Skip to content

chore(deps): Bump the cargo-minor-patch group across 1 directory with 11 updates - #2638

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-a01df62a6e
Open

chore(deps): Bump the cargo-minor-patch group across 1 directory with 11 updates#2638
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-patch-a01df62a6e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo-minor-patch group with 11 updates in the / directory:

Package From To
aws-lc-rs 1.18.2 1.19.0
pest 2.8.5 2.9.5
napi 3.15.0 3.16.1
napi-derive 3.6.13 3.7.0
rustix 1.1.5 1.1.6
russh 0.65.0 0.65.1
signal-hook 0.4.5 0.4.6
tree-sitter 0.27.1 0.27.2
ureq 3.5.0 3.5.1
uuid 1.28.0 1.29.1
wat 1.262.0 1.263.0

Updates aws-lc-rs from 1.18.2 to 1.19.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

  • Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
    • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
  • Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
    • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
  • Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
    • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
  • Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
    • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
  • Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
    • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
    • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

  • aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
  • aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

  • Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
    • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
    • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
  • Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
    • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

Other Merged PRs

New Contributors

... (truncated)

Commits

Updates pest from 2.8.5 to 2.9.5

Release notes

Sourced from pest's releases.

v2.9.5

What's Changed

Full Changelog: pest-parser/pest@v2.9.4...v2.9.5

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

pest 2.9.3 and 2.9.4 required a stacker dependency which relies on a C compiler toolchain; this was made optional for non-native targets and can be opt-in enabled with the feature flag in those targets (see native stack guard notes in README):

...
pest = { version = "2.9.5", features = ["stack-guard"] }

v2.9.4

What's Changed

New Contributors

Full Changelog: pest-parser/pest@v2.9.3...v2.9.4

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:

...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

v2.9.3

What's Changed

... (truncated)

Commits

Updates napi from 3.15.0 to 3.16.1

Release notes

Sourced from napi's releases.

napi-v3.16.1

Fixed

  • (napi) avoid a deadlock when a worker loads the addon during block_on (#3670)

napi-v3.16.0

Added

  • (napi) support well-known symbol keys for class members (#3665)
  • (napi) support symbol_for keys for class members (#3661)

Fixed

  • (napi) compact class identity metadata (#3667)
  • (napi) keep the registered classes when a later load fails (#3666)
  • (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)
  • (napi) free threadsafe function call data when the call fails (#3656)
Commits
  • 417375a chore: release (#3671)
  • 9ffcf8d build(deps): bump qs from 6.16.0 to 6.17.1 (#3669)
  • 8a89547 fix(napi): avoid a deadlock when a worker loads the addon during block_on (...
  • eec0c64 chore(deps): update dependency oxfmt to ^0.75.0 (#3660)
  • f89400d chore: release (#3637)
  • 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
  • 9188219 chore(deps): update dependency electron to v45 (#3634)
  • 1d93a4e fix(napi): compact class identity metadata (#3667)
  • e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
  • cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
  • Additional commits viewable in compare view

Updates napi-derive from 3.6.13 to 3.7.0

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.7.0

Added

  • (napi) support well-known symbol keys for class members (#3665)
  • (napi) support symbol_for keys for class members (#3661)

Fixed

  • (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)
Commits
  • f89400d chore: release (#3637)
  • 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
  • 9188219 chore(deps): update dependency electron to v45 (#3634)
  • 1d93a4e fix(napi): compact class identity metadata (#3667)
  • e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
  • cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
  • c01ce60 fix(napi): free define_class closures, honour static flags, avoid TS1016 in c...
  • 5a49dad feat(napi): support symbol_for keys for class members (#3661)
  • 0c58903 fix(napi): free threadsafe function call data when the call fails (#3656)
  • ada66a3 chore(deps): update release-plz/action action to v0.5.147 (#3659)
  • Additional commits viewable in compare view

Updates rustix from 1.1.5 to 1.1.6

Commits
  • 4a563ad chore: Release rustix version 1.1.6
  • 8e6aaa6 Merge commit from fork
  • 4686873 fix: expose additional termios output mode flags (#1709)
  • c9ad9d3 fix(net): don't trust cmsg_len past the end of a truncated control buffer (...
  • 98358af Avoid constructing a zero Pid in tcgetpgrp on non-Linux targets (#1710)
  • 664aeae fix(net): use IPPROTO_IPV6 for IPV6_MULTICAST_HOPS (#1692)
  • bf78ee6 freebsd: Fix cfg gates for FreeBSD 12 (#1707)
  • b3d81bd Fix fallocate on Apple platforms. (#1708)
  • 915ab6f fix(fs): Set proper inotify WatchFlags values on libc backend (#1714)
  • 52d5db7 Use 32-bit UID/GID syscalls on arm, sparc, and x86 (#1716)
  • Additional commits viewable in compare view

Updates russh from 0.65.0 to 0.65.1

Release notes

Sourced from russh's releases.

v0.65.1

Security fixes

GHSA-736f-c93q-9fwx - agent lock status not checked after confirmation wait

Agent lock status is now rechecked after the confirmation await again.

GHSA-9264-jvgf-6w2f - kex_done called before host-key verification

client::Handler::kex_done is now only called after server host key verification succeeds

Fixes

  • 20c5a93: fix(keys): keep the comment when loading a public key file (#801) (@​JakeHuneau) #801
    • load_public_key now keeps the comment from an OpenSSH public key file, so key.comment() returns it and to_openssh() round-trips. Fixes #713.
  • 3a21566: fix(client): accept non-canonical ECDSA P-521 signature mpints after strict decode fails (#803) (@​gugahartmann) #803
    • Fixes key exchange against servers such as the Huawei S6720, which pad P-521 signature scalars with extra leading zero bytes.
  • a6be9ba: fix(cipher): count the MAC tag in the minimum packet length check (#802) (@​JakeHuneau) #802
    • Fixes valid packets being rejected when an EtM MAC is in use. Fixes #787.
  • 43a46d6: fix(AgentClient): propagate method errors (#808) (@​mdevolde) #808
    • add_smartcard_key, lock, unlock, remove_identity, remove_smartcard_key and extension now return the agent's failure response as an error. Before, they always returned Ok(()).
  • 7c59594: fix(server): let Dropbear through strict kex by accounting for the ignored first_kex_packet_follows guess (#805) (@​NatLee) #805
    • Fixes Dropbear clients failing to connect when strict key exchange is on. Fixes #804.

Dependencies

  • d10345d: deps: trim aws-lc-rs features to avoid transitive deps (#809) (@​sepointon) #809
    • Removes the unused ring-compatible API of aws-lc-rs and the old untrusted crate it pulled in.
  • 0a8cc28: deps: remove dep on generic-array 0.14 compat (#810) (@​sepointon) #810

New Contributors

Full Changelog: Eugeny/russh@v0.65.0...v0.65.1

Commits
  • b33092a v0.65.1
  • 20c5a93 fix(keys): keep the comment when loading a public key file (#801)
  • 3a21566 fix(client): accept non-canonical ECDSA P-521 signature mpints after strict d...
  • a6be9ba fix(cipher): count the MAC tag in the minimum packet length check (#802)
  • 43a46d6 fix(AgentClient): propagate method errors (#808)
  • 56384e6 add Eric-D as a contributor for code (#799)
  • 7c59594 fix(server): let Dropbear through strict kex by accounting for the ignored fi...
  • d10345d deps: trim aws-lc-rs features to avoid transitive deps (#809)
  • 0a8cc28 deps: remove dep on generic-array 0.14 compat (#810)
  • 92562d3 tests: adapt to VerifiedPublicKey after #785 (#807)
  • See full diff in compare view

Updates signal-hook from 0.4.5 to 0.4.6

Changelog

Sourced from signal-hook's changelog.

0.4.6

  • Allow registering 'static flags in addition to Arc ones (#215, #180).
Commits

Updates tree-sitter from 0.27.1 to 0.27.2

Release notes

Sourced from tree-sitter's releases.

v0.27.2

What's Changed

Full Changelog: tree-sitter/tree-sitter@v0.27.1...v0.27.2

Commits
  • 3fb7be4 release v0.27.2
  • a7fd3a5 build(deps): bump wasmtime-c-api to v48.0.8
  • 270e885 fix(xtask): use zig fetch --save to update wasmtime in build.zig.zon
  • 292f963 build(zig): support Zig 0.17
  • f4739f9 fix(make): don't remove tree-sitter dir on uninstall
  • df4c34e fix(generate): preserve reserved-word behavior when merging states
  • d0051f8 fix(rust): address new unnecessary-box-pin lint
  • c2a14c7 fix(lib): retain siblings during byte-based child lookup
  • cfebeaa fix(lib): preserve descendant indices during reverse cursor traversal
  • bbc0e28 fix(lib): handle large child indices in reverse cursor traversal
  • Additional commits viewable in compare view

Updates ureq from 3.5.0 to 3.5.1

Changelog

Sourced from ureq's changelog.

3.5.1

  • Bump ureq-proto to 0.7.1 (fixes to connection reuse and transfer encoding) #1224
  • Send only cookie names and values in request Cookie headers #1222
  • Preserve readable responses after macOS rejects timeout changes on closed sockets #1220
Commits
  • 33ca9d3 3.5.1
  • d1b194c Bump ureq-proto to 0.7.1
  • 81d1b40 Bump ureq-proto to 0.7.0
  • 0cbee9a docs: clarify body read limit defaults (#1223)
  • f92baae Send only cookie names and values in the Cookie header
  • f60896d Preserve readable responses after macOS timeout setter failures
  • See full diff in compare view

Updates uuid from 1.28.0 to 1.29.1

Release notes

Sourced from uuid's releases.

v1.29.1

What's Changed

Full Changelog: uuid-rs/uuid@v1.29.0...v1.29.1

v1.29.0

What's Changed

Full Changelog: uuid-rs/uuid@v1.28.0...v1.29.0

Commits
  • 0fe2dab Merge pull request #927 from uuid-rs/cargo/v1.29.1
  • 8896d2e prepare for 1.29.1 release
  • 2eef370 Merge pull request #926 from uuid-rs/fix/timestamp-edges
  • de33fde fix up several bugs in v7 monotonicity raised by automated scanning
  • 7c7326d Merge pull request #923 from uuid-rs/fix/deprecate-borsh
  • 13e1ff0 deprecate the borsh feature of uuid in favour of a uuid feature in borsh
  • 4eba67b Merge pull request #921 from uuid-rs/chore/lint-fixup
  • 8a052e0 resolve some clippy lints
  • 3d24508 bump gungruan version
  • c097ab7 remove some deprecated attrs and resolve Cargo lints
  • Additional commits viewable in compare view

Updates wat from 1.262.0 to 1.263.0

Release notes

Sourced from wat's releases.

v1.263.0

What's Changed

New Contributors

Full Changelog: bytecodealliance/wasm-tools@v1.262.0...v1.263.0

Commits
  • 7a2fa42 Release wasm-tools 1.263.0 (#2803)
  • e5095e9 wasm-wave: require commas between record/flag/map entries per the grammar (#2...
  • 25a937a wit-parser: fix panics decoding WIT from components (#2794)
  • e6e6991 Implement the multibyte-array-access proposal (#2800)
  • cc0d3b7 wast: parse core rec groups in component and instance types (#2798)
  • 24de91c wasmprinter: fix outer aliases that print unparsable or shadowed identifiers ...
  • 23dc76b Implement the acquire-release-atomics proposal (#2799)
  • ebcc07c Plumb wasm features through reencoding/printing (#2797)
  • 2e6b2d6 Reject handles in the value types of maps (#2791)
  • 8c7a8e6 Move recursion in wasmprinter to the heap (#2790)
  • Additional commits viewable in compare view

@dependabot
dependabot Bot requested a review from jeremi as a code owner November 10, 2026 17:39
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Rust implementation work. labels Nov 10, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T02:31:49.801368Z b0bfdaa New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@dependabot
chore(deps): Bump the cargo-minor-patch group across 1 directory with…
b0bfdaa 
… 11 updates

Bumps the cargo-minor-patch group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.18.2` | `1.19.0` |
| [pest](https://github.com/pest-parser/pest) | `2.8.5` | `2.9.5` |
| [napi](https://github.com/napi-rs/napi-rs) | `3.15.0` | `3.16.1` |
| [napi-derive](https://github.com/napi-rs/napi-rs) | `3.6.13` | `3.7.0` |
| [rustix](https://github.com/bytecodealliance/rustix) | `1.1.5` | `1.1.6` |
| [russh](https://github.com/warp-tech/russh) | `0.65.0` | `0.65.1` |
| [signal-hook](https://github.com/vorner/signal-hook) | `0.4.5` | `0.4.6` |
| [tree-sitter](https://github.com/tree-sitter/tree-sitter) | `0.27.1` | `0.27.2` |
| [ureq](https://github.com/algesten/ureq) | `3.5.0` | `3.5.1` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.28.0` | `1.29.1` |
| [wat](https://github.com/bytecodealliance/wasm-tools) | `1.262.0` | `1.263.0` |



Updates `aws-lc-rs` from 1.18.2 to 1.19.0
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@v1.18.2...v1.19.0)

Updates `pest` from 2.8.5 to 2.9.5
- [Release notes](https://github.com/pest-parser/pest/releases)
- [Commits](pest-parser/pest@v2.8.5...v2.9.5)

Updates `napi` from 3.15.0 to 3.16.1
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](napi-rs/napi-rs@napi-v3.15.0...napi-v3.16.1)

Updates `napi-derive` from 3.6.13 to 3.7.0
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](napi-rs/napi-rs@napi-derive-v3.6.13...napi-derive-v3.7.0)

Updates `rustix` from 1.1.5 to 1.1.6
- [Release notes](https://github.com/bytecodealliance/rustix/releases)
- [Changelog](https://github.com/bytecodealliance/rustix/blob/main/CHANGES.md)
- [Commits](bytecodealliance/rustix@v1.1.5...v1.1.6)

Updates `russh` from 0.65.0 to 0.65.1
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.65.0...v0.65.1)

Updates `signal-hook` from 0.4.5 to 0.4.6
- [Changelog](https://github.com/vorner/signal-hook/blob/master/CHANGELOG.md)
- [Commits](vorner/signal-hook@v0.4.5...v0.4.6)

Updates `tree-sitter` from 0.27.1 to 0.27.2
- [Release notes](https://github.com/tree-sitter/tree-sitter/releases)
- [Commits](tree-sitter/tree-sitter@v0.27.1...v0.27.2)

Updates `ureq` from 3.5.0 to 3.5.1
- [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md)
- [Commits](algesten/ureq@3.5.0...3.5.1)

Updates `uuid` from 1.28.0 to 1.29.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.28.0...v1.29.1)

Updates `wat` from 1.262.0 to 1.263.0
- [Release notes](https://github.com/bytecodealliance/wasm-tools/releases)
- [Commits](bytecodealliance/wasm-tools@v1.262.0...v1.263.0)

---
updated-dependencies:
- dependency-name: aws-lc-rs
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: napi
  dependency-version: 3.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: napi-derive
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: pest
  dependency-version: 2.9.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: russh
  dependency-version: 0.65.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: rustix
  dependency-version: 1.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: signal-hook
  dependency-version: 0.4.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: tree-sitter
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: ureq
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor-patch
- dependency-name: uuid
  dependency-version: 1.29.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
- dependency-name: wat
  dependency-version: 1.263.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-minor-patch-a01df62a6e branch from 90c3c3e to b0bfdaa Compare November 11, 2026 02:29

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeremi jeremi Awaiting requested review from jeremi jeremi is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Rust implementation work.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants