chore(deps): bump the cargo group across 1 directory with 12 updates by dependabot[bot] · Pull Request #3 · raviqqe/sqlx

dependabot · 2024-07-22T18:03:56Z

Bumps the cargo group with 11 updates in the / directory:

Package	From	To
tokio	`1.20.1`	`1.26.0`
rustls	`0.21.3`	`0.21.5`
openssl	`0.10.41`	`0.10.80`
remove_dir_all	`0.7.0`	`0.8.0`
rsa	`0.9.2`	`0.9.10`
whoami	`1.2.1`	`1.5.0`
borsh	`0.10.2`	`0.10.4`
bumpalo	`3.10.0`	`3.20.3`
mio	`0.8.4`	`0.8.11`
rustix	`0.38.3`	`0.38.8`
rustls-webpki	`0.101.1`	`0.101.6`

Updates tokio from 1.20.1 to 1.26.0

Release notes

Sourced from tokio's releases.

Tokio v1.26.0

Fixed

macros: fix empty join! and try_join! ([https://redirect.github.com/fix empty join! and try_join! tokio-rs/tokio#5504])

sync: don't leak tracing spans in mutex guards ([https://redirect.github.com/sync: don't leak tracing spans in mutex guards tokio-rs/tokio#5469])

sync: drop wakers after unlocking the mutex in Notify ([https://redirect.github.com/Drop wakers after unlocking the mutex in Notify tokio-rs/tokio#5471])

sync: drop wakers outside lock in semaphore ([https://redirect.github.com/Solve deadlock in Semaphore tokio-rs/tokio#5475])

Added

fs: add fs::try_exists ([https://redirect.github.com/Add fs::try_exists tokio-rs/tokio#4299])

net: add types for named unix pipes ([https://redirect.github.com/net: add types for named Unix pipes tokio-rs/tokio#5351])

sync: add MappedOwnedMutexGuard ([https://redirect.github.com/Add MappedOwnedMutexGuard tokio-rs/tokio#5474])

Changed

chore: update windows-sys to 0.45 ([https://redirect.github.com/chore: update windows-sys to 0.45 tokio-rs/tokio#5386])

net: use Message Read Mode for named pipes ([https://redirect.github.com/Named Pipes: Support Message Read Mode tokio-rs/tokio#5350])

sync: mark lock guards with #[clippy::has_significant_drop] ([https://redirect.github.com/Mark MutexGuard with #[clippy::has_significant_drop] tokio-rs/tokio#5422])

sync: reduce contention in watch channel ([https://redirect.github.com/Reduce contention in watch channel tokio-rs/tokio#5464])

time: remove cache padding in timer entries ([https://redirect.github.com/time: remove cache padding in timer entries tokio-rs/tokio#5468])

time: Improve Instant::now() perf with test-util ([https://redirect.github.com/time: Improve Instant::now() perf with test-util tokio-rs/tokio#5513])

Internal Changes

io: use poll_fn in copy_bidirectional ([https://redirect.github.com/Use poll_fn in copy_bidirectional tokio-rs/tokio#5486])

net: refactor named pipe builders to not use bitfields ([https://redirect.github.com/net: refactor named pipe builders to not use bitfields tokio-rs/tokio#5477])

rt: remove Arc from Clock ([https://redirect.github.com/rt: remove Arc from Clock tokio-rs/tokio#5434])

sync: make notify_waiters calls atomic ([https://redirect.github.com/sync: make notify_waiters calls atomic tokio-rs/tokio#5458])

time: don't store deadline twice in sleep entries ([https://redirect.github.com/remove double store of deadline, saving 128 bytes tokio-rs/tokio#5410])

Unstable

metrics: add a new metric for budget exhaustion yields ([https://redirect.github.com/metrics: add a new metric for budget exhaustion yields tokio-rs/tokio#5517])

Documented

io: improve AsyncFd example ([https://redirect.github.com/io: improve AsyncFd example tokio-rs/tokio#5481])

runtime: document the nature of the main future ([https://redirect.github.com/Document the nature of the main future tokio-rs/tokio#5494])

runtime: remove extra period in docs ([https://redirect.github.com/chore: remove unnecessary dot in comment tokio-rs/tokio#5511])

signal: updated Documentation for Signals ([https://redirect.github.com/Updated Documentation for Signals tokio-rs/tokio#5459])

sync: add doc aliases for blocking_* methods ([https://redirect.github.com/sync: add doc aliases for blocking_* methods tokio-rs/tokio#5448])

sync: fix docs for Send/Sync bounds in broadcast ([https://redirect.github.com/sync: fix docs for Send/Sync bounds in broadcast tokio-rs/tokio#5480])

sync: document drop behavior for channels ([https://redirect.github.com/sync: document drop behavior for channels tokio-rs/tokio#5497])

task: clarify what happens to spawned work during runtime shutdown ([https://redirect.github.com/clarify what happens to spawned work during runtime shutdown tokio-rs/tokio#5394])

task: clarify process::Command docs ([https://redirect.github.com/Clarify process::Command docs (fixing #5406) tokio-rs/tokio#5413])

task: fix wording with 'unsend' ([https://redirect.github.com/fix: fix wording with 'unsend' tokio-rs/tokio#5452])

time: document immediate completion guarantee for timeouts ([https://redirect.github.com/time: document immediate completion guarantee for timeouts tokio-rs/tokio#5509])

tokio: document supported platforms ([https://redirect.github.com/Document supported platforms tokio-rs/tokio#5483])

... (truncated)

Commits

a377240 chore: prepare for Tokio v1.26.0 release (#5521)
52da177 metrics: add a new metric for budget exhaustion yields (#5517)
ee1c940 time: Improve Instant::now() perf with test-util (#5513)
815d89a runtime: remove extra period in docs (#5511)
54aaf3d time: document immediate completion guarantee for timeouts (#5509)
5a3abe5 net: add types for named unix pipes (#5351)
d44b1ca io: ignore SplitByUtf8BoundaryIfWindows test on miri (#5507)
e23c6f3 signal: updated Documentation for Signals (#5459)
0a50cb3 net: fix test compilation failure (#5506)
2298679 runtime: document the nature of the main future (#5494)
Additional commits viewable in compare view

Updates rustls from 0.21.3 to 0.21.5

Commits

b1808ac cargo: prepare 0.21.5 release.
6ff5b77 Revert "Take IntoIterator in add_parsable_certificates()"
f613c9f cargo: prepare 0.21.4 release.
11e9386 Prepare to move release notes to github releases
4a9f375 RELEASING.md: restructure, use github releases
7924f00 Take IntoIterator in add_parsable_certificates()
6fedb35 client: with_single_cert -> with_client_auth_cert
208d767 deps: update webpki-roots 0.23.0 -> 0.24.0
da5be06 error: use automatic link for RFC 5280 ref.
3e90954 lib: export CertRevocationListError enum.
See full diff in compare view

Updates openssl from 0.10.41 to 0.10.80

Release notes

Sourced from openssl's releases.

openssl-v0.10.80

What's Changed

Prefer Homebrew openssl@4 and stop looking for openssl@1.1 by @alex in rust-openssl/rust-openssl#2633

Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-padding by @alex in rust-openssl/rust-openssl#2638

Release openssl 0.10.80 and openssl-sys 0.9.116 by @alex in rust-openssl/rust-openssl#2639

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in rust-openssl/rust-openssl#2610

Try to fix OpenSSL 1.1.0l download by @botovq in rust-openssl/rust-openssl#2614

Require &mut BigNumContextRef for EcPointRef mul/invert by @alex in rust-openssl/rust-openssl#2615

Fix UB in EcGroupRef::generator on groups without a generator by @alex in rust-openssl/rust-openssl#2617

Replace use libc::*; with targeted imports in openssl-sys by @alex in rust-openssl/rust-openssl#2618

Add PKeyRef::is_a and KeyType for name-based key identification by @reaperhulk in rust-openssl/rust-openssl#2619

Add PKey::{public,private}_key_from_raw_bytes_ex by @reaperhulk in rust-openssl/rust-openssl#2620

Bump MSRV to 1.80 by @reaperhulk in rust-openssl/rust-openssl#2622

Drop once_cell in favor of std::sync::{LazyLock, OnceLock} by @reaperhulk in rust-openssl/rust-openssl#2623

Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import by @reaperhulk in rust-openssl/rust-openssl#2621

parallelize more builds in CI for cold caches by @reaperhulk in rust-openssl/rust-openssl#2625

Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction by @reaperhulk in rust-openssl/rust-openssl#2626

Fix process abort when verify/PSK callbacks fire after SSL_CTX swap by @alex in rust-openssl/rust-openssl#2624

Bind OSSL_PARAM_modified and use it for seed_into by @reaperhulk in rust-openssl/rust-openssl#2628

Add PkeyCtxRef::set_context_string for ML-DSA by @reaperhulk in rust-openssl/rust-openssl#2629

Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders by @alex in rust-openssl/rust-openssl#2631

Fix output buffer overflow for AES key-wrap-with-padding ciphers by @alex in rust-openssl/rust-openssl#2630

Release openssl 0.10.79 and openssl-sys 0.9.115 by @reaperhulk in rust-openssl/rust-openssl#2632

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

openssl-v0.10.78

What's Changed

Fix Suite B flag assignments in verify.rs by @alex in rust-openssl/rust-openssl#2592

Use cvt_p for OPENSSL_malloc error handling by @alex in rust-openssl/rust-openssl#2593

Mark BIO_get_mem_data on AWS-LC to be unsafe by @alex in rust-openssl/rust-openssl#2594

Set timeout for package installation step by @alex in rust-openssl/rust-openssl#2595

Panic in Crypter::new when IV is required but not provided by @alex in rust-openssl/rust-openssl#2596

openssl 4 support by @reaperhulk in rust-openssl/rust-openssl#2591

Avoid panic for overlong OIDs by @botovq in rust-openssl/rust-openssl#2598

Fix dangling stack pointer in custom extension add callback by @alex in rust-openssl/rust-openssl#2599

Add support for LibreSSL 4.3.x by @botovq in rust-openssl/rust-openssl#2603

fix inverted bounds assertion in AES key unwrap by @reaperhulk in rust-openssl/rust-openssl#2604

Reject oversized length returns from password callback trampoline by @alex in rust-openssl/rust-openssl#2605

Validate callback-returned lengths in PSK and cookie trampolines by @alex in rust-openssl/rust-openssl#2607

Error for short out in MdCtxRef::digest_final() by @botovq in rust-openssl/rust-openssl#2608

Check derive output buffer length on OpenSSL 1.1.x by @alex in rust-openssl/rust-openssl#2606

Release openssl v0.10.78 and openssl-sys v0.9.114 by @alex in rust-openssl/rust-openssl#2609

... (truncated)

Commits

35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
19eceb2 Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-pad...
b460eb3 Prefer Homebrew openssl@4 and stop looking for openssl@1.1 (#2633)
649f2d9 Release openssl 0.10.79 and openssl-sys 0.9.115 (#2632)
257f9b2 Fix output buffer overflow for AES key-wrap-with-padding ciphers (#2630)
d43e917 Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders (#2631)
f46519c Add PkeyCtxRef::set_context_string for ML-DSA (#2629)
ad9ae31 Bind OSSL_PARAM_modified and use it for seed_into (#2628)
4e25c9b Fix process abort when verify/PSK callbacks fire after SSL_CTX swap (#2624)
3dd8f42 Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction (#2626)
Additional commits viewable in compare view

Updates remove_dir_all from 0.7.0 to 0.8.0

Changelog

Sourced from remove_dir_all's changelog.

0.8.0

Security changes

Fix TOCTOU race conditions both inside the implementation of functions and the contract: functions now only operate on directories. Callers wanting to process the contents of a symlink (e.g. for remove_dir_contents) should resolve the symlink themselves. This is an API break from 0.7.0, but the previous behaviour was insecure.

This is due to the same code pattern as caused CVE-2022-21658 in Rust itself: it was possible to trick a privileged process doing a recursive delete in an attacker controlled directory into deleting privileged files, on all operating systems.

For instance, consider deleting a tree called 'etc' in a parent directory called 'p'. Between calling remove_dir_all("a") and remove_dir_all("a") actually starting its work, the attacker can move 'p' to 'p-prime', and replace 'p' with a symlink to '/'. Then the privileged process deletes 'p/etc' which is actually /etc, and now your system is broken. There are some mitigations for this exact scenario, such as CWD relative file lookup, but they are not guaranteed - any code using absolute paths will not have that protection in place.

The same attack could be performed at any point in the directory tree being deleted: if 'a' contains a child directory called 'etc', attacking the deletion by replacing 'a' with a link is possible.

The new code in this release mitigates the attack within the directory tree being deleted by using file-handle relative operations: to open 'a/etc', the path 'etc' relative to 'a' is opened, where 'a' is represented by a file descriptor (Unix) or handle (Windows). With the exception of the entry points into the directory deletion logic, this is robust against manipulation of the directory hierarchy, and remove_dir_all will only delete files and directories contained in the tree it is deleting.

The entry path however is a challenge - as described above, there are some potential mitigations, but since using them must be done by the calling code, it is hard to be confident about the security properties of the path based interface.

The new extension trait RemoveDir provides an interface where it is much harder to get it wrong.

somedir.remove_dir_contents("name-of-child").

Callers can then make their own security evaluation about how to securely get a directory handle. That is still not particularly obvious, and we're going to follow up with a helper of some sort (probably in the fs_at crate). Once that is available, the path based entry points will get deprecated.

... (truncated)

Commits

e1066ef Release 0.8.0
7247a8b Merge pull request from GHSA-mc8h-8q98-g5hr
be7a410 Update windows-sys requirement from 0.42.0 to 0.45.0 (#52)
6ebf7f0 Use SPDX license format (#50)
48e2043 Remove unused num_cpus dependency (#48)
720ca0e Update windows-sys to 0.42.0 (#47)
8b66129 Migrate from winapi to windows-sys. (#42)
d224855 Make parallelism a default-on feature (#38)
08037c9 Remove nightly feature (#37)
d8e02e6 Update env_logger requirement from 0.8.1 to 0.9.0 (#32)
Additional commits viewable in compare view

Updates rsa from 0.9.2 to 0.9.10

Changelog

Sourced from rsa's changelog.

0.9.10 (2026-01-06)

Fixed

do not panic on a prime being 1 when loading a secret key (#624)

#624: RustCrypto/RSA#624

0.9.9 (2025-11-13)

Fixed

Support for cryptographic operations with larger keys (#594)

#594: RustCrypto/RSA#594

0.9.8 (2025-03-12)

Added

Doc comments to specify the rand version (#473)

#473: RustCrypto/RSA#473

0.9.7 (2024-11-26)

Fixed

always validate keys in from_components

do not crash when handling tiny keys in PKCS1v15

0.9.6 (2023-12-01)

Added

expose a pss::get_default_pss_signature_algo_id helper (#393)

expose pkcs1v15::RsaSignatureAssociatedOid (#392)

#392: RustCrypto/RSA#392 #393: RustCrypto/RSA#393

0.9.5 (2023-11-27)

Added

Adds RsaPrivateKey::from_primes and RsaPrivateKey::from_p_q methods (#386)

#386: RustCrypto/RSA#386

0.9.4 (2023-11-20)

Added

Deterministic implementation of prime factors recovery (#380)

#380: RustCrypto/RSA#380

0.9.3 (2023-10-26)

Added

PKCS#8/SPKI decoding trait impls for pkcs1v15 keys (#346)

hazmat feature as a replacement for expose-internals (#352)

Changed

... (truncated)

Commits

da2af9a chore: release v0.9.10
2926c91 fix: do not panic on a prime being 1 when loading a secret key (#624)
488d2ad chore: release 0.9.9
c1f00a3 Support for cryptographic operations with larger keys (#594)
85f03b5 Release v0.9.8 (#495)
bd3575b Add comment to specify the rand version (#473)
551f6e5 release: v0.9.7
2edd479 fix: always validate keys in from_components
201ad81 fix: handle tiny keys
a801f53 v0.9.6 (#397)
Additional commits viewable in compare view

Updates whoami from 1.2.1 to 1.5.0

Changelog

Sourced from whoami's changelog.

[1.5.0] - 2024-03-03

Added

WASI support

Redox support

Fallible functions

whoami::fallible::devicename()

whoami::fallible::devicename_os()

whoami::fallible::distro()

whoami::fallible::hostname() - notably doesn't normalize to lowercase

whoami::fallible::realname()

whoami::fallible::realname_os()

whoami::fallible::username()

whoami::fallible::username_os()

whoami::Language

whoami::Country

whoami::langs()

whoami::fallible::account()

whoami::fallible::account_os()

whoami::DesktopEnv::is_gtk()

whoami::DesktopEnv::is_kde()

Removed

Generated device names that infer casing based on the hostname when the device name is not available - now returns the hostname unchanged

Partial (potentially unsound) support for Android, iOS, watchOS, tvOS, Fuchsia, Haiku, Solaris, and a few others. These targets now use the "fake" implementation.

Changed

Deprecated whoami::distro_os()

Deprecated whoami::hostname()

Deprecated whoami::hostname_os()

Deprecated whoami::lang()

illumos and Redox are no longer untested targets

Documented that illumos and Redox have a higher MSRV (Rust 1.65) than other targets

Display implementation on Platform::Illumos now displays in lowercase: illumos

Fixed

Removed some unnecessary allocations

Rare and nearly impossible cases of undefined behavior

Better handling of UTF-8 non-conformant strings

Multiple instances of undefined behavior on illumos

... (truncated)

Commits

358dc0e WhoAmI 1.5.0 Release (#94)
d6ee13e Fix Instances of Memory Corruption on Illumos (#93)
953e702 Support Redox (#92)
5bc73e4 Preserve OS case for hostnames (#86)
29d5f22 Support WASI (#84)
d7885e7 Add Target trait for implementing new targets (#80)
e3da4c5 Add langs() function, deprecate lang() (#78)
9a2ee7e Add commas to format!() calls
f499c74 Implement Fallible API (#71)
1c076a5 Fix broken non-utf8 support for some platform / function combinations (#70)
Additional commits viewable in compare view

Updates borsh from 0.10.2 to 0.10.4

Release notes

Sourced from borsh's releases.

borsh-derive-internal-v0.10.4

No release notes provided.

borsh-derive-v0.10.4

No release notes provided.

borsh-schema-derive-internal-v0.10.4

No release notes provided.

borsh-v0.10.4

Backported a fix for RUSTSEC-2023-0033: Forbid Vectors of Zero-sized types from de-/serialization (#145)

Changelog

Sourced from borsh's changelog.

[0.10.4] - 2024-09-23

Backported a fix for RUSTSEC-2023-0033: Forbid Vectors of Zero-sized types from de-/serialization (#145)

[0.10.3] - 2022-03-22

Add optional bytes/bytesmut support

Commits

a1fe363 release: 0.10.4
c545f3c chore: revert workspace and exclude changes (#311)
27843bc chore: prepare 0.10.4 with backported fix (#310)
79097e3 release: Prepare for 0.10.3 release
ad25b07 ci: Removed release-plz as it does not play well with the workspaces setup we...
c93d434 ci: Add release-plz CI action which will create a PR with a suggestion to cut...
e91f405 feat: Add optional bytes/bytesmut support (#132)
See full diff in compare view

Updates bumpalo from 3.10.0 to 3.20.3

Changelog

Sourced from bumpalo's changelog.

3.20.3

Released 2026-05-22.

Fixed

Fixed the try_alloc_slice_fill_with, alloc_slice_try_fill_with, alloc_slice_fill_with methods to properly rewind the bump pointer on allocation, initialization, and panic failure and avoid wasting bump capacity.

Fixed a drop bug in bumpalo::collections::vec::DrainFilter (used by retain and retain_mut) when the predicate panics.

3.20.2

Released 2026-02-19.

Fixed

Restored Send and Sync implementations for Box<T> for T: ?Sized types as well.

3.20.1

Released 2026-02-18.

Fixed

Restored Send and Sync implementations for Box<T> when T: Send and T: Sync respectively.

3.20.0

Released 2026-02-18.

Added

Added the bumpalo::collections::Vec::pop_if method.

Fixed

Fixed a bug in the bumpalo::collections::String::retain method in the face of panics.

Made bumpalo::collections::Box<T> covariant with T (just like std::boxed::Box<T>).

... (truncated)

Commits

84654ac Rewind on slice allocation failure (#324)
5325624 Fix a couple bugs (#323)
fcf8370 Fix UB in Allocator::grow_zeroed (#321)
657caf8 test: fix test for OOM instead of overflow (#320)
1db9be9 fix: fix typo in comment (#318)
a47f6d6 fix: bump pointer/bump chunk debug assertion (#313)
0b12966 Update Cargo.toml with keywords (#303)
1aad072 Bump to version 3.20.2 (#312)
2fb1d6a Add more tests for send and sync behavior, support unsized types (#311)
7c8d1f3 Bump to 3.20.1 (#310)
Additional commits viewable in compare view

Updates mio from 0.8.4 to 0.8.11

Changelog

Sourced from mio's changelog.

0.8.11

Fix receiving IOCP events after deregistering a Windows named pipe (tokio-rs/mio#1760, backport pr: tokio-rs/mio#1761).

0.8.10

Added

Solaris support (tokio-rs/mio#1724).

0.8.9

Added

ESP-IDF framework support (tokio-rs/mio#1692).

AIX operating system support (tokio-rs/mio#1704).

Vita support (tokio-rs/mio#1721).

{UnixListener,UnixStream}:bind_addr (tokio-rs/mio#1630).

mio_unsupported_force_poll_poll and mio_unsupported_force_waker_pipe unsupported configuration flags to force a specific poll or waker implementation (tokio-rs/mio#1684, tokio-rs/mio#1685, tokio-rs/mio#1692).

Fixed

The pipe(2) based waker (swapped file descriptors) (tokio-rs/mio#1722).

The duplicate waker check to work correctly with cloned Registrys. (tokio-rs/mio#1706).

0.8.8

Fixed

Fix compilation on WASI (tokio-rs/mio#1676).

0.8.7

Added

Add/fix support for tvOS and watchOS, Mio should now build for tvOS and

... (truncated)

Commits

0328bde Release v0.8.11
7084498 Fix warnings
90d4fe0 named-pipes: fix receiving IOCP events after deregister
c710a30 Add v0.8.x to the CI
c29e21c Release v0.8.10
f6a20da Add Solaris operating system support (#1724)
e80c3b2 Release v0.8.9
862786b Fix importing of IoSourceState
4034872 Add support for vita target
8eb4010 Fix receiver and sender fd in pipe based waker
Additional commits viewable in compare view

Updates openssl-src from 111.22.0+1.1.1q to 300.6.1+3.6.3

Commits

See full diff in compare view

Updates rustix from 0.38.3 to 0.38.8

Commits

db14303 chore: Release rustix version 0.38.8
3f9a1aa rustfmt
33cd42b Move some transmutes out of the main code and into #[test]s. (#785)
a141847 Make the "hole" test check _PC_MIN_HOLE_SIZE on platforms that have it. (#786)
9e55075 Remove some unnecessary unsafe blocks. (#784)
a25ae26 Miscellaneous documentation cleanups. (#778)
5d9bcbc Add a function for SO_DOMAIN. (#779)
eb97b82 Construct non-zero types safely at compile-time (#781)
a196582 Enable SeekFrom::Hole on more platforms. (#774)
3708b64 Add data() method to kqueue events (#772)
Additional commits viewable in compare view

Updates rustls-webpki from 0.101.1 to 0.101.6

Release notes

Sourced from rustls-webpki's releases.

0.101.6

The CertificateRevocationList trait's verify_signature Budget argument was removed. This was a semver incompatible change mistakenly introduced in v0.101.5.

What's Changed

crl: rm Budget from verify_signature fn by @cpu in rustls/webpki#187

Full Changelog: rustls/webpki@v/0.101.5...v/0.101.6

0.101.5

Path building complexity is now limited to a maximum budget of path finding operations, avoiding exponential processing time when encountering certificate chains containing many certificates with the same subject/issuer distinguished name but different subject public key information.

Name constraints evaluation is now limited to a maximum number of comparison operations, avoiding exponential processing time when encountering certificate chains containing many name constraints and subject alternate names.

Subject common names are no longer parsed for name iteration, or applying name constraints. Webpki only uses Subject Alternate Names when validating certificates, and the common name handling was buggy, producing Error::BadDer when iterating certificates with printable string subject common names, or omitted common names encoded as an empty sequence.

What's Changed

The following PRs were backported to the rel-0.101 branch in #170:

Further limits on expensive path building (#163)

Budget tweaks (#164)

Bound name constraint comparisons (#165)

Remove subject common name parsing (#169, thanks to @hawkw)

Correct handling of fatal errors (#168)

Thanks to all who have contributed, on behalf of the rustls team (@ctz, @cpu and @djc)!

0.101.4

Release notes

certificate path building and verification is now capped at 100 signature validation operations to avoid the risk of CPU usage denial-of-service attack when validating crafted certificate chains producing quadratic runtime. This risk affected both clients, as well as servers that verified client certificates.

What's Changed

v0.101.4 prep by @cpu in rustls/webpki#153

Full Changelog: rustls/webpki@v/0.101.3...v/0.101.4

v/0.101.3

Release Notes

TlsServerTrustAnchors, TlsClientTrustAnchors, verify_is_valid_tls_server_cert and verify_is_valid_tls_client_cert deprecation notes improved.

What's Changed

trust_anchor/end_entity: rework deprecation notes by @cpu in rustls/webpki#149

0.101.3 release prep by @cpu in rustls/webpki#149

Full Changelog: rustls/webpki@v/0.101.2...v/0.101.3

v/0.101.2

Release notes

... (truncated)

Commits

7956538 Cargo: v0.101.5 -> v0.101.6
7f8208e crl: rm Budget from verify_signature fn
7cb6c64 Cargo: bump version 0.101.4 -> 0.101.5
2dd2a06 verify_cert: use enum for build chain error
c255d61 verify_cert: correct handling of fatal errors
b166eab error: add is_fatal helper, use in verify_cert
cce08ee verify_cert: optional Budget arg for verify_chain helper
08fd439 verify_cert: take references in verify_chain helper
c9914e4 Remove common name parsing from NameIterator
bb9fe71 Remove tests for common name handling
Additional commits viewable in compare view

raviqqe · 2026-08-03T05:37:39Z

@dependabot recreate

Bumps the cargo group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.20.1` | `1.26.0` | | [rustls](https://github.com/rustls/rustls) | `0.21.3` | `0.21.5` | | [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.41` | `0.10.80` | | [remove_dir_all](https://github.com/XAMPPRocky/remove_dir_all) | `0.7.0` | `0.8.0` | | [rsa](https://github.com/RustCrypto/RSA) | `0.9.2` | `0.9.10` | | [whoami](https://github.com/ardaku/whoami) | `1.2.1` | `1.5.0` | | [borsh](https://github.com/near/borsh-rs) | `0.10.2` | `0.10.4` | | [bumpalo](https://github.com/fitzgen/bumpalo) | `3.10.0` | `3.20.3` | | [mio](https://github.com/tokio-rs/mio) | `0.8.4` | `0.8.11` | | [rustix](https://github.com/bytecodealliance/rustix) | `0.38.3` | `0.38.8` | | [rustls-webpki](https://github.com/rustls/webpki) | `0.101.1` | `0.101.6` | Updates `tokio` from 1.20.1 to 1.26.0 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.20.1...tokio-1.26.0) Updates `rustls` from 0.21.3 to 0.21.5 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.21.3...v/0.21.5) Updates `openssl` from 0.10.41 to 0.10.80 - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.41...openssl-v0.10.80) Updates `remove_dir_all` from 0.7.0 to 0.8.0 - [Release notes](https://github.com/XAMPPRocky/remove_dir_all/releases) - [Changelog](https://github.com/XAMPPRocky/remove_dir_all/blob/master/CHANGELOG.md) - [Commits](https://github.com/XAMPPRocky/remove_dir_all/compare/v0.7.0...remove_dir_all@0.8.0) Updates `rsa` from 0.9.2 to 0.9.10 - [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md) - [Commits](RustCrypto/RSA@v0.9.2...v0.9.10) Updates `whoami` from 1.2.1 to 1.5.0 - [Release notes](https://github.com/ardaku/whoami/releases) - [Changelog](https://github.com/ardaku/whoami/blob/v1.5.0/CHANGELOG.md) - [Commits](ardaku/whoami@v1.2.1...v1.5.0) Updates `borsh` from 0.10.2 to 0.10.4 - [Release notes](https://github.com/near/borsh-rs/releases) - [Changelog](https://github.com/near/borsh-rs/blob/borsh-v0.10.4/CHANGELOG.md) - [Commits](near/borsh-rs@v0.10.2...borsh-v0.10.4) Updates `bumpalo` from 3.10.0 to 3.20.3 - [Changelog](https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md) - [Commits](fitzgen/bumpalo@3.10.0...v3.20.3) Updates `mio` from 0.8.4 to 0.8.11 - [Release notes](https://github.com/tokio-rs/mio/releases) - [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md) - [Commits](tokio-rs/mio@v0.8.4...v0.8.11) Updates `openssl-src` from 111.22.0+1.1.1q to 300.6.1+3.6.3 - [Release notes](https://github.com/alexcrichton/openssl-src-rs/releases) - [Commits](https://github.com/alexcrichton/openssl-src-rs/commits) Updates `rustix` from 0.38.3 to 0.38.8 - [Release notes](https://github.com/bytecodealliance/rustix/releases) - [Changelog](https://github.com/bytecodealliance/rustix/blob/main/CHANGES.md) - [Commits](bytecodealliance/rustix@v0.38.3...v0.38.8) Updates `rustls-webpki` from 0.101.1 to 0.101.6 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.101.1...v/0.101.6) --- updated-dependencies: - dependency-name: borsh dependency-version: 0.10.3 dependency-type: indirect - dependency-name: bumpalo dependency-version: 3.16.0 dependency-type: indirect - dependency-name: mio dependency-version: 0.8.8 dependency-type: indirect - dependency-name: openssl dependency-version: 0.10.66 dependency-type: direct:production - dependency-name: openssl-src dependency-version: 300.3.1+3.3.1 dependency-type: indirect - dependency-name: remove_dir_all dependency-version: 0.8.0 dependency-type: direct:production - dependency-name: rsa dependency-version: 0.9.6 dependency-type: direct:production - dependency-name: rustix dependency-version: 0.35.16 dependency-type: indirect - dependency-name: rustls dependency-version: 0.21.5 dependency-type: direct:production - dependency-name: rustls-webpki dependency-version: 0.101.6 dependency-type: indirect - dependency-name: tokio dependency-version: 1.20.4 dependency-type: direct:production - dependency-name: whoami dependency-version: 1.5.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 22, 2024

dependabot Bot force-pushed the dependabot/cargo/cargo-0bf2fd03da branch from 434b7e4 to 988978d Compare August 3, 2026 05:48

Navigation Menu

chore(deps): bump the cargo group across 1 directory with 12 updates - #3

chore(deps): bump the cargo group across 1 directory with 12 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-0bf2fd03da

dependabot Bot commented on behalf of github Jul 22, 2024 •

edited

Loading

Uh oh!

raviqqe commented Aug 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tokio v1.26.0

Fixed

Added

Changed

Internal Changes

Unstable

Documented

openssl-v0.10.80

What's Changed

openssl-v0.10.79

What's Changed

openssl-v0.10.78

What's Changed

0.8.0

Security changes

0.9.10 (2026-01-06)

Fixed

0.9.9 (2025-11-13)

Fixed

0.9.8 (2025-03-12)

Added

0.9.7 (2024-11-26)

Fixed

0.9.6 (2023-12-01)

Added

0.9.5 (2023-11-27)

Added

0.9.4 (2023-11-20)

Added

0.9.3 (2023-10-26)

Added

Changed

[1.5.0] - 2024-03-03

Added

Removed

Changed

Fixed

borsh-derive-internal-v0.10.4

borsh-derive-v0.10.4

borsh-schema-derive-internal-v0.10.4

borsh-v0.10.4

[0.10.4] - 2024-09-23

[0.10.3] - 2022-03-22

3.20.3

Fixed

3.20.2

Fixed

3.20.1

Fixed

3.20.0

Added

Fixed

0.8.11

0.8.10

Added

0.8.9

Added

Fixed

0.8.8

Fixed

0.8.7

Added

0.101.6

What's Changed

0.101.5

What's Changed

0.101.4

Release notes

What's Changed

v/0.101.3

Release Notes

What's Changed

v/0.101.2

Release notes

Uh oh!

raviqqe commented Aug 3, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 22, 2024 •

edited

Loading