[dependabot]

Bumps zstd from 0.13.4 to 0.14.3.

Commits

• 75bc740 Release zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2
• 1c580b6 zstd-safe: keep the one-shot reset check inline
• 502ee2f zstd-safe: only reset after one-shot decompression if a stream may be open
• 5ded6e0 zstd-safe: apply rustfmt
• e224018 zstd-safe: refuse to unload a dictionary under unfinished zstdmt jobs
• 6a1065b Stop a single_frame() decoder when finish_frame() ends the frame
• c7156df Don't let finish_frame() start a frame nothing was read from
• b0fb8a7 Add write::Decoder::finish() to report incomplete frames
• ab34d01 Don't retry a panicked writer when dropping AutoFlushDecoder/AutoFinishEncoder
• 74ace2d Reset the borrowed context's session in raw::{Encoder,Decoder}::with_context
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1b028685-3daf-41b3-b1a6-805708dee3d5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[clawgenti]

Summary

This is a routine Dependabot bump of the zstd crate from 0.13.4 to 0.14.3 (and zstd-safe 7.4.0 to 8.2.0) in the praxis Rust workspace. The diff is minimal: one requirement line in praxis/filters/Cargo.toml and two package entries in praxis/Cargo.lock. Both checksums match crates.io. I built and tested the PR head locally: cargo test --locked passes (53 unit + 4 parity tests) and cargo clippy --locked --all-targets -- -D warnings is clean on the pinned 1.96.0 toolchain. No must-fix issues found.

Author: dependabot[bot] (CONTRIBUTOR, trusted automated dependency bot)
Areas reviewed: Rust dependency manifests (Cargo.toml/Cargo.lock), API usage in praxis/filters/src/parse/decode.rs, supply chain
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes (DCO pass)
CI status: pending. At review time only DCO has passed. The other 37 checks are queued or running, 0 have failed, and 2 are skipped (Spellcheck, CodeRabbit). The Rust (praxis) job is still queued, so please confirm it and Dependency Review go green before merging.

Upstream / transitive check

• Checksums: zstd 0.14.3 (db3ae9bf…3c70) and zstd-safe 8.2.0 (ded520f1…434b) match the crates.io index. Neither is yanked. zstd-sys stays at 2.1.2+zstd.1.5.7, which satisfies 0.14.3's ^2.1.2 requirement, so the lockfile delta is limited to these two packages, as expected.
• MSRV: both crates declare rust-version = "1.64". praxis pins 1.96.0 (rust-version = "1.96"), so that's fine.
• Breaking changes in 0.14.0:
  • with_prepared_dictionary() constructors now borrow the dictionary for the stream's lifetime. praxis doesn't use dictionaries.
  • zstd-safe 8 adds a 'a lifetime on ref_cdict/ref_ddict. Not used here.
  • read::Decoder::finish() now consumes the rest of the frame. praxis never calls finish() on the read decoder.
• Behavioral fixes worth knowing about. Both are compatible with how praxis uses the crate:
  • zstd-safe now commits InBuffer/OutBuffer positions only after a successful streaming call (006e1d1). The streaming path in decode.rs maps any run() error to DecodeError::Corrupt and treats it as final, so it never reads positions after a failure.
  • read_to_end buffer growth is reduced (f302406). That affects decode_request_body, but the 64 MiB take() cap and its semantics are unchanged.
• API calls in praxis checked against 0.14.3. Signatures are unchanged for raw::Decoder::new(), set_parameter(DParameter::WindowLogMax), Operation::run with InBuffer::around/OutBuffer::around, read::Decoder::new + window_log_max, encode_all, and the Encoder builders used in tests (window_log, long_distance_matching, include_contentsize). It compiles and the zstd_window_limits test (RFC 9659 8 MiB window / 2^26 request window) passes.
• License: upstream relicensed from MIT to BSD-3-Clause in 0.14.0. That's permissive and not in the repo's deny-licenses: GPL-3.0, AGPL-3.0 list, so it's fine. Mentioning it for anyone who tracks third-party license notices.