Skip to content

chore(deps): bump the cargo group across 2 directories with 8 updates#136

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/codex-rs/cargo-07cd3be43b
Open

chore(deps): bump the cargo group across 2 directories with 8 updates#136
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/codex-rs/cargo-07cd3be43b

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 8, 2026

Bumps the cargo group with 7 updates in the /codex-rs directory:

Package From To
jsonwebtoken 9.3.1 10.3.0
rand 0.9.2 0.9.3
rmcp 0.15.0 1.4.0
actix-http 3.11.2 3.12.1
openssl 0.10.75 0.10.79
quinn-proto 0.11.13 0.11.14
rustls-webpki 0.103.10 0.103.13

Bumps the cargo group with 1 update in the /tools/argument-comment-lint directory: tar.

Updates jsonwebtoken from 9.3.1 to 10.3.0

Changelog

Sourced from jsonwebtoken's changelog.

10.3.0 (2026-01-27)

  • Export everything needed to define your own CryptoProvider
  • Fix type confusion with exp/nbf when not required

10.2.0 (2025-11-06)

  • Remove Clone bound from decode functions

10.1.0 (2025-10-18)

  • add dangerous::insecure_decode
  • Implement TryFrom &Jwk for DecodingKey

10.0.0 (2025-09-29)

  • BREAKING: now using traits for crypto backends, you have to choose between aws_lc_rs and rust_crypto
  • Add Clone bound to decode
  • Support decoding byte slices
  • Support JWS
Commits

Updates rand from 0.9.2 to 0.9.3

Changelog

Sourced from rand's changelog.

[0.9.3] — 2026-02-11

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1764)
  • Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

Commits

Updates rmcp from 0.15.0 to 1.4.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v1.4.0

Added

  • (macros) auto-generate get_info and default router (#785)

rmcp-v1.4.0

Added

  • add Default and constructors to ServerSseMessage (#794)
  • add meta to elicitation results (#792)
  • (macros) auto-generate get_info and default router (#785)
  • (transport) add which_command for cross-platform executable resolution (#774)
  • (auth) add StoredCredentials::new() constructor (#778)

Fixed

  • (server) remove initialized notification gate to support Streamable HTTP (#788)
  • default session keep_alive to 5 minutes (#780)
  • (http) add host check (#764)
  • exclude local feature from docs.rs build (#782)

Other

  • update Rust toolchain to 1.92 (#797)
  • unify IntoCallToolResult Result impls (#787)

rmcp-macros-v1.3.0

Added

  • add local feature for !Send tool handler support (#740)

Other

  • fix all clippy warnings across workspace (#746)

rmcp-v1.3.0

Added

  • (transport) add Unix domain socket client for streamable HTTP (#749)
  • (auth) implement SEP-2207 OIDC-flavored refresh token guidance (#676)
  • add configuration for transparent session re-init (#760)
  • add local feature for !Send tool handler support (#740)

Fixed

  • prevent CallToolResult and GetTaskPayloadResult from shadowing CustomResult in untagged enums (#771)
  • drain in-flight responses on stdin EOF (#759)
  • remove default type param from StreamableHttpService (#758)
  • use cfg-gated Send+Sync supertraits to avoid semver break (#757)
  • (rmcp) surface JSON-RPC error bodies on HTTP 4xx responses (#748)

... (truncated)

Commits
  • 4628720 chore: release v1.4.0 (#779)
  • 65d2b29 fix(server): remove initialized notification gate to support Streamable HTTP ...
  • a7b5700 fix: pass GIT_TOKEN to release-plz CLI (#798)
  • 8a8c036 chore: update Rust toolchain to 1.92 (#797)
  • 34d0bc6 fix: upgrade rustc in actions (#796)
  • 45a4cc5 feat: add Default and constructors to ServerSseMessage (#794)
  • 5f43283 feat: add meta to elicitation results (#792)
  • be321a4 feat(macros): auto-generate get_info and default router (#785)
  • 5891b45 refactor: unify IntoCallToolResult Result impls (#787)
  • d98248a ci: add --locked to release-plz install (#786)
  • Additional commits viewable in compare view

Updates actix-http from 3.11.2 to 3.12.1

Release notes

Sourced from actix-http's releases.

actix-http: v3.12.1

Notice: This release contains a security fix. Users are encouraged to update to this version ASAP.

  • SECURITY: Reject HTTP/1 requests with ambiguous request framing from Content-Length and Transfer-Encoding headers to prevent request smuggling.
  • Encode the HTTP/1 Connection: Upgrade header in Camel-Case when camel-case header formatting is enabled.#3953
  • Fix HeaderMap iterators' len() and size_hint() implementations for multi-value headers.
  • Update rand dependency to 0.10.
  • Update sha1 dependency to 0.11.

#3953: actix/actix-web#3953

actix-http: v3.12.0

  • Minimum supported Rust version (MSRV) is now 1.88.
  • Increase default HTTP/2 flow control window sizes. #3638
  • Expose configuration methods to improve upload throughput. #3638
  • Fix truncated body ending without error when connection closed abnormally. #3067
  • Add config/method for TCP_NODELAY. #3918
  • Do not compress 206 Partial Content responses. #3191
  • Fix lingering sockets and client stalls when responding early to dropped chunked request payloads. #2972

#3638: actix/actix-web#3638 #3067: actix/actix-web#3067 #3918: actix/actix-web#3918 #3191: actix/actix-web#3191 #2972: actix/actix-web#2972

Commits

Updates openssl from 0.10.75 to 0.10.79

Release notes

Sourced from openssl's releases.

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

openssl-v0.10.78

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.77...openssl-v0.10.78

openssl-v0.10.77

What's Changed

... (truncated)

Commits
  • 649f2d9 Release openssl 0.10.79 and openssl-sys 0.9.115 (#2632)
  • 257f9b2 Fix output buffer overflow for AES key-wrap-with-padding ciphers (#2630)
  • d43e917 Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders (#2631)
  • f46519c Add PkeyCtxRef::set_context_string for ML-DSA (#2629)
  • ad9ae31 Bind OSSL_PARAM_modified and use it for seed_into (#2628)
  • 4e25c9b Fix process abort when verify/PSK callbacks fire after SSL_CTX swap (#2624)
  • 3dd8f42 Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction (#2626)
  • 2c5e5a8 parallelize more builds in CI for cold caches (#2625)
  • 6685591 Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import (#2621)
  • 8f8fdce Drop once_cell in favor of std::sync::{LazyLock, OnceLock} (#2623)
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.14

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.14

@​jxs reported a denial of service issue in quinn-proto 5 days ago:

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

Commits
  • 2c315aa proto: bump version to 0.11.14
  • 8ad47f4 Use newer rustls-pki-types PEM parser API
  • c81c028 ci: fix workflow syntax
  • 0050172 ci: pin wasm-bindgen-cli version
  • 8a6f82c Take semver-compatible dependency updates
  • e52db4a Apply suggestions from clippy 1.91
  • 6df7275 chore: Fix unnecessary_unwrap clippy
  • c8eefa0 proto: avoid unwrapping varint decoding during parameters parsing
  • 9723a97 fuzz: add fuzzing target for parsing transport parameters
  • eaf0ef3 Fix over-permissive proto dependency edge (#2385)
  • Additional commits viewable in compare view

Updates rustls-webpki from 0.103.10 to 0.103.13

Release notes

Sourced from rustls-webpki's releases.

0.103.13

  • Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
  • For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

  • GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
  • GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

Commits
  • 2879b2c Prepare 0.103.13
  • 2c49773 Improve tests for padding of BitStringFlags
  • 4e3c0b3 Correct validation of BIT STRING constraints
  • 39c91d2 Actually fail closed for URI matching against excluded subtrees
  • 27131d4 Bump version to 0.103.12
  • 6ecb876 Clean up stuttery enum variant names
  • 318b3e6 Ignore wildcard labels when matching name constraints
  • 1219622 Rewrite constraint matching to avoid permissive catch-all branch
  • 57bc62c Bump version to 0.103.11
  • d0fa01e Allow parsing trust anchors with unknown criticial extensions
  • See full diff in compare view

Updates tar from 0.4.44 to 0.4.45

Commits
  • 096e3d1 Bump to 0.4.45 (#443)
  • 17b1fd8 archive: Prevent symlink-directory collision chmod attack (#442)
  • de1a587 archive: Unconditionally honor PAX size (#441)
  • 6071cbe ci: Consolidate workflows (#439)
  • ad1fde9 build-sys: Promote unused_code to an error
  • c8cb250 tests: Squash a warning
  • 638c495 ci: Add xtask infra + reverse dependency testing (#435)
  • 32a9bbb tests: Add RandomReader to exercise partial-read resilience (#436)
  • 9c5df0b Fix GNU long-name extension stream corruption on validation error (#434)
  • 88b1e3b Fix docs typo in header.rs (#431)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the cargo group across 2 directories with 8 updates
7dafe3c 
Bumps the cargo group with 7 updates in the /codex-rs directory:

| Package | From | To |
| --- | --- | --- |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `9.3.1` | `10.3.0` |
| [rand](https://github.com/rust-random/rand) | `0.9.2` | `0.9.3` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `0.15.0` | `1.4.0` |
| [actix-http](https://github.com/actix/actix-web) | `3.11.2` | `3.12.1` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.75` | `0.10.79` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.13` | `0.11.14` |
| [rustls-webpki](https://github.com/rustls/webpki) | `0.103.10` | `0.103.13` |

Bumps the cargo group with 1 update in the /tools/argument-comment-lint directory: [tar](https://github.com/alexcrichton/tar-rs).


Updates `jsonwebtoken` from 9.3.1 to 10.3.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v9.3.1...v10.3.0)

Updates `rand` from 0.9.2 to 0.9.3
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.9.3/CHANGELOG.md)
- [Commits](rust-random/rand@rand_core-0.9.2...0.9.3)

Updates `rmcp` from 0.15.0 to 1.4.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v0.15.0...rmcp-v1.4.0)

Updates `actix-http` from 3.11.2 to 3.12.1
- [Release notes](https://github.com/actix/actix-web/releases)
- [Changelog](https://github.com/actix/actix-web/blob/main/CHANGES.md)
- [Commits](actix/actix-web@http-v3.11.2...http-v3.12.1)

Updates `openssl` from 0.10.75 to 0.10.79
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.75...openssl-v0.10.79)

Updates `quinn-proto` from 0.11.13 to 0.11.14
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.13...quinn-proto-0.11.14)

Updates `rustls-webpki` from 0.103.10 to 0.103.13
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.10...v/0.103.13)

Updates `tar` from 0.4.44 to 0.4.45
- [Commits](composefs/tar-rs@0.4.44...0.4.45)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-version: 10.3.0
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.9.3
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: rmcp
  dependency-version: 1.4.0
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: actix-http
  dependency-version: 3.12.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-version: 0.10.79
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: quinn-proto
  dependency-version: 0.11.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rustls-webpki
  dependency-version: 0.103.13
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tar
  dependency-version: 0.4.45
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 8, 2026
@dependabot dependabot Bot requested a review from zapabob as a code owner May 8, 2026 11:08
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels May 8, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 8, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
codex Error Error May 8, 2026 11:08am

@dependabot dependabot Bot mentioned this pull request May 8, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@zapabob zapabob Awaiting requested review from zapabob zapabob is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants