Skip to content

chore(deps): bump the cargo group across 1 directory with 5 updates - #110

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-f4b04e43b0
Open

chore(deps): bump the cargo group across 1 directory with 5 updates#110
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-f4b04e43b0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown

Bumps the cargo group with 5 updates in the / directory:

Package From To
rustls 0.23.40 0.23.45
ammonia 4.1.2 4.1.5
quinn-proto 0.11.14 0.11.19
serde_with 3.20.0 3.24.0
xxhash-rust 0.8.15 0.8.19

Updates rustls from 0.23.40 to 0.23.45

Commits
  • 2976d90 Prepare 0.23.45
  • f9d4ee9 Handshake "alignment" check covers previously-received messages
  • c4e92e8 Keep data needed for HRR processing together
  • e553a7a server: TLS1.2 is not available after a HRR
  • 5dff9da Test whether server negotiates TLS1.2 after HRR
  • 185a063 reject a second ClientHello that changes the cipher suite
  • 9fafe6d reject a second ClientHello that drops pre_shared_key
  • 1b42c5f providers: zeroize private key DER
  • 64ad386 Bump version to 0.23.44
  • 1efbf66 bogo: remove PostQuantum setup
  • Additional commits viewable in compare view

Updates ammonia from 4.1.2 to 4.1.5

Release notes

Sourced from ammonia's releases.

4.1.5

  • fix: apply URL rewrites to CSS url() function
  • Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.1.4

  • fix: SVG animation and set can cause XSS, because attributeName is not checked (reported by Younghun Ko, koyokr)

4.1.3

  • fix: unexpected namespace switches after cleanup on MathML annotation-xml can cause mXSS

Special thanks to Ivan Ivančić (ivan0912, YesWeHack) for finding this vulnerability!

Changelog

Sourced from ammonia's changelog.

4.1.5

  • fix: apply URL rewrites to CSS url() function
  • Security fix: CSS sanitization only ever worked on attributes, not stylesheets. This now panics if you try to enable the style tag while also using style attribute filtering

4.1.4

  • fix: SVG animation and set can cause XSS, because attributeName is not checked (reported by Younghun Ko, koyokr)

4.1.3

  • fix: unexpected namespace switches after cleanup on MathML annotation-xml can cause mXSS (reported by Ivan Ivančić)

  • chore: upgrade to html5ever 0.37.1

  • chore: always strip the contents of selectedcontent elements, since the parser will always replace it with the actual contents anyway

Commits
  • f19b70a Release 4.1.5
  • 8829aa7 Merge pull request #257 from rust-ammonia/release-4.1.5
  • ec5b26e Prevent footgun around style filtering
  • ec0bfbd Fix handling of URLs in CSS background
  • fba7512 Merge pull request #250 from rust-ammonia/release-4.1.4
  • 9e3335e Fix XSS caused by not sanitizing svg animations
  • 7c64409 Merge pull request #249 from rust-ammonia/notriddle-patch-1
  • 75d58d1 Fix credit in changelog by request
  • 06b868a Merge pull request #246 from rust-ammonia/notriddle-patch-1
  • 04ea01a Add credit to changelog
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.14 to 0.11.19

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.19

Fixes several advisories:

What's Changed

quinn-proto 0.11.18, quinn 0.11.12

Three more security issues were reported and fixed since 0.11.17:

What's Changed

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

... (truncated)

Commits
  • 8192ed3 udp: bump version to 0.5.16
  • 6862d3d udp: backport receive error handling to 0.11.x
  • 78d30dc proto: bump version to 0.11.19
  • 73114d8 Check MAX_STREAM_DATA on remote bidi streams against limit
  • a6e78d1 proto: reserve close frame space after large Initial headers
  • 74c33ff proto: reject Initial tokens that prevent packet construction
  • f97fb5a quinn: Wake wait_idle when the endpoint driver is dropped
  • 8ada074 quinn-proto: Pad Initial datagrams to the configured minimum MTU
  • 16ecc70 fix: stale waker in blocked_readers
  • 12d7f07 fix: cleanup state if transmit failed
  • Additional commits viewable in compare view

Updates serde_with from 3.20.0 to 3.24.0

Release notes

Sourced from serde_with's releases.

serde_with v3.24.0

Added

  • Implement JsonSchemaAs for NoneAsEmptyString, so fields using it compile with the schemars_* features (#1014)

Changed

  • Make with_prefix! and with_suffix! available with the alloc feature, instead of only with std (#1008)

Fixed

  • Handle potential panics in deserialization of chrono and time DateTimes. This was privately reported by @​NotAFlightRisk.

serde_with v3.23.0

Changed

  • Update syn and darling dependencies to use syn v3 (#992)
  • Update dev-dependencies to newer versions (#993)
  • Update base64 to a newer version. This should not have any API change, but some error messages might change. (#993)
  • serde_as can now parse cfg_attr(true, ...) and cfg_attr(false, ...) (#995) true/false are new literals as of Rust 1.88 but need to be parsed explicitly with the syn types. This is used when emitting schemars annotations.

serde_with v3.22.0

Added

  • Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

  • Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

... (truncated)

Commits
  • 35ac84c Bump version to 3.24 (#1016)
  • 7b8e561 Bump version to 3.24
  • 6e576c8 Bump the github-actions group with 2 updates (#1012)
  • 7b1814b Add schemars support for NoneAsEmptyString (#1014)
  • 92eeedd Handle potential panic during deserialization for large datetimes (#1015)
  • 3404642 Handle potential panic during deserialization for large datetimes
  • c7073b9 Add schemars support for NoneAsEmptyString
  • 6b32290 Run test with only the alloc feature (#1013)
  • 3361c69 Run test with only the alloc feature
  • b43bb81 Reduce required feature for with_{prefix,suffix} from std to alloc (#1008)
  • Additional commits viewable in compare view

Updates xxhash-rust from 0.8.15 to 0.8.19

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the cargo group across 1 directory with 5 updates
2fa3d55 
Bumps the cargo group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [rustls](https://github.com/rustls/rustls) | `0.23.40` | `0.23.45` |
| [ammonia](https://github.com/rust-ammonia/ammonia) | `4.1.2` | `4.1.5` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.14` | `0.11.19` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.20.0` | `3.24.0` |
| [xxhash-rust](https://github.com/DoumanAsh/xxhash-rust) | `0.8.15` | `0.8.19` |



Updates `rustls` from 0.23.40 to 0.23.45
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.40...v/0.23.45)

Updates `ammonia` from 4.1.2 to 4.1.5
- [Release notes](https://github.com/rust-ammonia/ammonia/releases)
- [Changelog](https://github.com/rust-ammonia/ammonia/blob/v.4.1.5/CHANGELOG.md)
- [Commits](rust-ammonia/ammonia@v4.1.2...v.4.1.5)

Updates `quinn-proto` from 0.11.14 to 0.11.19
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.19)

Updates `serde_with` from 3.20.0 to 3.24.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.20.0...v3.24.0)

Updates `xxhash-rust` from 0.8.15 to 0.8.19
- [Commits](https://github.com/DoumanAsh/xxhash-rust/commits)

---
updated-dependencies:
- dependency-name: rustls
  dependency-version: 0.23.45
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: ammonia
  dependency-version: 4.1.5
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: quinn-proto
  dependency-version: 0.11.19
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: serde_with
  dependency-version: 3.24.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: xxhash-rust
  dependency-version: 0.8.19
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants