Skip to content

Bump the rust-runtime group across 1 directory with 11 updates - #103

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/dory-core/rust-runtime-4f855d04e2
Open

Bump the rust-runtime group across 1 directory with 11 updates#103
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/dory-core/rust-runtime-4f855d04e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown

Bumps the rust-runtime group with 11 updates in the /dory-core directory:

Package From To
tokio 1.52.3 1.53.1
thiserror 2.0.18 2.0.20
prost 0.13.5 0.14.4
prost-build 0.13.5 0.14.4
serde_json 1.0.150 1.0.151
libc 0.2.186 0.2.189
uniffi 0.32.0 0.32.1
sha2 0.10.9 0.11.0
zstd 0.13.3 0.14.0
russh 0.60.3 0.63.3
serde 1.0.228 1.0.229

Updates tokio from 1.52.3 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

  • signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

  • time: fix alt timer cancellation and insertion race (#8252)

Documented

  • runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

Updates thiserror from 2.0.18 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)

2.0.19

  • Update to syn 3
Commits
  • b1d5db5 Release 2.0.20
  • c4c3ebd Merge pull request #454 from dtolnay/clippy
  • 2266152 Suppress redundant_field_names clippy lint
  • 2901cfd Raise minimum tested compiler to rust 1.88
  • aa9d91f Update ui tests for version 2.0.19
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • Additional commits viewable in compare view

Updates prost from 0.13.5 to 0.14.4

Changelog

Sourced from prost's changelog.

Prost version 0.14.4

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

🚀 Features

  • (prost-derive) Make is_valid a constant function (#1401)
  • Increase MSRV to 1.85 (#1428)

🐛 Bug Fixes

  • Use Display instead of Debug for generated enumeration attributes (#1419)
  • (prost-derive) Return error for invalid enumeration default identifiers (#1426)
  • (build) Grab binary path from cargo (#1429)
  • (build) Fix C++ build on GCC 15 (#1395)

📚 Documentation

  • Add example for decode_length_delimiter (#1311)
  • Update protobuf-src example to avoid unsafe set_var

🧪 Testing

  • Test derive Eq behavior (#1422)
  • (groups) Actually construct NestedGroup (#1363)

💼 Dependencies

  • (deps) Update criterion requirement from 0.7 to 0.8 (#1374)
  • (deps) Remove getrandom@0.4.1 from build-dependencies (#1400)
  • (deps) Update rand requirement from 0.9 to 0.10 (#1397)
  • (deps) Bump actions/upload-artifact from 6 to 7 (#1409)
  • (deps) Update cargo clippy to 1.89 (#1433)
  • (deps) Update cargo clippy to 1.91 (#1435)
  • (deps) Update and improve nix devshell (#1393)

🎨 Styling

  • Prevent needless borrow (#1404)
  • Use std::hint::black_box() (#1403)
  • Use variables directly in format!() (#1432)
  • Remove explicit .into_iter() (#1434)
  • Run clippy on benches (#1405)

Prost version 0.14.3

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

⚠️ Heads-up

... (truncated)

Commits

Updates prost-build from 0.13.5 to 0.14.4

Changelog

Sourced from prost-build's changelog.

Prost version 0.14.4

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

🚀 Features

  • (prost-derive) Make is_valid a constant function (#1401)
  • Increase MSRV to 1.85 (#1428)

🐛 Bug Fixes

  • Use Display instead of Debug for generated enumeration attributes (#1419)
  • (prost-derive) Return error for invalid enumeration default identifiers (#1426)
  • (build) Grab binary path from cargo (#1429)
  • (build) Fix C++ build on GCC 15 (#1395)

📚 Documentation

  • Add example for decode_length_delimiter (#1311)
  • Update protobuf-src example to avoid unsafe set_var

🧪 Testing

  • Test derive Eq behavior (#1422)
  • (groups) Actually construct NestedGroup (#1363)

💼 Dependencies

  • (deps) Update criterion requirement from 0.7 to 0.8 (#1374)
  • (deps) Remove getrandom@0.4.1 from build-dependencies (#1400)
  • (deps) Update rand requirement from 0.9 to 0.10 (#1397)
  • (deps) Bump actions/upload-artifact from 6 to 7 (#1409)
  • (deps) Update cargo clippy to 1.89 (#1433)
  • (deps) Update cargo clippy to 1.91 (#1435)
  • (deps) Update and improve nix devshell (#1393)

🎨 Styling

  • Prevent needless borrow (#1404)
  • Use std::hint::black_box() (#1403)
  • Use variables directly in format!() (#1432)
  • Remove explicit .into_iter() (#1434)
  • Run clippy on benches (#1405)

Prost version 0.14.3

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

⚠️ Heads-up

... (truncated)

Commits

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • See full diff in compare view

Updates libc from 0.2.186 to 0.2.189

Release notes

Sourced from libc's releases.

0.2.189

Added

  • Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
  • Linux SPARC: Enable the clone3 syscall (#4980)
  • Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

  • Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

  • Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
  • NuttX: Fix wchar_t definition under Arm (#5245)
  • Windows: Add back link names for time-related symbols (#5300)

0.2.188

Changed

These were removed in 0.2.187 because libc does not actually make Send and Sync guarantees about DIR (or other extern types), but this caused some crates to break. The traits are added back for now to allow time to migrate, but will be removed again in the future; please make sure your crates are not relying on libc::DIR: Send or libc::DIR: Sync.

0.2.187

This release contains a number of improvements related to 64-bit time_t configuration. Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

  • The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits

  • uClibc now supports a similar configuration option:

    RUSTFLAGS='--cfg=libc_unstable_uclibc_time64'

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.189 - 2026-07-21

Added

  • Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
  • Linux SPARC: Enable the clone3 syscall (#4980)
  • Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

  • Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

  • Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
  • NuttX: Fix wchar_t definition under Arm (#5245)
  • Windows: Add back link names for time-related symbols (#5300)

0.2.188 - 2026-07-21

Changed

These were removed in 0.2.187 because libc does not actually make Send and Sync guarantees about DIR (or other extern types), but this caused some crates to break. The traits are added back for now to allow time to migrate, but will be removed again in the future; please make sure your crates are not relying on libc::DIR: Send or libc::DIR: Sync.

0.2.187 - 2026-07-20

This release contains a number of improvements related to 64-bit time_t configuration. Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

  • The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits
  • uClibc now supports a similar configuration option:

... (truncated)

Commits
  • ef0906e libc: Release 0.2.189
  • 5a79f76 riscv32-musl: Rename padding fields to avoid a conflict
  • 3e51062 psp: Fix overflowing_literals warnings
  • e352fdd emscripten: add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessa...
  • 63221b3 macros: Require safe in safe_f! invocations
  • 707ab52 macros: Require unsafe in f! invocations
  • 8e40c94 Enable clone3() syscall on sparc-linux and sparc64-linux
  • 8427909 windows: Add back link names for time-related symbols
  • b4863fa nuttx: fix wchar_t definition under arm
  • 41c683d nuttx: mirror type definitions
  • Additional commits viewable in compare view

Updates uniffi from 0.32.0 to 0.32.1

Changelog

Sourced from uniffi's changelog.

v0.32.1 (backend crates: v0.32.1) - (2026-09-08)

What's Fixed

  • Kotlin: Fixed checksum failure on aarch64 (#2935)

All changes in v0.32.1.

Commits
  • 35a4743 chore: Release
  • 1f25db6 chore: Release
  • 2a8331b fix(kotlin): Make sure uniffiCheckApiChecksums compares against the rust gene...
  • See full diff in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

Updates zstd from 0.13.3 to 0.14.0

Commits
  • 648acb4 Avoid let...else in the seekable callbacks
  • e1152c1 Bump versions for the next release
  • 7caed6e Derive the usual traits on ResetDirective
  • bf7b1f7 Refuse to reuse a context an error may have left undefined
  • 1565618 Check the target, not the host, for MSVC
  • 8315a62 Return Ok(0) from Read::read for an empty buffer
  • a7cfa93 Keep the std gate on the Cursor WriteBuf impl
  • 9bf1692 Say why the Send and Sync impls hold
  • 681bcc3 Don't truncate Cursor positions on 32-bit targets
  • d5a1fdd Don't hand out a &mut Seekable from AdvancedSeekable
  • Additional commits viewable in compare view

Updates russh from 0.60.3 to 0.63.3

Release notes

Sourced from russh's releases.

v0.63.3

Fixes

  • c13b259: enforce inactivity timeout even during stalled writes (Eugene)

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

A malicious Pageant agent could cause an out-of-bounds read / oversized allocation in the pageant library user.

GHSA-35g8-35p8-c8fw - unbounded memory allocation in server

An authenticated client could trigger unbounded memory allocation during rekey phase

Fixes

  • client: encode the negotiated hash algorithm for RSA certificates (#764) #764 (Jeongkyu Shin)
  • 4206815: Fix pty-req terminal modes: deliver them unpadded, encode the right l… (#755) (tluyben) #755
  • b1d3893: fixed #762 - redact sensitive data from debug logging (Eugene)
  • 66789f4: fixed #761 - data write split across a kex breaks (Eugene)
  • a04e1b5: fixed #758 - fail RSA signing explicitly when RSA feature is not enabled (Eugene)
  • 422123c: dedup zlib compress loop into compress_into (Eugene)

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

    • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

    • Adds a Config::certificates that functions similarly to Config::keys

Fixes

  • f2354c7: improve strict kex checks (Eugene)
  • 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
  • 46c927a: use constant-time comparison for agent unlock (Eugene)
  • 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

... (truncated)

Commits

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the rust-runtime group across 1 directory with 11 updates
a94e598 
Bumps the rust-runtime group with 11 updates in the /dory-core directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.20` |
| [prost](https://github.com/tokio-rs/prost) | `0.13.5` | `0.14.4` |
| [prost-build](https://github.com/tokio-rs/prost) | `0.13.5` | `0.14.4` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [libc](https://github.com/rust-lang/libc) | `0.2.186` | `0.2.189` |
| [uniffi](https://github.com/mozilla/uniffi-rs) | `0.32.0` | `0.32.1` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [zstd](https://github.com/gyscos/zstd-rs) | `0.13.3` | `0.14.0` |
| [russh](https://github.com/warp-tech/russh) | `0.60.3` | `0.63.3` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |



Updates `tokio` from 1.52.3 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1)

Updates `thiserror` from 2.0.18 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.20)

Updates `prost` from 0.13.5 to 0.14.4
- [Release notes](https://github.com/tokio-rs/prost/releases)
- [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/prost@v0.13.5...v0.14.4)

Updates `prost-build` from 0.13.5 to 0.14.4
- [Release notes](https://github.com/tokio-rs/prost/releases)
- [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/prost@v0.13.5...v0.14.4)

Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `libc` from 0.2.186 to 0.2.189
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.189/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.186...0.2.189)

Updates `uniffi` from 0.32.0 to 0.32.1
- [Changelog](https://github.com/mozilla/uniffi-rs/blob/v0.32.1/CHANGELOG.md)
- [Commits](mozilla/uniffi-rs@v0.32.0...v0.32.1)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `zstd` from 0.13.3 to 0.14.0
- [Release notes](https://github.com/gyscos/zstd-rs/releases)
- [Commits](gyscos/zstd-rs@v0.13.3...v0.14.0)

Updates `russh` from 0.60.3 to 0.63.3
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.60.3...v0.63.3)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

---
updated-dependencies:
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-runtime
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-runtime
- dependency-name: prost
  dependency-version: 0.14.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-runtime
- dependency-name: prost-build
  dependency-version: 0.14.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-runtime
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-runtime
- dependency-name: libc
  dependency-version: 0.2.189
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-runtime
- dependency-name: uniffi
  dependency-version: 0.32.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-runtime
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-runtime
- dependency-name: zstd
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-runtime
- dependency-name: russh
  dependency-version: 0.63.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-runtime
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants