Skip to content

chore(deps-rust)(deps): bump the rust-dependencies group across 1 directory with 10 updates - #173

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-cb9c605038
Closed

chore(deps-rust)(deps): bump the rust-dependencies group across 1 directory with 10 updates#173
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-cb9c605038

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group with 10 updates in the / directory:

Package From To
tokio 1.52.3 1.52.4
anyhow 1.0.102 1.0.103
time 0.3.47 0.3.53
uuid 1.23.2 1.24.0
toml 1.1.2+spec-1.1.0 1.1.3+spec-1.1.0
rand 0.10.1 0.10.2
clap 4.6.1 4.6.2
refinery 0.9.1 0.9.2
bytes 1.11.1 1.12.1
rust-embed 8.11.0 8.12.0

Updates tokio from 1.52.3 to 1.52.4

Release notes

Sourced from tokio's releases.

Tokio v1.52.4

1.52.4 (July 16th, 2026)

Fixed

  • runtime: don't skip the driver when before_park schedules work (#8222)

Fixed (unstable)

  • taskdump: remove crate disambiguators from output (#8264)

#8264: tokio-rs/tokio#8264 #8222: tokio-rs/tokio#8222

Commits

Updates anyhow from 1.0.102 to 1.0.103

Release notes

Sourced from anyhow's releases.

1.0.103

  • Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)
Commits
  • 5bdb0e2 Release 1.0.103
  • e621bd3 Merge pull request #452 from dtolnay/downcast
  • 6e8c000 Eliminate pointer->reference->pointer during downcast
  • 67c4abd Add regression test for issue 451
  • 917a169 Update actions/upload-artifact@v6 -> v7
  • d9dc3fa Update actions/checkout@v6 -> v7
  • 841522b Raise minimum tested compiler to rust 1.85
  • See full diff in compare view

Updates time from 0.3.47 to 0.3.53

Release notes

Sourced from time's releases.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result in a loss of precision and even invalid values.
  • The date! macro could previously create an invalid value that would then panic at compile time. The macro now emits a proper error instead.
  • When parsing an invalid format description, an edge case would inadvertently panic. This now returns an error as intended.

Added

  • Support default values when parsing

0.3.51 [2026-06-22]

Fixed

  • time compiles with macros enabled. This version is otherwise identical to v0.3.50.

0.3.50 [2026-06-22] [YANKED]

This version was yanked because it would not compile when the macros feature was enabled.

Added

  • Timestamp type

Fixed

  • [year] in a runtime-parsed version 3 format description when the large-dates feature is not enabled now succeeds. This previously failed due to a missing #[cfg].

Performance

  • Further gains when parsing with the non-deprecated parts of the RFC 2822 well-known format
  • Gains when formatting with the ISO 8601 well-known format
  • Date arithmetic is improved in common situations

0.3.49 [2026-06-13]

... (truncated)

Commits
  • 0ae2f84 v0.3.53 release
  • cea8c96 Avoid issue with cookie crate temporarily
  • 55e1f2b Require private type to properly seal traits
  • 7cf4780 v0.3.52 release
  • 0e5b04f Fix trusted publishing workflow
  • 6e4140a Support default values when parsing
  • 10ac36a Add more doctests to Timestamp
  • 6b0d468 Restore lexer depth on the unclosed-bracket error path
  • 0abc06d Add trusted publishing
  • 43cf0c0 Preferentially group shards by target
  • Additional commits viewable in compare view

Updates uuid from 1.23.2 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

Commits
  • 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
  • e6db8ec prepare for 1.24.0 release
  • 606f236 Merge pull request #892 from weifanglab/main
  • ab848db feat(fmt): support encoding into MaybeUninit buffers
  • 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
  • 5a7dfe5 prepare for 1.23.5 release
  • 9b4bfc8 Merge pull request #894 from geeknoid/main
  • 5acc5a5 perf: Optimize UUID hex parsing and formatting
  • 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
  • 1e5d867 Merge pull request #891 from frostyplanet/doc
  • Additional commits viewable in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

Updates rand from 0.10.1 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

  • Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
  • Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

Commits

Updates clap from 4.6.1 to 4.6.2

Release notes

Sourced from clap's releases.

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 0fe0be3 chore: Release
  • 480af9d docs: Update changelog
  • 2b3ddd0 Merge pull request #6340 from liskin/fix-completion-escape
  • 7ffe739 fix(complete): Do not suggest options after "--"
  • d47fc4f test(complete): Options suggested after escape (--)
  • See full diff in compare view

Updates refinery from 0.9.1 to 0.9.2

Release notes

Sourced from refinery's releases.

V0.9.2

[0.9.2] - 2026-06-09

Added

  • Support for rustls as a TLS backend for tokio-postgres via the new tokio-postgres-rustls feature. #426

Changed

  • Make TLS opt-in for postgres and tokio-postgres features. The postgres and tokio-postgres features no longer pull in native-tls unconditionally. Use postgres-tls and tokio-postgres-tls features for TLS support. #408
  • Support rusqlite 0.39.x. #425
  • Support mysql up to 0.28.x and mysql_async up to 0.37.x. #436
  • Update toml dependency to 1.1.2. #430
Changelog

Sourced from refinery's changelog.

[0.9.2] - 2026-06-09

Added

  • Support for rustls as a TLS backend for tokio-postgres via the new tokio-postgres-rustls feature. #426

Changed

  • Make TLS opt-in for postgres and tokio-postgres features. The postgres and tokio-postgres features no longer pull in native-tls unconditionally. Use postgres-tls and tokio-postgres-tls features for TLS support. #408
  • Support rusqlite 0.39.x. #425
  • Support mysql up to 0.28.x and mysql_async up to 0.37.x. #436
  • Update toml dependency to 1.1.2. #430
Commits

Updates bytes from 1.11.1 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)
Commits

Updates rust-embed from 8.11.0 to 8.12.0

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-rust)(deps): bump the rust-dependencies group across 1 dir…
37c6866 
…ectory with 10 updates

Bumps the rust-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.52.4` |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.102` | `1.0.103` |
| [time](https://github.com/time-rs/time) | `0.3.47` | `0.3.53` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.2` | `1.24.0` |
| [toml](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.3+spec-1.1.0` |
| [rand](https://github.com/rust-random/rand) | `0.10.1` | `0.10.2` |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.2` |
| [refinery](https://github.com/rust-db/refinery) | `0.9.1` | `0.9.2` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.11.1` | `1.12.1` |
| rust-embed | `8.11.0` | `8.12.0` |



Updates `tokio` from 1.52.3 to 1.52.4
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.52.4)

Updates `anyhow` from 1.0.102 to 1.0.103
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.102...1.0.103)

Updates `time` from 0.3.47 to 0.3.53
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.47...v0.3.53)

Updates `uuid` from 1.23.2 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.2...v1.24.0)

Updates `toml` from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.2...toml-v1.1.3)

Updates `rand` from 0.10.1 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.10.1...0.10.2)

Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.2)

Updates `refinery` from 0.9.1 to 0.9.2
- [Release notes](https://github.com/rust-db/refinery/releases)
- [Changelog](https://github.com/rust-db/refinery/blob/main/CHANGELOG.md)
- [Commits](rust-db/refinery@v0.9.1...v0.9.2)

Updates `bytes` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.11.1...v1.12.1)

Updates `rust-embed` from 8.11.0 to 8.12.0

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: anyhow
  dependency-version: 1.0.103
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: time
  dependency-version: 0.3.53
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: toml
  dependency-version: 1.1.3+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: clap
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: refinery
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rust-embed
  dependency-version: 8.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

github-actions Bot commented Jul 20, 2026

Copy link
Copy Markdown

Thank you for contributing to this project with this PR, welcome to the community and the amazing world of open source!

@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​tokio@​1.52.3 ⏵ 1.52.45810093100100
Updatedcargo/​anyhow@​1.0.102 ⏵ 1.0.1038110093100100
Updatedcargo/​bytes@​1.11.1 ⏵ 1.12.110010093100100
Updatedcargo/​clap@​4.6.1 ⏵ 4.6.29910093100100
Updatedcargo/​rand@​0.10.1 ⏵ 0.10.210010093100100
Updatedcargo/​refinery@​0.9.1 ⏵ 0.9.210010093100100
Updatedcargo/​time@​0.3.47 ⏵ 0.3.5310010093100100
Updatedcargo/​toml@​1.1.2%2Bspec-1.1.0 ⏵ 1.1.3+spec-1.1.010010093100100
Updatedcargo/​uuid@​1.23.2 ⏵ 1.24.010010093100100
Updatedcargo/​rust-embed@​8.11.0 ⏵ 8.12.09910097100100

View full report

@socket-security

socket-security Bot commented Jul 20, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: cargo tokio is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/rook/Cargo.toml → cargo/tokio@1.52.4

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.52.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github

dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 22, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/rust-dependencies-cb9c605038 branch July 22, 2026 06:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants