Skip to content

Bump the crates group across 1 directory with 7 updates - #25

Merged
valicm merged 2 commits into
developfrom
dependabot/cargo/develop/crates-af122299d3
Nov 10, 2026
Merged

Bump the crates group across 1 directory with 7 updates#25
valicm merged 2 commits into
developfrom
dependabot/cargo/develop/crates-af122299d3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the crates group with 7 updates in the / directory:

Package From To
russh 0.65.0 0.65.1
aws-lc-rs 1.18.2 1.19.0
aes 0.9.3 0.9.4
rustix 1.1.5 1.1.6
flate2 1.1.10 1.1.11
toml 1.1.8+spec-1.1.0 1.2.0+spec-1.1.0
zip 9.0.5 9.4.1

Updates russh from 0.65.0 to 0.65.1

Release notes

Sourced from russh's releases.

v0.65.1

Security fixes

GHSA-736f-c93q-9fwx - agent lock status not checked after confirmation wait

Agent lock status is now rechecked after the confirmation await again.

GHSA-9264-jvgf-6w2f - kex_done called before host-key verification

client::Handler::kex_done is now only called after server host key verification succeeds

Fixes

  • 20c5a93: fix(keys): keep the comment when loading a public key file (#801) (@​JakeHuneau) #801
    • load_public_key now keeps the comment from an OpenSSH public key file, so key.comment() returns it and to_openssh() round-trips. Fixes #713.
  • 3a21566: fix(client): accept non-canonical ECDSA P-521 signature mpints after strict decode fails (#803) (@​gugahartmann) #803
    • Fixes key exchange against servers such as the Huawei S6720, which pad P-521 signature scalars with extra leading zero bytes.
  • a6be9ba: fix(cipher): count the MAC tag in the minimum packet length check (#802) (@​JakeHuneau) #802
    • Fixes valid packets being rejected when an EtM MAC is in use. Fixes #787.
  • 43a46d6: fix(AgentClient): propagate method errors (#808) (@​mdevolde) #808
    • add_smartcard_key, lock, unlock, remove_identity, remove_smartcard_key and extension now return the agent's failure response as an error. Before, they always returned Ok(()).
  • 7c59594: fix(server): let Dropbear through strict kex by accounting for the ignored first_kex_packet_follows guess (#805) (@​NatLee) #805
    • Fixes Dropbear clients failing to connect when strict key exchange is on. Fixes #804.

Dependencies

  • d10345d: deps: trim aws-lc-rs features to avoid transitive deps (#809) (@​sepointon) #809
    • Removes the unused ring-compatible API of aws-lc-rs and the old untrusted crate it pulled in.
  • 0a8cc28: deps: remove dep on generic-array 0.14 compat (#810) (@​sepointon) #810

New Contributors

Full Changelog: Eugeny/russh@v0.65.0...v0.65.1

Commits
  • b33092a v0.65.1
  • 20c5a93 fix(keys): keep the comment when loading a public key file (#801)
  • 3a21566 fix(client): accept non-canonical ECDSA P-521 signature mpints after strict d...
  • a6be9ba fix(cipher): count the MAC tag in the minimum packet length check (#802)
  • 43a46d6 fix(AgentClient): propagate method errors (#808)
  • 56384e6 add Eric-D as a contributor for code (#799)
  • 7c59594 fix(server): let Dropbear through strict kex by accounting for the ignored fi...
  • d10345d deps: trim aws-lc-rs features to avoid transitive deps (#809)
  • 0a8cc28 deps: remove dep on generic-array 0.14 compat (#810)
  • 92562d3 tests: adapt to VerifiedPublicKey after #785 (#807)
  • See full diff in compare view

Updates aws-lc-rs from 1.18.2 to 1.19.0

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

  • Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
    • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
  • Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
    • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
  • Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
    • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
  • Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
    • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
  • Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
    • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
    • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

  • aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
  • aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

  • Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
    • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
    • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
  • Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
    • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

Other Merged PRs

New Contributors

... (truncated)

Commits

Updates aes from 0.9.3 to 0.9.4

Commits

Updates rustix from 1.1.5 to 1.1.6

Commits
  • 4a563ad chore: Release rustix version 1.1.6
  • 8e6aaa6 Merge commit from fork
  • 4686873 fix: expose additional termios output mode flags (#1709)
  • c9ad9d3 fix(net): don't trust cmsg_len past the end of a truncated control buffer (...
  • 98358af Avoid constructing a zero Pid in tcgetpgrp on non-Linux targets (#1710)
  • 664aeae fix(net): use IPPROTO_IPV6 for IPV6_MULTICAST_HOPS (#1692)
  • bf78ee6 freebsd: Fix cfg gates for FreeBSD 12 (#1707)
  • b3d81bd Fix fallocate on Apple platforms. (#1708)
  • 915ab6f fix(fs): Set proper inotify WatchFlags values on libc backend (#1714)
  • 52d5db7 Use 32-bit UID/GID syscalls on arm, sparc, and x86 (#1716)
  • Additional commits viewable in compare view

Updates flate2 from 1.1.10 to 1.1.11

Release notes

Sourced from flate2's releases.

v1.1.11

Fixed

  • fixup! Complete sync flushes across output buffer boundaries (#581)
  • Separate gzip header reads from compressed data
  • Defer gzip input errors without losing read progress
  • Preserve gzip header progress on input read errors (#571)

Other

  • Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
  • Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
  • Merge pull request #577 from rust-lang/fix-loop
  • Setup trusted publishing for the flate2 crate
  • Complete sync flushes across output buffer boundaries (#581)
  • Fix "can by extended" typos in deflate and zlib write docs
  • Merge pull request #579 from NUAAwqy/docs/fix-double-space
  • Fix double space in read module doc comment
  • Add missing preposition in README description
  • Cover decoder retries across the output buffer boundary
  • Drain output before refilling the buffer
  • Clarify partial-write buffering behavior
  • Avoid shifting buffered output on partial writes
  • Merge pull request #567 from ndossche/more-asserts
  • Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
  • Fix encoder writes hanging after try_finish (#576)
  • Avoid panicking when dropping unfinished compressors
  • Merge pull request #565 from HDauven/zlib-rs-uninit-output
  • still allow resetting incomplete write decoders
  • Assert return result of reset calls
  • Reject incomplete streams in write decoders
  • Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
  • review
  • Reject incomplete streams when finishing write-side decoders
  • Preserve window size and gzip mode across Decompress::reset
  • preserve runtime detection in backend examples (#570)
  • Make miniz_oxide dictionary clearing explicit on reset
  • Harden miniz_oxide decompressor reset
  • Deduplicate zlib-rs flush conversions
  • Use native zlib-rs uninitialized output
Changelog

Sourced from flate2's changelog.

1.1.11 - 2026-11-06

Fixed

  • fixup! Complete sync flushes across output buffer boundaries (#581)
  • Separate gzip header reads from compressed data
  • Defer gzip input errors without losing read progress
  • Preserve gzip header progress on input read errors (#571)

Other

  • Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
  • Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
  • Merge pull request #577 from rust-lang/fix-loop
  • Setup trusted publishing for the flate2 crate
  • Complete sync flushes across output buffer boundaries (#581)
  • Fix "can by extended" typos in deflate and zlib write docs
  • Merge pull request #579 from NUAAwqy/docs/fix-double-space
  • Fix double space in read module doc comment
  • Add missing preposition in README description
  • Cover decoder retries across the output buffer boundary
  • Drain output before refilling the buffer
  • Clarify partial-write buffering behavior
  • Avoid shifting buffered output on partial writes
  • Merge pull request #567 from ndossche/more-asserts
  • Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
  • Fix encoder writes hanging after try_finish (#576)
  • Avoid panicking when dropping unfinished compressors
  • Merge pull request #565 from HDauven/zlib-rs-uninit-output
  • still allow resetting incomplete write decoders
  • Assert return result of reset calls
  • Reject incomplete streams in write decoders
  • Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
  • review
  • Reject incomplete streams when finishing write-side decoders
  • Preserve window size and gzip mode across Decompress::reset
  • preserve runtime detection in backend examples (#570)
  • Make miniz_oxide dictionary clearing explicit on reset
  • Harden miniz_oxide decompressor reset
  • Deduplicate zlib-rs flush conversions
  • Use native zlib-rs uninitialized output
Commits
  • cd06529 chore: release v1.1.11
  • 6ff4098 Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
  • 5f68913 Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
  • 5582d95 fixup! Complete sync flushes across output buffer boundaries (#581)
  • d05c7c4 Merge pull request #577 from rust-lang/fix-loop
  • 5c7ee7a Merge pull request #583 from Kobzol/trusted-publishing
  • cc527c6 Setup trusted publishing for the flate2 crate
  • 54f49cd Merge pull request #580 from NUAAwqy/fix/can-by-extended-typo
  • 491df15 Complete sync flushes across output buffer boundaries (#581)
  • a7a1161 Fix "can by extended" typos in deflate and zlib write docs
  • Additional commits viewable in compare view

Updates toml from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0

Commits
  • 8ffe3c5 chore: Release
  • fa51878 docs: Update changelog
  • f8ad91e perf(serde): Reuse key allocations (#1261)
  • fe51467 perf(serde): Reuse key allocations
  • 7024319 perf(writer): Expand coverage of the fast path (#1259)
  • be196a8 perf(writer): Expand coverage of the fast path
  • 932704c perf(serde): Pre-allocate serialization buffers (#1258)
  • 52b563d perf(serde): Pre-allocate serialization buffers
  • e346a79 perff(writer): Add key and string fast paths (#1257)
  • ab695e6 perf(writer): Add a fast path for writing string types
  • Additional commits viewable in compare view

Updates zip from 9.0.5 to 9.4.1

Release notes

Sourced from zip's releases.

v9.4.1

🐛 Bug Fixes

🚜 Refactor

  • Use boxed slices instead of Vec when growability isn't needed (#1271)

v9.4.0

🚀 Features

  • Implement ZipIterable::files_with_reader (#1267)

v9.3.0

🚀 Features

  • (write) implement TryFrom for PreparedZipFile (#1258)

v9.2.3

🐛 Bug Fixes

  • (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

  • Replace std:: with core:: where possible (#1253)

v9.2.2

🚜 Refactor

  • Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

  • Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.1

🚜 Refactor

  • Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

  • Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.0

🚀 Features

  • (write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)

... (truncated)

Changelog

Sourced from zip's changelog.

9.4.1 - 2026-11-06

🐛 Bug Fixes

🚜 Refactor

  • Use boxed slices instead of Vec when growability isn't needed (#1271)

9.4.0 - 2026-11-05

🚀 Features

  • Implement ZipIterable::files_with_reader (#1267)

9.3.0 - 2026-11-03

🚀 Features

  • (write) implement TryFrom for PreparedZipFile (#1258)

9.2.3 - 2026-11-03

🐛 Bug Fixes

  • (ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

  • Replace std:: with core:: where possible (#1253)

9.2.2 - 2026-11-01

🚜 Refactor

  • Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

  • Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

9.2.0 - 2026-10-31

🚀 Features

  • (write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)
  • add index_for_name_raw (#1210)
  • (extract) multi-threaded parallel extraction engine and safe extent pre-allocation (#1207)
  • (read) add index-free iterable ZIP reader (#1218)

... (truncated)

Commits
  • 96e8cce chore: release v9.4.1 (#1272)
  • f1b82f2 docs(example): Fix bug in memory-tracking example where reallocations were co...
  • 2308d6d refactor: Use boxed slices instead of Vec when growability isn't needed (#1271)
  • b3ad5df fix: Add a OwnedZipFileEntry for #177 (#1270)
  • 196b805 chore(deps): update lzma-rust2 from 0.24 to 0.25 (#1268)
  • f347dd4 chore: release v9.4.0 (#1269)
  • e9b7dcd feat: Implement ZipIterable::files_with_reader (#1267)
  • 47765a9 docs(security): Clarify that some "vulnerabilities" are necessary for legitim...
  • 53cfe46 ci(deps): bump useblacksmith/checkout from 1.8.1 to 1.8.2 (#1260)
  • b66f6b1 ci(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 (#1262)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the crates group across 1 directory with 7 updates
b30515e 
Bumps the crates group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [russh](https://github.com/warp-tech/russh) | `0.65.0` | `0.65.1` |
| [aws-lc-rs](https://github.com/aws/aws-lc-rs) | `1.18.2` | `1.19.0` |
| [aes](https://github.com/RustCrypto/block-ciphers) | `0.9.3` | `0.9.4` |
| [rustix](https://github.com/bytecodealliance/rustix) | `1.1.5` | `1.1.6` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.10` | `1.1.11` |
| [toml](https://github.com/toml-rs/toml) | `1.1.8+spec-1.1.0` | `1.2.0+spec-1.1.0` |
| [zip](https://github.com/zip-rs/zip2) | `9.0.5` | `9.4.1` |



Updates `russh` from 0.65.0 to 0.65.1
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.65.0...v0.65.1)

Updates `aws-lc-rs` from 1.18.2 to 1.19.0
- [Release notes](https://github.com/aws/aws-lc-rs/releases)
- [Commits](aws/aws-lc-rs@v1.18.2...v1.19.0)

Updates `aes` from 0.9.3 to 0.9.4
- [Commits](RustCrypto/block-ciphers@aes-v0.9.3...aes-v0.9.4)

Updates `rustix` from 1.1.5 to 1.1.6
- [Release notes](https://github.com/bytecodealliance/rustix/releases)
- [Changelog](https://github.com/bytecodealliance/rustix/blob/main/CHANGES.md)
- [Commits](bytecodealliance/rustix@v1.1.5...v1.1.6)

Updates `flate2` from 1.1.10 to 1.1.11
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Changelog](https://github.com/rust-lang/flate2-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/flate2-rs@1.1.10...v1.1.11)

Updates `toml` from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.8...toml-v1.2.0)

Updates `zip` from 9.0.5 to 9.4.1
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v9.0.5...v9.4.1)

---
updated-dependencies:
- dependency-name: russh
  dependency-version: 0.65.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crates
- dependency-name: aws-lc-rs
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crates
- dependency-name: aes
  dependency-version: 0.9.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crates
- dependency-name: rustix
  dependency-version: 1.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crates
- dependency-name: flate2
  dependency-version: 1.1.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: crates
- dependency-name: toml
  dependency-version: 1.2.0+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crates
- dependency-name: zip
  dependency-version: 9.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: crates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Nov 9, 2026
@valicm
valicm merged commit 19ddd69 into develop Nov 10, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/cargo/develop/crates-af122299d3 branch November 10, 2026 10:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@valicm