chore(deps): bump the cargo group across 2 directories with 2 updates

[dependabot]

Bumps the cargo group with 2 updates in the /indieweb2-bastion/graphql-dns-api directory: hickory-proto and openssl.
Bumps the cargo group with 1 update in the /indieweb2-bastion/odns-rs directory: hickory-proto.

Updates hickory-proto from 0.24.4 to 0.26.1

Release notes

Sourced from hickory-proto's releases.

v0.26.1

This point release for the 0.26 release series brings in several bug fixes, and no user-facing changes. Two security reports are addressed: RUSTSEC-2026-0120 and RUSTSEC-2026-0119.

What's Changed

• net: avoid infinite loop in NSEC3 processing by @​djc in hickory-dns/hickory-dns#3597
• Limit work expended on name compression (backport) by @​divergentdave in hickory-dns/hickory-dns#3615

Full Changelog: hickory-dns/hickory-dns@v0.26.0...v0.26.1

0.26.0

13 months after the release of 0.25.0, we finally have a bigger feature release of Hickory DNS, the suite of DNS libraries and authoritative/recursive name servers written in pure Rust. A lot of work has gone into this release, so we wanted to take a moment to release this before we continue work on deploying the Hickory DNS recursive resolver at Let's Encrypt (and did you see that Hickory is being used in some of Google's Pixel devices?). Because of the ongoing work, we expect that 0.27.0 might happen quite a bit sooner than in 13 months from now.

These release notes describe a number of high-level improvements as well as API changes that are likely to break a larger fraction of our downstream users. Feedback (both on these notes and the release itself) is always welcome in our issue tracker or via our Discord server.

Most of the following notes are broken up by specific components: the server binary and our library crates. However, for this release we've made several changes to the structure of our crates itself:

• Network protocol support has moved out of the hickory-proto crate, into a new hickory-net crate (#3394); this allows the hickory-proto crate to cleanly focus on message encoding and decoding.
• The hickory-client crate has been subsumed into hickory-net, in the client module (#3366). No future releases of the hickory-client crate are expected.
• The hickory-recursor crate has been merged into hickory-resolver (#3370), guarded by a recursor feature which must be enabled explicitly. The recursor implementation was already tightly coupled to the resolver internals, so keeping it separate didn't really make sense.

Additionally, substantial cross-crate changes have been made to improve our error handling:

• More error handling simplification
• proto: split NetError out of ProtoError
• proto: clean up ProtoError
• Be more strict about decode errors
• resolver: remove unnecessary ResolveError wrapper
• Avoid large errors

hickory-dns (the server binary)

• We've added a number of ways to optimize performance via low-level networking configuration:
  • Use SO_REUSEADDR for tcp sockets
  • Allow configuring UDP socket buffer sizes
  • Add SO_REUSEPORT support with configurable UDP socket count
  • More TCP tuning options
• We further extended and reworked our metrics:
  • Additional recursive resolver metrics
  • Minor metrics tidying
  • Initial histogram metrics support
• Miscellaneous changes:
  • Implement RFC 5001 NSID for authoritative server
  • Add server SSLKEYLOGFILE support
  • Add systemd readiness + watchdog support
  • prometheus: enable gzip compression on metrics endpoint
  • Add support for jemalloc + profiling

hickory-server (the library API)

... (truncated)

Commits

• f093210 Limit number of names that may be compressed
• a9b884b Skip search when name compression is disabled
• 6e70e93 Limit number of name pointers stored in BinEncoder
• c2bdb8c Add benchmark for encoding message with many names
• 9e0b528 Bump version to 0.26.1
• 14cc3c8 net: respect caller timeout for DoT TCP connect
• fc2e3f4 resolver: release connections lock before TCP/TLS handshake
• bbdfcd2 Add tests combining NSEC and NSEC3 via CNAME chain
• 994076b Update rustls-webpki to 0.103.13
• 3b265fb net: check query name is in zone when building encloser candidates
• Additional commits viewable in compare view

Updates openssl from 0.10.78 to 0.10.79

Release notes

Sourced from openssl's releases.

openssl-v0.10.79

What's Changed

• Bump actions/cache from 5.0.4 to 5.0.5 by @​dependabot[bot] in rust-openssl/rust-openssl#2610
• Try to fix OpenSSL 1.1.0l download by @​botovq in rust-openssl/rust-openssl#2614
• Require &mut BigNumContextRef for EcPointRef mul/invert by @​alex in rust-openssl/rust-openssl#2615
• Fix UB in EcGroupRef::generator on groups without a generator by @​alex in rust-openssl/rust-openssl#2617
• Replace use libc::*; with targeted imports in openssl-sys by @​alex in rust-openssl/rust-openssl#2618
• Add PKeyRef::is_a and KeyType for name-based key identification by @​reaperhulk in rust-openssl/rust-openssl#2619
• Add PKey::{public,private}_key_from_raw_bytes_ex by @​reaperhulk in rust-openssl/rust-openssl#2620
• Bump MSRV to 1.80 by @​reaperhulk in rust-openssl/rust-openssl#2622
• Drop once_cell in favor of std::sync::{LazyLock, OnceLock} by @​reaperhulk in rust-openssl/rust-openssl#2623
• Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import by @​reaperhulk in rust-openssl/rust-openssl#2621
• parallelize more builds in CI for cold caches by @​reaperhulk in rust-openssl/rust-openssl#2625
• Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction by @​reaperhulk in rust-openssl/rust-openssl#2626
• Fix process abort when verify/PSK callbacks fire after SSL_CTX swap by @​alex in rust-openssl/rust-openssl#2624
• Bind OSSL_PARAM_modified and use it for seed_into by @​reaperhulk in rust-openssl/rust-openssl#2628
• Add PkeyCtxRef::set_context_string for ML-DSA by @​reaperhulk in rust-openssl/rust-openssl#2629
• Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders by @​alex in rust-openssl/rust-openssl#2631
• Fix output buffer overflow for AES key-wrap-with-padding ciphers by @​alex in rust-openssl/rust-openssl#2630
• Release openssl 0.10.79 and openssl-sys 0.9.115 by @​reaperhulk in rust-openssl/rust-openssl#2632

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

Commits

• 649f2d9 Release openssl 0.10.79 and openssl-sys 0.9.115 (#2632)
• 257f9b2 Fix output buffer overflow for AES key-wrap-with-padding ciphers (#2630)
• d43e917 Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders (#2631)
• f46519c Add PkeyCtxRef::set_context_string for ML-DSA (#2629)
• ad9ae31 Bind OSSL_PARAM_modified and use it for seed_into (#2628)
• 4e25c9b Fix process abort when verify/PSK callbacks fire after SSL_CTX swap (#2624)
• 3dd8f42 Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction (#2626)
• 2c5e5a8 parallelize more builds in CI for cold caches (#2625)
• 6685591 Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import (#2621)
• 8f8fdce Drop once_cell in favor of std::sync::{LazyLock, OnceLock} (#2623)
• Additional commits viewable in compare view

Updates hickory-proto from 0.24.4 to 0.26.1

Release notes

Sourced from hickory-proto's releases.

v0.26.1

This point release for the 0.26 release series brings in several bug fixes, and no user-facing changes. Two security reports are addressed: RUSTSEC-2026-0120 and RUSTSEC-2026-0119.

What's Changed

• net: avoid infinite loop in NSEC3 processing by @​djc in hickory-dns/hickory-dns#3597
• Limit work expended on name compression (backport) by @​divergentdave in hickory-dns/hickory-dns#3615

Full Changelog: hickory-dns/hickory-dns@v0.26.0...v0.26.1

0.26.0

13 months after the release of 0.25.0, we finally have a bigger feature release of Hickory DNS, the suite of DNS libraries and authoritative/recursive name servers written in pure Rust. A lot of work has gone into this release, so we wanted to take a moment to release this before we continue work on deploying the Hickory DNS recursive resolver at Let's Encrypt (and did you see that Hickory is being used in some of Google's Pixel devices?). Because of the ongoing work, we expect that 0.27.0 might happen quite a bit sooner than in 13 months from now.

These release notes describe a number of high-level improvements as well as API changes that are likely to break a larger fraction of our downstream users. Feedback (both on these notes and the release itself) is always welcome in our issue tracker or via our Discord server.

Most of the following notes are broken up by specific components: the server binary and our library crates. However, for this release we've made several changes to the structure of our crates itself:

• Network protocol support has moved out of the hickory-proto crate, into a new hickory-net crate (#3394); this allows the hickory-proto crate to cleanly focus on message encoding and decoding.
• The hickory-client crate has been subsumed into hickory-net, in the client module (#3366). No future releases of the hickory-client crate are expected.
• The hickory-recursor crate has been merged into hickory-resolver (#3370), guarded by a recursor feature which must be enabled explicitly. The recursor implementation was already tightly coupled to the resolver internals, so keeping it separate didn't really make sense.

Additionally, substantial cross-crate changes have been made to improve our error handling:

• More error handling simplification
• proto: split NetError out of ProtoError
• proto: clean up ProtoError
• Be more strict about decode errors
• resolver: remove unnecessary ResolveError wrapper
• Avoid large errors

hickory-dns (the server binary)

• We've added a number of ways to optimize performance via low-level networking configuration:
  • Use SO_REUSEADDR for tcp sockets
  • Allow configuring UDP socket buffer sizes
  • Add SO_REUSEPORT support with configurable UDP socket count
  • More TCP tuning options
• We further extended and reworked our metrics:
  • Additional recursive resolver metrics
  • Minor metrics tidying
  • Initial histogram metrics support
• Miscellaneous changes:
  • Implement RFC 5001 NSID for authoritative server
  • Add server SSLKEYLOGFILE support
  • Add systemd readiness + watchdog support
  • prometheus: enable gzip compression on metrics endpoint
  • Add support for jemalloc + profiling

hickory-server (the library API)

... (truncated)

Commits

• f093210 Limit number of names that may be compressed
• a9b884b Skip search when name compression is disabled
• 6e70e93 Limit number of name pointers stored in BinEncoder
• c2bdb8c Add benchmark for encoding message with many names
• 9e0b528 Bump version to 0.26.1
• 14cc3c8 net: respect caller timeout for DoT TCP connect
• fc2e3f4 resolver: release connections lock before TCP/TLS handshake
• bbdfcd2 Add tests combining NSEC and NSEC3 via CNAME chain
• 994076b Update rustls-webpki to 0.103.13
• 3b265fb net: check query name is in zone when building encloser candidates
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.