build(deps): bump the patch group across 2 directories with 8 updates by dependabot[bot] · Pull Request #486 · Devolutions/picky-rs

dependabot · 2026-05-08T12:16:48Z

Bumps the patch group with 7 updates in the / directory:

Package	From	To
reqwest	`0.13.2`	`0.13.3`
digest	`0.11.2`	`0.11.3`
pbkdf2	`0.13.0-rc.10`	`0.13.0`
signature	`3.0.0-rc.10`	`3.0.0`
pkcs8	`0.11.0-rc.11`	`0.11.0`
rfc6979	`0.5.0-rc.5`	`0.5.0`
embed-resource	`3.0.8`	`3.0.9`

Bumps the patch group with 1 update in the /ffi/wasm directory: wasm-bindgen-test.

Updates reqwest from 0.13.2 to 0.13.3

Release notes

Sourced from reqwest's releases.

v0.13.3

tl;dr

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

Update docs.rs Features by @JamesWiresmith in seanmonstar/reqwest#2961

fix: fallback to hickory_resolver's default config if reading /etc/resolv.conf fails by @monosans in seanmonstar/reqwest#2797

fix: remove timeout con by @cuiweixie in seanmonstar/reqwest#2967

http3: handle stop_sending without error by @anuraaga in seanmonstar/reqwest#2978

resolve: debug log to change only host by @lms0806 in seanmonstar/reqwest#2992

Edit reference link by @lms0806 in seanmonstar/reqwest#2996

docs: more accurate about default HTTP2 window sizes by @seanmonstar in seanmonstar/reqwest#3007

[HTTP/3] Optimize IPv6 fallback and enforce HTTPS scheme #2911 by @lyuzichong in seanmonstar/reqwest#3006

Upgrade rustls-platform-verifier by @jplatte in seanmonstar/reqwest#3010

use wasm-bindgen ecosystem only for wasm32-unknown-* target by @Ludea in seanmonstar/reqwest#3000

fix rustls crl pem parsing by @Threated in seanmonstar/reqwest#3013

docs(retry): include ReqRep in docsrs by @seanmonstar in seanmonstar/reqwest#3020

New Contributors

@JamesWiresmith made their first contribution in seanmonstar/reqwest#2961

@monosans made their first contribution in seanmonstar/reqwest#2797

@cuiweixie made their first contribution in seanmonstar/reqwest#2967

@anuraaga made their first contribution in seanmonstar/reqwest#2978

@lms0806 made their first contribution in seanmonstar/reqwest#2992

@lyuzichong made their first contribution in seanmonstar/reqwest#3006

@Ludea made their first contribution in seanmonstar/reqwest#3000

Full Changelog: seanmonstar/reqwest@v0.13.2...v0.13.3

Changelog

Sourced from reqwest's changelog.

v0.13.3

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

Commits

a9a88c4 v0.13.3
f3f6d9d docs(retry): include ReqRep in docsrs (#3020)
5f9c231 fix rustls CRL PEM parsing (#3013)
11d835d use wasm-bindgen ecosystem only for wasm32-unknown-* target (#3000)
1f72916 Upgrade rustls-platform-verifier (#3010)
5d5bf35 [HTTP/3] Optimize IPv6 fallback and enforce HTTPS scheme #2911 (#3006)
93dc1b2 docs: more accurate about default HTTP2 window sizes (#3007)
c5e50f0 docs: update outdated link in comments
b25611f resolve: debug log to change only host (#2992)
ca1f479 http3: handle stop_sending without error (#2978)
Additional commits viewable in compare view

Updates digest from 0.11.2 to 0.11.3

Commits

2fb9ed8 Release digest v0.11.3 (#2402)
086cf38 digest: add TryCustomizedInit trait (#2395)
9488e7e signature v3.0.0 (#2400)
2917d19 build(deps): bump the all-deps group across 1 directory with 4 updates (#2398)
7b029ba signature: add AsyncVerifier, AsyncMultipartVerifier, `AsyncDigestVerifie...
c6d4dd7 elliptic-curve v0.14.0-rc.32 (#2399)
f2069a2 elliptic-curve: bump pkcs8 to v0.11 (#2397)
8250383 elliptic-curve: bump pkcs8 to v0.11.0-rc.12 (#2396)
54e464f signature: remove long-winded intro section in rustdoc (#2392)
5cb62a4 signature: enable/fix workspace-level lints; reformat docs (#2391)
Additional commits viewable in compare view

Updates pbkdf2 from 0.13.0-rc.10 to 0.13.0

Commits

eba9411 pbkdf2 v0.13.0 (#885)
3b43bd6 bcrypt-pbkdf: bump blowfish to v0.10 (#887)
8f703a9 Adopt Trusted Publishing (#886)
8f0ced5 pbkdf2: apply workspace-level lints (#884)
267d901 Cargo.lock: bump dependencies (#881)
e698b38 argon2: add regression test for RustCrypto/traits#2352 (#879)
22ca09e build(deps): bump the all-deps group with 10 updates (#878)
1bcae95 pbkdf2: remove outdated Sync bounds (#876)
57d89c4 Bump salsa20 dependency to v0.11 (#875)
4db687c pbkdf2: bump belt-hash to v0.2 (#874)
Additional commits viewable in compare view

Updates signature from 3.0.0-rc.10 to 3.0.0

Commits

9488e7e signature v3.0.0 (#2400)
2917d19 build(deps): bump the all-deps group across 1 directory with 4 updates (#2398)
7b029ba signature: add AsyncVerifier, AsyncMultipartVerifier, `AsyncDigestVerifie...
c6d4dd7 elliptic-curve v0.14.0-rc.32 (#2399)
f2069a2 elliptic-curve: bump pkcs8 to v0.11 (#2397)
8250383 elliptic-curve: bump pkcs8 to v0.11.0-rc.12 (#2396)
54e464f signature: remove long-winded intro section in rustdoc (#2392)
5cb62a4 signature: enable/fix workspace-level lints; reformat docs (#2391)
375378f elliptic-curve: consistent PKCS#8 / SEC1 naming in secret_key.rs (#2388)
30a48ab elliptic-curve: add mul_by_generator(_vartime) benchmarks (#2389)
Additional commits viewable in compare view

Updates pkcs8 from 0.11.0-rc.11 to 0.11.0

Commits

a582243 pkcs8 v0.11.0 (#2314)
6f2ea3e der: disable wasmtime tests (#2315)
055d258 pkcs8 v0.11.0-rc.12 (#2312)
7d69c45 pkcs8: getrandom feature (#2311)
381e23c pkcs8: use TryCryptoRng instead of CryptoRng (#2309)
77c386e pkcs8: replace subtle with ctutils (#2308)
967d9f1 pkcs8: add KeyError enum (#2305)
1a52afe pkcs8: impl Decode/EncodePrivateKey for PrivateKeyInfoOwned (#2306)
e65d751 pkcs8: enable workspace-level lint config (#2304)
c50f584 pkcs5: build with all-features = true on docs.rs (#2303)
Additional commits viewable in compare view

Updates rfc6979 from 0.5.0-rc.5 to 0.5.0

Commits

ebe040e rfc6979 v0.5.0 (#1337)
4854bcf ml-dsa: optimize rejection sampling in rej_(ntt|bounded)_poly (#1291)
2399f8a build(deps): bump digest from 0.11.2 to 0.11.3 (#1329)
8c849e0 rfc6979: apply and fix workspace-level lints (#1336)
78c2b75 ed448 v0.5.0 (#1335)
668b851 ed448: apply and fix workspace-level lints (#1334)
3f353f9 ed448: use serdect for serde support (#1333)
2ac115c build(deps): bump serdect from 0.4.2 to 0.4.3 (#1330)
d5012d5 ed25519: add back serde_bytes support (#1332)
b60664e build(deps): bump crate-ci/typos from 1.45.0 to 1.46.0 (#1331)
Additional commits viewable in compare view

Updates embed-resource from 3.0.8 to 3.0.9

Commits

9dbd940 Add @Legend-Master to authors list
e804fbd Generate lockfile
75aabf9 Specify edition and rust-version
aadfe6c Revert "Ship a toml=1.0.7 lock file for CI"
cae565f Ship a toml=1.0.7 lock file for CI
ee64a84 toml = 0.9 -> 1
57a559e Revert "toml = 0.9 -> 1.1"
b50ff93 Bump version to 3.0.9
adf18ff toml = 0.9 -> 1.1
See full diff in compare view

Updates wasm-bindgen-test from 0.3.68 to 0.3.71

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.2` | `0.13.3` | | [digest](https://github.com/RustCrypto/traits) | `0.11.2` | `0.11.3` | | [pbkdf2](https://github.com/RustCrypto/password-hashes) | `0.13.0-rc.10` | `0.13.0` | | [signature](https://github.com/RustCrypto/traits) | `3.0.0-rc.10` | `3.0.0` | | [pkcs8](https://github.com/RustCrypto/formats) | `0.11.0-rc.11` | `0.11.0` | | [rfc6979](https://github.com/RustCrypto/signatures) | `0.5.0-rc.5` | `0.5.0` | | [embed-resource](https://github.com/nabijaczleweli/rust-embed-resource) | `3.0.8` | `3.0.9` | Bumps the patch group with 1 update in the /ffi/wasm directory: [wasm-bindgen-test](https://github.com/wasm-bindgen/wasm-bindgen). Updates `reqwest` from 0.13.2 to 0.13.3 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.2...v0.13.3) Updates `digest` from 0.11.2 to 0.11.3 - [Commits](RustCrypto/traits@digest-v0.11.2...digest-v0.11.3) Updates `pbkdf2` from 0.13.0-rc.10 to 0.13.0 - [Commits](RustCrypto/password-hashes@pbkdf2-v0.13.0-rc.10...pbkdf2-v0.13.0) Updates `signature` from 3.0.0-rc.10 to 3.0.0 - [Commits](RustCrypto/traits@signature-v3.0.0-rc.10...signature-v3.0.0) Updates `pkcs8` from 0.11.0-rc.11 to 0.11.0 - [Commits](RustCrypto/formats@pkcs8/v0.11.0-rc.11...pkcs8/v0.11.0) Updates `rfc6979` from 0.5.0-rc.5 to 0.5.0 - [Commits](RustCrypto/signatures@rfc6979/v0.5.0-rc.5...rfc6979/v0.5.0) Updates `embed-resource` from 3.0.8 to 3.0.9 - [Release notes](https://github.com/nabijaczleweli/rust-embed-resource/releases) - [Commits](nabijaczleweli/rust-embed-resource@v3.0.8...v3.0.9) Updates `wasm-bindgen-test` from 0.3.68 to 0.3.71 - [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases) - [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md) - [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits) --- updated-dependencies: - dependency-name: reqwest dependency-version: 0.13.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: digest dependency-version: 0.11.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: pbkdf2 dependency-version: 0.13.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: signature dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: pkcs8 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: rfc6979 dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: embed-resource dependency-version: 3.0.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch - dependency-name: wasm-bindgen-test dependency-version: 0.3.71 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch ... Signed-off-by: dependabot[bot] <support@github.com>

…n picky/Cargo.toml Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/d1a6edc3-cea1-4a2f-b76c-14de5ba599a7 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

…rgo.toml Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/6faf34c9-e611-4da4-b1be-9fe8286c1b5d Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

Benoît Cortier (CBenoit) · 2026-05-08T12:34:59Z

Copilot Investigate the compilation errors: https://github.com/Devolutions/picky-rs/actions/runs/25555600954/job/75014323589?pr=486

Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/09188e23-ff37-4da8-a2c0-fbacf6b3a0d6 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

Copilot · 2026-05-08T12:37:35Z

Copilot Investigate the compilation errors: https://github.com/Devolutions/picky-rs/actions/runs/25555600954/job/75014323589?pr=486

The ffi/wasm/Cargo.lock still had pbkdf2 locked to 0.13.0-rc.10, while picky's direct dependency was updated to 0.13.0 stable. With --locked, Cargo couldn't reconcile the two versions. Fixed in 564c255 by running cargo update -p pbkdf2 in ffi/wasm/ to update the lockfile to 0.13.0.

Benoît Cortier (CBenoit) · 2026-05-08T13:09:04Z

Copilot CI is still failing: https://github.com/Devolutions/picky-rs/actions/runs/25555941709/job/75015936638?pr=486

Also run, locally to verify the compilation is working.

… for pkcs8 0.11.0 compat Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/069b99f5-0610-4109-bd7b-f8ba35c6581c Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

Copilot · 2026-05-08T13:23:25Z

Copilot CI is still failing: https://github.com/Devolutions/picky-rs/actions/runs/25555941709/job/75015936638?pr=486

Also run, locally to verify the compilation is working.

Two issues were causing the failures (fixed in cc4b273):

unresolved import crypto_common — crypto-common was removed from picky/Cargo.toml's direct dependencies entirely, but key/mod.rs and jose/jwe.rs both use crypto_common::Generate as _. Added it back as a plain crypto-common = "0.2" dep outside the pin block.
rsa + pkcs8 0.11.0 incompatibility — rsa 0.10.0-rc.17 uses pkcs8::Error::KeyMalformed as a unit variant, but in the stable pkcs8 0.11.0 it became KeyMalformed(KeyError) (tuple). Bumped rsa to =0.10.0-rc.18 which was updated for pkcs8 0.11.0 compatibility. Lock files updated accordingly.

Verified locally with cargo check --locked --workspace --all-features — no errors.

dependabot Bot assigned Benoît Cortier (CBenoit) May 8, 2026

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 8, 2026

dependabot Bot mentioned this pull request May 8, 2026

build(deps): bump the patch group across 1 directory with 6 updates #484

Closed

Benoît Cortier (CBenoit) reviewed May 8, 2026

View reviewed changes

Comment thread picky/Cargo.toml

Benoît Cortier (CBenoit) reviewed May 8, 2026

View reviewed changes

Comment thread picky/Cargo.toml Outdated

Copilot started work on behalf of Benoît Cortier (CBenoit) May 8, 2026 12:20 View session

Apply suggestion from @CBenoit

adad840

Benoît Cortier (CBenoit) reviewed May 8, 2026

View reviewed changes

Comment thread picky-krb/Cargo.toml Outdated

Benoît Cortier (CBenoit) and others added 2 commits May 8, 2026 21:20

Apply suggestion from @CBenoit

4cf5726

Remove stabilized crates (signature, pkcs8, rfc6979) from pin block i…

c46c65e

…n picky/Cargo.toml Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/d1a6edc3-cea1-4a2f-b76c-14de5ba599a7 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

Copilot finished work on behalf of Benoît Cortier (CBenoit) May 8, 2026 12:25

Copilot AI requested a review from Benoît Cortier (CBenoit) May 8, 2026 12:25

Benoît Cortier (CBenoit) reviewed May 8, 2026

View reviewed changes

Comment thread picky/Cargo.toml Outdated

Copilot started work on behalf of Benoît Cortier (CBenoit) May 8, 2026 12:28 View session

Remove crypto-common from transitive dependency pin block in picky/Ca…

d1b407f

…rgo.toml Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/6faf34c9-e611-4da4-b1be-9fe8286c1b5d Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

Copilot finished work on behalf of Benoît Cortier (CBenoit) May 8, 2026 12:30

Copilot AI requested a review from Benoît Cortier (CBenoit) May 8, 2026 12:30

Benoît Cortier (CBenoit) approved these changes May 8, 2026

View reviewed changes

Benoît Cortier (CBenoit) enabled auto-merge (squash) May 8, 2026 12:33

Copilot started work on behalf of Benoît Cortier (CBenoit) May 8, 2026 12:35 View session

Fix ffi/wasm Cargo.lock: update pbkdf2 from 0.13.0-rc.10 to 0.13.0

564c255

Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/09188e23-ff37-4da8-a2c0-fbacf6b3a0d6 Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

auto-merge was automatically disabled May 8, 2026 12:37
Head branch was pushed to by a user without write access

Copilot finished work on behalf of Benoît Cortier (CBenoit) May 8, 2026 12:38

Copilot AI requested a review from Benoît Cortier (CBenoit) May 8, 2026 12:38

Benoît Cortier (CBenoit) enabled auto-merge (squash) May 8, 2026 12:44

Copilot started work on behalf of Benoît Cortier (CBenoit) May 8, 2026 13:09 View session

Fix compilation errors: add crypto-common dep back, bump rsa to rc.18…

cc4b273

… for pkcs8 0.11.0 compat Agent-Logs-Url: https://github.com/Devolutions/picky-rs/sessions/069b99f5-0610-4109-bd7b-f8ba35c6581c Co-authored-by: CBenoit <3809077+CBenoit@users.noreply.github.com>

auto-merge was automatically disabled May 8, 2026 13:23
Head branch was pushed to by a user without write access

Copilot finished work on behalf of Benoît Cortier (CBenoit) May 8, 2026 13:24

Benoît Cortier (CBenoit) enabled auto-merge (squash) May 8, 2026 14:32

Benoît Cortier (CBenoit) merged commit cea4919 into master May 8, 2026
11 checks passed

Benoît Cortier (CBenoit) deleted the dependabot/cargo/patch-3376e1ac84 branch May 8, 2026 14:36

devolutionsbot mentioned this pull request May 8, 2026

chore(release): prepare for publishing #487

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the patch group across 2 directories with 8 updates#486

build(deps): bump the patch group across 2 directories with 8 updates#486
Benoît Cortier (CBenoit) merged 7 commits intomasterfrom
dependabot/cargo/patch-3376e1ac84

dependabot Bot commented on behalf of github May 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Benoît Cortier (CBenoit) commented May 8, 2026

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Benoît Cortier (CBenoit) commented May 8, 2026

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github May 8, 2026

v0.13.3

tl;dr

What's Changed

New Contributors

v0.13.3

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Benoît Cortier (CBenoit) commented May 8, 2026

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Benoît Cortier (CBenoit) commented May 8, 2026

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants