Bump the "infrastructure" group with 2 updates across multiple ecosystems by dependabot[bot] · Pull Request #211 · HydroRoll-Team/DropOut

dependabot · 2026-08-13T10:57:15Z

Bumps the infrastructure group with 8 updates:

Package	From	To
toml	`3.0.0`	`5.0.0`
@biomejs/biome	`2.4.9`	`2.5.7`
@j178/prek	`0.2.29`	`0.4.13`
@tauri-apps/cli	`2.9.6`	`2.11.4`
@types/node	`24.10.9`	`26.2.0`
js-yaml	`4.2.0`	`5.2.3`
tsx	`4.21.0`	`4.23.12`
wrangler	`4.111.0`	`4.120.0`

Updates toml from 3.0.0 to 5.0.0

Changelog

Sourced from toml's changelog.

5.0.0 - July 14 2026

Breaking: Integers outside JavaScript's safe range (beyond ±Number.MAX_SAFE_INTEGER) now throw a parse error instead of silently returning a rounded value (#28). Opt in to lossless handling of the full 64-bit range with toml.parse(input, { bigint: true }), which returns all integer values as BigInt.

Breaking: Integers outside TOML's 64-bit signed integer range now throw a parse error in either mode, as required by the spec. Previously they were silently rounded.

4.3.0 - July 13 2026

Add opt-in Temporal support via toml.parse(input, { useTemporal: true }), mapping offset date-times to Temporal.ZonedDateTime and local date-times/dates/times to Temporal.PlainDateTime/PlainDate/PlainTime. An implementation can be supplied via the temporal option on runtimes without a Temporal global. (#69)

4.2.0 - July 13 2026

Address security advisory GHSA-82x6-q7mm-w9cf (CVE pending), in which deeply nested arrays or inline tables could overflow the call stack and crash the process with an uncatchable RangeError. Nesting is now bounded (default 500 levels), and input past the limit throws a normal parse error. The limit is configurable via toml.parse(input, { maxDepth }).

4.1.2 - June 30 2026

Address CVE-2026-63376, in which a specially crafted TOML string could pollute Object.prototype process-wide.

4.1.1 - March 31 2026

Increase performance ~5x (#68)

4.1.0 - March 31 2026

Add spec v1.1.0 support (#67)

4.0.1 - March 31 2026

Minor packaging changes

4.0.0 - March 31 2026

Modernize tooling and support TOML v1.0.0 spec (#66)

2.3.0 - July 13 2015

Correctly handle quoted keys (#21)

2.2.3 - June 8 2015

... (truncated)

Commits

ccd8b10 5.0.0
00ac4a6 Update changelog
121e5fa Merge pull request #74 from BinaryMuse/mkt/big-ints
2b6bcb7 Add opt-in BigInt support, throw when parsing out of bounds values
38fb4e6 4.3.0
5222a64 feat: Add opt-in Temporal support for date/time values (#73)
95f79b3 4.2.0
b71c439 Merge pull request #72 from BinaryMuse/fix/nesting-depth-dos
a2d6dbb Update changelog
967b8b0 fix: bound nesting depth to prevent stack-overflow DoS
Additional commits viewable in compare view

Updates @biomejs/biome from 2.4.9 to 2.5.7

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes
#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.7

Patch Changes
#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;
schedule(async () => {}) ?? "fallback";
The following code is also now invalid, because map(() => 42) returns 42:
type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

191d051 ci: release (#11119)
9847e68 feat(lint): add noNonScalableViewport rule (#11168)
e63354c feat(lint): add noExtendNative nursery rule (#11136)
2fa0a62 docs: rework CLI (#11134)
e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
1139f1c ci: release (#11022)
781d68d feat(lint/js): add noRestrictedProperties (#9806)
412a0e9 ci: release (#10948)
b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
Additional commits viewable in compare view

Updates @j178/prek from 0.2.29 to 0.4.13

Release notes

Sourced from @j178/prek's releases.

0.4.13

Release Notes

Released on 2026-08-10.

Highlights

Manage hook tools with mise

The new language: mise support lets hooks install tools using mise in an isolated environment:
repos:
  - repo: local
    hooks:
      - id: golangci-lint
        name: golangci-lint
        language: mise
        additional_dependencies: ["aqua:golangci/golangci-lint@2"]
        entry: golangci-lint run --fast-only ./...
        pass_filenames: false
Run commands in hook environments

The new prek exec subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:
$ prek exec golangci-lint -- golangci-lint --version
Enhancements

Add mise language support (#2540)

Add deny-filename-pattern and require-filename-pattern hooks (#2488)

Add prek exec for running commands in a hook environment (#2478)

Add yaml-language-server: comment to YAML sample config (#2486)

Make prek cache size output terminal-aware (#2508)

Match file regexes against path bytes (#2541)

Show hook aliases in run output (#2497)

Show hook descriptions in run output (#2490)

Performance

Avoid env cache scans for skipped hooks (#2502)

Cache Node version queries (#2500)

... (truncated)

Changelog

Sourced from @j178/prek's changelog.

0.4.13

Released on 2026-08-10.

Highlights

Manage hook tools with mise

The new language: mise support lets hooks install tools using mise in an isolated environment:
repos:
  - repo: local
    hooks:
      - id: golangci-lint
        name: golangci-lint
        language: mise
        additional_dependencies: ["aqua:golangci/golangci-lint@2"]
        entry: golangci-lint run --fast-only ./...
        pass_filenames: false
Run commands in hook environments

The new prek exec subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:
$ prek exec golangci-lint -- golangci-lint --version
Enhancements

Add mise language support (#2540)

Add deny-filename-pattern and require-filename-pattern hooks (#2488)

Add prek exec for running commands in a hook environment (#2478)

Add yaml-language-server: comment to YAML sample config (#2486)

Make prek cache size output terminal-aware (#2508)

Match file regexes against path bytes (#2541)

Show hook aliases in run output (#2497)

Show hook descriptions in run output (#2490)

Performance

Avoid env cache scans for skipped hooks (#2502)

Cache Node version queries (#2500)

Bug fixes

... (truncated)

Commits

6204a68 Bump version to 0.4.13 (#2543)
f1c73c5 Add mise language support (#2540)
3f08ed4 Match file regexes against path bytes (#2541)
6bc5f06 Update Rust crate serde-saphyr to v1 (#2539)
b8c5c69 Update Rust crate fancy-regex to 0.19.0 (#2537)
2557af9 Update prek hooks (#2528)
a958731 Update Rust crate http to v1.5.0 (#2538)
fc8b9a4 Update Rust crate clap to v4.6.5 (#2531)
3bacaa1 Update dependency uv to v0.12.1 (#2536)
222fc00 Update Rust crate toml to v1.1.4 (#2535)
Additional commits viewable in compare view

Updates @tauri-apps/cli from 2.9.6 to 2.11.4

Release notes

Sourced from @tauri-apps/cli's releases.

@tauri-apps/cli v2.11.4

[2.11.4]

Bug Fixes

67ffa192a (#15596 by @FabianLars) Fixed an issue in the AppImage bundler that caused the /.desktop and .DirIcon files to be absolute symlinks instead of relative symlinks which caused problems with AppImage installers like AppManager.

Dependencies

Upgraded to tauri-cli@2.11.4

@tauri-apps/cli v2.11.3

[2.11.3]

Bug Fixes

50b0237ed (#15549 by @Legend-Master) Escape special characters in productName when generating Android strings.xml

728c8d4a5 (#15473 by @Legend-Master) Skip building bundles when using tauri android run

be0cb0d43 (#15344 by @raglady) Fix NDK_HOME environment variable not honored when set

ed8fd411f (#15552 by @Legend-Master) Make ureq_proto show trace level logs only on -vvv instead of -vv

fca4a31f9 (#15454 by @fallintoplace) Fix tauri migrate generating invalid namespace imports for aliased pluginified imports from @tauri-apps/api.

Inputs like import { cli as superCli } from "@tauri-apps/api" now migrate to import * as superCli from "@tauri-apps/plugin-cli" instead of producing invalid ESM syntax. The migration tests also reparse migrated JS, Svelte, and Vue output so syntax regressions are caught directly.

Dependencies

Upgraded to tauri-cli@2.11.3

@tauri-apps/cli v2.11.2

[2.11.2]

Dependencies

Upgraded to tauri-cli@2.11.2

@tauri-apps/cli v2.11.1

[2.11.1]

Dependencies

Upgraded to tauri-cli@2.11.1

@tauri-apps/cli v2.11.0

[2.11.0]

New Features

926a57bb0 (#15201) Added uninstaller icon and uninstaller header image support for NSIS installer.

Notes:

... (truncated)

Commits

8909f22 apply version updates (#15598)
67ffa19 fix(bundler): make .desktop and .DirIcon relative symlinks (#15596)
c5c8b2b docs(readme): desktop platforms -> operating systems, closes #15589
80d437f fix(#15580): bump memmap2 (#15587)
469ecc8 test: regenerate stale macOS acl snapshot for has_app_acl (#15576)
5be0cb8 fix(ci): change strip to debuginfo for cloudflare worker (#15574)
4bbd497 chore(deps): bump cloudflare worker versions (#15573)
5712549 chore(deps): update dependency rollup to v4.62.0 (#15551)
c8faedf ci: test on node 20,22 instead of node 18,20
3641e26 refactor: simplify menu code (#15559)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @tauri-apps/cli since your current version.

Updates @types/node from 24.10.9 to 26.2.0

Commits

See full diff in compare view

Updates js-yaml from 4.2.0 to 5.2.3

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

Prevent prototype fallback when resolving tags and mapping entries, #782.

Resolve !!timestamp years 0000-0099 correctly, #775.

Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.

Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

[5.2.2] - 2026-07-24

Fixed

Quote flow scalars where a colon precedes a flow indicator, #773.

Security

Avoid exponential parsing time for nested flow sequence pairs.

[5.2.1] - 2026-07-02

Fixed

Add Map support to !!omap (should work when realMapTag used)

Security

Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

... (truncated)

Commits

6740445 5.2.3 released
94e766d Update changelog
c3bd7ca Polish previous commit, #780
00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
49280f3 Fix !!timestamp resolution for years 0000-0099, #775
355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
d524f83 docs: add contributing guidelines
3c29559 5.2.2 released
3e5240f parser: avoid reparsing flow sequence pair keys
Additional commits viewable in compare view

Updates tsx from 4.21.0 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

npm package (@latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

preserve async ESM require fallback (55cbece)

This release is also available on:

npm package (@latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

support nyc coverage discovery (#710) (ec1bcd5)

This release is also available on:

npm package (@latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

map Node test locations (2f55884)

support data URLs in tsImport (b94f46f)

This release is also available on:

npm package (@latest dist-tag)

v4.23.8

... (truncated)

Commits

ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
651f5be test: cover CommonJS TypeScript import.meta paths
bd3bc64 test: cover CommonJS loader source fallback
55cbece fix: preserve async ESM require fallback
6c5ba85 docs: document CommonJS default interop
ec1bcd5 fix: support nyc coverage discovery (#710)
b6e5b48 docs: clarify CommonJS default imports
2f55884 fix: map Node test locations
de935d5 docs: document Node source-map stack formatting
b94f46f fix: support data URLs in tsImport
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.

Updates wrangler from 4.111.0 to 4.120.0

Release notes

Sourced from wrangler's releases.

wrangler@4.120.0

Minor Changes

#15008 35c87e9 Thanks @skepticfx! - Adds the ability to find container instances by exact ID or name

wrangler containers instances <application_id> --search <instance_id_or_name> now searches every page and returns exact matches in human-readable or JSON output. JSON returns a top-level array, including an empty array when there is no match, while human-readable output prints a no-match message. If multiple instances have the same exact name, every matching instance is returned.

#15008 35c87e9 Thanks @skepticfx! - Add explicit pagination to container instance JSON output

Use wrangler containers instances <application_id> --json --per-page <size> to return one page with machine-readable result_info, then pass its next_page_token to --page-token to retrieve the next page. Plain --json remains backward-compatible: it requests the complete list and returns the existing top-level array.

Patch Changes

#15013 8cf78c8 Thanks @dario-piotrowicz! - Update undici from 7.28.0 to 7.29.0

#15015 a60ff4d Thanks @nickpatt! - Cut the per-request cost of local observability capture

Every tail event was written to the trace store as its own Durable Object call, so a request paid two or three round-trips per span. On a module-heavy app under the Vite plugin that dominated dev request latency. Rows are now buffered and written in batches, taking a request from roughly thirty calls to three.

Work in progress still shows up as it happens: the root span is written immediately, console logs and exceptions as they arrive, and a span's completion is written on the next event once 100ms has passed. An invocation that goes completely quiet writes nothing further until it ends, since the flush is driven by tail events rather than a timer.

The Vite plugin's own router, asset and proxy workers are also no longer captured. Their traces were noise the Observability views already hid, and skipping them cuts the spans recorded per request — a side benefit being that a trace's root is now your Worker rather than __router-worker__.

Updated dependencies [b4f0c97, 8cf78c8, a60ff4d, 99eb50c]:

miniflare@5.20260801.1-alpha

wrangler@4.119.0

Minor Changes
#14952 20470fa Thanks @nelsonjsduarte! - Add --parse-type flag to wrangler ai-search create

wrangler ai-search create now accepts --parse-type to control how a website data source discovers URLs. sitemap (the default) reads XML sitemaps; discover follows links recursively.

Previously the parse type could only be chosen through the interactive wizard, which was skipped whenever --source was supplied — so it was impossible to create a discover instance from a script.
wrangler ai-search create my-instance \
  --type web-crawler \
  --source https://example.com \
  --parse-type discover
The interactive wizard now offers Discover alongside Sitemap. --parse-type is only valid with --type web-crawler; passing it with --type builtin or --type r2 is rejected, since the API stores the value for those source types but never reads it. When the flag is omitted in non-interactive mode the field is left unset and the API default (sitemap) applies.
#14941 266172b Thanks @nickpatt! - Improve the Local Explorer's Observability views

console.log messages now render the way the console would (JSON-encoded strings are unwrapped and multi-argument logs are joined), traces and events can be looked up by trace or span id from the search bar, and an event's "View trace" button jumps to the exact invocation that emitted it — even when a trace_id spans several invocations (e.g. a subrequest or self fetch).

#14064 a9e5abb Thanks @petebacondarwin! - Add support for OAuth 2.0 Device Authorization Grant to wrangler login

... (truncated)

Commits

b0aea76 Version Packages (#15036)
386ff6e [miniflare] Register workers in the dev registry by default (#15061)
35c87e9 CC-8338, CC-8340: Improve Wrangler container instance listings (#15008)
99eb50c [miniflare] Restrict dev registry registration to user workers (#15040)
2938c01 Version Packages (#15021)
b6a8629 Revert "Version Packages (#14977)" (#15033)
42c4227 Version Packages (#14977)
511635c [wrangler] Skip the CAA half of the unenv-preset testDns E2E (#15016)
ebd1dfd [vite-plugin] Surface Local Explorer API to headless agents, matching wrangle...
a9e5abb [wrangler] Add OAuth 2.0 Device Authorization Grant support (#14064)
Additional commits viewable in compare view

Updates the requirements on dirs, env_logger, reqwest, sha1, sha2, toml, ts-rs, zip, ctor and embed-resource to permit the latest version.
Updates dirs to 6.0.0

Commits

See full diff in compare view

Updates env_logger to 0.11.11

Release notes

Sourced from env_logger's releases.

v0.11.11

[0.11.11] - 2026-06-25

Internal

Updated env_filter

Changelog

Sourced from env_logger's changelog.

[0.11.11] - 2026-06-25

Internal

Updated env_filter

[0.11.10] - 2026-03-23

Internal

Update dependencies

[0.11.9] - 2026-02-11

[0.11.8] - 2025-04-01

Compatibility

(kv) Deprecate the unstable-kv feature which may be removed in a future patch release

Features

(kv) Stabilize key-value support behind the kv feature

Expose ConfigurableFormat to build custom [Builder::format]s that leverage this

[0.11.7] - 2025-03-10

Internal

Replaced humantime with jiff

[0.11.6] - 2024-12-20

Features

Opt-in file and line rendering

[0.11.5] - 2024-07-25

[0.11.4] - 2024-07-23

[0.11.3] - 2024-03-05

Features

Experimental support for key-value logging behind unstable-kv

[0.11.2] - 2024-02-13

[0.11.1] - 2024-01-27

... (truncated)

Commits

b4d3f2b chore: Release
cc2b2ef chore: Release
69e27d1 docs: Update changelog
166880d Merge pull request #411 from epage/parse
0a580d0 fix(filter): Remove 'parse' on no_std
78d8ef1 Merge pull request #404 from cagatay-y/feature/filter-no_std
132fe86 feat(filter): Add support for no_std environments
4feafa4 refactor(env_filter): Fix unreachable pub warning
92f8d8d Merge pull request #410 from rust-cli/renovate/crate-ci-typos-1.x
4e57784 chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
Additional commits viewable in compare view

Updates reqwest to 0.13.4

Release notes

Sourced from reqwest's releases.

v0.13.4

tl;dr

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

What's Changed

fix(tls): improve rustls-no-provider panic message and add module docs by @smythg4 in seanmonstar/reqwest#3021

fix: do not lose the url in error when decoding json by @Dushistov in seanmonstar/reqwest#3026

Add tls_sslkeylogfile builder method by @passcod in seanmonstar/reqwest#2923

fix(redirect): strip sensitive headers on scheme change across redirects by @SAY-5 in seanmonstar/reqwest#3034

chore: upgrade MSRV to 1.85 by @seanmonstar in seanmonstar/reqwest#3038

chore: clean up minimal-versions CI job by @seanmonstar in seanmonstar/reqwest#3039

fix(http3): use happy eyeballs for h3 connect by @lyuzichong in seanmonstar/reqwest#3030

fix: update hickory-resolver to 0.26 and adjust code accordingly by @seanmonstar in seanmonstar/reqwest#3040

fix: remove unwrap in hickory initialization by @mat813 in seanmonstar/reqwest#3041

feat(https): support TLS 1.3 as min version under native-tls 🎉 by @AverageHelper in seanmonstar/reqwest#2975

Expose keep alive configurations in blocking client by @aeb-dev in seanmonstar/reqwest#3043

Prepare v0.13.4 by @seanmonstar in seanmonstar/reqwest#3046

New Contributors

@smythg4 made their first contribution in seanmonstar/reqwest#3021

@Dushistov made their first contribution in seanmonstar/reqwest#3026

@SAY-5 made their first contribution in seanmonstar/reqwest#3034

@mat813 made their first contribution in seanmonstar/reqwest#3041

@AverageHelper made their first contribution in seanmonstar/reqwest#2975

@aeb-dev made their first contribution in seanmonstar/reqwest#3043

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

Changelog

Sourced from reqwest's changelog.

v0.13.4

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

v0.13.3

Fix CertificateRevocationList parsing of PEM values.

Fix logging in resolver to only show host, not full URL.

Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.

Fix HTTP/3 to handle STOP_SENDING as not an error.

Fix HTTP/3 pool to remove timed out QUIC connections.

Fix HTTP/3 connection establishment picking IPv4 and IPv6.

Upgrade rustls-platform-verifier.

(wasm) Only use wasm-bindgen on unknown-* targets.

v0.13.2

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Fixes compiling with rustls on Android targets.

v0.13.0

Breaking changes:

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

Many TLS-related methods renamed to improve autocompletion and discovery, but previo...
Description has been truncated

Bumps the infrastructure group with 8 updates: | Package | From | To | | --- | --- | --- | | [toml](https://github.com/BinaryMuse/toml-node) | `3.0.0` | `5.0.0` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.9` | `2.5.7` | | [@j178/prek](https://github.com/j178/prek) | `0.2.29` | `0.4.13` | | [@tauri-apps/cli](https://github.com/tauri-apps/tauri) | `2.9.6` | `2.11.4` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.10.9` | `26.2.0` | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.2.0` | `5.2.3` | | [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.23.12` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.111.0` | `4.120.0` | Updates `toml` from 3.0.0 to 5.0.0 - [Changelog](https://github.com/BinaryMuse/toml-node/blob/master/CHANGELOG.md) - [Commits](BinaryMuse/toml-node@v3.0.0...v5.0.0) Updates `@biomejs/biome` from 2.4.9 to 2.5.7 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome) Updates `@j178/prek` from 0.2.29 to 0.4.13 - [Release notes](https://github.com/j178/prek/releases) - [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md) - [Commits](j178/prek@v0.2.29...v0.4.13) Updates `@tauri-apps/cli` from 2.9.6 to 2.11.4 - [Release notes](https://github.com/tauri-apps/tauri/releases) - [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.9.6...@tauri-apps/cli-v2.11.4) Updates `@types/node` from 24.10.9 to 26.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `js-yaml` from 4.2.0 to 5.2.3 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...5.2.3) Updates `tsx` from 4.21.0 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.23.12) Updates `wrangler` from 4.111.0 to 4.120.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.120.0/packages/wrangler) chore(deps): bump the infrastructure group in /src-tauri with 10 updates Updates the requirements on [dirs](https://github.com/soc/dirs-rs), [env_logger](https://github.com/rust-cli/env_logger), [reqwest](https://github.com/seanmonstar/reqwest), [sha1](https://github.com/RustCrypto/hashes), [sha2](https://github.com/RustCrypto/hashes), [toml](https://github.com/toml-rs/toml), [ts-rs](https://github.com/Aleph-Alpha/ts-rs), [zip](https://github.com/zip-rs/zip2), [ctor](https://github.com/mmastrac/linktime) and [embed-resource](https://github.com/nabijaczleweli/rust-embed-resource) to permit the latest version. Updates `dirs` to 6.0.0 - [Commits](https://github.com/soc/dirs-rs/commits) Updates `env_logger` to 0.11.11 - [Release notes](https://github.com/rust-cli/env_logger/releases) - [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md) - [Commits](rust-cli/env_logger@v0.9.0...v0.11.11) Updates `reqwest` to 0.13.4 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.11.0...v0.13.4) Updates `sha1` to 0.11.0 - [Commits](RustCrypto/hashes@groestl-v0.10.0...sha1-v0.11.0) Updates `sha2` to 0.11.0 - [Commits](RustCrypto/hashes@groestl-v0.10.0...sha2-v0.11.0) Updates `toml` to 1.1.4+spec-1.1.0 - [Commits](toml-rs/toml@toml_datetime-v0.5.0...toml-v1.1.4) Updates `ts-rs` to 12.0.1 - [Release notes](https://github.com/Aleph-Alpha/ts-rs/releases) - [Changelog](https://github.com/Aleph-Alpha/ts-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/Aleph-Alpha/ts-rs/commits) Updates `zip` to 8.6.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v2.2.2...v8.6.0) Updates `ctor` to 1.0.13 - [Release notes](https://github.com/mmastrac/linktime/releases) - [Changelog](https://github.com/mmastrac/linktime/blob/master/CHANGELOG.md) - [Commits](https://github.com/mmastrac/linktime/commits/ctor-1.0.13) Updates `embed-resource` to 3.0.11 - [Release notes](https://github.com/nabijaczleweli/rust-embed-resource/releases) - [Commits](nabijaczleweli/rust-embed-resource@v2.4.0...v3.0.11) --- updated-dependencies: - dependency-name: toml dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: "@biomejs/biome" dependency-version: 2.5.7 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: "@j178/prek" dependency-version: 0.4.13 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: "@tauri-apps/cli" dependency-version: 2.11.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: "@types/node" dependency-version: 26.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: js-yaml dependency-version: 5.2.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: infrastructure - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: wrangler dependency-version: 4.120.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: infrastructure - dependency-name: dirs dependency-version: 6.0.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: env_logger dependency-version: 0.11.11 dependency-type: direct:production dependency-group: infrastructure - dependency-name: reqwest dependency-version: 0.13.4 dependency-type: direct:production dependency-group: infrastructure - dependency-name: sha1 dependency-version: 0.11.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: toml dependency-version: 1.1.4+spec-1.1.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: ts-rs dependency-version: 12.0.1 dependency-type: direct:production dependency-group: infrastructure - dependency-name: zip dependency-version: 8.6.0 dependency-type: direct:production dependency-group: infrastructure - dependency-name: ctor dependency-version: 1.0.13 dependency-type: direct:production dependency-group: infrastructure - dependency-name: embed-resource dependency-version: 3.0.11 dependency-type: direct:production dependency-group: infrastructure ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 13, 2026

dependabot Bot mentioned this pull request Aug 13, 2026

Bump the "infrastructure" group with 2 updates across multiple ecosystems #209

Closed

Navigation Menu

Uh oh!

Bump the "infrastructure" group with 2 updates across multiple ecosystems - #211

Bump the "infrastructure" group with 2 updates across multiple ecosystems#211
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/infrastructure-4620045222

dependabot Bot commented on behalf of github Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 13, 2026

5.0.0 - July 14 2026

4.3.0 - July 13 2026

4.2.0 - July 13 2026

4.1.2 - June 30 2026

4.1.1 - March 31 2026

4.1.0 - March 31 2026

4.0.1 - March 31 2026

4.0.0 - March 31 2026

2.3.0 - July 13 2015

2.2.3 - June 8 2015

Biome CLI v2.5.7

2.5.7

Patch Changes

2.5.7

Patch Changes

0.4.13

Release Notes

Highlights

Manage hook tools with mise

Run commands in hook environments

Enhancements

Performance

0.4.13

Highlights

Manage hook tools with mise

Run commands in hook environments

Enhancements

Performance

Bug fixes

@​tauri-apps/cli v2.11.4

[2.11.4]

Bug Fixes

Dependencies

@​tauri-apps/cli v2.11.3

[2.11.3]

Bug Fixes

Dependencies

@​tauri-apps/cli v2.11.2

[2.11.2]

Dependencies

@​tauri-apps/cli v2.11.1

[2.11.1]

Dependencies

@​tauri-apps/cli v2.11.0

[2.11.0]

New Features

[5.2.3] - 2026-08-01

Fixed

[5.2.2] - 2026-07-24

Fixed

Security

[5.2.1] - 2026-07-02

Fixed

Security

4.3.0, 3.15.0 - 2026-06-27

Security

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

v4.23.8

wrangler@4.120.0

Minor Changes

Patch Changes

`@tauri-apps/cli` v2.11.4

`@tauri-apps/cli` v2.11.3

`@tauri-apps/cli` v2.11.2

`@tauri-apps/cli` v2.11.1

`@tauri-apps/cli` v2.11.0