chore(deps): Bump the cargo-minor-patch group across 1 directory with 11 updates - #986
chore(deps): Bump the cargo-minor-patch group across 1 directory with 11 updates#986dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
a934e27 to
1887979
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 18879796fa
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| napi-derive = { version = "3.6.2" } | ||
| p256 = { version = "0.13", features = ["ecdsa"] } | ||
| pg_query = { version = "=6.1.1", default-features = false } | ||
| pg_query = { version = "=6.2.0", default-features = false } |
There was a problem hiding this comment.
The reviewed commit has no Signed-off-by trailer, so it violates the repository's mandatory DCO policy and is liable to fail DCO enforcement. Re-record this commit with git commit -s before merging.
AGENTS.md reference: AGENTS.md:L413-L415
Useful? React with 👍 / 👎.
| rcgen = { version = "0.13", default-features = false, features = ["ring", "zeroize"] } | ||
| reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "rustls-tls-native-roots"] } | ||
| rhai = { version = "=1.25.1", features = ["sync", "serde"] } | ||
| rhai = { version = "=1.26.0", features = ["sync", "serde"] } |
There was a problem hiding this comment.
This upgrades the interpreter used for Evidence derivations and BReg governed-action scripts, and Rhai 1.26 changes optimizer, switch, and function-pointer execution semantics, but the commit contains no explicit Registry Stack review note assessing those assertion/action-evaluation effects. Add the required security-sensitive review record, including confirmation that the pinned-lexer scanner and bounded evaluation behavior were revalidated.
AGENTS.md reference: AGENTS.md:L424-L426
Useful? React with 👍 / 👎.
1887979 to
cbe66b8
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cbe66b8782
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| rcgen = { version = "0.13", default-features = false, features = ["ring", "zeroize"] } | ||
| reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "rustls-tls-native-roots"] } | ||
| rhai = { version = "=1.25.1", features = ["sync", "serde"] } | ||
| rhai = { version = "=1.26.0", features = ["sync", "serde"] } |
There was a problem hiding this comment.
Beyond the previously raised missing review note, repo-wide search shows a concrete version-contract mismatch: Evidence's frozen ABI and adapter API still pin Rhai 1.25.1 (products/evidence/contracts/rhai-abi.yaml:170, products/evidence/reference/request-adapter/ADAPTER-API.md:545), while BReg also embeds 1.25.1 into signed compiled package metadata via CHANGE_REQUEST_PLANNER_RHAI_VERSION (crates/registry-breg/src/change_request.rs:64). Because 1.26.0 changes optimizer and switch evaluation semantics, upgrading the executable alone can make the same accepted Evidence script or BReg package revision produce different results while still claiming the old interpreter contract; retain 1.25.1 or explicitly advance and revalidate the contracts, metadata, and generated artifacts with the runtime.
AGENTS.md reference: AGENTS.md:L228-L229
Useful? React with 👍 / 👎.
6d27ef2 to
bd38c72
Compare
… 11 updates Bumps the cargo-minor-patch group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.18.0` | `1.18.1` | | [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.26.1` | `0.26.2` | | [ipnet](https://github.com/krisprice/ipnet) | `2.12.1` | `2.12.2` | | [napi](https://github.com/napi-rs/napi-rs) | `3.12.1` | `3.12.2` | | [pg_query](https://github.com/pganalyze/pg_query.rs) | `6.1.1` | `6.2.0` | | [rhai](https://github.com/rhaiscript/rhai) | `1.25.1` | `1.26.1` | | [rustls](https://github.com/rustls/rustls) | `0.23.43` | `0.23.44` | | [tokio-rustls](https://github.com/rustls/tokio-rustls) | `0.26.4` | `0.26.5` | | [tower-http](https://github.com/tower-rs/tower-http) | `0.7.0` | `0.7.1` | | [uuid](https://github.com/uuid-rs/uuid) | `1.24.1` | `1.26.1` | | [oxjsonld](https://github.com/oxigraph/oxigraph) | `0.2.5` | `0.2.6` | Updates `aws-lc-rs` from 1.18.0 to 1.18.1 - [Release notes](https://github.com/aws/aws-lc-rs/releases) - [Commits](aws/aws-lc-rs@v1.18.0...v1.18.1) Updates `hickory-resolver` from 0.26.1 to 0.26.2 - [Release notes](https://github.com/hickory-dns/hickory-dns/releases) - [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md) - [Commits](hickory-dns/hickory-dns@v0.26.1...v0.26.2) Updates `ipnet` from 2.12.1 to 2.12.2 - [Release notes](https://github.com/krisprice/ipnet/releases) - [Changelog](https://github.com/krisprice/ipnet/blob/master/RELEASES.md) - [Commits](https://github.com/krisprice/ipnet/commits) Updates `napi` from 3.12.1 to 3.12.2 - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-v3.12.1...napi-v3.12.2) Updates `pg_query` from 6.1.1 to 6.2.0 - [Changelog](https://github.com/pganalyze/pg_query.rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/pganalyze/pg_query.rs/commits/v6.2.0) Updates `rhai` from 1.25.1 to 1.26.1 - [Release notes](https://github.com/rhaiscript/rhai/releases) - [Changelog](https://github.com/rhaiscript/rhai/blob/v1.26.1/CHANGELOG.md) - [Commits](https://github.com/rhaiscript/rhai/commits/v1.26.1) Updates `rustls` from 0.23.43 to 0.23.44 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.43...v/0.23.44) Updates `tokio-rustls` from 0.26.4 to 0.26.5 - [Release notes](https://github.com/rustls/tokio-rustls/releases) - [Commits](rustls/tokio-rustls@v/0.26.4...v/0.26.5) Updates `tower-http` from 0.7.0 to 0.7.1 - [Release notes](https://github.com/tower-rs/tower-http/releases) - [Commits](tower-rs/tower-http@tower-http-0.7.0...tower-http-0.7.1) Updates `uuid` from 1.24.1 to 1.26.1 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.1...v1.26.1) Updates `oxjsonld` from 0.2.5 to 0.2.6 - [Release notes](https://github.com/oxigraph/oxigraph/releases) - [Changelog](https://github.com/oxigraph/oxigraph/blob/main/CHANGELOG.md) - [Commits](https://github.com/oxigraph/oxigraph/commits) --- updated-dependencies: - dependency-name: aws-lc-rs dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: hickory-resolver dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: ipnet dependency-version: 2.12.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: napi dependency-version: 3.12.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: oxjsonld dependency-version: 0.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: pg_query dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: rhai dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch - dependency-name: rustls dependency-version: 0.23.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tokio-rustls dependency-version: 0.26.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: tower-http dependency-version: 0.7.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor-patch - dependency-name: uuid dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
bd38c72 to
d00b618
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d00b618e46
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| rcgen = { version = "0.13", default-features = false, features = ["ring", "zeroize"] } | ||
| reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "rustls-tls-native-roots"] } | ||
| rhai = { version = "=1.25.1", features = ["sync", "serde"] } | ||
| rhai = { version = "=1.26.1", features = ["sync", "serde"] } |
There was a problem hiding this comment.
When this line selects Rhai 1.26.1, the resolved graph still contains smartstring 1.0.1, but deny.toml:14-24 continues to justify suppressing RUSTSEC-2026-0249 specifically through Rhai 1.25.1 and records only the pre-upgrade review. Consequently, cargo deny can pass while the scoped risk record describes the wrong interpreter version; re-review the advisory's reachability and update its rationale alongside this bump.
AGENTS.md reference: AGENTS.md:L264-L270
Useful? React with 👍 / 👎.
Bumps the cargo-minor-patch group with 11 updates in the / directory:
1.18.01.18.10.26.10.26.22.12.12.12.23.12.13.12.26.1.16.2.01.25.11.26.10.23.430.23.440.26.40.26.50.7.00.7.11.24.11.26.10.2.50.2.6Updates
aws-lc-rsfrom 1.18.0 to 1.18.1Release notes
Sourced from aws-lc-rs's releases.
... (truncated)
Commits
22e629dPrepare v1.18.1 (#1224)c4fde5cPrepare aws-lc-fips-sys v0.14.2 (#1221)7943223Prepare aws-lc-sys v0.45.0 (#1220)8ea2229fix: tighten AEAD, cipher IV, and digest API contracts (#1215)bcca4d1Add ECDSA P-256 SHA-1 ASN.1 verification algorithm (#1214)32338a5fix(builder): filter the raw-triple CFLAGS spelling for jitterentropy (#1207)af422bdFix-Wa,--debug-prefix-mapprobe (#1212)749b26fci: replace removed llvm-devel-lite package in FreeBSD jobs (#1213)36c7a68fix(publish): verify packaged crate with cargo build, not cargo test (#1201)c71ab00fix: address clippy::assert_is_empty lints in ECB cipher modes (#1210)Updates
hickory-resolverfrom 0.26.1 to 0.26.2Release notes
Sourced from hickory-resolver's releases.
... (truncated)
Commits
48323efBump version to 0.26.2ccd6952Only follow one CNAME record from each responsec04ad2bBetter distinguish NODATA response and wildcards64b4291Add test for bogus wildcard expansion478998bproto: constrain peer-controlled allocation sizes8392769resolver: avoid caching empty nameserver poolse2d21d8Replace use of SOA name with NSEC3 record parents84fa8abCheck for correct zone name in covering NSEC3s too09803baLook for correct zone name in matching NSEC3s26f45d3Rename Nsec3RecordPair to Nsec3RecordInfoUpdates
ipnetfrom 2.12.1 to 2.12.2Changelog
Sourced from ipnet's changelog.
Commits
Updates
napifrom 3.12.1 to 3.12.2Release notes
Sourced from napi's releases.
Commits
444bf29chore(napi): release v3.12.2 (#3459)2ffb055fix(napi): memory safety in PromiseRaw callbacks and AbortSignal conversion (...511ead2chore(deps): update dependency oxc-parser to ^0.146.0 (#3457)220b402chore(deps): update dependency oxc-parser to ^0.145.0 (#3456)70c1493chore(release): publishaeba312fix(cli): compatible with emnapi v1 & v2 (#3454)d532909chore(deps): update dependency oxc-parser to ^0.144.0 (#3453)b8ba732fix(deps): update emnapi to v2.0.0-alpha.4 (#3451)06349ebchore(deps): update cross-platform-actions/action action to v1.4.0 (#3452)a5b5f27chore(release): publishUpdates
pg_queryfrom 6.1.1 to 6.2.0Changelog
Sourced from pg_query's changelog.
Commits
Updates
rhaifrom 1.25.1 to 1.26.1Release notes
Sourced from rhai's releases.
Changelog
Sourced from rhai's changelog.
Commits
Updates
rustlsfrom 0.23.43 to 0.23.44Commits
64ad386Bump version to 0.23.441efbf66bogo: remove PostQuantum setupe78162faws-lc-rs: add support for ML-DSA signaturesd880772bogo: extract Options::provider() helper87201d6bogo: force all callers to get provider from Options93657e3server: limit 1.2 certificate requests to 1.2-compatible signature schemesbbd3c9aclient: avoid sending 1.3-only signature schemes if no cipher suites configuredeb57688tls12: require known signature algorithme7a9ceftls12: send illegal_parameter alert for kx signed with wrong algorithm06a546dbogo: take latestUpdates
tokio-rustlsfrom 0.26.4 to 0.26.5Release notes
Sourced from tokio-rustls's releases.
Commits
f8832d2Bump version to 0.26.5c0fad2freturn more data at once from TlsStream::poll_read (#198)edc7306build(deps): bump futures-util from 0.3.33 to 0.3.34baeadaabuild(deps): bump rcgen from 0.14.8 to 0.14.91e138adbuild(deps): bump taiki-e/cache-cargo-install-action from 3.0.7 to 3.0.8b4ecff6build(deps): bump taiki-e/cache-cargo-install-action from 3 to 3.0.7f47a689build(deps): bump rustls from 0.23.42 to 0.23.43e25578ebuild(deps): bump tokio from 1.53.0 to 1.53.1d2a6d98server: add rustdoc hinting towards timeout wrappingc2e9b4aclient: add rustdoc hinting towards timeout wrappingUpdates
tower-httpfrom 0.7.0 to 0.7.1Release notes
Sourced from tower-http's releases.
... (truncated)
Commits
c941451chore(release): prepare 0.7.1 (#729)9697702chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)e2582e2Allow ignoring multi-range requests (#727)888f7fefeat(services): configure directory redirects (#728)5ad7654chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)d154adbfix: reject multipart ranges before validation (#661)d9e5c8aci: Update to cargo-check-external-types 0.5.0 (#724)90c072bPropagate ServeDir::try_call I/O errors (#718)860922efix(decompression): don't end the body on an empty data frame (#722)8532252docs(example)/custom future with multiple bodies (#711)Updates
uuidfrom 1.24.1 to 1.26.1Release notes
Sourced from uuid's releases.
Commits
9f92712Merge pull request #910 from uuid-rs/cargo/v1.26.1d4df8f0prepare for 1.26.1 release5613f23Merge pull request #909 from uuid-rs/fix/ts-conversion-overflowfda00ebdon't panic in overflowing Timestamp to SystemTime conversionc82e88cMerge pull request #907 from lenamonj/v7-counter-placementac065a6Align the counter diagram34ec102Seat the v7 counter below the version nibblecdc96a8Merge pull request #905 from uuid-rs/cargo/v1.26.034e4f49don't test macros under mirid9e7242update nightly used for miriUpdates
oxjsonldfrom 0.2.5 to 0.2.6Changelog
Sourced from oxjsonld's changelog.
... (truncated)
Commits