Skip to content

Bump the cargo group across 1 directory with 19 updates - #13

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-97e06d23ad
Closed

Bump the cargo group across 1 directory with 19 updates#13
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/cargo-97e06d23ad

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the cargo group with 17 updates in the / directory:

Package From To
slatedb 0.15.0 0.16.0
russh 0.62.6 0.63.1
gix-odb 0.83.0 0.84.0
gix-pack 0.73.0 0.74.2
gix-object 0.63.0 0.64.1
gix-traverse 0.60.0 0.61.0
gix-actor 0.41.2 0.42.0
flate2 1.1.9 1.1.10
rand 0.8.7 0.10.2
base64 0.22.1 0.23.1
sha2 0.10.9 0.11.0
imara-diff 0.1.8 0.2.0
redis 0.27.6 1.6.0
mongodb 3.8.0 3.8.2
tower-http 0.6.11 0.7.1
slatedb-common 0.15.0 0.16.0
tokio-tungstenite 0.29.0 0.30.0

Updates slatedb from 0.15.0 to 0.16.0

Release notes

Sourced from slatedb's releases.

v0.16.0

What's Changed

... (truncated)

Commits

Updates russh from 0.62.6 to 0.63.1

Release notes

Sourced from russh's releases.

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

    • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

    • Adds a Config::certificates that functions similarly to Config::keys

Fixes

  • f2354c7: improve strict kex checks (Eugene)
  • 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
  • 46c927a: use constant-time comparison for agent unlock (Eugene)
  • 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0-beta.1

v0.62.7

Features

Fixes

  • don't truncate decompressed packets that expand more than 2x (#750) #750 (Luiz Ribeiro)
  • c9da80c: Pageant WM_COPYDATA protocol fix & token tightening (#624) (vzex) #624
  • fall back to GetUserNameA when GetUserNameExA fails (#726) #726 (cwatanab)
Commits

Updates gix-odb from 0.83.0 to 0.84.0

Release notes

Sourced from gix-odb's releases.

gix-odb v0.84.0

Refactor (BREAKING)

  • add object_hash to gix-odb::Store::at_opts() and remove it from options This aligns at and at_opts, putting mandatory information as separate parameters.

New Features (BREAKING)

  • require object_hash in Store::at Split Store::at_opts for callers that want to pass Options.
  • (re-)introduce at(path, hash_kind) This way, a hash must be chosen, so that SHA-1 isn't hardcoded anymore.

Changed (BREAKING)

  • fall back to the raw text when unquoting fails. Both callers of gix_quote::ansi_c::undo() turned a failure into an error of their own, while Git keeps the raw, still-quoted token as the value:

    • parse_attr_line() in attr.c falls through to its unquoted branch
    • Git's alternates parsing in odb.c spells the unterminated case out in a comment of its own

    For attributes this also covers invalid escapes, which were previously a hard error for the whole line. Git keeps "\!x" as the pattern, where the backslash goes on to escape the ! for the matcher rather than negating the pattern.

    Both fall back before checking for the [attr] macro prefix, as Git does, so a line like "[attr]x stays a pattern on either side.

    The Unquote variants are unreachable now and have been removed.

Test

  • use gix_testtools::object_hash in a few tests

  • explicitly pass Sha1 for static fixtures

  • exercise alternates parsing without touching the filesystem. The previous test reached content() through alternate::resolve(), which meant creating a directory whose name begins with the quote that is never closed. That is not a legal filename on Windows, where it failed with InvalidFilename.

    Calling content() directly tests the same parsing without a filesystem, and adds a companion case showing that intact quoting still decodes its escapes.

New Features

  • expose alternate-file parsing via alternate::parse() This is mostly for completeness and more low-level access.

Bug Fixes

... (truncated)

Commits
  • 0c541c7 Release gix-note v0.1.0, gix-pack v0.74.0, gix-odb v0.84.0, gix-refspec v0.45...
  • 94aa28e Make gix-note compile on docs.rs
  • d2af4ed Release gix-error v0.3.0, gix-date v0.16.0, gix-actor v0.42.0, gix-validate v...
  • ebe9095 update manifests prior to release
  • 68c263b report proofing
  • 0d8bd1d Report August 2026
  • 7424676 Merge pull request #2930 from GitoxideLabs/gix-notes
  • 5c8d935 thanks clippy
  • d934f5b feat: expose git notes in gix::Repository
  • dc556e4 feat(gix-glob): add Pattern::has_wildcard()
  • Additional commits viewable in compare view

Updates gix-pack from 0.73.0 to 0.74.2

Release notes

Sourced from gix-pack's releases.

gix-pack v0.74.2

Bug Fixes

  • retain additions from all merge parents

    TreeAdditionsComparedToAncestor cleared its collected changes before every parent diff. For merge commits, objects added relative to an earlier parent were marked seen and then discarded, producing incomplete packs.

    Add a regression graph whose merge tree matches its second parent and verify that the blob found only against the first parent is counted. Clear the delegate once before the parent loop so each parent’s additions accumulate.

    Expose a read-only gix_pack::testing::Memory adapter for loose in-memory objects. Use it with gix_odb::memory::Proxy in the regression and deduplicate the equivalent benchmark adapter.

    Git baseline: 15c6308cf7ad276b306aa5b3ababfbdebfb1a917; list-objects.c:add_edge_parents accounts for every merge parent tree during object traversal.

Commit Statistics

  • 3 commits contributed to the release over the course of 1 calendar day.
  • 1 day passed between releases.
  • 1 commit was understood as conventional.
  • 1 unique issue was worked on: #2935

Commit Details

  • #2935
    • Retain additions from all merge parents (4009a9a)
  • Uncategorized
    • Merge pull request #2936 from GitoxideLabs/fixup-pack-creation (4fa211d)
    • Merge pull request #2932 from GitoxideLabs/fundamental-types-comp (6704303)

gix-pack v0.74.1

Commit Statistics

  • 2 commits contributed to the release.
  • 1 day passed between releases.
  • 0 commits were understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

... (truncated)

Commits
  • 3ebca8b Release gix-packetline v0.22.2, gix-worktree-stream v0.36.1, gix-archive v0.3...
  • 209fb85 feat(gix-macros): replace the withdrawn bisync dependency (#2939)
  • 2825d97 Merge pull request #2937 from SebTardif/fix/conflict-skip-consecutive-path
  • 6be36bc review
  • 4fa211d Merge pull request #2936 from GitoxideLabs/fixup-pack-creation
  • 251e0f5 fix: skip only consecutive same-path conflict stages
  • 4009a9a fix(gix-pack): retain additions from all merge parents (#2935)
  • 0f837c0 Merge pull request #2931 from cruessler/make-slider-test-more-granular
  • 169ae96 review
  • 7192d9a add optional detailed report to slider test
  • Additional commits viewable in compare view

Updates gix-object from 0.63.0 to 0.64.1

Release notes

Sourced from gix-object's releases.

gix-object v0.64.1

Commit Statistics

  • 2 commits contributed to the release.
  • 1 day passed between releases.
  • 0 commits were understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

  • Uncategorized
    • Use fundamental-type comparisons throughout tests (47536a5)
    • Merge pull request #2933 from GitoxideLabs/report-august (b8914ff)

gix-object v0.64.0

New Features (BREAKING)

  • support signing and verifying annotated tags Breaking as it renames Tag::pgp_signature to signature.

    Extend gix-object signature support from commits to annotated tags.

    Signature infrastructure

    • Move object-independent signing and verification machinery into the shared gix_object::signature module.
    • Keep signature discovery available without the signature feature.
    • Continue using the existing signing and verification options and shared verification outcome for all object types.

    Annotated tags

    • Add Tag::sign() and TagRef::sign().
    • Add signature accessors that report both the armor and detected format.
    • Add raw extraction of a tag signature and its exact signed bytes.
    • Recognize OpenPGP signature/message, X.509, and SSH armor markers.
    • Match Git by selecting the last recognized marker at a line boundary.
    • Support native SHA-1 and SHA-256 tags without compatibility headers or multiple signatures.

New Features

  • add explicit commit signing to gix-object

... (truncated)

Commits
  • e52fe9d Release gix-error v0.3.1, gix-hash v0.26.2, gix-object v0.64.1, gix-ref v0.67...
  • 900a0f6 feat(gix): improve remote-name comparison and resolution
  • 47536a5 Use fundamental-type comparisons throughout tests
  • 23bd32d feat(gix): compare attached Ids and References with text
  • 72e8fd1 feat(gix-ref): compare names and references with natural counterparts
  • 75ad70c feat(gix-hash): compare hash types with text
  • 6b8edbb feat(gix-error): add BoxedResultExt for boxed errors
  • b8914ff Merge pull request #2933 from GitoxideLabs/report-august
  • 0c541c7 Release gix-note v0.1.0, gix-pack v0.74.0, gix-odb v0.84.0, gix-refspec v0.45...
  • 94aa28e Make gix-note compile on docs.rs
  • Additional commits viewable in compare view

Updates gix-hash from 0.26.0 to 0.26.2

Release notes

Sourced from gix-hash's releases.

gix-hash v0.26.2

New Features

  • compare hash types with text

    Allow ObjectId, oid, ChangeId, Prefix, HexDisplay, and ReverseHexDisplay to compare with str and String values without allocating, reusing the existing stack encoders and Kind::hex_buf().

    Make full object and change ID comparisons symmetric but intentionally less lenient than parsing: only their exact canonical lowercase spelling compares equal. Uppercase input remains parseable, but treating differently-cased strings as equal through the same hash would violate PartialEq transitivity even though the strings differ from each other.

    Keep Prefix and truncated display comparisons directional, with the hash value on the left, because their text omits the hash kind or remaining digest and therefore cannot uniquely identify the structural value. This prevents distinct hashes from forming non-transitive equality chains through a shared textual prefix.

Commit Statistics

  • 2 commits contributed to the release.
  • 1 day passed between releases.
  • 1 commit was understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

  • Uncategorized
    • Compare hash types with text (75ad70c)
    • Merge pull request #2933 from GitoxideLabs/report-august (b8914ff)

gix-hash v0.26.1

New Features

  • add allocation-free prefix hex utilities

    ObjectId consumers such as notes fanout need to work with byte-aligned portions of an ID and emit their hexadecimal form without allocating intermediate strings.

    Add oid::to_prefix() for standalone byte ranges and Prefix output APIs for display, caller-provided buffers, and writers. Decode even and odd hexadecimal

... (truncated)

Changelog

Sourced from gix-hash's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

  • add configurable terminal screen modes.

  • hide revision ancestry in tix

  • add tix to the gix CLI

  • add explicit gix config show subcommand.

  • add gix config list for showing the git-configuration files.

  • add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

  • add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

  • add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

    The command can also write the advertised refs into a standalone ref store:

    gix free remote refs --refs-directory out-refs <url>

Bug Fixes

  • preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

    Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits
  • e52fe9d Release gix-error v0.3.1, gix-hash v0.26.2, gix-object v0.64.1, gix-ref v0.67...
  • 900a0f6 feat(gix): improve remote-name comparison and resolution
  • 47536a5 Use fundamental-type comparisons throughout tests
  • 23bd32d feat(gix): compare attached Ids and References with text
  • 72e8fd1 feat(gix-ref): compare names and references with natural counterparts
  • 75ad70c feat(gix-hash): compare hash types with text
  • 6b8edbb feat(gix-error): add BoxedResultExt for boxed errors
  • b8914ff Merge pull request #2933 from GitoxideLabs/report-august
  • 0c541c7 Release gix-note v0.1.0, gix-pack v0.74.0, gix-odb v0.84.0, gix-refspec v0.45...
  • 94aa28e Make gix-note compile on docs.rs
  • Additional commits viewable in compare view

Updates gix-traverse from 0.60.0 to 0.61.0

Release notes

Sourced from gix-traverse's releases.

gix-traverse v0.61.0

Bug Fixes

  • ignore duplicate topo traversal tips

    Repeated starting commits were inserted into the topological queue more than once, which could duplicate the tip and truncate walks depending on sorting. The regression compares one tip with the same tip supplied twice for both topological and date ordering, with and without a commit graph.

    Ignore repeated tips at the builder boundary while preserving their first-seen order. This matches Git's duplicated-head behavior covered by t/t6003-rev-list-topo-order.sh.

New Features (BREAKING)

  • add commit::Info::generation That way it's evident if a commit-graph was present for this node. Breaking, as it adds a new public field to a structure.

Commit Statistics

  • 10 commits contributed to the release over the course of 30 calendar days.
  • 30 days passed between releases.
  • 2 commits were understood as conventional.
  • 1 unique issue was worked on: #2902

Commit Details

  • #2902
    • Ignore duplicate topo traversal tips (75f1a01)
  • Uncategorized
    • Update manifests prior to release (ebe9095)
    • Merge pull request #2905 from GitoxideLabs/various-improvements (f3bbfad)
    • Adapt to changes in gix-testtools (0cbe539)
    • Merge pull request #2901 from cruessler/switch-to-gix-odb-at-opts (2a4d996)
    • Introduce Store::at() where possible (17fea2a)
    • Merge pull request #2903 from GitoxideLabs/traverse-dupl-tip (70e98a0)
    • Merge pull request #2839 from GitoxideLabs/tix-improvements (4b3bf5a)
    • Add commit::Info::generation (e768682)
    • Merge pull request #2812 from GitoxideLabs/report-july (ae8845a)
Commits
  • d2af4ed Release gix-error v0.3.0, gix-date v0.16.0, gix-actor v0.42.0, gix-validate v...
  • ebe9095 update manifests prior to release
  • 68c263b report proofing
  • 0d8bd1d Report August 2026
  • 7424676 Merge pull request #2930 from GitoxideLabs/gix-notes
  • 5c8d935 thanks clippy
  • d934f5b feat: expose git notes in gix::Repository
  • dc556e4 feat(gix-glob): add Pattern::has_wildcard()
  • d21b52a feat: support note mutation in gix-note
  • 7f7367c feat(gix-hash): add allocation-free prefix hex utilities
  • Additional commits viewable in compare view

Updates gix-features from 0.49.0 to 0.49.1

Release notes

Sourced from gix-features's releases.

gix-features v0.49.1

Bug Fixes

  • don't append a whole periodic() interval to every in_parallel_with_slice call The interrupt-watching thread sleeps out its whole interval, and stop_everything is only set at the end of the enclosing std::thread::scope, after every worker has been joined. The watcher lives in that same scope, so the sleep is appended to the call rather than overlapped with it: the function cannot return in less than one interval however little work it was given, and all of that interval is dead time.

    gix-pack's delta traversal asks for 50 ms and Tree::traverse is unconditional in write_data_iter_to_stream, so every index-pack pays it. An 8-object 490-byte pack — a five-file commit — measured 50.22 ms as the minimum of 101 calls, for 3 ms of process CPU, with no sample of a hundred below 45 ms. strace -e trace=clock_nanosleep shows exactly one 50 ms sleep per call.

    Park instead of sleeping, and unpark once there is nothing left to watch. The inner loop re-parks for the remaining time so a spurious wake-up cannot shorten the interval a caller asked for, and no mutex is needed because an unpark that arrives before the park_timeout is remembered by the park token. The three exits of the join loop — normal, consumer error, worker panic — all unpark, so a failure is not held open for an interval either.

Commit Statistics

  • 5 commits contributed to the release over the course of 30 calendar days.
  • 30 days passed between releases.
  • 1 commit was understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

  • Uncategorized
    • Update manifests prior to release (ebe9095)
    • Merge pull request #2877 from Ignalina/fix/in-parallel-with-slice-watcher-sleep (c08cdc8)
    • Review (9fe5c02)
    • Don't append a whole periodic() interval to every in_parallel_with_slice call (5f882bc)
    • Merge pull request #2812 from GitoxideLabs/report-july (ae8845a)
Changelog

Sourced from gix-features's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

  • add configurable terminal screen modes.

  • hide revision ancestry in tix

  • add tix to the gix CLI

  • add explicit gix config show subcommand.

  • add gix config list for showing the git-configuration files.

  • add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

  • add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

  • add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

    The command can also write the advertised refs into a standalone ref store:

    gix free remote refs --refs-directory out-refs <url>

Bug Fixes

  • preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

    Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits
  • d2af4ed Release gix-error v0.3.0, gix-date v0.16.0, gix-actor v0.42.0, gix-validate v...
  • ebe9095 update manifests prior to release
  • 68c263b report proofing
  • 0d8bd1d Report August 2026
  • 7424676 Merge pull request #2930 from GitoxideLabs/gix-notes
  • 5c8d935 thanks clippy
  • d934f5b feat: expose git notes in gix::Repository
  • dc556e4 feat(gix-glob): add Pattern::has_wildcard()
  • d21b52a feat: support note mutation in gix-note
  • 7f7367c feat(gix-hash): add allocation-free prefix hex utilities
  • Additional commits viewable in compare view

Updates gix-actor from 0.41.2 to 0.42.0

Release notes

Sourced from gix-actor's releases.

gix-actor v0.42.0

Commit Statistics

  • 4 commits contributed to the release over the course of 30 calendar days.
  • 30 days passed between releases.
  • 0 commits were understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Commit Details

  • Uncategorized
    • Update manifests prior to release (ebe9095)
    • Merge pull request #2905 from GitoxideLabs/various-improvements (f3bbfad)
    • Adapt to changes in gix-testtools (0cbe539)
    • Merge pull request #2812 from GitoxideLabs/report-july (ae8845a)
Changelog

Sourced from gix-actor's changelog.

0.42.0 (2025-04-04)

New Features

  • add first 'debug' version of gix diff file

Commit Statistics

  • 14 commits contributed to the release.
  • 76 days passed between releases.
  • 2 commits were understood as conventional.
  • 0 issues like '(#ID)' were seen in commit messages

Thanks Clippy

Clippy helped 1 time to make code idiomatic.

Commit Details

  • Uncategorized
    • Merge pull request #1880 from cruessler/add-gix-diff-file (b10cc6f)
    • Apply suggestions from code review (1039ae9)
    • Use revspecs for revision and path (dd366a5)
    • Add first 'debug' version of gix diff file (dbb1532)
    • Merge pull request #1888 from cruessler/respect-diff-algorithm-in-blame (dce127e)
    • Adapt to changes in gix-blame (8a31d88)
    • Merge pull request #1859 from cruessler/add-failing-test-for-as-time (36a846f)
    • Merge pull request #1858 from cruessler/add-git-blame-since (7059609)
    • Add test for --since (330711d)
    • Adapt to changes in gix-blame (e7084d8)
    • Merge pull request #1861 from GitoxideLabs/revert-lazylock (6acca19)
    • Don't use LazyLock just yet. (147eb41)
    • Merge pull request #1854 from GitoxideLabs/montly-report (16a248b)
    • Thanks clippy (8e96ed3)

0.41.0 (2025-01-18)

New Features

... (truncated)

Commits
  • d2af4ed Release gix-error v0.3.0, gix-date v0.16.0, gix-actor v0.42.0, gix-validate v...
  • ebe9095 update manifests prior to release
  • 68c263b report proofing
  • 0d8bd1d Report August 2026
  • 7424676 Merge pull request #2930 from GitoxideLabs/gix-notes
  • 5c8d935 thanks clippy
  • d934f5b feat: expose git notes in gix::Repository
  • dc556e4 feat(gix-glob): add Pattern::has_wildcard()
  • d21b52a feat: support note mutation in gix-note
  • 7f7367c feat(gix-hash): add allocation-free prefix hex utilities
  • Additional commits viewable in compare view

Updates flate2 from 1.1.9 to 1.1.10

Release notes

Sourced from flate2's releases.

1.1.10

What's Changed

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 3, 2026
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-97e06d23ad branch 4 times, most recently from 7ebaed7 to f801eef Compare September 4, 2026 16:00
@dependabot
Bump the cargo group across 1 directory with 19 updates
8cea9d8 
Bumps the cargo group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [slatedb](https://github.com/slatedb/slatedb) | `0.15.0` | `0.16.0` |
| [russh](https://github.com/warp-tech/russh) | `0.62.6` | `0.63.1` |
| [gix-odb](https://github.com/GitoxideLabs/gitoxide) | `0.83.0` | `0.84.0` |
| [gix-pack](https://github.com/GitoxideLabs/gitoxide) | `0.73.0` | `0.74.2` |
| [gix-object](https://github.com/GitoxideLabs/gitoxide) | `0.63.0` | `0.64.1` |
| [gix-traverse](https://github.com/GitoxideLabs/gitoxide) | `0.60.0` | `0.61.0` |
| [gix-actor](https://github.com/GitoxideLabs/gitoxide) | `0.41.2` | `0.42.0` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` |
| [rand](https://github.com/rust-random/rand) | `0.8.7` | `0.10.2` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` |
| [imara-diff](https://github.com/pascalkuthe/imara-diff) | `0.1.8` | `0.2.0` |
| [redis](https://github.com/redis-rs/redis-rs) | `0.27.6` | `1.6.0` |
| [mongodb](https://github.com/mongodb/mongo-rust-driver) | `3.8.0` | `3.8.2` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.6.11` | `0.7.1` |
| [slatedb-common](https://github.com/slatedb/slatedb) | `0.15.0` | `0.16.0` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.29.0` | `0.30.0` |



Updates `slatedb` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/slatedb/slatedb/releases)
- [Changelog](https://github.com/slatedb/slatedb/blob/main/RELEASE.md)
- [Commits](slatedb/slatedb@v0.15.0...v0.16.0)

Updates `russh` from 0.62.6 to 0.63.1
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.62.6...v0.63.1)

Updates `gix-odb` from 0.83.0 to 0.84.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-odb-v0.83.0...gix-odb-v0.84.0)

Updates `gix-pack` from 0.73.0 to 0.74.2
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-pack-v0.73.0...gix-pack-v0.74.2)

Updates `gix-object` from 0.63.0 to 0.64.1
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-object-v0.63.0...gix-object-v0.64.1)

Updates `gix-hash` from 0.26.0 to 0.26.2
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-hash-v0.26.0...gix-hash-v0.26.2)

Updates `gix-traverse` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-traverse-v0.60.0...gix-traverse-v0.61.0)

Updates `gix-features` from 0.49.0 to 0.49.1
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-features-v0.49.0...gix-features-v0.49.1)

Updates `gix-actor` from 0.41.2 to 0.42.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-actor-v0.41.2...gix-actor-v0.42.0)

Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.9...1.1.10)

Updates `rand` from 0.8.7 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.7...0.10.2)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `sha2` from 0.10.9 to 0.11.0
- [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0)

Updates `imara-diff` from 0.1.8 to 0.2.0
- [Release notes](https://github.com/pascalkuthe/imara-diff/releases)
- [Changelog](https://github.com/pascalkuthe/imara-diff/blob/master/CHANGELOG.md)
- [Commits](pascalkuthe/imara-diff@v0.1.8...v0.2.0)

Updates `redis` from 0.27.6 to 1.6.0
- [Release notes](https://github.com/redis-rs/redis-rs/releases)
- [Commits](redis-rs/redis-rs@redis-0.27.6...redis-1.6.0)

Updates `mongodb` from 3.8.0 to 3.8.2
- [Release notes](https://github.com/mongodb/mongo-rust-driver/releases)
- [Commits](mongodb/mongo-rust-driver@v3.8.0...v3.8.2)

Updates `tower-http` from 0.6.11 to 0.7.1
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.6.11...tower-http-0.7.1)

Updates `slatedb-common` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/slatedb/slatedb/releases)
- [Changelog](https://github.com/slatedb/slatedb/blob/main/RELEASE.md)
- [Commits](slatedb/slatedb@v0.15.0...v0.16.0)

Updates `tokio-tungstenite` from 0.29.0 to 0.30.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.29.0...v0.30.0)

---
updated-dependencies:
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: gix-actor
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: gix-features
  dependency-version: 0.49.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: gix-hash
  dependency-version: 0.26.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: gix-object
  dependency-version: 0.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: gix-odb
  dependency-version: 0.84.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: gix-pack
  dependency-version: 0.74.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: gix-traverse
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: imara-diff
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: mongodb
  dependency-version: 3.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: redis
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cargo
- dependency-name: russh
  dependency-version: 0.63.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: slatedb
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: slatedb-common
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tokio-tungstenite
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: tower-http
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/cargo-97e06d23ad branch from f801eef to 8cea9d8 Compare September 4, 2026 20:15
@dependabot @github

dependabot Bot commented on behalf of github Sep 5, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 5, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-97e06d23ad branch September 5, 2026 06:24
karthik1729 added a commit that referenced this pull request Sep 12, 2026
@karthik1729
Web: one markdown pipeline, a metrics gate that needs an address, and…
650db5d 
… docs read once per render

Batch 7.1 of the 2026-09-12 review (#13, #77-#79, #99-#102, quota-bar, markdown
stacks).

- `nav`, `page` and `searchIndex` are `cache()`d: one docs render called them
  from the layout, from `flat()`, from `searchIndex()` and from the route's own
  existence check, re-reading the same markdown dozens of times. The route's
  check goes with it -- a slug with no page behind it is `DocsPage`'s own fact --
  and `app/docs/error.tsx` keeps a throw inside the docs chrome.
- The docs link renderer escapes the `href` and `title` it writes into an
  attribute; a `"` in either closed it and the rest became markup.
- READMEs render through the docs' `marked` + shiki pipeline (`lib/readme.ts`)
  instead of react-markdown, so there is one parser, one sanitizing stance and
  one place escaping can be wrong. Raw HTML is dropped, every attribute is
  escaped, and only http/https/mailto/tel and relative URLs survive. A mermaid
  fence keeps its source and `MermaidBlocks` draws it, the `CopyButtons` shape.
- `/api/metrics` needed only a `Host` header ending in the container port, which
  the caller writes: the name must now be a private address literal, or
  `KLOUDLITE_METRICS_TOKEN` is set and a bearer token is the only way in.
- The CLI install line came from `centralSettings().cloneHost`, not from one
  deployment's hostname compiled into the component.
- `.catch` on the environments and volume-snapshot reads, `Promise.all` on the
  registries page's two independent reads, and the palette keys its repo list by
  owner so a team switch cannot list the previous team's repos.
- `QuotaBar` had no callers.
karthik1729 added a commit that referenced this pull request Sep 12, 2026
@karthik1729
Bound the directory, and stop trusting a person's argv
f1f4c7e 
Review findings #9, #10, #13, #14, #25, #26, #83-#89.

The mongo client had no timeout of any kind: connect, server selection
and every query now carry one, and `max_time` is a SERVER-side ceiling, so
a query the api walked away from stops rather than running on. Every
listing takes a limit. `credentials_for` gets the compound index its own
query shape needs — Cosmos will not combine three single-field ones — and
the fingerprint repair runs once per cluster behind a `meta` sentinel
rather than as an unindexed regex scan on every connect, forever.

`remove_superadmin` is a compare-and-swap: two concurrent removes each saw
two administrators and each deleted one, leaving a cluster nobody could
administer. The delete now counts what is left and puts the row back,
exactly as it was, if it emptied the roster. Both superadmin writes record
the audit row BEFORE the effect, and refuse when it cannot be written.

Argv and paths: `kl` takes `--` before a context or a source ref and
creates its buildx metadata file instead of naming a guessable one in
/tmp; `kl-connect` percent-encodes a target into the path, reads
`$HOSTNAME` instead of forking, and names `kl-connect` in the PATH note
it always got wrong. The gateway checks a workspace id is a DNS label
before it becomes part of a kube API URL and splits each tunnel frame out
of a `BytesMut` rather than allocating one. The worker's heartbeat goes
through `tokio::fs`, and `KLOUDLITE_MERGE_CACHE_BYTES` is a real variable
now rather than a constant that only looked like one.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants