Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the cargo group across 2 directories with 6 updates #9

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump the cargo group across 2 directories with 6 updates #9

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 3, 2025

Bumps the cargo group with 6 updates in the / directory:

Package From To
anstream 0.6.4 0.6.18
h2 0.3.21 0.3.26
libgit2-sys 0.16.1+1.7.1 0.16.2+1.7.2
mio 0.8.9 0.8.11
shlex 1.2.0 1.3.0
zerocopy 0.7.14 0.7.35

Bumps the cargo group with 6 updates in the /cli directory:

Package From To
anstream 0.6.4 0.6.18
h2 0.3.21 0.3.26
libgit2-sys 0.16.1+1.7.1 0.16.2+1.7.2
mio 0.8.9 0.8.11
shlex 1.2.0 1.3.0
zerocopy 0.7.11 0.7.35

Updates anstream from 0.6.4 to 0.6.18

Commits
  • fabe0c3 chore: Release
  • 762ca76 docs: Update changelog
  • d364ac4 Merge pull request #229 from epage/cfg
  • ad3f458 fix(stream): Respect 'test' feature
  • 0b8d105 fix(stream): Refer to correct stream on panic
  • 69cf6c9 refactor(stream): Pull out test macro body
  • c78b3c1 refactor(stream): Be extra clear that macros mod is not for use
  • ab37812 chore(deps): Update compatible (dev) (#226)
  • 7c48196 Merge pull request #227 from rust-cli/renovate/stable-1.x
  • a28405f style: Make clippy happy
  • Additional commits viewable in compare view

Updates h2 from 0.3.21 to 0.3.26

Release notes

Sourced from h2's releases.

v0.3.26

What's Changed

  • Limit number of CONTINUATION frames for misbehaving connections.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.

v0.3.25

What's Changed

Full Changelog: hyperium/h2@v0.3.24...v0.3.25

v0.3.24

Fixed

  • Limit error resets for misbehaving connections.

v0.3.23

What's Changed

v0.3.22

What's Changed

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

New Contributors

Changelog

Sourced from h2's changelog.

0.3.26 (April 3, 2024)

  • Limit number of CONTINUATION frames for misbehaving connections.

0.3.25 (March 15, 2024)

  • Improve performance decoding many headers.

0.3.24 (January 17, 2024)

  • Limit error resets for misbehaving connections.

0.3.23 (January 10, 2024)

  • Backport fix from 0.4.1 for stream capacity assignment.

0.3.22 (November 15, 2023)

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.
Commits

Updates libgit2-sys from 0.16.1+1.7.1 to 0.16.2+1.7.2

Commits

Updates mio from 0.8.9 to 0.8.11

Changelog

Sourced from mio's changelog.

0.8.11

0.8.10

Added

Commits

Updates shlex from 1.2.0 to 1.3.0

Changelog

Sourced from shlex's changelog.

1.3.0

  • Full fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27:
    • Deprecates quote APIs in favor of try_ equivalents that complain about nul bytes.
    • Also adds a builder API, which allows re-enabling nul bytes without using the deprecated interface, and in the future can allow other things (as discussed in quoting_warning).
    • Adds documentation about various security risks that remain, particularly with interactive shells.
  • Adds explicit MSRV of 1.46.0.

1.2.1

  • Partial fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27 without bumping MSRV:
    • The bytes { and \xa0 are now escaped by quoting functions.
Commits
  • 4a0724b Address security issues involving quote API
  • 4c53044 Minimal fix for the high-severity issue without bumping MSRV
  • See full diff in compare view

Updates zerocopy from 0.7.14 to 0.7.35

Release notes

Sourced from zerocopy's releases.

v0.7.35

What's Changed

Full Changelog: google/zerocopy@v0.7.34...v0.7.35

v0.7.34

What's Changed

Full Changelog: google/zerocopy@v0.7.33...v0.7.34

v0.7.33

What's Changed

Full Changelog: google/zerocopy@v0.7.32...v0.7.33

v0.7.32

What's Changed

... (truncated)

Changelog

Sourced from zerocopy's changelog.

Changelog

Releases

We track releases and release notes using GitHub Releases.

Yanks and Regressions

0.2.2 through 0.2.8, 0.3.0 through 0.3.1, 0.4.0, 0.5.0, 0.6.0 through 0.6.5, 0.7.0 through 0.7.30

Security advisories for this bug have been published as RUSTSEC-2023-0074 and GHSA-3mv5-343c-w2qg.

In these versions, the Ref methods into_ref, into_mut, into_slice, and into_mut_slice were permitted in combination with the standard library cell::Ref and cell::RefMut types for Ref<B, T>'s B type parameter. These combinations are unsound, and may permit safe code to exhibit undefined behavior. Fixes have been published to each affected minor version which do not permit this code to compile.

See #716issue-716 for more details.

0.7.27, 0.7.28

These versions were briefly yanked due to a non-soundness regression reported in #672pull-672. After reconsidering our yanking policy in #679issue-679, we un-yanked these versions.

Commits

Updates anstream from 0.6.4 to 0.6.18

Commits
  • fabe0c3 chore: Release
  • 762ca76 docs: Update changelog
  • d364ac4 Merge pull request #229 from epage/cfg
  • ad3f458 fix(stream): Respect 'test' feature
  • 0b8d105 fix(stream): Refer to correct stream on panic
  • 69cf6c9 refactor(stream): Pull out test macro body
  • c78b3c1 refactor(stream): Be extra clear that macros mod is not for use
  • ab37812 chore(deps): Update compatible (dev) (#226)
  • 7c48196 Merge pull request #227 from rust-cli/renovate/stable-1.x
  • a28405f style: Make clippy happy
  • Additional commits viewable in compare view

Updates h2 from 0.3.21 to 0.3.26

Release notes

Sourced from h2's releases.

v0.3.26

What's Changed

  • Limit number of CONTINUATION frames for misbehaving connections.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.

v0.3.25

What's Changed

Full Changelog: hyperium/h2@v0.3.24...v0.3.25

v0.3.24

Fixed

  • Limit error resets for misbehaving connections.

v0.3.23

What's Changed

v0.3.22

What's Changed

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

New Contributors

Changelog

Sourced from h2's changelog.

0.3.26 (April 3, 2024)

  • Limit number of CONTINUATION frames for misbehaving connections.

0.3.25 (March 15, 2024)

  • Improve performance decoding many headers.

0.3.24 (January 17, 2024)

  • Limit error resets for misbehaving connections.

0.3.23 (January 10, 2024)

  • Backport fix from 0.4.1 for stream capacity assignment.

0.3.22 (November 15, 2023)

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.
Commits

Updates libgit2-sys from 0.16.1+1.7.1 to 0.16.2+1.7.2

Commits

Updates mio from 0.8.9 to 0.8.11

Changelog

Sourced from mio's changelog.

0.8.11

0.8.10

Added

Commits

Updates shlex from 1.2.0 to 1.3.0

Changelog

Sourced from shlex's changelog.

1.3.0

  • Full fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27:
    • Deprecates quote APIs in favor of try_ equivalents that complain about nul bytes.
    • Also adds a builder API, which allows re-enabling nul bytes without using the deprecated interface, and in the future can allow other things (as discussed in quoting_warning).
    • Adds documentation about various security risks that remain, particularly with interactive shells.
  • Adds explicit MSRV of 1.46.0.

1.2.1

  • Partial fix for the high-severity security vulnerability RUSTSEC-2024-0006 a.k.a. GHSA-r7qv-8r2h-pg27 without bumping MSRV:
    • The bytes { and \xa0 are now escaped by quoting functions.
Commits
  • 4a0724b Address security issues involving quote API
  • 4c53044 Minimal fix for the high-severity issue without bumping MSRV
  • See full diff in compare view

Updates zerocopy from 0.7.11 to 0.7.35

Release notes

Sourced from zerocopy's releases.

v0.7.35

What's Changed

Full Changelog: google/zerocopy@v0.7.34...v0.7.35

v0.7.34

What's Changed

Full Changelog: google/zerocopy@v0.7.33...v0.7.34

v0.7.33

What's Changed

Full Changelog: google/zerocopy@v0.7.32...v0.7.33

v0.7.32

What's Changed

... (truncated)

Changelog

Sourced from zerocopy's changelog.

Changelog

Releases

We track releases and release notes using GitHub Releases.

Yanks and Regressions

0.2.2 through 0.2.8, 0.3.0 through 0.3.1, 0.4.0, 0.5.0, 0.6.0 through 0.6.5, 0.7.0 through 0.7.30

Security advisories for this bug have been published as RUSTSEC-2023-0074 and GHSA-3mv5-343c-w2qg.

In these versions, the Ref methods into_ref, into_mut, into_slice, and into_mut_slice were permitted in combination with the standard library cell::Ref and cell::RefMut types for Ref<B, T>'s B type parameter. These combinations are unsound, and may permit safe code to exhibit undefined behavior. Fixes have been published to each affected minor version which do not permit this code to compile.

See #716issue-716 for more details.

0.7.27, 0.7.28

These versions were briefly yanked due to a non-soundness regression reported in #672pull-672. After reconsidering our yanking policy in #679issue-679, we un-yanked these versions.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the cargo group across 2 directories with 6 updates
6883dd8 
Bumps the cargo group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anstream](https://github.com/rust-cli/anstyle) | `0.6.4` | `0.6.18` |
| [h2](https://github.com/hyperium/h2) | `0.3.21` | `0.3.26` |
| [libgit2-sys](https://github.com/rust-lang/git2-rs) | `0.16.1+1.7.1` | `0.16.2+1.7.2` |
| [mio](https://github.com/tokio-rs/mio) | `0.8.9` | `0.8.11` |
| [shlex](https://github.com/comex/rust-shlex) | `1.2.0` | `1.3.0` |
| [zerocopy](https://github.com/google/zerocopy) | `0.7.14` | `0.7.35` |

Bumps the cargo group with 6 updates in the /cli directory:

| Package | From | To |
| --- | --- | --- |
| [anstream](https://github.com/rust-cli/anstyle) | `0.6.4` | `0.6.18` |
| [h2](https://github.com/hyperium/h2) | `0.3.21` | `0.3.26` |
| [libgit2-sys](https://github.com/rust-lang/git2-rs) | `0.16.1+1.7.1` | `0.16.2+1.7.2` |
| [mio](https://github.com/tokio-rs/mio) | `0.8.9` | `0.8.11` |
| [shlex](https://github.com/comex/rust-shlex) | `1.2.0` | `1.3.0` |
| [zerocopy](https://github.com/google/zerocopy) | `0.7.11` | `0.7.35` |



Updates `anstream` from 0.6.4 to 0.6.18
- [Commits](rust-cli/anstyle@anstream-v0.6.4...anstream-v0.6.18)

Updates `h2` from 0.3.21 to 0.3.26
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/v0.3.26/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.21...v0.3.26)

Updates `libgit2-sys` from 0.16.1+1.7.1 to 0.16.2+1.7.2
- [Changelog](https://github.com/rust-lang/git2-rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/git2-rs/commits)

Updates `mio` from 0.8.9 to 0.8.11
- [Release notes](https://github.com/tokio-rs/mio/releases)
- [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/mio@v0.8.9...v0.8.11)

Updates `shlex` from 1.2.0 to 1.3.0
- [Changelog](https://github.com/comex/rust-shlex/blob/master/CHANGELOG.md)
- [Commits](comex/rust-shlex@1.2.0...1.3.0)

Updates `zerocopy` from 0.7.14 to 0.7.35
- [Release notes](https://github.com/google/zerocopy/releases)
- [Changelog](https://github.com/google/zerocopy/blob/main/CHANGELOG.md)
- [Commits](google/zerocopy@v0.7.14...v0.7.35)

Updates `anstream` from 0.6.4 to 0.6.18
- [Commits](rust-cli/anstyle@anstream-v0.6.4...anstream-v0.6.18)

Updates `h2` from 0.3.21 to 0.3.26
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/v0.3.26/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.21...v0.3.26)

Updates `libgit2-sys` from 0.16.1+1.7.1 to 0.16.2+1.7.2
- [Changelog](https://github.com/rust-lang/git2-rs/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/git2-rs/commits)

Updates `mio` from 0.8.9 to 0.8.11
- [Release notes](https://github.com/tokio-rs/mio/releases)
- [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/mio@v0.8.9...v0.8.11)

Updates `shlex` from 1.2.0 to 1.3.0
- [Changelog](https://github.com/comex/rust-shlex/blob/master/CHANGELOG.md)
- [Commits](comex/rust-shlex@1.2.0...1.3.0)

Updates `zerocopy` from 0.7.11 to 0.7.35
- [Release notes](https://github.com/google/zerocopy/releases)
- [Changelog](https://github.com/google/zerocopy/blob/main/CHANGELOG.md)
- [Commits](google/zerocopy@v0.7.14...v0.7.35)

---
updated-dependencies:
- dependency-name: anstream
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: h2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: libgit2-sys
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: mio
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: shlex
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: zerocopy
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: anstream
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: h2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: libgit2-sys
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: mio
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: shlex
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: zerocopy
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 3, 2025
This was referenced Mar 3, 2025
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants