Skip to content

build(deps): bump the cargo-minor group across 1 directory with 12 updates - #566

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-57ff251f66
Closed

build(deps): bump the cargo-minor group across 1 directory with 12 updates#566
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-57ff251f66

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo-minor group with 12 updates in the / directory:

Package From To
soroban-sdk 27.0.0-rc.1 27.0.0
clap 4.6.1 4.6.2
tar 0.4.45 0.4.46
tokio 1.52.3 1.53.0
ignore 0.4.25 0.4.30
regex 1.12.3 1.13.1
assert_cmd 2.2.1 2.2.2
assert_fs 1.1.3 1.1.4
uuid 1.23.1 1.24.0
syn 2.0.117 2.0.119
quote 1.0.45 1.0.46
reflink-copy 0.1.29 0.1.30

Updates soroban-sdk from 27.0.0-rc.1 to 27.0.0

Release notes

Sourced from soroban-sdk's releases.

27.0.0

What's Changed

New Features

  • CAP-71 — Auth delegation for custom accounts — Adds support for delegating a custom account's __check_auth to another address. CustomAccount::delegate_auth hands authorization to a G- or C-address that performs the actual authentication logic, and CustomAccount::get_delegated_signers returns the delegated signers supplied in the transaction's authorization payload for verification. (#1896)

Improvements

  • Zero-copy BytesN::from for [u8; N] — BytesN::from now uses BytesN::to_array instead of allocating, avoiding extra memory allocation and significantly reducing CPU cost on conversions (up to ~80% on larger arrays in end-to-end benchmarks). (#1888)

What's Changed

Full Changelog: stellar/rs-soroban-sdk@v26.1.0...v27.0.0

Commits

Updates clap from 4.6.1 to 4.6.2

Release notes

Sourced from clap's releases.

v4.6.2

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Changelog

Sourced from clap's changelog.

[4.6.2] - 2026-07-15

Fixes

  • (help) Say alias when there is only one
Commits
  • 0fe0be3 chore: Release
  • 480af9d docs: Update changelog
  • 2b3ddd0 Merge pull request #6340 from liskin/fix-completion-escape
  • 7ffe739 fix(complete): Do not suggest options after "--"
  • d47fc4f test(complete): Options suggested after escape (--)
  • See full diff in compare view

Updates tar from 0.4.45 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits

Updates tokio from 1.52.3 to 1.53.0

Release notes

Sourced from tokio's releases.

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)
  • time (alt timer): ensure timers stay in the same runtime after .reset() (#8169)

IO uring (unstable)

  • fs: use io-uring for fs::try_exists (#8080)
  • fs: use io-uring for renaming files (#7800)
  • rt: flush io-uring CQE in case of CQE overflow (#8277)

Documented

  • docs: clarify cancel safety wording (#8181)
  • fs: clarify create_dir_all succeeds if path exists (#8149)
  • io: add warning about stdout reordering with multiple handles (#8276)
  • net: document pipe try_read*/try_write* readiness behavior (#8032)
  • runtime: document interaction with fork() (#8202)
  • sync: clarify broadcast lagging semantics (#8239)
  • sync: document memory ordering guarantees for Semaphore (#8119)
  • task: explain why yield_now defers its waker (#8254)
  • time: add panic docs to timeout_at() (#8077)

... (truncated)

Commits

Updates ignore from 0.4.25 to 0.4.30

Commits

Updates regex from 1.12.3 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

  • #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

  • #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

1.12.4 (2026-06-09)

This release includes a performance optimization for compilation of regexes

... (truncated)

Commits
  • 2b52759 1.13.1, redux
  • 40e9823 1.13.1
  • 75fcb96 changelog: 1.13.1
  • 64ad0b6 automata: fix bug in reverse suffix/inner optimization
  • fa91c31 automata: fix a bug caught by Codex review
  • 30390ec automata: formatting tweaks
  • 821a8eb automata: refactor reverse suffix/inner search slightly
  • 10afd70 automata: expose the extracted literals for inner literal extraction
  • 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
  • 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
  • Additional commits viewable in compare view

Updates assert_cmd from 2.2.1 to 2.2.2

Changelog

Sourced from assert_cmd's changelog.

[2.2.2] - 2026-05-11

Fixes

  • Ensure #[track_caller] works for better panic messages
Commits
  • feece89 chore: Release assert_cmd version 2.2.2
  • 367cdf7 docs: Update changelog
  • a98cc85 Merge pull request #289 from marcospb19/track_caller
  • cd2e167 fix: .success() not reporting panic location
  • 45a1c74 chore(deps): Update Prek to v0.3.13 (#293)
  • f1d9b5b chore(deps): Update Prek to v0.3.12 (#292)
  • 1d34bab Merge pull request #291 from epage/template
  • d9a70ad style: Make clippy happy
  • 4f5b5af chore: Update from _rust template
  • 1e1d586 chore(renovate): Fix the tag
  • Additional commits viewable in compare view

Updates assert_fs from 1.1.3 to 1.1.4

Changelog

Sourced from assert_fs's changelog.

[1.1.4] - 2026-05-26

Performance

  • Default to the old tempfile behavior for faster builds
Commits
  • e943103 chore: Release assert_fs version 1.1.4
  • cb3f854 docs: Update changelog
  • 6c1f14a Merge pull request #170 from cschwan/remove-default-features-tempfile
  • ad41375 chore(deps): Update Prek to v0.4.2 (#171)
  • 738e445 Disable default features of tempfile dependency
  • 7a3ec6a chore(deps): Update Prek to v0.4.1 (#168)
  • a6612ad chore(deps): Update Prek to v0.4.0 (#167)
  • 62c5cd7 chore(deps): Update Prek to v0.3.13 (#166)
  • 0e2bc10 chore(deps): Update Prek to v0.3.12 (#165)
  • bf08330 Merge pull request #164 from epage/template
  • Additional commits viewable in compare view

Updates uuid from 1.23.1 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

v1.23.4

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.3...v1.23.4

v1.23.3

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

Commits
  • 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
  • e6db8ec prepare for 1.24.0 release
  • 606f236 Merge pull request #892 from weifanglab/main
  • ab848db feat(fmt): support encoding into MaybeUninit buffers
  • 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
  • 5a7dfe5 prepare for 1.23.5 release
  • 9b4bfc8 Merge pull request #894 from geeknoid/main
  • 5acc5a5 perf: Optimize UUID hex parsing and formatting
  • 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
  • 1e5d867 Merge pull request #891 from frostyplanet/doc
  • Additional commits viewable in compare view

Updates syn from 2.0.117 to 2.0.119

Release notes

Sourced from syn's releases.

2.0.119

  • Preserve attributes on tail-call expressions in statement position (#1994)
  • Parse field-representing types builtin in type position (#1996)

2.0.118

  • Documentation improvements
Commits
  • 3295f9e Release 2.0.119
  • 6ae9c18 Merge pull request #1996 from dtolnay/fieldrepresenting
  • 8ebd963 Parse field-representing types builtin
  • 540ccf8 Drop unneeded lifetime on covariant Cursor in verbatim::between
  • aa05887 Merge pull request #1995 from dtolnay/cursor
  • b7160d3 Reduce forking for Verbatim construction
  • efdc925 Merge pull request #1994 from dtolnay/tailcall
  • de6424c Preserve attribute on tail-call expression in statement position
  • 050dd73 Stricter const move closure grammar
  • c7d514b Merge pull request #1992 from dtolnay/scanconstmove
  • Additional commits viewable in compare view

Updates quote from 1.0.45 to 1.0.46

Release notes

Sourced from quote's releases.

1.0.46

Commits
  • bc4caf2 Release 1.0.46
  • dc0e304 Format with rustfmt
  • 712114c Drop arrow from syntax of quote_spanned_with_expanded_span
  • f93ab8a Eliminate quote_spanned_with_expanded_span_as_expr macro
  • 1ff3951 Eliminate __quote_spanned macro
  • 64e913a Unify quote_spanned definitions
  • 2978e8b Wrap comment to 80 columns
  • 7f311a0 Fix PR 329 fat arrow spacing
  • 313a8a2 Remove unneeded get_span from PR 329
  • 0b33821 Merge pull request #329 from Noratrieb/avoid-repeat-expand
  • Additional commits viewable in compare view

Updates reflink-copy from 0.1.29 to 0.1.30

Changelog

Sourced from reflink-copy's changelog.

0.1.30 - 2026-06-18

Other

  • Fix reflink: copy over permissions (#174)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the cargo-minor group across 1 directory with 12 up…
e00a946 
…dates

Bumps the cargo-minor group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [soroban-sdk](https://github.com/stellar/rs-soroban-sdk) | `27.0.0-rc.1` | `27.0.0` |
| [clap](https://github.com/clap-rs/clap) | `4.6.1` | `4.6.2` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.45` | `0.4.46` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.0` |
| [ignore](https://github.com/BurntSushi/ripgrep) | `0.4.25` | `0.4.30` |
| [regex](https://github.com/rust-lang/regex) | `1.12.3` | `1.13.1` |
| [assert_cmd](https://github.com/assert-rs/assert_cmd) | `2.2.1` | `2.2.2` |
| [assert_fs](https://github.com/assert-rs/assert_fs) | `1.1.3` | `1.1.4` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.1` | `1.24.0` |
| [syn](https://github.com/dtolnay/syn) | `2.0.117` | `2.0.119` |
| [quote](https://github.com/dtolnay/quote) | `1.0.45` | `1.0.46` |
| [reflink-copy](https://github.com/cargo-bins/reflink-copy) | `0.1.29` | `0.1.30` |



Updates `soroban-sdk` from 27.0.0-rc.1 to 27.0.0
- [Release notes](https://github.com/stellar/rs-soroban-sdk/releases)
- [Commits](stellar/rs-soroban-sdk@v27.0.0-rc.1...v27.0.0)

Updates `clap` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.1...clap_complete-v4.6.2)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `tokio` from 1.52.3 to 1.53.0
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.0)

Updates `ignore` from 0.4.25 to 0.4.30
- [Release notes](https://github.com/BurntSushi/ripgrep/releases)
- [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/ripgrep@ignore-0.4.25...ignore-0.4.30)

Updates `regex` from 1.12.3 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.3...1.13.1)

Updates `assert_cmd` from 2.2.1 to 2.2.2
- [Changelog](https://github.com/assert-rs/assert_cmd/blob/master/CHANGELOG.md)
- [Commits](assert-rs/assert_cmd@v2.2.1...v2.2.2)

Updates `assert_fs` from 1.1.3 to 1.1.4
- [Changelog](https://github.com/assert-rs/assert_fs/blob/master/CHANGELOG.md)
- [Commits](assert-rs/assert_fs@v1.1.3...v1.1.4)

Updates `uuid` from 1.23.1 to 1.24.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.1...v1.24.0)

Updates `syn` from 2.0.117 to 2.0.119
- [Release notes](https://github.com/dtolnay/syn/releases)
- [Commits](dtolnay/syn@2.0.117...2.0.119)

Updates `quote` from 1.0.45 to 1.0.46
- [Release notes](https://github.com/dtolnay/quote/releases)
- [Commits](dtolnay/quote@1.0.45...1.0.46)

Updates `reflink-copy` from 0.1.29 to 0.1.30
- [Release notes](https://github.com/cargo-bins/reflink-copy/releases)
- [Changelog](https://github.com/cargo-bins/reflink-copy/blob/main/CHANGELOG.md)
- [Commits](cargo-bins/reflink-copy@v0.1.29...v0.1.30)

---
updated-dependencies:
- dependency-name: soroban-sdk
  dependency-version: 27.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: clap
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: tokio
  dependency-version: 1.53.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor
- dependency-name: ignore
  dependency-version: 0.4.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor
- dependency-name: assert_cmd
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: assert_fs
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: uuid
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-minor
- dependency-name: syn
  dependency-version: 2.0.119
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: quote
  dependency-version: 1.0.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
- dependency-name: reflink-copy
  dependency-version: 0.1.30
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 17, 2026
@socket-security

socket-security Bot commented Jul 17, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedcargo/​tokio@​1.52.3 ⏵ 1.53.05810093100100
Updatedcargo/​assert_cmd@​2.2.1 ⏵ 2.2.27910093100100
Addedcargo/​soroban-sdk@​27.0.08110093100100
Updatedcargo/​quote@​1.0.45 ⏵ 1.0.468210093100100
Updatedcargo/​assert_fs@​1.1.3 ⏵ 1.1.410010093 +4100100
Updatedcargo/​clap@​4.6.1 ⏵ 4.6.29910093100100
Updatedcargo/​ignore@​0.4.25 ⏵ 0.4.3098 -110093100100
Updatedcargo/​reflink-copy@​0.1.29 ⏵ 0.1.309910093100100
Updatedcargo/​regex@​1.12.3 ⏵ 1.13.110010093100100
Updatedcargo/​tar@​0.4.45 ⏵ 0.4.46100100 +293100100
Updatedcargo/​uuid@​1.23.1 ⏵ 1.24.010010093100100
Updatedcargo/​syn@​2.0.117 ⏵ 2.0.119100100100100100

View full report

@socket-security

socket-security Bot commented Jul 17, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: cargo tokio is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: Cargo.lock → cargo/tokio@1.53.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.53.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot @github

dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 21, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-minor-57ff251f66 branch July 21, 2026 16:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants