deps: bump the production-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #271 · advanced-security/codeql-extractor-iac

dependabot · 2026-09-04T01:43:32Z

Bumps the production-dependencies group with 4 updates in the / directory: flate2, clap, regex and tree-sitter.

Updates flate2 from 1.1.9 to 1.1.10

Release notes

1.1.10

What's Changed

feat: reuse zlib's decoder buffer by @Vaiz in rust-lang/flate2-rs#532

feat: add reset method for read::GzDecoder and buffered::GzDecoder by @Vaiz in rust-lang/flate2-rs#534

Drop cloudflare-zlib by @kornelski in rust-lang/flate2-rs#539

Add a wrapper for the Crc struct by @MikkelPaulson in rust-lang/flate2-rs#540

Bump miniz_oxide to 0.9 by @oscargus in rust-lang/flate2-rs#543

Upgrade miniz_oxide and add unit tests of the different flush kinds by @fintelia in rust-lang/flate2-rs#498

Fix infinite loop in writing gzip header/footer by @Shnatsel in rust-lang/flate2-rs#547

test: generate corrupt gzip fixture at runtime by @nanookclaw in rust-lang/flate2-rs#550

Reject oversized gzip extra fields by @Byron in rust-lang/flate2-rs#553

Reject incomplete deflate streams at EOF by @Guflly in rust-lang/flate2-rs#556

Include README.md in a private module by @bushrat011899 in rust-lang/flate2-rs#562

Add no_std support using nightly alloc_io by @bushrat011899 in rust-lang/flate2-rs#559

Update get_mut() documentation to make clear how 'inner` can be used by @Byron in rust-lang/flate2-rs#558

New Contributors

@Vaiz made their first contribution in rust-lang/flate2-rs#532

@MikkelPaulson made their first contribution in rust-lang/flate2-rs#540

@oscargus made their first contribution in rust-lang/flate2-rs#543

@nanookclaw made their first contribution in rust-lang/flate2-rs#550

@Guflly made their first contribution in rust-lang/flate2-rs#556

@bushrat011899 made their first contribution in rust-lang/flate2-rs#562

Full Changelog: rust-lang/flate2-rs@1.1.9...1.1.10

Commits

ed93d4f Merge pull request #558 from rust-lang/lib-doc-update
fb5228d Merge pull request #559 from bushrat011899/no_std
6ed3ba3 Add executable no_std example
faed8a0 Expand CI to test no_std compatibility and correctness
2ba8e7e Add unstable no_std support behind flate2_unstable_nightly_alloc_io
3fe1126 Centralize usage of std for error and io
98e313a Add GzHeader::mtime_as_duration
0642965 Switch to core implicit prelude and only use std where required
454a63c Remove left-over dbg! statement
2a490b7 Add runtime_detection feature
Additional commits viewable in compare view

Updates clap from 4.6.1 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

(help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

(derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

(help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

(help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

Update to syn v3

[4.6.3] - 2026-07-20

Fixes

(derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

(help) Say alias when there is only one

Commits

348cff3 chore: Release
d478377 docs: Update changelog
04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
f90a966 fix(complete): Use spaces for indentation in fish
dd4997b fix(complete): Don't glob-expand bash positionals
8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
8141e11 chore(deps): Update compatible (dev) (#6398)
8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
Additional commits viewable in compare view

Updates regex from 1.12.3 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

#1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:
use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);
Improvements:

#709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes

... (truncated)

Commits

2b52759 1.13.1, redux
40e9823 1.13.1
75fcb96 changelog: 1.13.1
64ad0b6 automata: fix bug in reverse suffix/inner optimization
fa91c31 automata: fix a bug caught by Codex review
30390ec automata: formatting tweaks
821a8eb automata: refactor reverse suffix/inner search slightly
10afd70 automata: expose the extracted literals for inner literal extraction
8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
5524f02 test: add regression tests for failed reverse suffix/inner optimizations
Additional commits viewable in compare view

Updates tree-sitter from 0.26.9 to 0.27.0

Release notes

Sourced from tree-sitter's releases.

v0.27.0

What's Changed

feat: start working on v0.27 by @clason in tree-sitter/tree-sitter#5127

docs(cli): include information on generated files by @clason in tree-sitter/tree-sitter#5129

fix(docs): remove conflicting --release cargo flag in contributing.md by @arkriny in tree-sitter/tree-sitter#5132

fix(cli): trailing whitespace after multiline text nodes in CST by @arkriny in tree-sitter/tree-sitter#5133

ci: bump the actions group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5137

fix(cli): correct discrepancy with cst for --no-ranges by @WillLillis in tree-sitter/tree-sitter#5134

ci: bump korthout/backport-action from 3 to 4 in the actions group by @dependabot[bot] in tree-sitter/tree-sitter#5155

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5154

Fix Playground Query by @kevin-hua-kraken in tree-sitter/tree-sitter#5150

fix(cli): cst printing improvements by @arkriny in tree-sitter/tree-sitter#5161

docs(cli): better description of files generated by init by @clason in tree-sitter/tree-sitter#5152

fix(cli): set language in cwd for all usages of highlight command by @WillLillis in tree-sitter/tree-sitter#5180

feat(cli): concurrent builds of the same grammar on different locations on disk by @stackmystack in tree-sitter/tree-sitter#5174

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5184

fix(cli): canonicalize build --output path by @WillLillis in tree-sitter/tree-sitter#5183

feat(cli): make test --update rewrite all corpus files by @arkriny in tree-sitter/tree-sitter#5179

build(deps): update rquickjs to 0.11.0 by @clason in tree-sitter/tree-sitter#5186

fix(cli): increase verbosity of tree-sitter init -u updates by @WillLillis in tree-sitter/tree-sitter#5178

fix(cli): restore test summary output for tree-sitter test by @arkriny in tree-sitter/tree-sitter#5197

feat(wasm): add some common used defs to wasm stdlib by @trim21 in tree-sitter/tree-sitter#5199

fix(wasm): update wasm-stdlib.h by @clason in tree-sitter/tree-sitter#5209

build(deps): bump clap from 4.5.53 to 4.5.54 in the cargo group by @dependabot[bot] in tree-sitter/tree-sitter#5211

Fix python free-threading compatibility by @kevmo314 in tree-sitter/tree-sitter#5212

fix(build): define _BSD_SOURCE by @WillLillis in tree-sitter/tree-sitter#5219

build(deps): bump the cargo group with 3 updates by @dependabot[bot] in tree-sitter/tree-sitter#5227

docs: various updates by @WillLillis in tree-sitter/tree-sitter#5228

fix(docs): appease clippy regarding spacing in README by @WillLillis in tree-sitter/tree-sitter#5236

fix(wasm): regenerate stdlib with wasm-opt by @clason in tree-sitter/tree-sitter#5237

fix: Clarify lifetime parameters; Rust 2018 idioms by @DanikVitek in tree-sitter/tree-sitter#5223

feat: free memory automatically by @theanarkh in tree-sitter/tree-sitter#5225

fix(cli): warn user when nm can't be run to verify the symbols inside the parser being built by @WillLillis in tree-sitter/tree-sitter#5245

feat(ci): ensure wasm-stdlib.h is regenerated when wasm stdlib source files are modified by @WillLillis in tree-sitter/tree-sitter#5229

docs(playground): highlight full row for highlighted nodes by @Tam1SH in tree-sitter/tree-sitter#5207

ci: bump actions/github-script from 7 to 8 in the actions group by @dependabot[bot] in tree-sitter/tree-sitter#5248

build(deps): bump cc from 1.2.52 to 1.2.53 in the cargo group by @dependabot[bot] in tree-sitter/tree-sitter#5247

wasm: give binaryen the wasi-sdk treatment by @WillLillis in tree-sitter/tree-sitter#5241

fix(loader): search correct cache directory for wasi-sdk clang by @WillLillis in tree-sitter/tree-sitter#5251

Fix tree-sitter-ruby crate failing to build to Wasm by @kossnocorp in tree-sitter/tree-sitter#5158

fix(wasm): add iswpunct to stdlib by @clason in tree-sitter/tree-sitter#5130

fix(lib): address strict aliasing violations with Array type by @WillLillis in tree-sitter/tree-sitter#5242

misc Windows fixes by @WillLillis in tree-sitter/tree-sitter#5256

docs: document parser library symbol checks for build command by @WillLillis in tree-sitter/tree-sitter#5258

build(deps): bump the cargo group with 2 updates by @dependabot[bot] in tree-sitter/tree-sitter#5263

fix(wasm): correct several bugs in realloc by @WillLillis in tree-sitter/tree-sitter#5261

fix(ci): add wasm-stdlib.h to cache key by @WillLillis in tree-sitter/tree-sitter#5266

fix(generate): error if a supertype is defined as a terminal by @WillLillis in tree-sitter/tree-sitter#5267

Action overflow by @WillLillis in tree-sitter/tree-sitter#5273

fix(wasm): don't wasm-opt twice by @clason in tree-sitter/tree-sitter#5253

... (truncated)

Commits

6070dbf fix(nix): remove Dockerfile reference from flake (#5892)
f52e78c build(deps): cargo update
49dbf70 fix(rust): ensure C returned pointers are non-null in
9540ea3 fix(lib): reject an old_tree from a different language
3e7be91 fix(rust): reject out-of-range node kind ids
f471709 fix(lib): bounds-check symbol and state ids in language lookups
5ddf71b fix(rust)!: expose QueryMatch::captures as a method
efa0dd9 fix(cli): correct zero-based positions for --edits
16d5e9d ci(checks): add lint-toml step using taplo
3ac04a6 docs: add taplo instructions
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…4 updates Bumps the production-dependencies group with 4 updates in the / directory: [flate2](https://github.com/rust-lang/flate2-rs), [clap](https://github.com/clap-rs/clap), [regex](https://github.com/rust-lang/regex) and [tree-sitter](https://github.com/tree-sitter/tree-sitter). Updates `flate2` from 1.1.9 to 1.1.10 - [Release notes](https://github.com/rust-lang/flate2-rs/releases) - [Commits](rust-lang/flate2-rs@1.1.9...1.1.10) Updates `clap` from 4.6.1 to 4.6.6 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.6) Updates `regex` from 1.12.3 to 1.13.1 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](rust-lang/regex@1.12.3...1.13.1) Updates `tree-sitter` from 0.26.9 to 0.27.0 - [Release notes](https://github.com/tree-sitter/tree-sitter/releases) - [Commits](tree-sitter/tree-sitter@v0.26.9...v0.27.0) --- updated-dependencies: - dependency-name: flate2 dependency-version: 1.1.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: clap dependency-version: 4.6.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: regex dependency-version: 1.13.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: tree-sitter dependency-version: 0.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-04T01:43:47Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA dd18732.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

cargo/cc

1.4.4

🟢 7.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 18/22 approved changesets -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/clap

4.6.6

🟢 5.7

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/19 approved changesets -- score normalized to 3
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/clap_builder

4.6.6

🟢 5.7

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/19 approved changesets -- score normalized to 3
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/clap_derive

4.6.4

🟢 5.7

Details

Check	Score	Reason
Code-Review	🟢 3	Found 7/19 approved changesets -- score normalized to 3
Maintained	🟢 10	30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/find-msvc-tools

0.1.11

🟢 7.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 8	Found 18/22 approved changesets -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/flate2

1.1.10

🟢 6.7

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	22 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/miniz_oxide

0.9.1

🟢 4.5

Details

Check	Score	Reason
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 7	7 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 7
Code-Review	🟢 3	Found 11/30 approved changesets -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
License	🟢 10	license file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/regex

1.13.1

🟢 6.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 3/19 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/regex-automata

0.4.18

🟢 6.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 3/19 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/regex-syntax

0.8.11

🟢 6.3

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 3/19 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/serde_json

1.0.151

🟢 6.3

Details

Check	Score	Reason
Maintained	🟢 10	10 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 4/24 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/shlex

2.0.1

🟢 3.5

Details

Check	Score	Reason
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	⚠️ 1	Found 2/15 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 9	license file detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/simd-adler32

0.3.10

🟢 4.5

Details

Check	Score	Reason
Binary-Artifacts	🟢 10	no binaries found in the repo
Code-Review	🟢 6	Found 8/13 approved changesets -- score normalized to 6
Maintained	⚠️ 0	1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	🟢 10	project is fuzzed
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/syn

3.0.4

🟢 5.7

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/22 approved changesets -- score normalized to 0
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Security-Policy	🟢 3	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/tree-sitter

0.27.0

🟢 3.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 15/16 approved changesets -- score normalized to 9
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/tree-sitter-language

0.1.8

🟢 3.9

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Code-Review	🟢 9	Found 15/16 approved changesets -- score normalized to 9
Dangerous-Workflow	⚠️ 0	dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
Branch-Protection	🟢 4	branch protection is not maximal on development and all release branches
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/zlib-rs

0.6.7

Unknown

cargo/zmij

1.0.23

Unknown

cargo/tree-sitter

>= 0.27.0, < 0.28.0

Unknown

Scanned Files

Cargo.lock
extractor/Cargo.toml

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 4, 2026

github-actions Bot added the extractor label Sep 4, 2026

github-license-compliance Bot found potential problems Sep 4, 2026

View reviewed changes

Comment thread Cargo.lock

Navigation Menu

Uh oh!

deps: bump the production-dependencies group across 1 directory with 4 updates - #271

deps: bump the production-dependencies group across 1 directory with 4 updates#271
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/main/production-dependencies-7b2e34a4af

dependabot Bot commented on behalf of github Sep 4, 2026

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 4, 2026

1.1.10

What's Changed

New Contributors

v4.6.6

[4.6.6] - 2026-08-06

Features

v4.6.5

[4.6.5] - 2026-07-31

Fixes

v4.6.4

[4.6.4] - 2026-07-21

Internal

v4.6.3

[4.6.3] - 2026-07-20

Fixes

v4.6.2

[4.6.2] - 2026-07-15

Fixes

[4.6.6] - 2026-08-06

Features

[4.6.5] - 2026-07-31

Fixes

[4.6.4] - 2026-07-21

Internal

[4.6.3] - 2026-07-20

Fixes

[4.6.2] - 2026-07-15

Fixes

1.13.1 (2026-07-15)

1.13.0 (2026-07-09)

1.12.4 (2026-06-09)

v0.27.0

What's Changed

Uh oh!

github-actions Bot commented Sep 4, 2026

Dependency Review

Snapshot Warnings

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants