolver` from 0.25.2 to 0.26.1
- [Release notes](https://github.com/hickory-dns/hickory-dns/releases)
- [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md)
- [Commits](hickory-dns/hickory-dns@v0.25.2...v0.26.1)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `rcgen` from 0.14.7 to 0.14.8
- [Release notes](https://github.com/rustls/rcgen/releases)
- [Commits](rustls/rcgen@v0.14.7...v0.14.8)

Updates `uuid` from 1.23.0 to 1.23.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.0...v1.23.1)

Updates `test-log` from 0.2.19 to 0.2.20
- [Release notes](https://github.com/d-e-s-o/test-log/releases)
- [Changelog](https://github.com/d-e-s-o/test-log/blob/main/CHANGELOG.md)
- [Commits](d-e-s-o/test-log@v0.2.19...v0.2.20)

Updates `webpki-roots` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/rustls/webpki-roots/releases)
- [Commits](rustls/webpki-roots@v/1.0.6...v/1.0.7)

Updates `rmcp` from 1.4.0 to 1.6.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v1.4.0...rmcp-v1.6.0)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.52.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rustls
  dependency-version: 0.23.40
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: rustls-pki-types
  dependency-version: 1.14.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: reqwest
  dependency-version: 0.13.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: hickory-resolver
  dependency-version: 0.26.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rcgen
  dependency-version: 0.14.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: uuid
  dependency-version: 1.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: test-log
  dependency-version: 0.2.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: webpki-roots
  dependency-version: 1.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: rmcp
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 11, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 11, 2026

Coverage Report

Threshold: 90% line coverage | Full LCOV report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants