chore(deps): bump the cargo group across 1 directory with 12 updates by dependabot[bot] · Pull Request #2 · aldur/sqlx

dependabot · 2026-03-21T09:08:35Z

Bumps the cargo group with 11 updates in the / directory:

Package	From	To
tokio	`1.20.1`	`1.26.0`
time	`0.3.19`	`0.3.44`
rustls	`0.21.3`	`0.21.5`
openssl	`0.10.41`	`0.10.72`
remove_dir_all	`0.7.0`	`0.8.0`
rsa	`0.9.2`	`0.9.10`
whoami	`1.2.1`	`1.5.0`
borsh	`0.10.2`	`0.10.4`
bumpalo	`3.10.0`	`3.20.2`
mio	`0.8.4`	`0.8.11`
rustls-webpki	`0.101.1`	`0.101.6`

Updates tokio from 1.20.1 to 1.26.0

Release notes

Sourced from tokio's releases.

Tokio v1.26.0

Fixed

macros: fix empty join! and try_join! ([https://redirect.github.com/fix empty join! and try_join! tokio-rs/tokio#5504])

sync: don't leak tracing spans in mutex guards ([https://redirect.github.com/sync: don't leak tracing spans in mutex guards tokio-rs/tokio#5469])

sync: drop wakers after unlocking the mutex in Notify ([https://redirect.github.com/Drop wakers after unlocking the mutex in Notify tokio-rs/tokio#5471])

sync: drop wakers outside lock in semaphore ([https://redirect.github.com/Solve deadlock in Semaphore tokio-rs/tokio#5475])

Added

fs: add fs::try_exists ([https://redirect.github.com/Add fs::try_exists tokio-rs/tokio#4299])

net: add types for named unix pipes ([https://redirect.github.com/net: add types for named Unix pipes tokio-rs/tokio#5351])

sync: add MappedOwnedMutexGuard ([https://redirect.github.com/Add MappedOwnedMutexGuard tokio-rs/tokio#5474])

Changed

chore: update windows-sys to 0.45 ([https://redirect.github.com/chore: update windows-sys to 0.45 tokio-rs/tokio#5386])

net: use Message Read Mode for named pipes ([https://redirect.github.com/Named Pipes: Support Message Read Mode tokio-rs/tokio#5350])

sync: mark lock guards with #[clippy::has_significant_drop] ([https://redirect.github.com/Mark MutexGuard with #[clippy::has_significant_drop] tokio-rs/tokio#5422])

sync: reduce contention in watch channel ([https://redirect.github.com/Reduce contention in watch channel tokio-rs/tokio#5464])

time: remove cache padding in timer entries ([https://redirect.github.com/time: remove cache padding in timer entries tokio-rs/tokio#5468])

time: Improve Instant::now() perf with test-util ([https://redirect.github.com/time: Improve Instant::now() perf with test-util tokio-rs/tokio#5513])

Internal Changes

io: use poll_fn in copy_bidirectional ([https://redirect.github.com/Use poll_fn in copy_bidirectional tokio-rs/tokio#5486])

net: refactor named pipe builders to not use bitfields ([https://redirect.github.com/net: refactor named pipe builders to not use bitfields tokio-rs/tokio#5477])

rt: remove Arc from Clock ([https://redirect.github.com/rt: remove Arc from Clock tokio-rs/tokio#5434])

sync: make notify_waiters calls atomic ([https://redirect.github.com/sync: make notify_waiters calls atomic tokio-rs/tokio#5458])

time: don't store deadline twice in sleep entries ([https://redirect.github.com/remove double store of deadline, saving 128 bytes tokio-rs/tokio#5410])

Unstable

metrics: add a new metric for budget exhaustion yields ([https://redirect.github.com/metrics: add a new metric for budget exhaustion yields tokio-rs/tokio#5517])

Documented

io: improve AsyncFd example ([https://redirect.github.com/io: improve AsyncFd example tokio-rs/tokio#5481])

runtime: document the nature of the main future ([https://redirect.github.com/Document the nature of the main future tokio-rs/tokio#5494])

runtime: remove extra period in docs ([https://redirect.github.com/chore: remove unnecessary dot in comment tokio-rs/tokio#5511])

signal: updated Documentation for Signals ([https://redirect.github.com/Updated Documentation for Signals tokio-rs/tokio#5459])

sync: add doc aliases for blocking_* methods ([https://redirect.github.com/sync: add doc aliases for blocking_* methods tokio-rs/tokio#5448])

sync: fix docs for Send/Sync bounds in broadcast ([https://redirect.github.com/sync: fix docs for Send/Sync bounds in broadcast tokio-rs/tokio#5480])

sync: document drop behavior for channels ([https://redirect.github.com/sync: document drop behavior for channels tokio-rs/tokio#5497])

task: clarify what happens to spawned work during runtime shutdown ([https://redirect.github.com/clarify what happens to spawned work during runtime shutdown tokio-rs/tokio#5394])

task: clarify process::Command docs ([https://redirect.github.com/Clarify process::Command docs (fixing #5406) tokio-rs/tokio#5413])

task: fix wording with 'unsend' ([https://redirect.github.com/fix: fix wording with 'unsend' tokio-rs/tokio#5452])

time: document immediate completion guarantee for timeouts ([https://redirect.github.com/time: document immediate completion guarantee for timeouts tokio-rs/tokio#5509])

tokio: document supported platforms ([https://redirect.github.com/Document supported platforms tokio-rs/tokio#5483])

... (truncated)

Commits

a377240 chore: prepare for Tokio v1.26.0 release (#5521)
52da177 metrics: add a new metric for budget exhaustion yields (#5517)
ee1c940 time: Improve Instant::now() perf with test-util (#5513)
815d89a runtime: remove extra period in docs (#5511)
54aaf3d time: document immediate completion guarantee for timeouts (#5509)
5a3abe5 net: add types for named unix pipes (#5351)
d44b1ca io: ignore SplitByUtf8BoundaryIfWindows test on miri (#5507)
e23c6f3 signal: updated Documentation for Signals (#5459)
0a50cb3 net: fix test compilation failure (#5506)
2298679 runtime: document the nature of the main future (#5494)
Additional commits viewable in compare view

Updates time from 0.3.19 to 0.3.44

Release notes

Sourced from time's releases.

v0.3.44

See the changelog for details.

v0.3.43

See the changelog for details.

v0.3.42

See the changelog for details.

v0.3.41

See the changelog for details.

v0.3.40

See the changelog for details.

v0.3.39

See the changelog for details.

v0.3.38

See the changelog for details.

v0.3.37

See the changelog for details.

v0.3.36

See the changelog for details.

v0.3.35

See the changelog for details.

v0.3.34

See the changelog for details.

v0.3.33

See the changelog for details.

v0.3.32

See the changelog for details.

v0.3.31

See the changelog for details.

v0.3.30

See the changelog for details.

v0.3.29

See the changelog for details.

v0.3.28

See the changelog for details.

... (truncated)

Changelog

Sourced from time's changelog.

0.3.44 [2025-09-19]

Fixed

Comparisons of PrimitiveDateTime, UtcDateTime, and OffsetDateTime with differing signs (i.e. one negative and one positive year) would return the inverse result of what was expected. This was introduced in v0.3.42 and has been fixed.

Type inference would fail due to feature unification when wasm-bindgen enabled serde_json. This has been fixed by explicitly specifying the type in the relevant locations.

0.3.43 [2025-09-02]

Added

Support for rand 0.9

Fixed

In the convert module, any use of per with types that were not the same (such as Nanosecond::per(Second)) would not compile due to a bug. This has been fixed.

0.3.42 [2025-08-31]

Added

Time::duration_until

Time::duration_since

per_t method for all types in time::convert. This is similar to the existing per method, but can return any of the primitive numeric types that can represent the result. This will cut down on as casts while ensuring correctness. Type inference isn't perfect, so you may need to provide a type annotation in some situations.

impl PartialOrd for Month and impl Ord for Month; this assumes the months are in the same year

SystemTimeExt trait, adding methods for checked arithmetic with time::Duration and obtaining the difference between two SystemTimes as a time::Duration

Permit using UtcDateTime with rand (this was inadvertently omitted previously)

impl core::error::Error for all error types (now available when the std feature is disabled)

MacOS can now obtain the local UTC offset in multi-threaded programs as the system APIs are thread-safe.

#[track_caller] has been added to all relevant methods.

Changed

The minimum supported Rust version is now 1.81.0.

The dependency on itoa has been removed, as the standard library now has similar functionality by default.

Formatting a component that involves a floating point number is now guaranteed to be deterministic, avoiding any subtle differences between platforms or compiler versions.

Fixed

... (truncated)

Commits

04c0ef2 v0.3.44 release
b942063 Compare datetimes with signed integers
dcdfbf6 Add explicit type to avoid inference errors
f203852 Revert "Remove dependency on itoa"
45b9932 v0.3.43 release
8cbf0db Fix bug with convert
3343e85 Add support for rand 0.9
afb2574 Add note about MSRV
ed2852e v0.3.42 release
1067543 Fix copied comment
Additional commits viewable in compare view

Updates rustls from 0.21.3 to 0.21.5

Commits

b1808ac cargo: prepare 0.21.5 release.
6ff5b77 Revert "Take IntoIterator in add_parsable_certificates()"
f613c9f cargo: prepare 0.21.4 release.
11e9386 Prepare to move release notes to github releases
4a9f375 RELEASING.md: restructure, use github releases
7924f00 Take IntoIterator in add_parsable_certificates()
6fedb35 client: with_single_cert -> with_client_auth_cert
208d767 deps: update webpki-roots 0.23.0 -> 0.24.0
da5be06 error: use automatic link for RFC 5280 ref.
3e90954 lib: export CertRevocationListError enum.
See full diff in compare view

Updates openssl from 0.10.41 to 0.10.72

Release notes

Sourced from openssl's releases.

openssl-v0.10.72

What's Changed

make set_rsa_oaep_md visible to boringssl config by @frncs-rss in sfackler/rust-openssl#2372

Fix typo in openssl-sys build script by @rushilmehra in sfackler/rust-openssl#2375

Unify the two BoringSSL codepaths a bit and simplify init by @davidben in sfackler/rust-openssl#2377

pkey_ctx: Fix link to the corresponding OpenSSL function by @Jakuje in sfackler/rust-openssl#2378

fix test on MSRV by @alex in sfackler/rust-openssl#2383

Add support for AWS-LC to openssl and openssl-sys crates by @skmcgrail in sfackler/rust-openssl#1805

Enable additional capabilities for AWS-LC by @skmcgrail in sfackler/rust-openssl#2386

Use --experimental with bindgen-cli with aws-lc build by @skmcgrail in sfackler/rust-openssl#2389

Fixed two UAFs and bumped versions for release by @alex in sfackler/rust-openssl#2390

New Contributors

@Jakuje made their first contribution in sfackler/rust-openssl#2378

@skmcgrail made their first contribution in sfackler/rust-openssl#1805

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.71...openssl-v0.10.72

openssl-v0.10.71

What's Changed

Expose rc2 ciphers on symm::Cipher by @alex in sfackler/rust-openssl#2361

add full Apache license file to openssl by @frncs-rss in sfackler/rust-openssl#2366

Release openssl v0.10.71 and openssl-sys v0.9.106 by @alex in sfackler/rust-openssl#2369

New Contributors

@frncs-rss made their first contribution in sfackler/rust-openssl#2366

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.70...openssl-v0.10.71

openssl v0.10.70

What's Changed

Attempt to fix CI by pinning to the Ubuntu 22.04 image by @alex in sfackler/rust-openssl#2357

Remove EC_METHOD and EC_GROUP_new for LibreSSL 4.1 by @botovq in sfackler/rust-openssl#2356

Test against 3.4.0 final release by @alex in sfackler/rust-openssl#2359

Expose SslMethod::{dtls_client,dtls_server} by @alex in sfackler/rust-openssl#2358

Fix lifetimes in ssl::select_next_proto by @sfackler in sfackler/rust-openssl#2360

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.69...openssl-v0.10.70

openssl v0.10.69

What's Changed

build(deps): Update openssl-macro to version 0.1.1 by @caspermeijn in sfackler/rust-openssl#2324

Enable set_alpn_select_callback for BoringSSL by @ViktoriiaKovalova in sfackler/rust-openssl#2327

Switch the test to use prime256v1 based key by @dcermak in sfackler/rust-openssl#2330

Expose EVP_DigestSqueeze from Hasher by @initsecret in sfackler/rust-openssl#2275

Expose SSL_CTX_load_verify_locations by @sfackler in sfackler/rust-openssl#2353

New Contributors

@caspermeijn made their first contribution in sfackler/rust-openssl#2324

... (truncated)

Commits

87085bd Merge pull request #2390 from alex/uaf-fix
d1a12e2 Fixed two UAFs and bumped versions for release
7c7b2e6 Merge pull request #2389 from skmcgrail/aws-lc-follow-up
34a477b Use --experimental with bindgen-cli with aws-lc build
d4bf071 Merge pull request #2386 from skmcgrail/aws-lc-follow-up
a86bf67 Remove comment
705dbfb Fix test
e0df413 Skip final call for LibreSSL 4.1.0 for CCM mode
2f1164b Enable additional capabilities for AWS-LC
dde9ffb Merge pull request #1805 from skmcgrail/aws-lc-support-final
Additional commits viewable in compare view

Updates remove_dir_all from 0.7.0 to 0.8.0

Changelog

Sourced from remove_dir_all's changelog.

0.8.0

Security changes

Fix TOCTOU race conditions both inside the implementation of functions and the contract: functions now only operate on directories. Callers wanting to process the contents of a symlink (e.g. for remove_dir_contents) should resolve the symlink themselves. This is an API break from 0.7.0, but the previous behaviour was insecure.

This is due to the same code pattern as caused CVE-2022-21658 in Rust itself: it was possible to trick a privileged process doing a recursive delete in an attacker controlled directory into deleting privileged files, on all operating systems.

For instance, consider deleting a tree called 'etc' in a parent directory called 'p'. Between calling remove_dir_all("a") and remove_dir_all("a") actually starting its work, the attacker can move 'p' to 'p-prime', and replace 'p' with a symlink to '/'. Then the privileged process deletes 'p/etc' which is actually /etc, and now your system is broken. There are some mitigations for this exact scenario, such as CWD relative file lookup, but they are not guaranteed - any code using absolute paths will not have that protection in place.

The same attack could be performed at any point in the directory tree being deleted: if 'a' contains a child directory called 'etc', attacking the deletion by replacing 'a' with a link is possible.

The new code in this release mitigates the attack within the directory tree being deleted by using file-handle relative operations: to open 'a/etc', the path 'etc' relative to 'a' is opened, where 'a' is represented by a file descriptor (Unix) or handle (Windows). With the exception of the entry points into the directory deletion logic, this is robust against manipulation of the directory hierarchy, and remove_dir_all will only delete files and directories contained in the tree it is deleting.

The entry path however is a challenge - as described above, there are some potential mitigations, but since using them must be done by the calling code, it is hard to be confident about the security properties of the path based interface.

The new extension trait RemoveDir provides an interface where it is much harder to get it wrong.

somedir.remove_dir_contents("name-of-child").

Callers can then make their own security evaluation about how to securely get a directory handle. That is still not particularly obvious, and we're going to follow up with a helper of some sort (probably in the fs_at crate). Once that is available, the path based entry points will get deprecated.

... (truncated)

Commits

e1066ef Release 0.8.0
7247a8b Merge pull request from GHSA-mc8h-8q98-g5hr
be7a410 Update windows-sys requirement from 0.42.0 to 0.45.0 (#52)
6ebf7f0 Use SPDX license format (#50)
48e2043 Remove unused num_cpus dependency (#48)
720ca0e Update windows-sys to 0.42.0 (#47)
8b66129 Migrate from winapi to windows-sys. (#42)
d224855 Make parallelism a default-on feature (#38)
08037c9 Remove nightly feature (#37)
d8e02e6 Update env_logger requirement from 0.8.1 to 0.9.0 (#32)
Additional commits viewable in compare view

Updates rsa from 0.9.2 to 0.9.10

Changelog

Sourced from rsa's changelog.

0.9.10 (2026-01-06)

Fixed

do not panic on a prime being 1 when loading a secret key (#624)

#624: RustCrypto/RSA#624

0.9.9 (2025-11-13)

Fixed

Support for cryptographic operations with larger keys (#594)

#594: RustCrypto/RSA#594

0.9.8 (2025-03-12)

Added

Doc comments to specify the rand version (#473)

#473: RustCrypto/RSA#473

0.9.7 (2024-11-26)

Fixed

always validate keys in from_components

do not crash when handling tiny keys in PKCS1v15

0.9.6 (2023-12-01)

Added

expose a pss::get_default_pss_signature_algo_id helper (#393)

expose pkcs1v15::RsaSignatureAssociatedOid (#392)

#392: RustCrypto/RSA#392 #393: RustCrypto/RSA#393

0.9.5 (2023-11-27)

Added

Adds RsaPrivateKey::from_primes and RsaPrivateKey::from_p_q methods (#386)

#386: RustCrypto/RSA#386

0.9.4 (2023-11-20)

Added

Deterministic implementation of prime factors recovery (#380)

#380: RustCrypto/RSA#380

0.9.3 (2023-10-26)

Added

PKCS#8/SPKI decoding trait impls for pkcs1v15 keys (#346)

hazmat feature as a replacement for expose-internals (#352)

Changed

... (truncated)

Commits

da2af9a chore: release v0.9.10
2926c91 fix: do not panic on a prime being 1 when loading a secret key (#624)
488d2ad chore: release 0.9.9
c1f00a3 Support for cryptographic operations with larger keys (#594)
85f03b5 Release v0.9.8 (#495)
bd3575b Add comment to specify the rand version (#473)
551f6e5 release: v0.9.7
2edd479 fix: always validate keys in from_components
201ad81 fix: handle tiny keys
a801f53 v0.9.6 (#397)
Additional commits viewable in compare view

Updates whoami from 1.2.1 to 1.5.0

Changelog

Sourced from whoami's changelog.

[1.5.0] - 2024-03-03

Added

WASI support

Redox support

Fallible functions

whoami::fallible::devicename()

whoami::fallible::devicename_os()

whoami::fallible::distro()

whoami::fallible::hostname() - notably doesn't normalize to lowercase

whoami::fallible::realname()

whoami::fallible::realname_os()

whoami::fallible::username()

whoami::fallible::username_os()

whoami::Language

whoami::Country

whoami::langs()

whoami::fallible::account()

whoami::fallible::account_os()

whoami::DesktopEnv::is_gtk()

whoami::DesktopEnv::is_kde()

Removed

Generated device names that infer casing based on the hostname when the device name is not available - now returns the hostname unchanged

Partial (potentially unsound) support for Android, iOS, watchOS, tvOS, Fuchsia, Haiku, Solaris, and a few others. These targets now use the "fake" implementation.

Changed

Deprecated whoami::distro_os()

Deprecated whoami::hostname()

Deprecated whoami::hostname_os()

Deprecated whoami::lang()

illumos and Redox are no longer untested targets

Documented that illumos and Redox have a higher MSRV (Rust 1.65) than other targets

Display implementation on Platform::Illumos now displays in lowercase: illumos

Fixed

Removed some unnecessary allocations

Rare and nearly impossible cases of undefined behavior

Better handling of UTF-8 non-conformant strings

Multiple instances of undefined behavior on illumos

... (truncated)

Commits

358dc0e WhoAmI 1.5.0 Release (#94)
d6ee13e Fix Instances of Memory Corruption on Illumos (#93)
953e702 Support Redox (#92)
5bc73e4 Preserve OS case for hostnames (#86)
29d5f22 Support WASI (#84)
d7885e7 Add Target trait for implementing new targets (#80)
e3da4c5 Add langs() function, deprecate lang() (#78)
9a2ee7e Add commas to format!() calls
f499c74 Implement Fallible API (#71)
1c076a5 Fix broken non-utf8 support for some platform / function combinations (#70)
Additional commits viewable in compare view

Updates borsh from 0.10.2 to 0.10.4

Release notes

Sourced from borsh's releases.

borsh-derive-internal-v0.10.4

No release notes provided.

borsh-derive-v0.10.4

No release notes provided.

borsh-schema-derive-internal-v0.10.4

No release notes provided.

borsh-v0.10.4

Backported a fix for RUSTSEC-2023-0033: Forbid Vectors of Zero-sized types from de-/serialization (#145)

Changelog

Sourced from borsh's changelog.

[0.10.4] - 2024-09-23

Backported a fix for RUSTSEC-2023-0033: Forbid Vectors of Zero-sized types from de-/serialization (#145)

[0.10.3] - 2022-03-22

Add optional bytes/bytesmut support

Commits

a1fe363 release: 0.10.4
c545f3c chore: revert workspace and exclude changes (#311)
27843bc chore: prepare 0.10.4 with backported fix (#310)
79097e3 release: Prepare for 0.10.3 release
ad25b07 ci: Removed release-plz as it does not play well with the workspaces setup we...
c93d434 ci: Add release-plz CI action which will create a PR with a suggestion to cut...
e91f405 feat: Add optional bytes/bytesmut support (#132)
See full diff in compare view

Updates bumpalo from 3.10.0 to 3.20.2

Changelog

Sourced from bumpalo's changelog.

3.20.2

Released 2026-02-19.

Fixed

Restored Send and Sync implementations for Box<T> for T: ?Sized types as well.

3.20.1

Released 2026-02-18.

Fixed

Restored Send and Sync implementations for Box<T> when T: Send and T: Sync respectively.

3.20.0

Released 2026-02-18.

Added

Added the bumpalo::collections::Vec::pop_if method.

Fixed

Fixed a bug in the bumpalo::collections::String::retain method in the face of panics.

Made bumpalo::collections::Box<T> covariant with T (just like std::boxed::Box<T>).

3.19.1

Released 2025-12-16.

Changed

Annotated bumpalo::collections::String::from_str_in as #[inline].

Fixed

Fixed compilation failures with the latest nightly Rust when enabling the

... (truncated)

Commits

1aad072 Bump to version 3.20.2 (#312)
2fb1d6a Add more tests for send and sync behavior, support unsized types (#311)
7c8d1f3 Bump to 3.20.1 (#310)
e06b36b Restore Send and Sync for Box (#309)
cb7f033 Bump to 3.20.0 (#307)
d97d31c Make box covariant (#304)
f9256f7 Pin quickcheck (#306)
a006efb Fix String::retain panic safety yielding invalid UTF-8 (#302)
96ba386 Add pop_if() to Vec (#301)
8c2172a Bump to version 3.19.1 (#300)
Additional commits viewable in compare view

Updates mio from 0.8.4 to 0.8.11

Changelog

Sourced from mio's changelog.

0.8.11

Fix receiving IOCP events after deregistering a Windows named pipe (tokio-rs/mio#1760, backport pr: tokio-rs/mio#1761).

0.8.10

Added

Solaris support (tokio-rs/mio#1724).

0.8.9

Added

ESP-IDF framework support (tokio-rs/mio#1692).

AIX operating system support (tokio-rs/mio#1704).

Vita support (tokio-rs/mio#1721).

{UnixListener,UnixStream}:bind_addr (tokio-rs/mio#1630).

mio_unsupported_force_poll_poll and mio_unsupported_force_waker_pipe unsupported configuration flags to force a specific poll or waker implementation (tokio-rs/mio#1684, tokio-rs/mio#1685, tokio-rs/mio#1692).

Fixed

The pipe(2) based waker (swapped file descriptors) (tokio-rs/mio#1722).

The duplicate waker check to work correctly with cloned Registrys. (tokio-rs/mio#1706).

0.8.8

Fixed

Fix compilation on WASI (tokio-rs/mio#1676).

0.8.7

Added

Add/fix support for tvOS and watchOS, Mio should now build for tvOS and

... (truncated)

Commits

0328bde Release v0.8.11
7084498 Fix warnings
90d4fe0 named-pipes: fix receiving IOCP events after deregister
c710a30 Add v0.8.x to the CI
c29e21c Release v0.8.10
f6a20da Add Solaris operating system support (#1724)
e80c3b2 Release v0.8.9
862786b Fix importing of IoSourceState
4034872 Add support for vita target
8eb4010 Fix receiver and sender fd in pipe based waker
Additional commits viewable in compare view

Updates openssl-src from 111.22.0+1.1.1q to 300.5.5+3.5.5

Commits

See full diff in compare view

Updates rustls-webpki from 0.101.1 to 0.101.6

Release notes

Sourced from rustls-webpki's releases.

0.101.6

The CertificateRevocationList trait's verify_signature Budget argument was removed. This was a semver incompatible change mistakenly introduced in v0.101.5.

What's Changed

crl: rm Budget from verify_signature fn by @cpu in rustls/webpki#187

Full Changelog: rustls/webpki@v/0.101.5...v/0.101.6

0.101.5

Path building complexity is now limited to a maximum budget of path finding operations, avoiding exponential processing time when encountering certificate chains containing many certificates with the same subject/issuer distinguished name but different subject public key information.

Name constraints evaluation is now limited to a maximum number of comparison operations, avoiding exponential processing time when encountering certificate chains containing many name constraints and subject alternate names.

Subject common names are no longer parsed for name iteration, or applying name constraints. Webpki only uses Subject Alternate Names when validating certificates, and the common name handling was buggy, producing Error::BadDer when iterating certificates with printable string subject common names, or omitted common names encoded as an empty sequence.

What's Changed

The following PRs were backported to the rel-0.101 branch in #170:

Further limits on expensive path building (#163)

Budget tweaks (#164)

Bound name constraint comparisons (#165)

Remove subject common name parsing (#169, thanks to @hawkw)

Correct handling of fatal errors (#168)

Thanks to all who have contributed, on behalf of the rustls team (@ctz, @cpu and @djc)!

0.101.4

Release notes

certificate path building and verification is now capped at 100 signature validation operations to avoid the risk of CPU usage denial-of-service attack when validating crafted certificate chains producing quadratic runtime. This risk affected both clients, as well as servers that verified client certificates.

What's Changed

v0.101.4 prep by @cpu in rustls/webpki#153

Full Changelog: rustls/webpki@v/0.101.3...v/0.101.4

v/0.101.3

Release Notes

TlsServerTrustAnchors, TlsClientTrustAnchors, verify_is_valid_tls_server_cert and verify_is_valid_tls_client_cert deprecation notes improved.

What's Changed

trust_anchor/end_entity: rework deprecation notes by @cpu in rustls/webpki#149

0.101.3 release prep by @cpu in rustls/webpki#149

Full Changelog: rustls/webpki@v/0.101.2...v/0.101.3

v/0.101.2

Release notes

... (truncated)

Commits

7956538 Cargo: v0.101.5 -> v0.101.6
7f8208e crl: rm Budget from verify_signature fn
7cb6c64 Cargo: bump version 0.101.4 -> 0.101.5
2dd2a06 verify_cert: use enum for build chain error
c255d61 verify_cert: correct handling of fatal errors
b166eab error: add is_fatal helper, use in verify_cert
cce08ee verify_cert: optional Budget arg for verify_chain helper
08fd439 verify_cert: take references in verify_chain helper
c9914e4 Remove common name parsing from NameIterator
bb9fe71 Remove tests for common name handling
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the cargo group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.20.1` | `1.26.0` | | [time](https://github.com/time-rs/time) | `0.3.19` | `0.3.44` | | [rustls](https://github.com/rustls/rustls) | `0.21.3` | `0.21.5` | | [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.41` | `0.10.72` | | [remove_dir_all](https://github.com/XAMPPRocky/remove_dir_all) | `0.7.0` | `0.8.0` | | [rsa](https://github.com/RustCrypto/RSA) | `0.9.2` | `0.9.10` | | [whoami](https://github.com/ardaku/whoami) | `1.2.1` | `1.5.0` | | [borsh](https://github.com/near/borsh-rs) | `0.10.2` | `0.10.4` | | [bumpalo](https://github.com/fitzgen/bumpalo) | `3.10.0` | `3.20.2` | | [mio](https://github.com/tokio-rs/mio) | `0.8.4` | `0.8.11` | | [rustls-webpki](https://github.com/rustls/webpki) | `0.101.1` | `0.101.6` | Updates `tokio` from 1.20.1 to 1.26.0 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.20.1...tokio-1.26.0) Updates `time` from 0.3.19 to 0.3.44 - [Release notes](https://github.com/time-rs/time/releases) - [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md) - [Commits](time-rs/time@v0.3.19...v0.3.44) Updates `rustls` from 0.21.3 to 0.21.5 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.21.3...v/0.21.5) Updates `openssl` from 0.10.41 to 0.10.72 - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.41...openssl-v0.10.72) Updates `remove_dir_all` from 0.7.0 to 0.8.0 - [Release notes](https://github.com/XAMPPRocky/remove_dir_all/releases) - [Changelog](https://github.com/XAMPPRocky/remove_dir_all/blob/master/CHANGELOG.md) - [Commits](https://github.com/XAMPPRocky/remove_dir_all/compare/v0.7.0...remove_dir_all@0.8.0) Updates `rsa` from 0.9.2 to 0.9.10 - [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md) - [Commits](RustCrypto/RSA@v0.9.2...v0.9.10) Updates `whoami` from 1.2.1 to 1.5.0 - [Release notes](https://github.com/ardaku/whoami/releases) - [Changelog](https://github.com/ardaku/whoami/blob/v1.5.0/CHANGELOG.md) - [Commits](ardaku/whoami@v1.2.1...v1.5.0) Updates `borsh` from 0.10.2 to 0.10.4 - [Release notes](https://github.com/near/borsh-rs/releases) - [Changelog](https://github.com/near/borsh-rs/blob/borsh-v0.10.4/CHANGELOG.md) - [Commits](near/borsh-rs@v0.10.2...borsh-v0.10.4) Updates `bumpalo` from 3.10.0 to 3.20.2 - [Changelog](https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md) - [Commits](fitzgen/bumpalo@3.10.0...v3.20.2) Updates `mio` from 0.8.4 to 0.8.11 - [Release notes](https://github.com/tokio-rs/mio/releases) - [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md) - [Commits](tokio-rs/mio@v0.8.4...v0.8.11) Updates `openssl-src` from 111.22.0+1.1.1q to 300.5.5+3.5.5 - [Release notes](https://github.com/alexcrichton/openssl-src-rs/releases) - [Commits](https://github.com/alexcrichton/openssl-src-rs/commits) Updates `rustls-webpki` from 0.101.1 to 0.101.6 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.101.1...v/0.101.6) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.26.0 dependency-type: direct:production dependency-group: cargo - dependency-name: time dependency-version: 0.3.44 dependency-type: direct:production dependency-group: cargo - dependency-name: rustls dependency-version: 0.21.5 dependency-type: direct:production dependency-group: cargo - dependency-name: openssl dependency-version: 0.10.72 dependency-type: direct:production dependency-group: cargo - dependency-name: remove_dir_all dependency-version: 0.8.0 dependency-type: direct:production dependency-group: cargo - dependency-name: rsa dependency-version: 0.9.10 dependency-type: direct:production dependency-group: cargo - dependency-name: whoami dependency-version: 1.5.0 dependency-type: direct:production dependency-group: cargo - dependency-name: borsh dependency-version: 0.10.4 dependency-type: indirect dependency-group: cargo - dependency-name: bumpalo dependency-version: 3.20.2 dependency-type: indirect dependency-group: cargo - dependency-name: mio dependency-version: 0.8.11 dependency-type: indirect dependency-group: cargo - dependency-name: openssl-src dependency-version: 300.5.5+3.5.5 dependency-type: indirect dependency-group: cargo - dependency-name: rustls-webpki dependency-version: 0.101.6 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Mar 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the cargo group across 1 directory with 12 updates#2

chore(deps): bump the cargo group across 1 directory with 12 updates#2
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/cargo-a2162b08ca

dependabot bot commented on behalf of github Mar 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 21, 2026

Tokio v1.26.0

Fixed

Added

Changed

Internal Changes

Unstable

Documented

v0.3.44

v0.3.43

v0.3.42

v0.3.41

v0.3.40

v0.3.39

v0.3.38

v0.3.37

v0.3.36

v0.3.35

v0.3.34

v0.3.33

v0.3.32

v0.3.31

v0.3.30

v0.3.29

v0.3.28

0.3.44 [2025-09-19]

Fixed

0.3.43 [2025-09-02]

Added

Fixed

0.3.42 [2025-08-31]

Added

Changed

Fixed

openssl-v0.10.72

What's Changed

New Contributors

openssl-v0.10.71

What's Changed

New Contributors

openssl v0.10.70

What's Changed

openssl v0.10.69

What's Changed

New Contributors

0.8.0

Security changes

0.9.10 (2026-01-06)

Fixed

0.9.9 (2025-11-13)

Fixed

0.9.8 (2025-03-12)

Added

0.9.7 (2024-11-26)

Fixed

0.9.6 (2023-12-01)

Added

0.9.5 (2023-11-27)

Added

0.9.4 (2023-11-20)

Added

0.9.3 (2023-10-26)

Added

Changed

[1.5.0] - 2024-03-03

Added

Removed

Changed

Fixed

borsh-derive-internal-v0.10.4

borsh-derive-v0.10.4

borsh-schema-derive-internal-v0.10.4

borsh-v0.10.4

[0.10.4] - 2024-09-23

[0.10.3] - 2022-03-22

3.20.2

Fixed

3.20.1

Fixed