Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the cargo group across 1 directory with 6 updates #1

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

Bump the cargo group across 1 directory with 6 updates #1

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Aug 22, 2024

Bumps the cargo group with 6 updates in the / directory:

Package From To
h2 0.3.20 0.3.26
mio 0.8.8 0.8.11
openssl 0.10.56 0.10.66
rustix 0.37.23 0.37.27
snow 0.9.2 0.9.6
webpki 0.22.0 0.22.4

Updates h2 from 0.3.20 to 0.3.26

Release notes

Sourced from h2's releases.

v0.3.26

What's Changed

  • Limit number of CONTINUATION frames for misbehaving connections.

See https://seanmonstar.com/blog/hyper-http2-continuation-flood/ for more info.

v0.3.25

What's Changed

Full Changelog: hyperium/h2@v0.3.24...v0.3.25

v0.3.24

Fixed

  • Limit error resets for misbehaving connections.

v0.3.23

What's Changed

v0.3.22

What's Changed

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

New Contributors

v0.3.21

What's Changed

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.

New Contributors

Changelog

Sourced from h2's changelog.

0.3.26 (April 3, 2024)

  • Limit number of CONTINUATION frames for misbehaving connections.

0.3.25 (March 15, 2024)

  • Improve performance decoding many headers.

0.3.24 (January 17, 2024)

  • Limit error resets for misbehaving connections.

0.3.23 (January 10, 2024)

  • Backport fix from 0.4.1 for stream capacity assignment.

0.3.22 (November 15, 2023)

  • Add header_table_size(usize) option to client and server builders.
  • Improve throughput when vectored IO is not available.
  • Update indexmap to 2.

0.3.21 (August 21, 2023)

  • Fix opening of new streams over peer's max concurrent limit.
  • Fix RecvStream to return data even if it has received a CANCEL stream error.
  • Update MSRV to 1.63.
Commits

Updates mio from 0.8.8 to 0.8.11

Changelog

Sourced from mio's changelog.

0.8.11

0.8.10

Added

0.8.9

Added

Fixed

Commits

Updates openssl from 0.10.56 to 0.10.66

Release notes

Sourced from openssl's releases.

openssl-v0.10.66

What's Changed

Full Changelog: sfackler/rust-openssl@openssl-v0.10.65...openssl-v0.10.66

openssl-v0.10.65

What's Changed

New Contributors

Full Changelog: sfackler/rust-openssl@openssl-v0.10.64...openssl-v0.10.65

openssl-v0.10.64

What's Changed

... (truncated)

Commits
  • ad70a0b Merge pull request #2267 from alex/bump-for-release
  • 5ce473b Release openssl v0.10.66
  • aef36e0 Merge pull request #2266 from alex/mem-bio-invariant
  • 142deef Fixed invariant violation in MemBio::get_buf with empty results
  • 32f150b Merge pull request #2265 from alex/bump-for-release
  • 98addd2 Release openssl v0.10.65 and openssl-sys v0.9.103
  • 7c7958d Merge pull request #2262 from alex/pkey-api
  • d7b12cc Switch Pkey::from_ to use set1 functions
  • 22ffa9a Merge pull request #2258 from sfackler/init-md
  • 9de3794 Initialize OpenSSL in MD constructors
  • Additional commits viewable in compare view

Updates rustix from 0.37.23 to 0.37.27

Commits

Updates snow from 0.9.2 to 0.9.6

Release notes

Sourced from snow's releases.

v0.9.6

  • Validate invalid PSK positions when building a Noise protocol.
  • Raise errors in various typos/mistakes in Noise patterns when parsing.
  • Deprecate the sodiumoxide backend, as that crate is no longer maintained. We may eventually migrate it to a maintaned version of the crate, but for now it's best to warn users.
  • Set a hard limit in read_message() in transport mode to 65535 to be fully compliant with the Noise specification.

Full Changelog: mcginty/snow@v0.9.5...v0.9.6

v0.9.5

This is a security release that fixes a logic flaw in decryption in TransportState (i.e. the stateful one), where the nonce could increase even when decryption failed, which can cause a desync between the sender and receiver, opening this up as a denial of service vector if the attacker has the ability to inject packets in the channel Noise is talking over.

More details can be found in the advisory: GHSA-7g9j-g5jg-3vv3

All users are encouraged to update.

v0.9.4

This is a dependency version bump release because a couple of important dependencies released new versions that needed a Cargo.toml bump:

  • ring 0.17
  • pqcrypto-kyber 0.8
  • aes-gcm 0.10
  • chacha20poly1305 0.10

v0.9.3

This is a quick patch release to use the stable 4.0 version of curve25519-dalek.

Commits
  • a4be73f meta: v0.9.6 release
  • 9e53dcf TransportState: limit read_message size to 65535
  • faf0560 Deprecate sodiumoxide resolver
  • 308a24d Add warnings about multiple calls to same method in Builder
  • f280991 Error when extraneous parameters are included in string to parse
  • dbdcc48 Error on duplicate modifiers in parameter string
  • 8b1a819 Validate PSK index in pattern to avoid panic
  • 74e30cf meta: v0.9.5 release
  • 12e8ae5 Stateful nonce desync fix
  • 02c26b7 Remove clap from simple example
  • Additional commits viewable in compare view

Updates webpki from 0.22.0 to 0.22.4

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the cargo group across 1 directory with 6 updates
9110289 
Bumps the cargo group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [h2](https://github.com/hyperium/h2) | `0.3.20` | `0.3.26` |
| [mio](https://github.com/tokio-rs/mio) | `0.8.8` | `0.8.11` |
| [openssl](https://github.com/sfackler/rust-openssl) | `0.10.56` | `0.10.66` |
| [rustix](https://github.com/bytecodealliance/rustix) | `0.37.23` | `0.37.27` |
| [snow](https://github.com/mcginty/snow) | `0.9.2` | `0.9.6` |
| [webpki](https://github.com/briansmith/webpki) | `0.22.0` | `0.22.4` |



Updates `h2` from 0.3.20 to 0.3.26
- [Release notes](https://github.com/hyperium/h2/releases)
- [Changelog](https://github.com/hyperium/h2/blob/v0.3.26/CHANGELOG.md)
- [Commits](hyperium/h2@v0.3.20...v0.3.26)

Updates `mio` from 0.8.8 to 0.8.11
- [Release notes](https://github.com/tokio-rs/mio/releases)
- [Changelog](https://github.com/tokio-rs/mio/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/mio@v0.8.8...v0.8.11)

Updates `openssl` from 0.10.56 to 0.10.66
- [Release notes](https://github.com/sfackler/rust-openssl/releases)
- [Commits](sfackler/rust-openssl@openssl-v0.10.56...openssl-v0.10.66)

Updates `rustix` from 0.37.23 to 0.37.27
- [Release notes](https://github.com/bytecodealliance/rustix/releases)
- [Commits](bytecodealliance/rustix@v0.37.23...v0.37.27)

Updates `snow` from 0.9.2 to 0.9.6
- [Release notes](https://github.com/mcginty/snow/releases)
- [Commits](mcginty/snow@v0.9.2...v0.9.6)

Updates `webpki` from 0.22.0 to 0.22.4
- [Commits](https://github.com/briansmith/webpki/commits)

---
updated-dependencies:
- dependency-name: h2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: mio
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: openssl
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rustix
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: snow
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: webpki
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Aug 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants