Skip to content

build(deps): bump the minor group with 14 updates#258

Merged
benbrandt merged 2 commits into
mainfrom
dependabot/cargo/minor-58657ad9d5
Jul 13, 2026
Merged

build(deps): bump the minor group with 14 updates#258
benbrandt merged 2 commits into
mainfrom
dependabot/cargo/minor-58657ad9d5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor group with 14 updates:

Package From To
uuid 1.23.4 1.23.5
rmcp 2.1.0 2.2.0
open 5.3.6 5.4.0
regex 1.12.4 1.13.0
bytes 1.12.0 1.12.1
cc 1.2.66 1.2.67
memchr 2.8.2 2.8.3
regex-automata 0.4.14 0.4.15
rmcp-macros 2.1.0 2.2.0
thread_local 1.1.9 1.1.10
tinyvec 1.11.0 1.12.0
zerocopy 0.8.53 0.8.54
zerocopy-derive 0.8.53 0.8.54
zmij 1.0.21 1.0.23

Updates uuid from 1.23.4 to 1.23.5

Release notes

Sourced from uuid's releases.

v1.23.5

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

Commits

Updates rmcp from 2.1.0 to 2.2.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v2.2.0

Added

  • [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

  • fill missing fully qualified syntax in prompt_handler macros (#866)

Other

  • align README examples with v2 model API (#928)

rmcp-v2.2.0

Added

  • reject auth servers lacking S256 PKCE support (#955)

Fixed

  • pass client conformance suite (#960)
  • don't respond to cancelled requests (#957)
  • fail orphaned streamable HTTP responses on reinit (#914)
  • address 2025-11-25 conformance audit findings (#951)
Commits
  • 5195776 chore: release v2.2.0 (#953)
  • 6dd7b85 chore(deps): update p256 requirement from 0.13 to 0.14 (#959)
  • a037935 fix: pass client conformance suite (#960)
  • dbda50c fix: don't respond to cancelled requests (#957)
  • 45f2f72 fix: fail orphaned streamable HTTP responses on reinit (#914)
  • 95490fa feat: reject auth servers lacking S256 PKCE support (#955)
  • bdf0c32 fix: address 2025-11-25 conformance audit findings (#951)
  • See full diff in compare view

Updates open from 5.3.6 to 5.4.0

Release notes

Sourced from open's releases.

v5.4.0

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.
  • 1 unique issue was worked on: #124

Commit Details

... (truncated)

Changelog

Sourced from open's changelog.

5.4.0 (2026-07-12)

New Features

  • cargo run now shows the exact commands that were tried when opening. This is useful for debugging, mainly.

Bug Fixes

  • Align WSL PowerShell invocation with Windows Pass the WSL open target to PowerShell through the OPEN_RS_TARGET environment variable instead of embedding it in the command string and escaping it as a single-quoted PowerShell value.

    This matches the safer invocation already used by the native Windows backend. Keeping the PowerShell program fixed ensures that paths and URLs are treated purely as data, even when they contain quotes, semicolons, or other PowerShell metacharacters. It also removes the need for custom PowerShell quoting and avoids converting the target through to_string_lossy() during command construction.

    Add -NonInteractive for consistency with the Windows launcher and update the WSL tests to verify both the fixed command and the unchanged environment-variable value.

  • prevent launcher option and shell injection Opening an attacker-controlled dash-leading path could be interpreted as launcher options. On Windows, cmd /c start also parsed embedded quotes and metacharacters as command language, while the legacy gnome-open fallback could load a module even after a double-dash separator.

    Add command-construction regressions for malicious option-shaped paths and Windows shell metacharacters. Use supported separators on macOS and KDE, and rewrite dash-leading relative paths for launchers without separator support. Keep Windows values out of shell syntax by passing the default target through the environment and invoking custom applications directly, with explorer.exe as a PowerShell-free fallback.

    Exclude cmd-based opening by default, while providing an explicit insecure Cargo feature for users who need compatibility it and accept their unsafe handling of untrusted input.

    Validated with default and all-feature cargo tests, clippy, and cross-target cargo check --tests for aarch64 Linux and Windows.

Commit Statistics

  • 5 commits contributed to the release.
  • 3 commits were understood as conventional.

... (truncated)

Commits
  • b5c12bd Release open v5.4.0
  • bdc3397 Merge pull request #126 from Byron/fix-wsl
  • 7265cae fix: Align WSL PowerShell invocation with Windows
  • 407b058 Merge pull request #125 from Byron/open-with-dash-dash
  • fd29861 fix: prevent launcher option and shell injection (#124)
  • 7c19c0a feat: cargo run now shows the exact commands that were tried when opening.
  • See full diff in compare view

Updates regex from 1.12.4 to 1.13.0

Changelog

Sourced from regex's changelog.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

  • #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.
Commits
  • 926af2e 1.13.0
  • 7d941a9 regex-automata-0.4.15
  • e358341 api: add regex! macro for lazy compilation
  • c420333 automata: disable miri on a couple doc tests
  • b9d2cf7 github: add FUNDING link
  • 0858006 docs: add AI policy for contributors
  • 468fc64 automata: reject dense DFA start states that are match states
  • See full diff in compare view

Updates bytes from 1.12.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Commits

Updates cc from 1.2.66 to 1.2.67

Release notes

Sourced from cc's releases.

cc-v1.2.67

Other

  • Fix clippy warning (#1788)
  • Regenerate target info (#1785)
  • Add support for aarch64-unknown-linux-pauthtest target (#1713)
  • Fix nightly compilation error (#1783)
Changelog

Sourced from cc's changelog.

1.2.67 - 2026-07-11

Other

  • Fix clippy warning (#1788)
  • Regenerate target info (#1785)
  • Add support for aarch64-unknown-linux-pauthtest target (#1713)
  • Fix nightly compilation error (#1783)
Commits

Updates memchr from 2.8.2 to 2.8.3

Commits
  • 5fdb40c 2.8.3
  • 922c7b5 memchr: let compiler know that indexes returned by memchr fns are in bounds
  • e21e9fb arch: add unsafe to internal routines
  • 581faf0 rebar: update memchr version
  • See full diff in compare view

Updates regex-automata from 0.4.14 to 0.4.15

Commits
  • 7d941a9 regex-automata-0.4.15
  • e358341 api: add regex! macro for lazy compilation
  • c420333 automata: disable miri on a couple doc tests
  • b9d2cf7 github: add FUNDING link
  • 0858006 docs: add AI policy for contributors
  • 468fc64 automata: reject dense DFA start states that are match states
  • 7b96fdc 1.12.4
  • 7b89cf0 deps: update to regex-syntax 0.8.11
  • 1401679 regex-syntax-0.8.11
  • d709000 changelog: 1.12.4
  • Additional commits viewable in compare view

Updates rmcp-macros from 2.1.0 to 2.2.0

Release notes

Sourced from rmcp-macros's releases.

rmcp-macros-v2.2.0

Added

  • [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

  • fill missing fully qualified syntax in prompt_handler macros (#866)

Other

  • align README examples with v2 model API (#928)
Commits
  • 5195776 chore: release v2.2.0 (#953)
  • 6dd7b85 chore(deps): update p256 requirement from 0.13 to 0.14 (#959)
  • a037935 fix: pass client conformance suite (#960)
  • dbda50c fix: don't respond to cancelled requests (#957)
  • 45f2f72 fix: fail orphaned streamable HTTP responses on reinit (#914)
  • 95490fa feat: reject auth servers lacking S256 PKCE support (#955)
  • bdf0c32 fix: address 2025-11-25 conformance audit findings (#951)
  • See full diff in compare view

Updates thread_local from 1.1.9 to 1.1.10

Release notes

Sourced from thread_local's releases.

v1.1.10

Fixed

  • Fix undefined behavior when get_or or get_or_try reentrantly initializes the same ThreadLocal (#97).
  • Fix an integer underflow in iterator size_hint implementations (#89).
  • Fix compilation with the nightly feature enabled (#96).

Changed

  • ThreadLocal::get no longer allocates a thread ID or registers a thread-local destructor when no value exists for the current thread (#84).
Changelog

Sourced from thread_local's changelog.

1.1.10 - 2026-07-10

Fixed

  • Fix undefined behavior when get_or or get_or_try reentrantly initializes the same ThreadLocal (#97).
  • Fix an integer underflow in iterator size_hint implementations (#89).
  • Fix compilation with the nightly feature enabled (#96).

Changed

  • ThreadLocal::get no longer allocates a thread ID or registers a thread-local destructor when no value exists for the current thread (#84).
Commits
  • 4724199 Update changelog
  • 99b04cd chore: release v1.1.10
  • c40f3f4 Merge pull request #97 from teddytennant/fix-reentrant-get-or-ub
  • b754150 Merge pull request #95 from andersk/write
  • a706e66 Fix reentrant get_or/get_or_try UB by returning the already-present value
  • b1025c8 Merge pull request #96 from teddytennant/fix-nightly-compile
  • be26d1c Fix compile error in the nightly feature (new.id -> new.id())
  • ca354c2 Reduce unsafe usage with MaybeUninit::write
  • 2ed6865 Merge pull request #92 from polarathene/docs/use-thread-scope-example
  • 570bad3 docs: Switch to thread::scope for example
  • Additional commits viewable in compare view

Updates tinyvec from 1.11.0 to 1.12.0

Changelog

Sourced from tinyvec's changelog.

Changelog

1.12

  • Add schemars support.

1.11.1

  • Fix accidental OOM when deserializing hostile Borsh input.

1.11

  • switched from serde dep to serde_core dep, which should allow more parallelization in builds for downstream users.
  • add as_mut_inner method when the latest_stable_rust feature is enabled
  • add is_full method to check if the size is equal to the capacity
  • add defmt support

1.10

  • Minimum rust version is now 1.55, and the non-const-generic impls are removed. This reduces build times by over a second on average, which is significant enough for a library crate.

1.9

  • Adds a latest_stable_rust cargo feature, which will automatically pull in other cargo features related to the latest Stable version of rust.
  • Adds ArrayVec::try_from_array_len
  • Adds TinyVec::into_vec and TinyVec::into_boxed_slice
  • Adds support for generic-array crate
  • Adds support for the borsh crate

1.8.1

  • e00E updated the rustc features so that they all correctly depend on the lower version feature. pr 199

1.8

1.7

  • Fuuzetsu added the rustc_1_61 cargo feature, which adds the retain_mut method. pr 198

1.6.1

... (truncated)

Commits

Updates zerocopy from 0.8.53 to 0.8.54

Release notes

Sourced from zerocopy's releases.

v0.8.54

What's Changed

New Contributors

Full Changelog: google/zerocopy@v0.8.53...v0.8.54

Commits

Updates zerocopy-derive from 0.8.53 to 0.8.54

Release notes

Sourced from zerocopy-derive's releases.

v0.8.54

What's Changed

New Contributors

Full Changelog: google/zerocopy@v0.8.53...v0.8.54

Commits

Updates zmij from 1.0.21 to 1.0.23

Release notes

Sourced from zmij's releases.

1.0.23

1.0.22

No release notes provided.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
feat(deps): bump the minor group with 14 updates
db33d5e 
Bumps the minor group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.4` | `1.23.5` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `2.1.0` | `2.2.0` |
| [open](https://github.com/Byron/open-rs) | `5.3.6` | `5.4.0` |
| [regex](https://github.com/rust-lang/regex) | `1.12.4` | `1.13.0` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.12.0` | `1.12.1` |
| [cc](https://github.com/rust-lang/cc-rs) | `1.2.66` | `1.2.67` |
| [memchr](https://github.com/BurntSushi/memchr) | `2.8.2` | `2.8.3` |
| [regex-automata](https://github.com/rust-lang/regex) | `0.4.14` | `0.4.15` |
| [rmcp-macros](https://github.com/modelcontextprotocol/rust-sdk) | `2.1.0` | `2.2.0` |
| [thread_local](https://github.com/Amanieu/thread_local-rs) | `1.1.9` | `1.1.10` |
| [tinyvec](https://github.com/Lokathor/tinyvec) | `1.11.0` | `1.12.0` |
| [zerocopy](https://github.com/google/zerocopy) | `0.8.53` | `0.8.54` |
| [zerocopy-derive](https://github.com/google/zerocopy) | `0.8.53` | `0.8.54` |
| [zmij](https://github.com/dtolnay/zmij) | `1.0.21` | `1.0.23` |


Updates `uuid` from 1.23.4 to 1.23.5
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.4...v1.23.5)

Updates `rmcp` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v2.1.0...rmcp-v2.2.0)

Updates `open` from 5.3.6 to 5.4.0
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.3.6...v5.4.0)

Updates `regex` from 1.12.4 to 1.13.0
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.4...1.13.0)

Updates `bytes` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.12.0...v1.12.1)

Updates `cc` from 1.2.66 to 1.2.67
- [Release notes](https://github.com/rust-lang/cc-rs/releases)
- [Changelog](https://github.com/rust-lang/cc-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/cc-rs@cc-v1.2.66...cc-v1.2.67)

Updates `memchr` from 2.8.2 to 2.8.3
- [Commits](BurntSushi/memchr@2.8.2...2.8.3)

Updates `regex-automata` from 0.4.14 to 0.4.15
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@regex-automata-0.4.14...regex-automata-0.4.15)

Updates `rmcp-macros` from 2.1.0 to 2.2.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-macros-v2.1.0...rmcp-macros-v2.2.0)

Updates `thread_local` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/Amanieu/thread_local-rs/releases)
- [Changelog](https://github.com/Amanieu/thread_local-rs/blob/master/CHANGELOG.md)
- [Commits](Amanieu/thread_local-rs@v1.1.9...v1.1.10)

Updates `tinyvec` from 1.11.0 to 1.12.0
- [Changelog](https://github.com/Lokathor/tinyvec/blob/main/CHANGELOG.md)
- [Commits](Lokathor/tinyvec@v1.11.0...v1.12.0)

Updates `zerocopy` from 0.8.53 to 0.8.54
- [Release notes](https://github.com/google/zerocopy/releases)
- [Commits](google/zerocopy@v0.8.53...v0.8.54)

Updates `zerocopy-derive` from 0.8.53 to 0.8.54
- [Release notes](https://github.com/google/zerocopy/releases)
- [Commits](google/zerocopy@v0.8.53...v0.8.54)

Updates `zmij` from 1.0.21 to 1.0.23
- [Release notes](https://github.com/dtolnay/zmij/releases)
- [Commits](dtolnay/zmij@1.0.21...1.0.23)

---
updated-dependencies:
- dependency-name: uuid
  dependency-version: 1.23.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: rmcp
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: open
  dependency-version: 5.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: regex
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: cc
  dependency-version: 1.2.67
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: memchr
  dependency-version: 2.8.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: regex-automata
  dependency-version: 0.4.15
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: rmcp-macros
  dependency-version: 2.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: thread_local
  dependency-version: 1.1.10
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: tinyvec
  dependency-version: 1.12.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: minor
- dependency-name: zerocopy
  dependency-version: 0.8.54
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: zerocopy-derive
  dependency-version: 0.8.54
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
- dependency-name: zmij
  dependency-version: 1.0.23
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jul 13, 2026
@benbrandt benbrandt changed the title feat(deps): bump the minor group with 14 updates build(deps): bump the minor group with 14 updates Jul 13, 2026
@benbrandt benbrandt merged commit b0c1b19 into main Jul 13, 2026
14 checks passed
@benbrandt benbrandt deleted the dependabot/cargo/minor-58657ad9d5 branch July 13, 2026 14:03
@acp-release-bot acp-release-bot Bot mentioned this pull request Jul 13, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@benbrandt