Skip to content

Bump the security group across 1 directory with 15 updates - #7528

Merged
ComputelessComputer merged 1 commit into
mainfrom
dependabot/cargo/security-f05f4eb727
Sep 10, 2026
Merged

Bump the security group across 1 directory with 15 updates#7528
ComputelessComputer merged 1 commit into
mainfrom
dependabot/cargo/security-f05f4eb727

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026 •
edited by cursor Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the security group with 9 updates in the / directory:

Package From To
opentelemetry_sdk 0.30.0 0.32.1
tar 0.4.45 0.4.46
glib 0.18.5 0.20.0
gix 0.72.1 0.77.0
cmov 0.5.3 0.5.4
openssl 0.10.77 0.10.81
quinn-proto 0.11.14 0.11.17
rustls-webpki 0.103.12 0.103.15
serde_with 3.18.0 3.22.0

Updates opentelemetry_sdk from 0.30.0 to 0.32.1

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

  1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

  2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

  3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

  1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

  2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits
  • 74cb6f3 chore: Release opentelemetry-semantic-conventions 0.32.1 (#3562)
  • 10dde18 chore(sdk): add missing changelog entry (#3550)
  • ec2da12 refactor: leverage static str key when possible (#3529)
  • 90a39a0 feat(api): accept quoted-key fields in otel logging macros (#3567)
  • 8c922bc feat(appender-tracing): add builder support for custom instrumentation scope ...
  • fb2af9d feat(metrics): add BoundUpDownCounter under experimental_metrics_bound_instru...
  • 1b3846c feat(metrics): add BoundGauge under experimental_metrics_bound_instruments (#...
  • ee359db fix: remove reqwest-rustls-webpki-roots (#3524)
  • 4d4fd4d chore: Bump semantic-conventions to v1.42.0 (#3561)
  • 69213f2 fix(prometheus-exporter): Concatenate metric attributes with Scope during col...
  • Additional commits viewable in compare view

Updates tar from 0.4.45 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits

Updates glib from 0.18.5 to 0.20.0

Release notes

Sourced from glib's releases.

0.20.0

Bilal Elmoussaoui:
      cairo: Use workspaces
      cairo: Fix ffi glib crate name
      cairo: Add missing version
      Post release version bump
      ci/docs: Deploy 0.19 release
      chore: Drop no longer needed deny skips
      docs: Move metadata back to packages
      glib: Requires Upgrade on Downgrade::Weak type
      Update clone.rs
      glib: Mark GParamSpec types as manual
      glib: Don't use macros to generate ParamSpec structs
      Update gir/gir-files submodules
      Regenerate with latest gir/gir-files
      Revert "glib: Auto generate various win32 functions"
      glib/gio: Remove no longer used version/ignore
      glib: Ignore new unsafe functions
      Fix nightly clippy warnings
      gio: Stop re-exporting all the types in prelude
      gio: Move guards to trait definitions
      gio/socket: Replace c_int import with full qualifier
      gio/tests: Guard variable that is used on windows only builds
      typos: Ignore guid false-positive
      Regenerate with latest gir/gir-files
      pango: Mark Item.get_char_offset param as const
      pango: Re-export v1_54 feature
      ci: Bump pango feature
      pango: Downgrade require version for v1.54
      Fix various nightly clippy warnings
      Update gir submodule
      Regenerate with latest gir
      Adapt to no longer renamed ffi crates
      cairo: Add missing doc aliases
      gio/tests: Remove no longer useful guard
      Revert "build(deps): bump freetype-rs from 0.36.0 to 0.37.0"
      Update dependencies

Carlos Martín Nieto:

gio: Add a method to get a stream of incoming connections to SocketListener

gio: add SocketListenerExtManual to Gir.toml


DaKnig:

spell fix


Fabio Valentini:

glib: fix UB in VariantStrIter::impl_get


Fina Wilke:

</tr></table>

... (truncated)

Commits
  • 184abe8 Update Cargo.lock
  • 673fd1f Regenerate with latest gir-files
  • a9d4e46 Update gir-files
  • b2d7678 Merge pull request #1454 from carlosmn/cmn/socket-listener-stream
  • 08b94be gio: add SocketListenerExtManual to Gir.toml
  • c0c0de7 gio: Add a method to get a stream of incoming connections to SocketListener
  • a9c1b6a Merge pull request #1453 from sdroege/update-gir-files
  • 95036c8 Update Cargo.lock
  • 1951c67 Regenerate with latest gir / gir-files
  • f697f7c glib-sys: Add version for q_sort_array()
  • Additional commits viewable in compare view

Updates gix from 0.72.1 to 0.77.0

Release notes

Sourced from gix's releases.

gix-pack v0.74.2

Bug Fixes

  • retain additions from all merge parents

    TreeAdditionsComparedToAncestor cleared its collected changes before every parent diff. For merge commits, objects added relative to an earlier parent were marked seen and then discarded, producing incomplete packs.

    Add a regression graph whose merge tree matches its second parent and verify that the blob found only against the first parent is counted. Clear the delegate once before the parent loop so each parent’s additions accumulate.

    Expose a read-only gix_pack::testing::Memory adapter for loose in-memory objects. Use it with gix_odb::memory::Proxy in the regression and deduplicate the equivalent benchmark adapter.

    Git baseline: 15c6308cf7ad276b306aa5b3ababfbdebfb1a917; list-objects.c:add_edge_parents accounts for every merge parent tree during object traversal.

Commit Statistics

  • 3 commits contributed to the release over the course of 1 calendar day.
  • 1 day passed between releases.
  • 1 commit was understood as conventional.
  • 1 unique issue was worked on: #2935

Commit Details

  • #2935
    • Retain additions from all merge parents (4009a9a)
  • Uncategorized
    • Merge pull request #2936 from GitoxideLabs/fixup-pack-creation (4fa211d)
    • Merge pull request #2932 from GitoxideLabs/fundamental-types-comp (6704303)

gix-pack v0.74.1

Commit Statistics

  • 2 commits contributed to the release.
  • 1 day passed between releases.
  • 0 commits were understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

... (truncated)

Commits
  • 115e208 Release gix-date v0.12.0, gix-actor v0.37.0, gix-features v0.45.1, gix-hash v...
  • f7c2248 Bump the main crate to the next minor level
  • 9b721c3 Add end of 2025 report
  • 30d8d5c Merge pull request #2314 from GitoxideLabs/copilot/fix-shallow-cloning-issue
  • 3529428 refactor
  • 0b29bd3 Merge pull request #2312 from GitoxideLabs/copilot/adapt-script-for-gix-test-...
  • 2ffee22 fix: obtain correct worktree directories for submodule status when behind sym...
  • f087953 Fix shallow clone to respect remote HEAD instead of local defaults
  • ab67301 refactor
  • 33ff24b fix: handle read_link errors instead of panicking
  • Additional commits viewable in compare view

Updates cmov from 0.5.3 to 0.5.4

Commits

Updates gix-date from 0.10.7 to 0.12.1

Changelog

Sourced from gix-date's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

  • add configurable terminal screen modes.

  • hide revision ancestry in tix

  • add tix to the gix CLI

  • add explicit gix config show subcommand.

  • add gix config list for showing the git-configuration files.

  • add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

  • add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

  • add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

    The command can also write the advertised refs into a standalone ref store:

    gix free remote refs --refs-directory out-refs <url>

Bug Fixes

  • preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

    Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits
  • 7be8f90 Release gix-trace v0.1.17, gix-features v0.45.2, gix-command v0.6.5, gix-hash...
  • c0cf38f Merge pull request #2345 from matts1/push-utkmrmunzotv
  • d99352b fix[pack]: Don't decompress the delta when decompressing base objects.
  • d914d95 Merge pull request #2341 from GitoxideLabs/dependabot/cargo/cargo-cf4a2135ae
  • 9900da8 Run the Windows MSRV checks on Server 2025
  • 4f226b1 Work around too-low winapi after -Zminimal-versions
  • 3fea8f6 Enable the fallible_unit feature of rusqlite 0.38.0
  • 0d2fe18 Revert explicit-casting rusqlite fix and its refactor
  • 09b7aa7 refactor
  • ee31a8f Fix rusqlite 0.38.0 compatibility by casting usize/u64 to i64
  • Additional commits viewable in compare view

Updates gix-fs from 0.15.0 to 0.18.2

Changelog

Sourced from gix-fs's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

  • add configurable terminal screen modes.

  • hide revision ancestry in tix

  • add tix to the gix CLI

  • add explicit gix config show subcommand.

  • add gix config list for showing the git-configuration files.

  • add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

  • add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

  • add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

    The command can also write the advertised refs into a standalone ref store:

    gix free remote refs --refs-directory out-refs <url>

Bug Fixes

  • preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

    Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits
  • 7be8f90 Release gix-trace v0.1.17, gix-features v0.45.2, gix-command v0.6.5, gix-hash...
  • c0cf38f Merge pull request #2345 from matts1/push-utkmrmunzotv
  • d99352b fix[pack]: Don't decompress the delta when decompressing base objects.
  • d914d95 Merge pull request #2341 from GitoxideLabs/dependabot/cargo/cargo-cf4a2135ae
  • 9900da8 Run the Windows MSRV checks on Server 2025
  • 4f226b1 Work around too-low winapi after -Zminimal-versions
  • 3fea8f6 Enable the fallible_unit feature of rusqlite 0.38.0
  • 0d2fe18 Revert explicit-casting rusqlite fix and its refactor
  • 09b7aa7 refactor
  • ee31a8f Fix rusqlite 0.38.0 compatibility by casting usize/u64 to i64
  • Additional commits viewable in compare view

Updates gix-pack from 0.59.1 to 0.64.1

Commits
  • 7be8f90 Release gix-trace v0.1.17, gix-features v0.45.2, gix-command v0.6.5, gix-hash...
  • c0cf38f Merge pull request #2345 from matts1/push-utkmrmunzotv
  • d99352b fix[pack]: Don't decompress the delta when decompressing base objects.
  • d914d95 Merge pull request #2341 from GitoxideLabs/dependabot/cargo/cargo-cf4a2135ae
  • 9900da8 Run the Windows MSRV checks on Server 2025
  • 4f226b1 Work around too-low winapi after -Zminimal-versions
  • 3fea8f6 Enable the fallible_unit feature of rusqlite 0.38.0
  • 0d2fe18 Revert explicit-casting rusqlite fix and its refactor
  • 09b7aa7 refactor
  • ee31a8f Fix rusqlite 0.38.0 compatibility by casting usize/u64 to i64
  • Additional commits viewable in compare view

Updates gix-packetline from 0.19.3 to 0.20.0

Changelog

Sourced from gix-packetline's changelog.

0.20.0 (2022-12-22)

This release also fixes compatibility issues that formerly prevented to fetch or clone form https://googlesource.com.

Changed

  • represent GIT_(COMMITTER|AUTHOR)_(NAME|EMAIL|DATE) with git configuration. That way it becomes more obvious where values are coming from.

New Features

  • auto-enabled verbosity for gix fetch/clone and add --no-verbose. I found myself always adding (and having to remember to add) the -v flag for long-running operations so these should be able to default to a higher verbosity level.

    To counter that, there is a new --no-verbose flag to turn that off.

  • add --strict option to enforce strict checking of configuration.

  • gix odb stats to calculate statistics on the object database. This includes the amount of objects along with a listing of where they are located.

  • gix clone --no-tags support. This is the same as git clone --no-tags.

Changed (BREAKING)

  • open::ReplacementObjects is removed in favor of two custom git-configuration flags. Now it's possible to map the environment variables GIT_REPLACE_REF_BASE and GIT_NO_REPLACE_OBJECTS to custom git configuration keys which can also be set, namely gitoxide.odb.replaceObjectsRefBase and gitoxide.odb.noReplaceObjects.

    Along with the possibility of disabling the usage of GIT_ prefixed environment variables one reaches the previous level of control without making object replacement a special case.

New Features (BREAKING)

  • represent object cache configuration like GITOXIDE_PACK_CACHE_MEMORY in git-configuration. That way there is a unified system for how to set values, which may be overridable by configuration variables or not.

    With this changes, the explicit application of environment variables for setting the cache isn't required anymore as everything happens using git-configuration, and automatically, while providing full control like before.

Commit Statistics

  • 22 commits contributed to the release over the course of 30 calendar days.
  • 31 days passed between releases.

... (truncated)

Commits
  • 82ff92f Release gix-date v0.11.0, gix-actor v0.36.0, gix-path v0.10.22, gix-object v0...
  • e93e84e Merge pull request #2262 from GitoxideLabs/copilot/fix-non-blocking-piped-data
  • 1aaa6fa refactor
  • a457393 Implement on-demand thread for non-blocking piped data processing
  • 896cb4d Merge pull request #2261 from GitoxideLabs/copilot/replace-url-dependency
  • a9a4d4d Adapt to changes in gix-url
  • 402bcc7 feat: Add Scheme::default_port()
  • f679c13 refactor
  • b34d1d2 feat: Replace url dependency with minimal custom implementation
  • dc2794a Merge pull request #2263 from GitoxideLabs/report
  • Additional commits viewable in compare view

Updates gix-sec from 0.11.0 to 0.12.2

Release notes

Sourced from gix-sec's releases.

gix-validate v0.11.4

Bug Fixes

  • reject a lone '@' as a reference name, like Git does @ is shorthand for HEAD in revision syntax, so Git refuses a reference name consisting solely of it - see check_or_sanitize_refname() in refs.c, which check_refname_format() delegates to. It substitutes - when sanitizing, which is done here too.

    The visible effect was in refspec destinations: git push origin "HEAD:@" fails with fatal: invalid refspec, while gix_refspec::parse("HEAD:@", Push) returned Ok(dst = "@"). Sources were already correct, as parse() rewrites a bare @ source to HEAD, but destinations reach reference::name_partial().

    @ remains valid as a component, so refs/heads/@ and a tag named @ are unaffected.

    Pins that @ is rejected by name() and name_partial() while staying valid inside a path (refs/heads/@, @/x, @@), and that inputs collapsing to a lone @ during sanitization are replaced too. The tag expectation changes because mktests! sanitizes as a reference name - a tag named @ is still valid, as refs/tags/@ is a legal ref.

Commit Statistics

  • 7 commits contributed to the release over the course of 30 calendar days.
  • 30 days passed between releases.
  • 1 commit was understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

  • Uncategorized
    • Update manifests prior to release (ebe9095)
    • Merge pull request #2905 from GitoxideLabs/various-improvements (f3bbfad)
    • Adapt to changes in gix-testtools (0cbe539)
    • Merge pull request #2886 from ameyypawar/validate-at-refname (12240ab)
    • Review (1384133)
    • Reject a lone '@' as a reference name, like Git does (679f624)
    • Merge pull request #2812 from GitoxideLabs/report-july (ae8845a)

gix-validate v0.11.3

Commit Statistics

  • 3 commits contributed to the release.

... (truncated)

Changelog

Sourced from gix-sec's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

  • add configurable terminal screen modes.

  • hide revision ancestry in tix

  • add tix to the gix CLI

  • add explicit gix config show subcommand.

  • add gix config list for showing the git-configuration files.

  • add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

  • add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

  • add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

    The command can also write the advertised refs into a standalone ref store:

    gix free remote refs --refs-directory out-refs <url>

Bug Fixes

  • preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

    Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits
  • bdcce5f Release gix-date v0.10.7, gix-actor v0.35.6, gix-trace v0.1.15, gix-features ...
  • 6f469a6 doc: Remove doc_auto_cfg feature to fix docs.rs documentation.
  • fb13346 Merge pull request #2223 from GitoxideLabs/copilot/update-gix-url-documentation
  • 78898a7 Adjust documentation to be a bit less verbose.
  • c836c3d doc: Add documentation explaining URL serialization and password handling
  • 3313233 Merge pull request #2224 from GitoxideLabs/report
  • 49f8d53 Release gix-dir v0.16.0, gix-mailmap v0.27.3, gix-revision v0.36.0, gix-merge...
  • 89fb308 Release gix-date v0.10.6, gix-utils v0.3.1, gix-actor v0.35.5, gix-trace v0.1...
  • 43da177 Add report for October 2025.
  • 8699d0f Merge pull request #2208 from cruessler/add-commit-signing
  • Additional commits viewable in compare view

Updates gix-transport from 0.47.0 to 0.52.1

Changelog

Sourced from gix-transport's changelog.

0.52.1 (2026-04-24)

New Features

  • add gix free trust to easily check the assigned trust level of any given path This is particularly useful on Windows, which makes it easy to probe existing paths with ownership that might be complex to reproduce otherwise.

Commit Statistics

  • 6 commits contributed to the release over the course of 27 calendar days.
  • 33 days passed between releases.
  • 1 commit was understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Thanks Clippy

Clippy helped 1 time to make code idiomatic.

Commit Details

  • Uncategorized
    • Merge pull request #2510 from GitoxideLabs/folder-identity-on-windows (a96587c)
    • Add gix free trust to easily check the assigned trust level of any given path (ab2016f)
    • Merge pull request #2513 from GitoxideLabs/v2-diff (2a5db88)
    • Thanks clippy (e4f380e)
    • Merge pull request #2494 from GitoxideLabs/improvements (50fb46f)
    • Adapt to changes in gix-config. (344218a)

0.52.0 (2026-03-22)

0.51.0 (2026-02-22)

0.50.0 (2026-01-22)

Commit Statistics

  • 4 commits contributed to the release over the course of 12 calendar days.
  • 22 days passed between releases.

... (truncated)

Commits
  • 3bc0c47 Release gix-command v0.6.4, gix-credentials v0.34.1, gix-transport v0.52.1
  • ae8c9d3 Update changelogs prior to gix-transport release (#2328)
  • 69ab7b2 Merge pull request #2329 from GitoxideLabs/improvements
  • 5ae8221 Add note to remove libz-rs-sys crate from allow-list for pure Rust build
  • 5de660e Merge pull request #2328 from NobodyXu/patch-1
  • 28b675e Fixed CI: Whitelist aws-lc-sys for pure-rust-build
  • c8196c6 Bump reqwest to 0.13.1
  • 17bdf47 Merge pull request #2327 from EliahKagan/etc
  • 8602dbc Clarify etc/security readme and fix a typo in threat model notes
  • b79970a Clarify and slightly expand some comments in workflows
  • Additional commits viewable in compare view

Updates openssl from 0.10.77 to 0.10.81

Release notes

Sourced from openssl's releases.

openssl-v0.10.81

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.80...openssl-v0.10.81

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

... (truncated)

Commits
  • db9c9e2 Release openssl 0.10.81 and openssl-sys 0.9.117 (#2655)
  • 3a7fb56 Bump actions/checkout from 6.0.2 to 6.0.3 (#2653)
  • d059c43 Fix verify_mode() panic on unmodeled verify mode bits (#2651)
  • 8b1519e Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string (Description has been truncated

    [!NOTE]
    Medium Risk
    Medium risk from upgrading in-repo git operations (gix), Linux notification GTK bindings (glib 0.20 alongside 0.18), and TLS/crypto transitive updates; observability uses mismatched OpenTelemetry crate versions that warrant a quick trace export smoke test.

    Overview
    This PR refreshes the workspace security dependency group, with a few direct manifest bumps and a large Cargo.lock resolution.

    Direct dependency changes: workspace opentelemetry_sdk moves 0.30 → 0.32 while opentelemetry / OTLP exporters stay on 0.30 (the observability crate now resolves both SDK generations via the lockfile). tauri-plugin-git upgrades gix 0.72 → 0.77. On Linux, notification-linux bumps glib 0.18 → 0.20 for desktop notifications while the rest of the GTK stack remains on 0.18.

    Lockfile fallout: duplicate older gix / GTK-sys crate entries are collapsed onto the newer lines; transitive security-related updates include tar 0.4.46 (PAX header fix), openssl / openssl-sys, rustls-webpki, quinn-proto, aws-lc-rs, and serde_with 3.22 (adds bs58 / jiff support). No application source changes beyond Cargo.toml / Cargo.lock.

    Reviewed by Cursor Bugbot for commit a479b34. Bugbot is set up for automated code reviews on this repo. Configure here.

@dependabot
Bump the security group across 1 directory with 15 updates
a479b34 
Bumps the security group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [opentelemetry_sdk](https://github.com/open-telemetry/opentelemetry-rust) | `0.30.0` | `0.32.1` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.45` | `0.4.46` |
| [glib](https://github.com/gtk-rs/gtk-rs-core) | `0.18.5` | `0.20.0` |
| [gix](https://github.com/GitoxideLabs/gitoxide) | `0.72.1` | `0.77.0` |
| [cmov](https://github.com/RustCrypto/utils) | `0.5.3` | `0.5.4` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.77` | `0.10.81` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.14` | `0.11.17` |
| [rustls-webpki](https://github.com/rustls/webpki) | `0.103.12` | `0.103.15` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.18.0` | `3.22.0` |



Updates `opentelemetry_sdk` from 0.30.0 to 0.32.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md)
- [Commits](open-telemetry/opentelemetry-rust@opentelemetry_sdk-0.30.0...opentelemetry-semantic-conventions-0.32.1)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `glib` from 0.18.5 to 0.20.0
- [Release notes](https://github.com/gtk-rs/gtk-rs-core/releases)
- [Changelog](https://github.com/gtk-rs/gtk-rs-core/blob/main/CHANGELOG.md)
- [Commits](gtk-rs/gtk-rs-core@0.18.5...0.20.0)

Updates `gix` from 0.72.1 to 0.77.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-v0.72.1...gix-v0.77.0)

Updates `cmov` from 0.5.3 to 0.5.4
- [Commits](RustCrypto/utils@cmov-v0.5.3...cmov-v0.5.4)

Updates `gix-date` from 0.10.7 to 0.12.1
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-date-v0.10.7...gix-date-v0.12.1)

Updates `gix-fs` from 0.15.0 to 0.18.2
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-fs-v0.15.0...gix-fs-v0.18.2)

Updates `gix-pack` from 0.59.1 to 0.64.1
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-pack-v0.59.1...gix-pack-v0.64.1)

Updates `gix-packetline` from 0.19.3 to 0.20.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-packetline-v0.19.3...gix-packetline-v0.20.0)

Updates `gix-sec` from 0.11.0 to 0.12.2
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-sec-v0.11.0...gix-sec-v0.12.2)

Updates `gix-transport` from 0.47.0 to 0.52.1
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-transport-v0.47.0...gix-transport-v0.52.1)

Updates `openssl` from 0.10.77 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.77...openssl-v0.10.81)

Updates `quinn-proto` from 0.11.14 to 0.11.17
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.17)

Updates `rustls-webpki` from 0.103.12 to 0.103.15
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.12...v/0.103.15)

Updates `serde_with` from 3.18.0 to 3.22.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.18.0...v3.22.0)

---
updated-dependencies:
- dependency-name: opentelemetry_sdk
  dependency-version: 0.32.1
  dependency-type: direct:production
  dependency-group: security
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
  dependency-group: security
- dependency-name: glib
  dependency-version: 0.20.0
  dependency-type: direct:production
  dependency-group: security
- dependency-name: gix
  dependency-version: 0.77.0
  dependency-type: direct:production
  dependency-group: security
- dependency-name: cmov
  dependency-version: 0.5.4
  dependency-type: indirect
  dependency-group: security
- dependency-name: gix-date
  dependency-version: 0.12.1
  dependency-type: indirect
  dependency-group: security
- dependency-name: gix-fs
  dependency-version: 0.18.2
  dependency-type: indirect
  dependency-group: security
- dependency-name: gix-pack
  dependency-version: 0.64.1
  dependency-type: indirect
  dependency-group: security
- dependency-name: gix-packetline
  dependency-version: 0.20.0
  dependency-type: indirect
  dependency-group: security
- dependency-name: gix-sec
  dependency-version: 0.12.2
  dependency-type: indirect
  dependency-group: security
- dependency-name: gix-transport
  dependency-version: 0.52.1
  dependency-type: indirect
  dependency-group: security
- dependency-name: openssl
  dependency-version: 0.10.81
  dependency-type: indirect
  dependency-group: security
- dependency-name: quinn-proto
  dependency-version: 0.11.17
  dependency-type: indirect
  dependency-group: security
- dependency-name: rustls-webpki
  dependency-version: 0.103.15
  dependency-type: indirect
  dependency-group: security
- dependency-name: serde_with
  dependency-version: 3.22.0
  dependency-type: indirect
  dependency-group: security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 10, 2026
@ComputelessComputer
ComputelessComputer merged commit 8c245e8 into main Sep 10, 2026
24 of 25 checks passed
@ComputelessComputer
ComputelessComputer deleted the dependabot/cargo/security-f05f4eb727 branch September 10, 2026 07:51
This was referenced Sep 10, 2026
Closed
Open
@ComputelessComputer ComputelessComputer mentioned this pull request Sep 11, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ComputelessComputer