Bump the cargo group across 2 directories with 11 updates #2348

dependabot · 2026-01-26T13:22:03Z

Bumps the cargo group with 8 updates in the /packages directory:

Package	From	To
tokio	`1.44.1`	`1.44.2`
tracing-subscriber	`0.3.19`	`0.3.20`
curve25519-dalek	`4.1.2`	`4.1.3`
openssl	`0.10.68`	`0.10.72`
ammonia	`3.3.0`	`3.3.1`
zip	`2.2.2`	`2.3.0`
ring	`0.17.8`	`0.17.13`
crossbeam-channel	`0.5.14`	`0.5.15`

Bumps the cargo group with 1 update in the /packages/sequent-core directory: borsh.

Updates tokio from 1.44.1 to 1.44.2

Release notes

Sourced from tokio's releases.

Tokio v1.44.2

This release fixes a soundness issue in the broadcast channel. The channel accepts values that are Send but !Sync. Previously, the channel called clone() on these values without synchronizing. This release fixes the channel by synchronizing calls to .clone() (Thanks Austin Bonander for finding and reporting the issue).

Fixed

sync: synchronize clone() call in broadcast channel (#7232)

#7232: tokio-rs/tokio#7232

Commits

ec4b1d7 chore: forward port 1.43.x
e3c3a56 Merge branch 'tokio-1.43.x' into forward-port-1.43.x
a7b658c chore: prepare Tokio v1.43.1 release
c1c8d10 Merge remote-tracking branch 'origin/tokio-1.38.x' into forward-port-1.38.x
aa303bc chore: prepare Tokio v1.38.2 release
7b6ccb5 chore: backport CI fixes
4b174ce sync: fix cloning value when receiving from broadcast channel
See full diff in compare view

Updates tracing-subscriber from 0.3.19 to 0.3.20

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.20

Security Fix: ANSI Escape Sequence Injection (CVE-TBD)

Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

Manipulate terminal title bars

Clear screens or modify terminal display

Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

Solution

Version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

Affected Versions

All versions of tracing-subscriber prior to 0.3.20 are affected by this vulnerability.

Recommendations

Immediate Action Required: We recommend upgrading to tracing-subscriber 0.3.20 immediately, especially if your application:

Logs user-provided input (form data, HTTP headers, query parameters, etc.)

Runs in environments where terminal output is displayed to users

Migration

This is a patch release with no breaking API changes. Simply update your Cargo.toml:
[dependencies]
tracing-subscriber = "0.3.20"
Acknowledgments

We would like to thank zefr0x who responsibly reported the issue at security@tokio.rs.

If you believe you have found a security vulnerability in any tokio-rs project, please email us at security@tokio.rs.

Commits

4c52ca5 fmt: fix ANSI escape sequence injection vulnerability (#3368)
f71cebe subscriber: impl Clone for EnvFilter (#3360)
3a1f571 Fix CI (#3361)
e63ef57 chore: prepare tracing-attributes 0.1.30 (#3316)
6e59a13 attributes: fix tracing::instrument regression around shadowing (#3311)
e4df761 tracing: update core to 0.1.34 and attributes to 0.1.29 (#3305)
643f392 chore: prepare tracing-attributes 0.1.29 (#3304)
d08e7a6 chore: prepare tracing-core 0.1.34 (#3302)
6e70c57 tracing-subscriber: count numbers of enters in Timings (#2944)
c01d4fd fix docs and enable CI on main branch (#3295)
Additional commits viewable in compare view

Updates curve25519-dalek from 4.1.2 to 4.1.3

Commits

5312a03 curve: Bump version to 4.1.3 (#660)
b4f9e4d SECURITY: fix timing variability in backend/serial/u32/scalar.rs (#661)
415892a SECURITY: fix timing variability in backend/serial/u64/scalar.rs (#659)
56bf398 Updates license field to valid SPDX format (#647)
9252fa5 Mitigate check-cfg until MSRV 1.77 (#652)
1efe6a9 Fix a minor typo in signing.rs (#649)
cc3421a Indicate that the rand_core feature is required (#641)
858c4ca Address new nightly clippy unnecessary qualifications (#639)
31ccb67 Remove platforms in favor using CARGO_CFG_TARGET_POINTER_WIDTH (#636)
19c7f4a Fix new nightly redundant import lint warns (#638)
Additional commits viewable in compare view

Updates openssl from 0.10.68 to 0.10.72

Release notes

Sourced from openssl's releases.

openssl-v0.10.72

What's Changed

make set_rsa_oaep_md visible to boringssl config by @frncs-rss in sfackler/rust-openssl#2372

Fix typo in openssl-sys build script by @rushilmehra in sfackler/rust-openssl#2375

Unify the two BoringSSL codepaths a bit and simplify init by @davidben in sfackler/rust-openssl#2377

pkey_ctx: Fix link to the corresponding OpenSSL function by @Jakuje in sfackler/rust-openssl#2378

fix test on MSRV by @alex in sfackler/rust-openssl#2383

Add support for AWS-LC to openssl and openssl-sys crates by @skmcgrail in sfackler/rust-openssl#1805

Enable additional capabilities for AWS-LC by @skmcgrail in sfackler/rust-openssl#2386

Use --experimental with bindgen-cli with aws-lc build by @skmcgrail in sfackler/rust-openssl#2389

Fixed two UAFs and bumped versions for release by @alex in sfackler/rust-openssl#2390

New Contributors

@Jakuje made their first contribution in sfackler/rust-openssl#2378

@skmcgrail made their first contribution in sfackler/rust-openssl#1805

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.71...openssl-v0.10.72

openssl-v0.10.71

What's Changed

Expose rc2 ciphers on symm::Cipher by @alex in sfackler/rust-openssl#2361

add full Apache license file to openssl by @frncs-rss in sfackler/rust-openssl#2366

Release openssl v0.10.71 and openssl-sys v0.9.106 by @alex in sfackler/rust-openssl#2369

New Contributors

@frncs-rss made their first contribution in sfackler/rust-openssl#2366

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.70...openssl-v0.10.71

openssl v0.10.70

What's Changed

Attempt to fix CI by pinning to the Ubuntu 22.04 image by @alex in sfackler/rust-openssl#2357

Remove EC_METHOD and EC_GROUP_new for LibreSSL 4.1 by @botovq in sfackler/rust-openssl#2356

Test against 3.4.0 final release by @alex in sfackler/rust-openssl#2359

Expose SslMethod::{dtls_client,dtls_server} by @alex in sfackler/rust-openssl#2358

Fix lifetimes in ssl::select_next_proto by @sfackler in sfackler/rust-openssl#2360

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.69...openssl-v0.10.70

openssl v0.10.69

What's Changed

build(deps): Update openssl-macro to version 0.1.1 by @caspermeijn in sfackler/rust-openssl#2324

Enable set_alpn_select_callback for BoringSSL by @ViktoriiaKovalova in sfackler/rust-openssl#2327

Switch the test to use prime256v1 based key by @dcermak in sfackler/rust-openssl#2330

Expose EVP_DigestSqueeze from Hasher by @initsecret in sfackler/rust-openssl#2275

Expose SSL_CTX_load_verify_locations by @sfackler in sfackler/rust-openssl#2353

New Contributors

@caspermeijn made their first contribution in sfackler/rust-openssl#2324

... (truncated)

Commits

87085bd Merge pull request #2390 from alex/uaf-fix
d1a12e2 Fixed two UAFs and bumped versions for release
7c7b2e6 Merge pull request #2389 from skmcgrail/aws-lc-follow-up
34a477b Use --experimental with bindgen-cli with aws-lc build
d4bf071 Merge pull request #2386 from skmcgrail/aws-lc-follow-up
a86bf67 Remove comment
705dbfb Fix test
e0df413 Skip final call for LibreSSL 4.1.0 for CCM mode
2f1164b Enable additional capabilities for AWS-LC
dde9ffb Merge pull request #1805 from skmcgrail/aws-lc-support-final
Additional commits viewable in compare view

Updates ammonia from 3.3.0 to 3.3.1

Release notes

Sourced from ammonia's releases.

3.3.1

fix: unexpected namespace switches after cleanup can cause mXSS (reported by zzm0902@shu.edu.cn, backport 4.1.2)

Changelog

Sourced from ammonia's changelog.

3.3.1

fix: unexpected namespace switches after cleanup can cause mXSS (backport 4.1.2, reported by zzm0902@shu.edu.cn)

Commits

ac77346 Release 3.3.1 with security fix
See full diff in compare view

Updates zip from 2.2.2 to 2.3.0

Release notes

Sourced from zip's releases.

v2.3.0

🚀 Features

Add support for NTFS extra field (#279)

🐛 Bug Fixes

(test) Conditionalize a zip64 doctest (#308)

fix failing tests, remove symlink loop check

Canonicalize output path to avoid false negatives

Symlink handling in stream extraction

Canonicalize output paths and symlink targets, and ensure they descend from the destination

⚙️ Miscellaneous Tasks

Fix clippy and cargo fmt warnings (#310)

v2.2.3

🚜 Refactor

Change the inner structure of DateTime (#267)

⚙️ Miscellaneous Tasks

cargo fix --edition

Changelog

Sourced from zip's changelog.

2.3.0 - 2025-03-16

🚀 Features

Add support for NTFS extra field (#279)

🐛 Bug Fixes

(test) Conditionalize a zip64 doctest (#308)

fix failing tests, remove symlink loop check

Canonicalize output path to avoid false negatives

Symlink handling in stream extraction

Canonicalize output paths and symlink targets, and ensure they descend from the destination

⚙️ Miscellaneous Tasks

Fix clippy and cargo fmt warnings (#310)

2.2.3 - 2025-02-26

🚜 Refactor

Change the inner structure of DateTime (#267)

⚙️ Miscellaneous Tasks

cargo fix --edition

Commits

6eab5f5 chore: release v2.3.0 (#300)
e4aee20 implement ZipFile::options + refactor options normalization (#305)
ea8a7bb fix(test): Conditionalize a zip64 doctest (#308)
365c81a Use xz2 crate instead of a custom implementation (#306)
ae94b34 chore: Fix clippy and cargo fmt warnings (#310)
a2e062f Merge commit from fork
0199ac2 Simplify handling for symlink targets
977bb94 fix failing tests, remove symlink loop check
3cb29e7 Partial fix for tests
2182b07 Refactor
Additional commits viewable in compare view

Updates ring from 0.17.8 to 0.17.13

Changelog

Sourced from ring's changelog.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

Commits

See full diff in compare view

Updates crossbeam-channel from 0.5.14 to 0.5.15

Release notes

Sourced from crossbeam-channel's releases.

crossbeam-channel 0.5.15

Fix regression introduced in 0.5.12 that can lead to a double free when dropping unbounded channel. (#1187)

Commits

d35ffde Prepare for the next release
6ec74ec crossbeam-channel: prevent double free on Drop (#1187)
See full diff in compare view

Updates borsh from 0.9.3 to 1.5.1

Release notes

Sourced from borsh's releases.

borsh-derive-v1.5.1

No release notes provided.

borsh-v1.5.1

No release notes provided.

borsh-derive-v1.5.0

No release notes provided.

borsh-v1.5.0

Added

implement BorshSchema for VecDeque and LinkedList (#291)

Other

Fix repository field of borsh-derive (#288)

borsh-derive-v1.4.0

No release notes provided.

borsh-v1.4.0

Added

impl BorshSchema for Cow<'a, T> (#284)

BorshSerialize/BoshDeserialize/BorshSchema for Cell/RefCell (#265)

Other

reorg tests (#285)

remove conflicts with W/R parameters for BorshSerialize/BorshDeserialize derives (#283)

fix test_exhaustive_checks step + downgrade package for MSRV test (#280)

borsh-derive-v1.3.1

No release notes provided.

borsh-v1.3.1

Other

fix clippy (#275)

bump proc-macro-crate to 3; bump MSRV to 1.67 (#274)

borsh-derive-v1.3.0

No release notes provided.

borsh-v1.3.0

Added

impl BorshSchema for Rc and Arc; add doc for rc feature (#268)

borsh-derive-v1.2.1

No release notes provided.

borsh-v1.2.1

Other

optimize BorshSerialize derive for enums with unit variants (#262)

... (truncated)

Changelog

Sourced from borsh's changelog.

1.5.1 - 2024-05-30

Added

(schema) for HashMap<K, V> -> HashMap<K, V, S>, for HashSet<T> -> HashSet<T, S> (#294)

Fixed

fixed linting warnings for Rust 1.78 stable, 1.80 nightly (#295)

1.5.0 - 2024-04-29

Added

implement BorshSchema for VecDeque and LinkedList (#291)

Other

Fix repository field of borsh-derive (#288)

1.4.0 - 2024-03-25

Added

impl BorshSchema for Cow<'a, T> (#284)

BorshSerialize/BoshDeserialize/BorshSchema for Cell/RefCell (#265)

Other

reorg tests (#285)

remove conflicts with W/R parameters for BorshSerialize/BorshDeserialize derives (#283)

fix test_exhaustive_checks step + downgrade package for MSRV test (#280)

1.3.1 - 2024-01-10

Other

fix clippy (#275)

bump proc-macro-crate to 3; bump MSRV to 1.67 (#274)

1.3.0 - 2023-12-07

Added

impl BorshSchema for Rc and Arc; add doc for rc feature (#268)

1.2.1 - 2023-12-06

Other

optimize BorshSerialize derive for enums with unit variants (#262)

fix release-plz error; exclude *.snap from borsh-derive publish (#263)

1.2.0 - 2023-11-13

Added

add support for types from ascii crate (#255)

1.1.2 - 2023-11-08

... (truncated)

Commits

f16cd07 chore: release (#298)
cdb8fa9 feat(schema): for HashMap\<K, V> -> HashMap\<K, V, S>, for HashSet\<T> -> ...
fa6225c fix: fixed linting warnings for Rust 1.78 stable, 1.80 nightly (#295)
6fa3057 chore: release (#289)
238ea42 feat: implement BorshSchema for VecDeque and LinkedList (#291)
96268f2 Fix repository field of borsh-derive (#288)
410cab8 chore: release (#282)
f65fcce test: reorg tests (#285)
5f33c59 feat: impl BorshSchema for Cow\<'a, T> (#284)
fbcfd1d chore: remove conflicts with W/R parameters for BorshSerialize/`BorshDe...
Additional commits viewable in compare view

Updates curve25519-dalek from 3.2.1 to 4.1.2

Commits

5312a03 curve: Bump version to 4.1.3 (#660)
b4f9e4d SECURITY: fix timing variability in backend/serial/u32/scalar.rs (#661)
415892a SECURITY: fix timing variability in backend/serial/u64/scalar.rs (#659)
56bf398 Updates license field to valid SPDX format (#647)
9252fa5 Mitigate check-cfg until MSRV 1.77 (#652)
1efe6a9 Fix a minor typo in signing.rs (#649)
cc3421a Indicate that the rand_core feature is required (#641)
858c4ca Address new nightly clippy unnecessary qualifications (#639)
31ccb67 Remove platforms in favor using CARGO_CFG_TARGET_POINTER_WIDTH (#636)
19c7f4a Fix new nightly redundant import lint warns (#638)
Additional commits viewable in compare view

Updates ed25519-dalek from 1.0.1 to 2.1.1

Changelog

Sourced from ed25519-dalek's changelog.

2.1.1

Update the optional packed-simd dependency to rely on a newer, maintained version of the packed-simd-2 crate.

2.1.0

Make Scalar::from_bits a const fn, allowing its use in const contexts.

2.0.0

Fix a data modeling error in the serde feature pointed out by Trevor Perrin which caused points and scalars to be serialized with length fields rather than as fixed-size 32-byte arrays. This is a breaking change, but it fixes compatibility with serde-json and ensures that the serde-bincode encoding matches the conventional encoding for X/Ed25519.

Update rand_core to 0.5, allowing use with new rand versions.

Switch from clear_on_drop to zeroize (by Tony Arcieri).

Require subtle = ^2.2.1 and remove the note advising nightly Rust, which is no longer required as of that version of subtle. See the subtle changelog for more details.

Update README.md for 2.x series.

Remove the build.rs hack which loaded the entire crate into its own build.rs to generate constants, and keep the constants in the source code.

The only significant change is the data model change to the serde feature; besides the rand_core version bump, there are no other user-visible changes.

1.x series

1.2.4

Specify a semver bound for clear_on_drop rather than an exact version, addressing an issue where changes to inline assembly in rustc prevented clear_on_drop from working without an update.

1.2.3

Fix an issue identified by a Quarkslab audit (and Jack Grigg), where manually constructing unreduced Scalar values, as needed for X/Ed25519, and then performing scalar/scalar arithmetic could compute incorrect results.

Switch to upstream Rust intrinsics for the IFMA backend now that they exist in Rust and don't need to be defined locally.

Ensure that the NAF computation works correctly, even for parameters never used elsewhere in the codebase.

Minor refactoring to EdwardsPoint decompression.

Fix broken links in documentation.

Fix compilation on nightly broken due to changes to the #[doc(include)] path root (not quite correctly done in 1.2.2).

... (truncated)

Commits

0f07443 Bump curve25519-dalek to 2.1.1.
bb889e4 Remove deprecated feature flags from .travis.yml.
d00d4a5 Fix CHANGELOG so that we can note backported patches.
e6d8afc Add link to Cargo.toml with explanation of packed_simd renaming
dd71df6 adjusted dependency entry like to pick up latest pick up the latest packed_si...
6ffc8dd bumped packed_simd to 0.3.4. resolves #333
3fc47ef Bump version to 2.1.0
f04b830 Merge branch 'master' into develop
e342f25 Merge pull request #325 from rubdos/const_fn_for_scalar_from_bits
3a61a0b Make Scalar::from_bits a const fn.
Additional commits viewable in compare view

Updates time from 0.1.45 to 0.3.46

Release notes

Sourced from time's releases.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

v0.3.44

See the changelog for details.

v0.3.43

See the changelog for details.

v0.3.42

See the changelog for details.

v0.3.41

See the changelog for details.

v0.3.40

See the changelog for details.

v0.3.39

See the changelog for details.

v0.3.38

See the changelog for details.

v0.3.37

See the changelog for details.

v0.3.36

See the changelog for details.

v0.3.35

See the changelog for details.

v0.3.34

See the changelog for details.

v0.3.33

See the changelog for details.

v0.3.32

See the changelog for details.

v0.3.31

See the changelog for details.

v0.3.30

See the changelog for details.

... (truncated)

Changelog

Sourced from time's changelog.

0.3.46 [2026-01-23]

Added

All possible panics are now documented for the relevant methods.

The need to use #[serde(default)] when using custom serde formats is documented. This applies only when deserializing an Option<T>.

Duration::nanoseconds_i128 has been made public, mirroring std::time::Duration::from_nanos_u128.

Various methods for truncating components have been added, avoiding the need to call the fallible replace methods multiple times.

For PrimitiveDateTime, UtcDateTime, and OffsetDateTime:

truncate_to_day

For Time, PrimitiveDateTime, UtcDateTime, and OffsetDateTime:

truncate_to_hour

truncate_to_minute

truncate_to_second

truncate_to_millisecond

truncate_to_microsecond

Changed

The minimum supported Rust version is now 1.88.0.

Significant performance gains in numerous locations. No public APIs were changed or removed as part of this.

The size of error::ComponentRange, along with types that contain it, has been significantly reduced.

Fixed

The PartialOrd and Ord implementations of UtcOffset now return the expected result.

0.3.45 [2026-01-13]

Added

time::format_description::StaticFormatDescription type alias for &'static [BorrowedFormatItem<'static>]. This is the type returned by the time::macros::format_description! macro.

Changed

The minimum supported Rust version is now 1.83.0.

All floating point methods on Duration are now const fn.

All setters on Parsed are now const fn.

The serde dependency has been replaced with serde_core, This reduces compile times by not including unused parts of serde.

Date::from_julian_day uses a new algorithm, resulting in an approximately 16% performance

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the cargo group with 8 updates in the /packages directory: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.44.1` | `1.44.2` | | [tracing-subscriber](https://github.com/tokio-rs/tracing) | `0.3.19` | `0.3.20` | | [curve25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) | `4.1.2` | `4.1.3` | | [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.68` | `0.10.72` | | [ammonia](https://github.com/rust-ammonia/ammonia) | `3.3.0` | `3.3.1` | | [zip](https://github.com/zip-rs/zip2) | `2.2.2` | `2.3.0` | | [ring](https://github.com/briansmith/ring) | `0.17.8` | `0.17.13` | | [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam) | `0.5.14` | `0.5.15` | Bumps the cargo group with 1 update in the /packages/sequent-core directory: [borsh](https://github.com/near/borsh-rs). Updates `tokio` from 1.44.1 to 1.44.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.44.1...tokio-1.44.2) Updates `tracing-subscriber` from 0.3.19 to 0.3.20 - [Release notes](https://github.com/tokio-rs/tracing/releases) - [Commits](tokio-rs/tracing@tracing-subscriber-0.3.19...tracing-subscriber-0.3.20) Updates `curve25519-dalek` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases) - [Commits](dalek-cryptography/curve25519-dalek@curve25519-4.1.2...curve25519-4.1.3) Updates `openssl` from 0.10.68 to 0.10.72 - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.68...openssl-v0.10.72) Updates `ammonia` from 3.3.0 to 3.3.1 - [Release notes](https://github.com/rust-ammonia/ammonia/releases) - [Changelog](https://github.com/rust-ammonia/ammonia/blob/master/CHANGELOG.md) - [Commits](rust-ammonia/ammonia@v3.3.0...v3.3.1) Updates `zip` from 2.2.2 to 2.3.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v2.2.2...v2.3.0) Updates `ring` from 0.17.8 to 0.17.13 - [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md) - [Commits](https://github.com/briansmith/ring/commits) Updates `crossbeam-channel` from 0.5.14 to 0.5.15 - [Release notes](https://github.com/crossbeam-rs/crossbeam/releases) - [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/master/CHANGELOG.md) - [Commits](crossbeam-rs/crossbeam@crossbeam-channel-0.5.14...crossbeam-channel-0.5.15) Updates `borsh` from 0.9.3 to 1.5.1 - [Release notes](https://github.com/near/borsh-rs/releases) - [Changelog](https://github.com/near/borsh-rs/blob/master/CHANGELOG.md) - [Commits](near/borsh-rs@v0.9.3...borsh-v1.5.1) Updates `curve25519-dalek` from 3.2.1 to 4.1.2 - [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases) - [Commits](dalek-cryptography/curve25519-dalek@curve25519-4.1.2...curve25519-4.1.3) Updates `ed25519-dalek` from 1.0.1 to 2.1.1 - [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases) - [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/2.1.1/CHANGELOG.md) - [Commits](dalek-cryptography/curve25519-dalek@1.0.1...2.1.1) Updates `time` from 0.1.45 to 0.3.46 - [Release notes](https://github.com/time-rs/time/releases) - [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md) - [Commits](https://github.com/time-rs/time/commits/v0.3.46) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.44.2 dependency-type: direct:production dependency-group: cargo - dependency-name: tracing-subscriber dependency-version: 0.3.20 dependency-type: direct:production dependency-group: cargo - dependency-name: curve25519-dalek dependency-version: 4.1.3 dependency-type: direct:production dependency-group: cargo - dependency-name: openssl dependency-version: 0.10.72 dependency-type: direct:production dependency-group: cargo - dependency-name: ammonia dependency-version: 3.3.1 dependency-type: direct:production dependency-group: cargo - dependency-name: zip dependency-version: 2.3.0 dependency-type: direct:production dependency-group: cargo - dependency-name: ring dependency-version: 0.17.13 dependency-type: direct:production dependency-group: cargo - dependency-name: crossbeam-channel dependency-version: 0.5.15 dependency-type: indirect dependency-group: cargo - dependency-name: borsh dependency-version: 1.5.1 dependency-type: indirect dependency-group: cargo - dependency-name: curve25519-dalek dependency-version: 4.1.2 dependency-type: direct:production dependency-group: cargo - dependency-name: ed25519-dalek dependency-version: 2.1.1 dependency-type: direct:production dependency-group: cargo - dependency-name: time dependency-version: 0.3.46 dependency-type: direct:production dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jan 26, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the cargo group across 2 directories with 11 updates #2348

Bump the cargo group across 2 directories with 11 updates #2348

Uh oh!

dependabot bot commented on behalf of github Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump the cargo group across 2 directories with 11 updates #2348

Are you sure you want to change the base?

Bump the cargo group across 2 directories with 11 updates #2348

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 26, 2026

Tokio v1.44.2

Fixed

tracing-subscriber 0.3.20

Impact

Solution

Affected Versions

Recommendations

Migration

Acknowledgments

openssl-v0.10.72

What's Changed

New Contributors

openssl-v0.10.71

What's Changed

New Contributors

openssl v0.10.70

What's Changed

openssl v0.10.69

What's Changed

New Contributors

3.3.1

3.3.1

v2.3.0

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

v2.2.3

🚜 Refactor

⚙️ Miscellaneous Tasks

2.3.0 - 2025-03-16

🚀 Features

🐛 Bug Fixes

⚙️ Miscellaneous Tasks

2.2.3 - 2025-02-26

🚜 Refactor

⚙️ Miscellaneous Tasks

Version 0.17.13 (2025-03-06)

Version 0.17.12 (2025-03-05)

crossbeam-channel 0.5.15

borsh-derive-v1.5.1

borsh-v1.5.1

borsh-derive-v1.5.0

borsh-v1.5.0

Added

Other

borsh-derive-v1.4.0

borsh-v1.4.0

Added

Other

borsh-derive-v1.3.1

borsh-v1.3.1

Other

borsh-derive-v1.3.0

borsh-v1.3.0

Added

borsh-derive-v1.2.1

borsh-v1.2.1

Other

1.5.1 - 2024-05-30

Added

Fixed

1.5.0 - 2024-04-29

Added

Other

1.4.0 - 2024-03-25

Added

Other

1.3.1 - 2024-01-10

Other

1.3.0 - 2023-12-07

Added

1.2.1 - 2023-12-06

Other

1.2.0 - 2023-11-13