Skip to content

deps(deps): bump the cargo-deps group with 33 updates#3839

Merged
vedhavyas merged 7 commits into
mainfrom
dependabot/cargo/cargo-deps-888bf85368
May 15, 2026
Merged

deps(deps): bump the cargo-deps group with 33 updates#3839
vedhavyas merged 7 commits into
mainfrom
dependabot/cargo/cargo-deps-888bf85368

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 13, 2026 •
edited by vedhavyas
Loading

Copy link
Copy Markdown
Contributor

Six commits on top of Dependabot's batch. Worth reviewing commit-by-commit.

7c11de83e migrate source for the 33-dep bump; revert breakers — the substantive one. Adapts source for the deps with API changes (derive_more 1→2, bincode 1→2.0.1, chacha20 0.9→0.10, array-bytes 6→9, bytesize 1→2, fs4 0.9→1.x, async-nats 0.37→0.48, criterion 0.5→0.8) and reverts seven bumps I couldn't take: jsonrpsee / prometheus / async-channel pinned by our polkadot-sdk fork, prometheus-client pinned by our libp2p fork, and rand_chacha + rand_core held back transitively because rand 0.9's SliceRandom::shuffle is non-reproducible (rust-random/rand#1272) and would change on-chain extrinsic ordering in sp_domains::shuffle_extrinsics — a consensus break. bincode 3.0.0 on crates.io is a compile_error! placeholder published after the upstream repo was archived, so pinned at 2.0.1.

Notable rename for diff readers: fs4::fs_std::FileExt::try_lock_exclusive(&file) becomes fs4::FileExt::try_lock(&file) in single_disk_farm.rs. fs4 1.x mirrors std's stable File::try_lock API where try_lock is exclusive by default and try_lock_shared is the shared variant — same semantics, different signature.

640c9633a dependabot — ignore deps we can never take this week — adds ignore entries in .github/dependabot.yml so future Dependabot runs stop opening grouped PRs that include the same un-takeable bumps. Permanent skips for rand-family + bincode (with TODO unlock signals naming the source-level change required to lift them). Temporary skips for the four fork-pinned deps with TODOs pointing at the polkadot-sdk / libp2p rebase that would lift them.

a124c7145 revert drive-by rand::thread_rng() refactor — five test/mock files had unrelated rand::thread_rng() → thread_rng() edits left over from a rand 0.9 experiment that didn't survive the revert.

810797a41 drop stranded array-bytes workspace pin — after migrating to hex::encode, no workspace member used array-bytes directly; the workspace pin was dead.

6d3b387de tighten dependabot.yml fork-pin skips — drop inert semver-minor exclusions on pre-1.0 crates (Dependabot's Cargo classifier treats 0.x.y → 0.(x+1).y as semver-major), split the polkadot-sdk-rebase TODO so async-channel isn't grouped with jsonrpsee / prometheus.

a5e4cbb9d alphabetize hex.workspace placement — the new hex line in crates/sc-domains/Cargo.toml had landed out of order.

Bumps the cargo-deps group with 33 updates:

Package From To
aes 0.9.0-rc.4 0.9.0
array-bytes 6.2.3 9.3.0
async-channel 1.9.0 2.5.0
async-nats 0.37.0 0.48.0
bincode 1.3.3 3.0.0
blake3 1.8.3 1.8.5
bytesize 1.3.3 2.3.1
cc 1.2.58 1.2.62
chacha20 0.9.1 0.10.0
clap 4.6.0 4.6.1
cpufeatures 0.2.17 0.3.0
criterion 0.5.1 0.8.2
derive_more 1.0.0 2.1.1
fs4 0.9.1 1.1.0
hex-literal 0.4.1 1.1.0
hwlocality 1.0.0-alpha.11 1.0.0-alpha.12
jsonrpsee 0.24.10 0.26.0
libc 0.2.183 0.2.186
mimalloc 0.1.48 0.1.50
multihash 0.19.3 0.19.5
num_enum 0.5.11 0.7.6
pin-project 1.1.11 1.1.13
prometheus 0.13.4 0.14.0
prometheus-client 0.23.1 0.24.1
rand_chacha 0.3.1 0.9.0
rand_core 0.6.4 0.10.1
rayon 1.11.0 1.12.0
sha2 0.10.9 0.11.0
spin 0.9.8 0.10.0
strum_macros 0.26.4 0.28.0
thread-priority 1.2.0 3.0.0
x509-parser 0.16.0 0.17.0
ziggy 1.5.4 1.7.0

Updates aes from 0.9.0-rc.4 to 0.9.0

Commits

Updates array-bytes from 6.2.3 to 9.3.0

Release notes

Sourced from array-bytes's releases.

v9.2.1

Full Changelog: hack-ink/array-bytes@v9.2.0...v9.2.1

v9.2.0

What's Changed

Full Changelog: hack-ink/array-bytes@v9.1.2...v9.2.0

v9.1.2

Full Changelog: hack-ink/array-bytes@v9.1.1...v9.1.2

v9.1.1

Full Changelog: hack-ink/array-bytes@v9.1.0...v9.1.1

v9.1.0

Full Changelog: hack-ink/array-bytes@v9.0.0...v9.1.0

v9.0.0

Full Changelog: hack-ink/array-bytes@v8.0.0...v9.0.0

v8.0.0

Full Changelog: hack-ink/array-bytes@v7.1.0...v8.0.0

v7.1.0

Full Changelog: hack-ink/array-bytes@v7.0.0...v7.1.0

v7.0.0

What's Changed

... (truncated)

Changelog

Sourced from array-bytes's changelog.

v9.3.0

  • Use thiserror for error handling.

v9.2.2

  • Fix case sensitivity in ser_hexify_prefixed_upper.
  • Bump dependencies.
  • Format code.

v9.2.1

  • Enable all features for docs.rs.

v9.2.0

  • Include examples in the lib.rs.
  • Upgrade edition to 2024.
  • Bump dependencies.

v9.1.2

  • Add ser_bytes_stringify and de_bytes_destringify.

v9.1.1

  • Integrate serde_bytes.

v9.1.0

  • Use reference instead of value in Hexify trait and related serialize functions.

v9.0.0

  • Expose more friendly APIs, Hexify and DeHexify traits.
  • Un-public some tiny functions to encourage using Hexify and DeHexify traits.
  • Improve docs.
  • Restructure the code.

v8.0.0

  • Improve performance.

v7.1.0

  • Rename se_hex to ser_hex.
  • Rename se_hex_without_prefix to ser_hex_without_prefix.

v7.0.0

... (truncated)

Commits

Updates async-channel from 1.9.0 to 2.5.0

Release notes

Sourced from async-channel's releases.

v2.5.0

  • Add Sender::closed() (#102)

v2.4.0

  • Add Sender::same_channel() and Receiver::same_channel(). (#98)
  • Add portable-atomic feature to support platforms without atomics. (#106)

v2.3.1

  • Use the correct version of async-channel in our manifest. (#93)

v2.3.0

  • Add force_send for sending items over the channel that displace other items. (#89)

v2.2.1

  • Fix the CI badge in the crates.io page. (#84)

v2.2.0

  • Bump event-listener to v5.0.0. (#79)
  • Bump MSRV to 1.60. (#80)

v2.1.1

  • Bump event-listener to v4.0.0. (#73)

v2.1.0

  • Bump futures-lite to its latest version. (#70)

v2.0.0

  • Breaking: Make Send, Recv and Receiver !Unpin. This enables more efficient event notification strategies. (#59)
  • Breaking: Add an std enabled-by-default feature that enables parts of the API that require std. (#59)
  • Add support for the wasm32 target. (#67)
Changelog

Sourced from async-channel's changelog.

Version 2.5.0

  • Add Sender::closed() (#102)

Version 2.4.0

  • Add Sender::same_channel() and Receiver::same_channel(). (#98)
  • Add portable-atomic feature to support platforms without atomics. (#106)

Version 2.3.1

  • Use the correct version of async-channel in our manifest. (#93)

Version 2.3.0

  • Add force_send for sending items over the channel that displace other items. (#89)

Version 2.2.1

  • Fix the CI badge in the crates.io page. (#84)

Version 2.2.0

  • Bump event-listener to v5.0.0. (#79)
  • Bump MSRV to 1.60. (#80)

Version 2.1.1

  • Bump event-listener to v4.0.0. (#73)

Version 2.1.0

  • Bump futures-lite to its latest version. (#70)

Version 2.0.0

  • Breaking: Make Send, Recv and Receiver !Unpin. This enables more efficient event notification strategies. (#59)
  • Breaking: Add an std enabled-by-default feature that enables parts of the API that require std. (#59)
  • Add support for the wasm32 target. (#67)
Commits
  • 35a63c4 Release 2.5.0
  • b665e04 Add Sender::closed future (#102)
  • c250f28 Release 2.4.0 (#108)
  • c950c6e Fix description of recv_blocking (#107)
  • 9a96317 Support portable atomic (#106)
  • 3ce7937 Fix clippy::needless_lifetimes warning
  • e4132e3 ci: Use reusable workflows for fmt and security_audit
  • 43459d1 ci: Use "v2.0.0" branch for audit check
  • 1623170 Fix grammar in description of WeakSender and WeakReceiver
  • 74b2c74 Add example usage for fn same_channel in Sender and Receiver
  • Additional commits viewable in compare view

Updates async-nats from 0.37.0 to 0.48.0

Release notes

Sourced from async-nats's releases.

async-nats/v0.48.0

This release focuses on 2.14 nats-server features support.

Added

Fixed

Changed

New Contributors

Full Changelog: nats-io/nats.rs@async-nats/v0.47.0...async-nats/v0.48.0

v0.47.0

async-nats/v0.47.0

This release adds subject validation (with opt-out possibility) and wraps while connect attempt in timeout, making it more robust.

Added

Fixed

Changed

... (truncated)

Commits
  • 09b248d Release async-nats/v0.48.0
  • 9533a2b Improve Consumer Reset errors
  • 0b7d4f8 Update dictionary
  • 30dff21 Cover remaining 2.14 server error codes and predefined cron schedules
  • d1c4393 Add PublishAck batch_id and batch_size fields
  • f14775e Add 2.14 schedule, batch, and rollup header constants
  • e700e45 Add consumer reset API
  • 58e3d7a Add AckPolicy::FlowControl variant
  • 51978a9 Add Source.consumer for durable sourcing
  • 08baac8 Add server_2_14 feature flag and allow_batch_publish stream config
  • Additional commits viewable in compare view

Updates bincode from 1.3.3 to 3.0.0

Commits

Updates blake3 from 1.8.3 to 1.8.5

Release notes

Sourced from blake3's releases.

1.8.5

version 1.8.5

Changes since 1.8.4:

  • Forcibly disable LTO when compiling C intrinsics from the Rust build. This fixes a build break on Arch Linux ARM: BLAKE3-team/BLAKE3#550

1.8.4

version 1.8.4

Changes since 1.8.3:

  • Updated the digest dependency from v0.10 to v0.11. THIS IS A POTENTIALLY BREAKING CHANGE for callers using the traits-preview Cargo feature. But this is not considered a breaking change for the blake3 crate itself; see the docs for traits-preview.
  • Performance for WASM SIMD targets is improved by ~20% when the wasm32_simd feature is enabled. Contributed by @​lamb356.
Commits
  • 93a431c version 1.8.5
  • 299b1e2 fix LTO builds by disabling LTO
  • 6a45fee add LTO builds to CI
  • 15e83a5 c: Use correct SIMD flags when compiling with Clang-Cl (#549)
  • 2e3727d cargo fmt everywhere
  • b97a24f version 1.8.4
  • 0ebe469 update to new rustcrypto trait releases
  • d4b005a wasm32_simd: use i8x16_shuffle for rot8 and rot16
  • 6eebbbd fix a struct size mismatch in tests
  • fb1411e c: use SIZE_MAX instead of -1 for size_t sentinels, add <stdint.h>
  • See full diff in compare view

Updates bytesize from 1.3.3 to 2.3.1

Release notes

Sourced from bytesize's releases.

bytesize: v2.3.1

  • Fix unit truncation in error strings.

bytesize: v2.3.0

  • Add Unit enum.
  • Add UnitParseError type.

bytesize: v2.2.0

  • Add ByteSize::as_*() methods to return equivalent sizes in KB, GiB, etc.

bytesize: v2.1.0

  • Support parsing and formatting exabytes (EB) & exbibytes (EiB).
  • Migrate serde dependency to serde_core.

bytesize: v2.0.1

  • Add support for precision in Display implementations.

bytesize: v2.0.0

  • Add support for no_std targets.
  • Use IEC (binary) format by default with Display.
  • Use "kB" for SI unit.
  • Add Display type for customizing printed format.
  • Add ByteSize::display() method.
  • Implement Sub<ByteSize> for ByteSize.
  • Implement Sub<impl Into<u64>> for ByteSize.
  • Implement SubAssign<ByteSize> for ByteSize.
  • Implement SubAssign<impl Into<u64>> for ByteSize.
  • Reject parsing non-unit characters after whitespace.
  • Remove ByteSize::to_string_as() method.
  • Remove top-level to_string() method.
  • Remove top-level B constant.
Changelog

Sourced from bytesize's changelog.

2.3.1

  • Fix unit truncation in error strings.

2.3.0

  • Add Unit enum.
  • Add UnitParseError type.

2.2.0

  • Add ByteSize::as_*() methods to return equivalent sizes in KB, GiB, etc.

2.1.0

  • Support parsing and formatting exabytes (EB) & exbibytes (EiB).
  • Migrate serde dependency to serde_core.

2.0.1

  • Add support for precision in Display implementations.

v2.0.0

  • Add support for no_std targets.
  • Use IEC (binary) format by default with Display.
  • Use "kB" for SI unit.
  • Add Display type for customizing printed format.
  • Add ByteSize::display() method.
  • Implement Sub<ByteSize> for ByteSize.
  • Implement Sub<impl Into<u64>> for ByteSize.
  • Implement SubAssign<ByteSize> for ByteSize.
  • Implement SubAssign<impl Into<u64>> for ByteSize.
  • Reject parsing non-unit characters after whitespace.
  • Remove ByteSize::to_string_as() method.
  • Remove top-level to_string() method.
  • Remove top-level B constant.
Commits

Updates cc from 1.2.58 to 1.2.62

Release notes

Sourced from cc's releases.

cc-v1.2.62

Other

  • Regenerate target info (#1721)
  • Allow exceptions on wasm platforms (#1714)
  • Add relibc env (#1710)
  • recognize sh4 architecture in parse_arch() (#1712)

cc-v1.2.61

Other

  • fix OutputKind::Capture documentation (#1705)

cc-v1.2.60

Fixed

  • (ar) suppress warnings from D modifier probe (#1700)

cc-v1.2.59

Fixed

  • (ar) deterministic archives with D modifier (#1697)

Other

  • Regenerate target info (#1698)
  • Fix target abi parsing for sanitiser targets (#1695)
Changelog

Sourced from cc's changelog.

1.2.62 - 2026-05-08

Other

  • Regenerate target info (#1721)
  • Allow exceptions on wasm platforms (#1714)
  • Add relibc env (#1710)
  • recognize sh4 architecture in parse_arch() (#1712)

1.2.61 - 2026-04-24

Other

  • fix OutputKind::Capture documentation (#1705)

1.2.60 - 2026-04-10

Fixed

  • (ar) suppress warnings from D modifier probe (#1700)

1.2.59 - 2026-04-03

Fixed

  • (ar) deterministic archives with D modifier (#1697)

Other

  • Regenerate target info (#1698)
  • Fix target abi parsing for sanitiser targets (#1695)
Commits

Updates chacha20 from 0.9.1 to 0.10.0

Commits

Updates clap from 4.6.0 to 4.6.1

Release notes

Sourced from clap's releases.

v4.6.1

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Changelog

Sourced from clap's changelog.

[4.6.1] - 2026-04-15

Fixes

  • (derive) Ensure rebuilds happen when an read env variable is changed
Commits
  • 1420275 chore: Release
  • d2c817d docs: Update changelog
  • f88c94e Merge pull request #6341 from epage/sep
  • acbb822 fix(complete): Reduce risk of conflict with actual subcommands
  • a49fadb refactor(complete): Pull out subcommand separator
  • ddc008b Merge pull request #6332 from epage/update
  • 497dc50 chore: Update compatible dependencies
  • dca2326 Merge pull request #6331 from clap-rs/renovate/j178-prek-action-2.x
  • 54bdaa3 chore(deps): Update j178/prek-action action to v2
  • f0d30d9 chore: Release
  • Additional commits viewable in compare view

Updates cpufeatures from 0.2.17 to 0.3.0

Commits

Updates criterion from 0.5.1 to 0.8.2

Release notes

Sourced from criterion's releases.

criterion-plot-v0.8.2

Other

  • Update Readme

criterion-v0.8.2

Fixed

  • don't build alloca on unsupported targets

Other

  • (deps) bump crate-ci/typos from 1.40.0 to 1.43.0
  • Fix panic with uniform iteration durations in benchmarks
  • Update Readme
  • Exclude development scripts from published package

criterion-plot-v0.8.1

Fixed

  • Typo

criterion-v0.8.1

Fixed

  • Homepage link

Other

  • (deps) bump crate-ci/typos from 1.23.5 to 1.40.0
  • (deps) bump jontze/action-mdbook from 3 to 4
  • (deps) bump actions/checkout from 4 to 6

criterion-plot-v0.8.0

No release notes provided.

criterion-v0.8.0

BREAKING

  • Drop async-std support

Changed

  • Bump MSRV to 1.86, stable to 1.91.1

Added

  • Add ability to plot throughput on summary page.
  • Add support for reporting throughput in elements and bytes - Throughput::ElementsAndBytes allows the text summary to report throughput in both units simultaneously.
  • Add alloca-based memory layout randomisation to mitigate memory effects on measurements.

... (truncated)

Changelog

Sourced from criterion's changelog.

0.8.2 - 2026-02-04

Fixed

  • don't build alloca on unsupported targets

Other

  • (deps) bump crate-ci/typos from 1.40.0 to 1.43.0
  • Fix panic with uniform iteration durations in benchmarks
  • Update Readme
  • Exclude development scripts from published package

0.8.1 - 2025-12-07

Fixed

  • Homepage link

Other

  • (deps) bump crate-ci/typos from 1.23.5 to 1.40.0
  • (deps) bump jontze/action-mdbook from 3 to 4
  • (deps) bump actions/checkout from 4 to 6

0.8.0 - 2025-11-29

BREAKING

  • Drop async-std support

Changed

  • Bump MSRV to 1.86, stable to 1.91.1

Added

  • Add ability to plot throughput on summary page.
  • Add support for reporting throughput in elements and bytes - Throughput::ElementsAndBytes allows the text summary to report throughput in both units simultaneously.
  • Add alloca-based memory layout randomisation to mitigate memory effects on measurements.
  • Add doc comment to benchmark runner in criterion_group macro (removes linter warnings)

Fixed

  • Fix plotting NaN bug

Other

  • Remove Master API Docs links temporarily while we restore the docs publishing.

... (truncated)

Commits
  • 7f0d745 chore: release v0.8.2
  • 4a467ce chore(deps): bump crate-ci/typos from 1.40.0 to 1.43.0
  • b277a75 Fix panic with uniform iteration durations in benchmarks
  • 828af14 fix: don't build alloca on unsupported targets
  • b01316b Update Readme
  • 4c02a3b Exclude development scripts from published package
  • e4e06df chore: release v0.8.1
  • aa548b9 fix: Homepage link
  • 950c3b7 fix: Typo
  • 7e3e50c chore(deps): bump crate-ci/typos from 1.23.5 to 1.40.0
  • Additional commits viewable in compare view

Updates derive_more from 1.0.0 to 2.1.1

Release notes

Sourced from derive_more's releases.

2.1.1

API docs Changelog

2.1.0

Added

  • Support #[display(rename_all = "<casing>")] attribute to change output for implicit naming of unit enum variants or unit structs when deriving Display. (#443)
  • Support #[from_str(rename_all = "<casing>")] attribute for unit enum variants and unit structs when deriving FromStr. (#467)
  • Support Option fields for Error::source() in Error derive. (#459)
  • Support structs with no fields in FromStr derive. (#469)
  • Add PartialEq derive similar to std's one, but considering generics correctly, and implementing ne() method as well. (#473, #475)
  • Add Eq derive similar to std's one, but considering generics correctly. (#479)
  • Proxy-pass #[allow]/#[expect] attributes of the type in Constructor derive. (#477)
  • Support Deref and DerefMut derives for enums. (#485)
  • Support custom error in FromStr derive. (#494)
  • Support custom error in TryInto derive. (#503)
  • Support skipping fields in Add-like, AddAssign-like, Mul-like and MulAssign-like derives. (#472)

Changed

  • The minimum supported Rust version (MSRV) is now Rust 1.81. (#466)
  • Add-like, AddAssign-like, Mul-like and MulAssign-like derives now infer trait bounds for generics structurally (bound field types instead of type parameters directly). (#472)

Fixed

  • Suppress deprecation warnings in generated code. (#454)
  • Silent no-op when #[try_from(repr)] attribute is not specified for TryFrom derive. (#458)
  • Missing trait bounds in AsRef/AsMut derives when associative types are involved. (#474)
  • Erroneous code generated in Try/TryInto derives when Self type is present in the struct or enum definition. (#489)
  • Dependency on unstable feature(error_generic_member_access) in Error derive when using Backtrace on a non-nightly toolchain. (#513)
  • Broken support for #[<display-trait>("default formatting")] attribute without {_variant} being used as default for enum variants without explicit formatting. (#495)

New Contributors

@dependabot
deps(deps): bump the cargo-deps group with 33 updates
d9ee262 
Bumps the cargo-deps group with 33 updates:

| Package | From | To |
| --- | --- | --- |
| [aes](https://github.com/RustCrypto/block-ciphers) | `0.9.0-rc.4` | `0.9.0` |
| [array-bytes](https://github.com/hack-ink/array-bytes) | `6.2.3` | `9.3.0` |
| [async-channel](https://github.com/smol-rs/async-channel) | `1.9.0` | `2.5.0` |
| [async-nats](https://github.com/nats-io/nats.rs) | `0.37.0` | `0.48.0` |
| [bincode](https://github.com/bincode-org/bincode) | `1.3.3` | `3.0.0` |
| [blake3](https://github.com/BLAKE3-team/BLAKE3) | `1.8.3` | `1.8.5` |
| [bytesize](https://github.com/bytesize-rs/bytesize) | `1.3.3` | `2.3.1` |
| [cc](https://github.com/rust-lang/cc-rs) | `1.2.58` | `1.2.62` |
| [chacha20](https://github.com/RustCrypto/stream-ciphers) | `0.9.1` | `0.10.0` |
| [clap](https://github.com/clap-rs/clap) | `4.6.0` | `4.6.1` |
| [cpufeatures](https://github.com/RustCrypto/utils) | `0.2.17` | `0.3.0` |
| [criterion](https://github.com/criterion-rs/criterion.rs) | `0.5.1` | `0.8.2` |
| [derive_more](https://github.com/JelteF/derive_more) | `1.0.0` | `2.1.1` |
| [fs4](https://github.com/al8n/fs4) | `0.9.1` | `1.1.0` |
| [hex-literal](https://github.com/RustCrypto/utils) | `0.4.1` | `1.1.0` |
| [hwlocality](https://github.com/HadrienG2/hwlocality) | `1.0.0-alpha.11` | `1.0.0-alpha.12` |
| [jsonrpsee](https://github.com/paritytech/jsonrpsee) | `0.24.10` | `0.26.0` |
| [libc](https://github.com/rust-lang/libc) | `0.2.183` | `0.2.186` |
| [mimalloc](https://github.com/purpleprotocol/mimalloc_rust) | `0.1.48` | `0.1.50` |
| [multihash](https://github.com/multiformats/rust-multihash) | `0.19.3` | `0.19.5` |
| [num_enum](https://github.com/illicitonion/num_enum) | `0.5.11` | `0.7.6` |
| [pin-project](https://github.com/taiki-e/pin-project) | `1.1.11` | `1.1.13` |
| [prometheus](https://github.com/tikv/rust-prometheus) | `0.13.4` | `0.14.0` |
| [prometheus-client](https://github.com/prometheus/client_rust) | `0.23.1` | `0.24.1` |
| [rand_chacha](https://github.com/rust-random/rand) | `0.3.1` | `0.9.0` |
| [rand_core](https://github.com/rust-random/rand_core) | `0.6.4` | `0.10.1` |
| [rayon](https://github.com/rayon-rs/rayon) | `1.11.0` | `1.12.0` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [spin](https://github.com/mvdnes/spin-rs) | `0.9.8` | `0.10.0` |
| [strum_macros](https://github.com/Peternator7/strum) | `0.26.4` | `0.28.0` |
| [thread-priority](https://github.com/iddm/thread-priority) | `1.2.0` | `3.0.0` |
| [x509-parser](https://github.com/rusticata/x509-parser) | `0.16.0` | `0.17.0` |
| [ziggy](https://github.com/srlabs/ziggy) | `1.5.4` | `1.7.0` |


Updates `aes` from 0.9.0-rc.4 to 0.9.0
- [Commits](RustCrypto/block-ciphers@aes-v0.9.0-rc.4...aes-v0.9.0)

Updates `array-bytes` from 6.2.3 to 9.3.0
- [Release notes](https://github.com/hack-ink/array-bytes/releases)
- [Changelog](https://github.com/hack-ink/array-bytes/blob/main/CHANGELOG)
- [Commits](hack-ink/array-bytes@v6.2.3...v9.3.0)

Updates `async-channel` from 1.9.0 to 2.5.0
- [Release notes](https://github.com/smol-rs/async-channel/releases)
- [Changelog](https://github.com/smol-rs/async-channel/blob/master/CHANGELOG.md)
- [Commits](smol-rs/async-channel@v1.9.0...v2.5.0)

Updates `async-nats` from 0.37.0 to 0.48.0
- [Release notes](https://github.com/nats-io/nats.rs/releases)
- [Commits](nats-io/nats.rs@async-nats/v0.37.0...async-nats/v0.48.0)

Updates `bincode` from 1.3.3 to 3.0.0
- [Commits](https://github.com/bincode-org/bincode/commits)

Updates `blake3` from 1.8.3 to 1.8.5
- [Release notes](https://github.com/BLAKE3-team/BLAKE3/releases)
- [Commits](BLAKE3-team/BLAKE3@1.8.3...1.8.5)

Updates `bytesize` from 1.3.3 to 2.3.1
- [Release notes](https://github.com/bytesize-rs/bytesize/releases)
- [Changelog](https://github.com/bytesize-rs/bytesize/blob/master/CHANGELOG.md)
- [Commits](bytesize-rs/bytesize@v1.3.3...bytesize-v2.3.1)

Updates `cc` from 1.2.58 to 1.2.62
- [Release notes](https://github.com/rust-lang/cc-rs/releases)
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/cc-rs@cc-v1.2.58...cc-v1.2.62)

Updates `chacha20` from 0.9.1 to 0.10.0
- [Commits](RustCrypto/stream-ciphers@chacha20-v0.9.1...chacha20-v0.10.0)

Updates `clap` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.6.0...clap_complete-v4.6.1)

Updates `cpufeatures` from 0.2.17 to 0.3.0
- [Commits](RustCrypto/utils@cpufeatures-v0.2.17...cpufeatures-v0.3.0)

Updates `criterion` from 0.5.1 to 0.8.2
- [Release notes](https://github.com/criterion-rs/criterion.rs/releases)
- [Changelog](https://github.com/criterion-rs/criterion.rs/blob/master/CHANGELOG.md)
- [Commits](criterion-rs/criterion.rs@0.5.1...criterion-v0.8.2)

Updates `derive_more` from 1.0.0 to 2.1.1
- [Release notes](https://github.com/JelteF/derive_more/releases)
- [Changelog](https://github.com/JelteF/derive_more/blob/master/CHANGELOG.md)
- [Commits](JelteF/derive_more@v1.0.0...v2.1.1)

Updates `fs4` from 0.9.1 to 1.1.0
- [Release notes](https://github.com/al8n/fs4/releases)
- [Changelog](https://github.com/al8n/fs4/blob/main/CHANGELOG.md)
- [Commits](https://github.com/al8n/fs4/commits/1.1.0)

Updates `hex-literal` from 0.4.1 to 1.1.0
- [Commits](RustCrypto/utils@hex-literal-v0.4.1...hex-literal-v1.1.0)

Updates `hwlocality` from 1.0.0-alpha.11 to 1.0.0-alpha.12
- [Commits](HadrienG2/hwlocality@v1.0.0-alpha.11...v1.0.0-alpha.12)

Updates `jsonrpsee` from 0.24.10 to 0.26.0
- [Release notes](https://github.com/paritytech/jsonrpsee/releases)
- [Changelog](https://github.com/paritytech/jsonrpsee/blob/master/CHANGELOG.md)
- [Commits](paritytech/jsonrpsee@v0.24.10...v0.26.0)

Updates `libc` from 0.2.183 to 0.2.186
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.186/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.183...0.2.186)

Updates `mimalloc` from 0.1.48 to 0.1.50
- [Release notes](https://github.com/purpleprotocol/mimalloc_rust/releases)
- [Commits](purpleprotocol/mimalloc_rust@v0.1.48...v0.1.50)

Updates `multihash` from 0.19.3 to 0.19.5
- [Changelog](https://github.com/multiformats/rust-multihash/blob/master/CHANGELOG.md)
- [Commits](multiformats/rust-multihash@v0.19.3...v0.19.5)

Updates `num_enum` from 0.5.11 to 0.7.6
- [Commits](illicitonion/num_enum@0.5.11...0.7.6)

Updates `pin-project` from 1.1.11 to 1.1.13
- [Release notes](https://github.com/taiki-e/pin-project/releases)
- [Changelog](https://github.com/taiki-e/pin-project/blob/main/CHANGELOG.md)
- [Commits](taiki-e/pin-project@v1.1.11...v1.1.13)

Updates `prometheus` from 0.13.4 to 0.14.0
- [Changelog](https://github.com/tikv/rust-prometheus/blob/master/CHANGELOG.md)
- [Commits](tikv/rust-prometheus@v0.13.4...v0.14.0)

Updates `prometheus-client` from 0.23.1 to 0.24.1
- [Release notes](https://github.com/prometheus/client_rust/releases)
- [Changelog](https://github.com/prometheus/client_rust/blob/master/CHANGELOG.md)
- [Commits](prometheus/client_rust@v0.23.1...v0.24.1)

Updates `rand_chacha` from 0.3.1 to 0.9.0
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@rand_chacha-0.3.1...0.9.0)

Updates `rand_core` from 0.6.4 to 0.10.1
- [Release notes](https://github.com/rust-random/rand_core/releases)
- [Changelog](https://github.com/rust-random/rand_core/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand_core@v0.6.4...v0.10.1)

Updates `rayon` from 1.11.0 to 1.12.0
- [Changelog](https://github.com/rayon-rs/rayon/blob/main/RELEASES.md)
- [Commits](rayon-rs/rayon@rayon-core-v1.11.0...rayon-core-v1.12.0)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `spin` from 0.9.8 to 0.10.0
- [Changelog](https://github.com/zesterer/spin-rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mvdnes/spin-rs/commits)

Updates `strum_macros` from 0.26.4 to 0.28.0
- [Release notes](https://github.com/Peternator7/strum/releases)
- [Changelog](https://github.com/Peternator7/strum/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Peternator7/strum/commits/v0.28.0)

Updates `thread-priority` from 1.2.0 to 3.0.0
- [Release notes](https://github.com/iddm/thread-priority/releases)
- [Changelog](https://github.com/iddm/thread-priority/blob/master/CHANGELOG.md)
- [Commits](https://github.com/iddm/thread-priority/commits/v3.0.0)

Updates `x509-parser` from 0.16.0 to 0.17.0
- [Changelog](https://github.com/rusticata/x509-parser/blob/master/CHANGELOG.md)
- [Commits](rusticata/x509-parser@x509-parser-0.16.0...x509-parser-0.17.0)

Updates `ziggy` from 1.5.4 to 1.7.0
- [Release notes](https://github.com/srlabs/ziggy/releases)
- [Changelog](https://github.com/srlabs/ziggy/blob/main/CHANGELOG.md)
- [Commits](srlabs/ziggy@1.5.4...1.7.0)

---
updated-dependencies:
- dependency-name: aes
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: array-bytes
  dependency-version: 9.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: async-channel
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: async-nats
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: bincode
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: blake3
  dependency-version: 1.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: bytesize
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: cc
  dependency-version: 1.2.62
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: chacha20
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: clap
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: cpufeatures
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: criterion
  dependency-version: 0.8.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: derive_more
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: fs4
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: hex-literal
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: hwlocality
  dependency-version: 1.0.0-alpha.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: jsonrpsee
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: libc
  dependency-version: 0.2.186
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: mimalloc
  dependency-version: 0.1.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: multihash
  dependency-version: 0.19.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: num_enum
  dependency-version: 0.7.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: pin-project
  dependency-version: 1.1.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-deps
- dependency-name: prometheus
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: prometheus-client
  dependency-version: 0.24.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: rand_chacha
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: rand_core
  dependency-version: 0.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: rayon
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: spin
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: strum_macros
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: thread-priority
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo-deps
- dependency-name: x509-parser
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
- dependency-name: ziggy
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 13, 2026
@immunefi-magnus

immunefi-magnus Bot commented May 13, 2026

Copy link
Copy Markdown

🛡️ Immunefi PR Reviews

We noticed that your project isn't set up for automatic code reviews. If you'd like this PR reviewed by the Immunefi team, you can request it manually using the link below:

🔗 Send this PR in for review

Once submitted, we'll take care of assigning a reviewer and follow up here.

@vedhavyas
deps: migrate source for the 33-dep bump; revert breakers
7c11de8 
API migrations to land alongside the dependabot batch:
- derive_more 1→2: `with_trait::` import in pieces.rs; drop unused
  AsMut/AsRef/From/Into imports in sectors.rs and solutions.rs
- bincode 1→2: pinned to 2.0.1 (3.0.0 is an upstream compile_error
  placeholder; bincode-org repo archived 2025-08), staking fuzz now
  calls `bincode::serde::decode_from_slice` with legacy config,
  enabled `serde` feature on the pallet-domains dep
- chacha20 0.9→0.10: enabled the new `cipher` feature in
  subspace-proof-of-space
- array-bytes 6→9: replaced `array_bytes::bytes2hex("", x)` with
  `hex::encode(x)` across MMR / fraud-proof / snap-sync; dropped
  the array-bytes dep from those three crates
- bytesize 1→2: `bytesize::to_string(n, iec)` →
  `bytesize::ByteSize::b(n).display().iec()|.si()` across farmer
  + archiver
- fs4 0.9→1.x: `fs4::fs_std::FileExt::try_lock_exclusive` →
  `fs4::FileExt::try_lock`
- async-nats 0.37→0.48: cover new `RequestErrorKind::InvalidSubject`
  variant in nats_client + plotter
- criterion 0.5→0.8: drop `criterion::black_box` (deprecated) and
  use `std::hint::black_box` across all bench files

Reverted because polkadot-sdk pins them transitively:
- prometheus 0.14.0 → 0.13.4
- async-channel 2.5 → 1.9.0
- jsonrpsee 0.26 → 0.24.10

Reverted because the libp2p fork pins it:
- prometheus-client 0.24.1 → 0.23.1

Reverted as a consensus-break risk:
- rand 0.8.5 (kept), rand_chacha 0.9.0 → 0.3.1, rand_core 0.10.1 →
  0.6.4. rand 0.9 rewrote `SliceRandom::shuffle` to a faster
  non-reproducible algorithm (rust-random/rand#1272). Since
  `sp_domains::shuffle_extrinsics` uses `positions.shuffle(&mut rng)`
  with a ChaCha8Rng to determine on-chain extrinsic ordering,
  taking rand 0.9 would silently change that ordering at the fork
  point — a consensus break. rand_chacha and rand_core are bytestream-
  stable (empirically verified) but blocked transitively: rand_chacha
  0.9 needs rand_core 0.9, while rand 0.8 needs rand_core 0.6, and
  the SeedableRng trait impls don't cross those version boundaries.
  The shuffle_extrinsics_should_work test in domain-block-preprocessor
  catches it.
@vedhavyas
deps: dependabot — ignore deps we can never take this week
640c963 
Adds permanent and temporary skips so dependabot stops opening grouped
cargo PRs that include deps we have to revert.

Permanent (would break us if taken):
- rand 0.9 changed SliceRandom::shuffle to a non-reproducible algorithm
  (rust-random/rand#1272). sp_domains::shuffle_extrinsics relies on
  deterministic shuffle output, so the bump is a consensus break.
  rand_chacha and rand_core are bytestream-stable but blocked
  transitively by rand 0.8's rand_core 0.6 dependency. TODO: lift
  once shuffle_extrinsics is rewritten to drive Fisher-Yates directly
  over RngCore.
- bincode 3.0.0 on crates.io is a compile_error! placeholder; the
  upstream repo was archived 2025-08. TODO: lift when the ecosystem
  picks a maintained successor.

Temporary, gated on fork rebases (in ignore so dependabot doesn't
re-open weekly PRs that can't merge; TODOs flag the unlock signal):
- jsonrpsee, prometheus, async-channel — polkadot-sdk fork pins
- prometheus-client — libp2p fork pins
@vedhavyas
vedhavyas force-pushed the dependabot/cargo/cargo-deps-888bf85368 branch from c91fb9b to 640c963 Compare May 14, 2026 21:08
vedhavyas added 4 commits May 15, 2026 03:06
@vedhavyas
deps: revert drive-by rand::thread_rng() refactor
a124c71 
Five test/mock files had unrelated style changes that crept in during
the rand 0.8→0.9 experiment: `use rand::thread_rng;` was added and
call sites changed from `rand::thread_rng()` to `thread_rng()`. The
rand bump was reverted but the import edits stayed. They were never
required by any of the dep migrations in this PR.

Restoring these files to their main-branch form per the surgical-edits
rule.
@vedhavyas
deps: drop stranded array-bytes workspace pin
810797a 
The PR removed all three workspace-member consumers of `array-bytes`
(`subspace-service`, `sc-domains`, `sc-subspace-sync-common`) when
migrating to `hex::encode` for libp2p protocol names — but the
workspace-level `array-bytes = "9.3.0"` pin was left in place
advertising a dep nothing uses.

Dropping the pin. Cargo.lock is unchanged: `array-bytes 6.2.3` is
still pulled transitively by polkadot-sdk's `frame-support`, but that's
its own resolution and doesn't need our workspace pin to participate.
@vedhavyas
deps: tighten dependabot.yml fork-pinned dep skips
6d3b387 
- Drop redundant `version-update:semver-minor` entries on jsonrpsee,
  prometheus, prometheus-client. Dependabot's Cargo classifier treats
  pre-1.0 minor bumps (0.x.y → 0.(x+1).y) as semver-major, so the
  separate `semver-minor` lines were no-ops.
- Split the polkadot-sdk-rebase TODO into a jsonrpsee/prometheus group
  and an async-channel group; the latter unlocks on a different
  condition (polkadot-sdk migrating to async-channel 2.x), not on the
  same rebase as the others.
- Note that async-channel 1.x minor/patch bumps remain allowed since
  polkadot-sdk's caret is `< 2.0.0`.
@vedhavyas
deps: alphabetize hex.workspace placement in sc-domains/Cargo.toml
a5e4cbb 
The hex workspace dep was added to sc-domains/Cargo.toml during the
`array_bytes::bytes2hex` → `hex::encode` migration but landed right
after `async-channel`, breaking the file's alphabetical ordering.
Sibling Cargo.toml files (`subspace-service`, `sc-subspace-sync-common`)
already place `hex` between `futures` and the next dep — matching
that here.
@vedhavyas
vedhavyas merged commit 03efc87 into main May 15, 2026
15 of 17 checks passed
@vedhavyas
vedhavyas deleted the dependabot/cargo/cargo-deps-888bf85368 branch May 15, 2026 05:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vedhavyas vedhavyas Awaiting requested review from vedhavyas vedhavyas is a code owner
@nazar-pc nazar-pc Awaiting requested review from nazar-pc nazar-pc is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vedhavyas