diff --git a/Cargo.lock b/Cargo.lock index 3d94a66..dafa102 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -401,7 +401,7 @@ dependencies = [ "proc-macro2", "quote", "syn 2.0.119", - "synstructure", + "synstructure 0.13.2", ] [[package]] @@ -854,9 +854,9 @@ checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548" [[package]] name = "potential_utf" -version = "0.1.5" +version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564" +checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661" dependencies = [ "serde_core", "writeable", @@ -1137,9 +1137,9 @@ dependencies = [ [[package]] name = "rustls-platform-verifier" -version = "0.7.0" +version = "0.7.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0" +checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98" dependencies = [ "core-foundation", "core-foundation-sys", @@ -1158,9 +1158,9 @@ dependencies = [ [[package]] name = "rustls-platform-verifier-android" -version = "0.1.1" +version = "0.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f" +checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f" [[package]] name = "rustls-webpki" @@ -1372,6 +1372,17 @@ dependencies = [ "syn 2.0.119", ] +[[package]] +name = "synstructure" +version = "0.14.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02" +dependencies = [ + "proc-macro2", + "quote", + "syn 3.0.6", +] + [[package]] name = "thiserror" version = "2.0.20" @@ -1429,9 +1440,9 @@ checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee" [[package]] name = "tokio" -version = "1.53.1" +version = "1.53.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044" dependencies = [ "bytes", "libc", @@ -1832,9 +1843,9 @@ dependencies = [ [[package]] name = "yoke" -version = "0.8.2" +version = "0.8.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca" +checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5" dependencies = [ "stable_deref_trait", "yoke-derive", @@ -1843,14 +1854,14 @@ dependencies = [ [[package]] name = "yoke-derive" -version = "0.8.2" +version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e" +checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71" dependencies = [ "proc-macro2", "quote", - "syn 2.0.119", - "synstructure", + "syn 3.0.6", + "synstructure 0.14.0", ] [[package]] @@ -1891,7 +1902,7 @@ dependencies = [ "proc-macro2", "quote", "syn 2.0.119", - "synstructure", + "synstructure 0.13.2", ] [[package]] @@ -1902,9 +1913,9 @@ checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e" [[package]] name = "zerotrie" -version = "0.2.4" +version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf" +checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f" dependencies = [ "displaydoc", "yoke", @@ -1913,9 +1924,9 @@ dependencies = [ [[package]] name = "zerovec" -version = "0.11.6" +version = "0.11.8" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239" +checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8" dependencies = [ "serde", "yoke", diff --git a/Cargo.toml b/Cargo.toml index 45960b3..1c95eca 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -33,8 +33,8 @@ all = { level = "warn", priority = -1 } # found for type `str`). These versions work on Rust 1.85. # Remove these constraints once yoke-derive 0.8.4+ fixes the issue. [workspace.dependencies] -yoke = "=0.8.2" -yoke-derive = "=0.8.2" -zerotrie = "=0.2.4" -zerovec = "=0.11.6" -potential_utf = "=0.1.5" +yoke = "=0.8.3" +yoke-derive = "=0.8.4" +zerotrie = "=0.2.5" +zerovec = "=0.11.8" +potential_utf = "=0.1.6" diff --git a/crates/bitty-network-tls/Cargo.toml b/crates/bitty-network-tls/Cargo.toml index 955039d..f8de1dc 100644 --- a/crates/bitty-network-tls/Cargo.toml +++ b/crates/bitty-network-tls/Cargo.toml @@ -19,7 +19,7 @@ bitty-network-api = { path = "../bitty-network-api", version = "0.0.1" } # native roots, PKI types for certificates/keys/PEM, IDNA for canonical-host # normalization, and zeroize for key buffers. Exact pins match bitty-network. rustls = { version = "=0.23.45", default-features = false, features = ["std", "aws-lc-rs"] } -rustls-platform-verifier = { version = "=0.7.0", default-features = false } +rustls-platform-verifier = { version = "=0.7.1", default-features = false } rustls-pki-types = { version = "=1.15.1", default-features = false, features = ["std"] } idna = { version = "=1.1.0" } zeroize = { version = "=1.9.0", features = ["alloc"] } @@ -38,6 +38,8 @@ potential_utf = { workspace = true } # runtime and keep them outside the repository, so no certificate or key # fixture is ever committed. `default-features = false` with `aws_lc_rs` # avoids pulling a second crypto provider into the test build. +# Pinned to 0.13.x: rcgen 0.14+ requires rustc 1.88 and reworks the signing API +# around Issuer, above this repo's MSRV 1.85. Revisit on MSRV rise. rcgen = { version = "=0.13.2", default-features = false, features = ["aws_lc_rs", "pem"] } # `OffsetDateTime` is the type of a generated certificate's validity window. # Already in the graph through rcgen; a dev-dependency so the test-only diff --git a/crates/bitty-network/Cargo.toml b/crates/bitty-network/Cargo.toml index 94f9ecb..9f0a619 100644 --- a/crates/bitty-network/Cargo.toml +++ b/crates/bitty-network/Cargo.toml @@ -49,6 +49,8 @@ rustls = { version = "=0.23.45", default-features = false, features = ["std"], o # and private key at runtime and keep them outside the repository, so no # certificate or key fixture is ever committed. `default-features = false` # with `aws_lc_rs` avoids pulling a second crypto provider into the test build. +# Pinned to 0.13.x: rcgen 0.14+ requires rustc 1.88 and reworks the signing API +# around Issuer, above this repo's MSRV 1.85. Revisit on MSRV rise. rcgen = { version = "=0.13.2", default-features = false, features = ["aws_lc_rs", "pem"] } rustls-pki-types = "1.15.1" # `OffsetDateTime` is the type of a generated certificate's validity window. diff --git a/deny.toml b/deny.toml index 1a069a4..5d22e96 100644 --- a/deny.toml +++ b/deny.toml @@ -89,6 +89,10 @@ wildcards = "deny" # - r-efi 5.3.0 (via phodopus getrandom 0.3.x) alongside 6.0.0 (via reqwest getrandom 0.4.x). # Phodopus pins rand 0.9.x ecosystem; websocket/http use rand 0.10.x ecosystem. # Will unify when Phodopus updates or when published to crates.io. +# +# Duplicate versions from the icu patch updates (dependabot #84): +# - synstructure 0.13.2 (via phodopus gc-arena-derive) alongside 0.14.0 +# (via yoke-derive 0.8.4). Unifying is gc-arena upstream's release to make. skip = [ { crate = "base64@0.22.1", reason = "reqwest-tree dupe, upstream unification pending" }, { crate = "syn@2.0.119", reason = "reqwest-tree dupe, upstream unification pending" }, @@ -96,6 +100,7 @@ skip = [ { crate = "rand@0.9.5", reason = "phodopus git dep uses rand 0.9.x, will unify on phodopus publish" }, { crate = "getrandom@0.3.4", reason = "phodopus git dep uses getrandom 0.3.x, will unify on phodopus publish" }, { crate = "r-efi@5.3.0", reason = "phodopus git dep uses r-efi 5.x, will unify on phodopus publish" }, + { crate = "synstructure@0.13.2", reason = "phodopus gc-arena pins 0.13.x, yoke-derive 0.8.4 uses 0.14.x; unify on gc-arena release" }, ] [sources]