chore(deps): bump the cargo group across 1 directory with 8 updates

[dependabot]

Bumps the cargo group with 7 updates in the / directory:

Package	From	To
gix-features	0.38.2	0.48.1
gix-date	0.8.7	0.15.6
lru	0.12.5	0.16.3
rand	0.8.5	0.10.2
pyo3	0.27.2	0.29.0
quinn-proto	0.11.14	0.11.17
rustls-webpki	0.103.9	0.103.14

Updates gix-features from 0.38.2 to 0.48.1

Changelog

Sourced from gix-features's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

• add configurable terminal screen modes.

• hide revision ancestry in tix

• add tix to the gix CLI

• add explicit gix config show subcommand.

• add gix config list for showing the git-configuration files.

• add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

• add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

• add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

  The command can also write the advertised refs into a standalone ref store:

  gix free remote refs --refs-directory out-refs <url>

Bug Fixes

• preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

  Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits

• 10c58bb Release gix-error v0.2.4, gix-date v0.15.4, gix-actor v0.41.1, gix-trace v0.1...
• b6c41cb Montly report for May 2026
• faecc23 Merge pull request #2607 from SarthakB11/fix/issue-1842
• 8323858 fix: Derive $0 for sh -c from the shell's basename
• d62e33c Add tests for $0 deriving from the actually-running shell
• f6433ac Update downstream test assertions for sh $0 change
• 6752a96 Pass sh (not --) as $0 to sh -c
• 4377485 Merge pull request #2612 from GitoxideLabs/improvements
• 123cdaf spawn_git_daemon now spawns the git daemon on a free port automatically
• cad26e9 fix: disable automatic Git maintenance in gix-testtools, add `apply_git_confi...
• Additional commits viewable in compare view

Updates gix-date from 0.8.7 to 0.15.6

Release notes

Sourced from gix-date's releases.

gix-date v0.15.6

Commit Statistics

• 3 commits contributed to the release.
• 23 days passed between releases.
• 0 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Thanks Clippy

Clippy helped 1 time to make code idiomatic.

Commit Details

• Uncategorized
  • Merge pull request #2702 from ameyypawar/fix/2694-exn-source-chain (e9c973d)
  • Thanks clippy (d533f0c)
  • Merge pull request #2646 from GitoxideLabs/report (1b1541e)

gix-date v0.15.5

Commit Statistics

• 3 commits contributed to the release over the course of 27 calendar days.
• 27 days passed between releases.
• 0 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

• Uncategorized
  • Merge pull request #2635 from GitoxideLabs/dependabot/cargo/cargo-7b971a5e8c (155ff6d)
  • Bump the cargo group with 40 updates (9402adc)
  • Merge pull request #2618 from GitoxideLabs/report (f7d4f33)

Changelog

Sourced from gix-date's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

• add configurable terminal screen modes.

• hide revision ancestry in tix

• add tix to the gix CLI

• add explicit gix config show subcommand.

• add gix config list for showing the git-configuration files.

• add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

• add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

• add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

  The command can also write the advertised refs into a standalone ref store:

  gix free remote refs --refs-directory out-refs <url>

Bug Fixes

• preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

  Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits

• 27aec47 Release gix-path v0.12.2, gix-error v0.2.5, gix-utils v0.3.4, gix-date v0.15....
• a30d02f test: cover carriage returns in credential context values
• 3a99e25 fix: also reject carriage return when parsing credentials
• 7056d62 Merge pull request #2698 from GitoxideLabs/multi-remote-url
• 432e2b1 Add missing SHA256 archive
• 5f244b3 fix: preserve multiple remote URLs (#2696)
• f803d3e Merge pull request #2713 from GitoxideLabs/fix-flaky-cargo-run
• 06408b2 fix: preserve input when optional filter drivers fail
• e9d1d26 fix: handle broken pipes from optional filter drivers
• eaf579e test: avoid nested Cargo in gix-filter driver tests
• Additional commits viewable in compare view

Updates lru from 0.12.5 to 0.16.3

Changelog

Sourced from lru's changelog.

v0.16.3 - 2026-01-07

• Fix Stacked Borrows violation in IterMut.

v0.16.2 - 2025-10-14

• Upgrade hashbrown dependency to 0.16.0.

v0.16.1 - 2025-09-08

• Fix Clone for unbounded cache.

v0.16.0 - 2025-07-02

• Implement Clone for caches with custom hashers.

v0.15.0 - 2025-06-26

• Return bool from promote and demote to indicate whether key was found.

v0.14.0 - 2025-04-12

• Use NonZeroUsize::MAX instead of unwrap(), and update MSRV to 1.70.0.

v0.13.0 - 2025-01-27

• Add peek_mru and pop_mru methods, upgrade dependency on hashbrown to 0.15.2, and update MSRV to 1.65.0.

Commits

• af233e5 Merge pull request #225 from jeromefroe/jerome/prepare-0-16-3-release
• cf56f9a Prepare 0.16.3 release
• 62be24c Merge pull request #224 from paolobarbolini/iter-mut-stacked-borrows-violation
• 25669e7 Add regression test for IterMut stacked borrows violation
• b9bca34 Fix stacked borrows violation in IterMut::next and IterMut::next_back
• c1f843d Merge pull request #223 from jeromefroe/jerome/prepare-0-16-2-release
• fc4f309 Prepare 0.16.2 release
• e91ea2b Merge pull request #222 from torokati44/hashbrown-0.16
• 90d05fe Update hashbrown to 0.16
• c699209 Merge pull request #220 from jeromefroe/jerome/prepare-0-16-1-release
• Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
• Use Edition 2024 and MSRV 1.85 (#1653)
• Let Fill be implemented for element types, not sliceable types (#1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
• Remove Clone support for StdRng, ReseedingRng (#1677)
• Use postcard instead of bincode to test the serde feature (#1693)
• Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
• Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
• Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

• Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
• Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
• Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
• Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

• Removed ReseedingRng (#1722)
• Removed unused feature "nightly" (#1732)
• Removed feature small_rng (#1732)

... (truncated)

Commits

• 1540ea3 Prepare rand 0.10.2 (#1800)
• a29964a Bump chacha20 from 0.10.0 to 0.10.1 in the all-deps group (#1801)
• ced9491 Tweak docs for RngExt::random_range and SampleRange (#1798)
• db14664 Check UniformChar validity on deser (#1790)
• bea8620 Bump the all-deps group with 2 updates (#1796)
• 4f44932 Bump actions/cache from 5 to 6 (#1795)
• b999a13 Bump actions/checkout from 6 to 7 (#1794)
• aeab810 Avoid unsafe where safety depends on non-local values (#1791)
• 1896d7c Add typos CI job (#1789)
• 43eddee Bump the all-deps group with 2 updates (#1788)
• Additional commits viewable in compare view

Updates pyo3 from 0.27.2 to 0.29.0

Release notes

Sourced from pyo3's releases.

PyO3 0.29.0

This release is a relatively large release with improvements across many areas of PyO3's API.

Build and packaging changes

This release brings full support for Python 3.15 beta. We encourage downstream projects to begin testing and distributing Python 3.15 beta wheels so that the ecosystem can prepare for the 3.15 final release later in the year.

Alongside Python 3.15 support comes support for its new "abi3t" stable ABI which supports both free-threaded and gil-enabled Python builds. For projects distributing stable ABI wheels, we recommend distributing (for each OS/architecture) an abi3 wheel built for your minimum supported Python version, a 3.14t version-specific wheel for free-threaded Python 3.14, and an abi3t wheel to support Python 3.15 (and future versions).

Support for Python 3.7 has been dropped. Support for Python 3.13t, the first experimental free-threaded release of CPython, has also been dropped. 3.14t (and soon 3.15t) is more stable, performant, and the starting point for CPython's own declaration of "support" for the free-threaded build.

The PyO3 build process (via the pyo3-build-config crate) has been adjusted to reduce the cost of rebuilds when the environment used to detect the Python interpreter changes; pyo3-build-config and pyo3-macros will no longer be rebuilt in such cases (although pyo3-ffi and crates downstream of it still will be rebuilt). As a consequence the pyo3_build_config APIs now require crates to have a direct dependency on pyo3 or pyo3-ffi. We hope to continue to reduce rebuild frequency and cost in a future PyO3 release.

Security updates

With the recent boom in AI-assisted security scanning, PyO3 has inevitably had several correctness issues exposed by AI-assisted scanning.

In particular, PyO3 0.29 fixes two security vulnerabilities we will be releasing to the RustSec Advisory Database imminently:

• Missing Sync bound on PyCFunction::new_closure closures
• Possible out of bounds read in BoundTupleIterator::nth_back and BoundListIterator::nth_back

Any code using the above APIs is advised to update as soon as possible.

This release also contains several other minor breaking changes to close soundness holes uncovered by AI-assisted scanning. Our assessment as maintainers was that, excluding the two vulnerability cases listed above, these correctness issues would likely have crashed immediately upon user testing rather than leading to attacker-exploitable pathways. We nevertheless wanted to see them closed without the usual deprecation cycle. These cases are noted in the migration guide.

Other major themes in this release

New in this release is a CLI in pyo3-introspection to generate type stubs along with the experimental-inspect feature. Downstream, maturin has also gained support to generate type stubs using the feature. The feature is reaching a point where substantial amount of type stubs can be generated automatically. We would like to encourage users to begin using this feature and helping us find what functionality is missing, with a hope we can declare its API stable given sufficient feedback.

A substantial amount of effort has been invested in pyo3-ffi as part of the process of extending it with 3.15's new APIs. There have been many missing APIs from older Python versions added. There have also been a number of fixes to incorrect definitions (these are breaking changes, but also necessary for correctness); we hope there will be far fewer such cases in the future due to more comprehensive checking added to PyO3's CI. Finally, many private CPython APIs (those with _Py underscore-named prefix) have been removed from pyo3-ffi's public API.

In closing

There are also many other incremental improvements, bug fixes and smaller features; full detail can be found in the CHANGELOG.

Please consult the migration guide for help upgrading.

Thank you to everyone who contributed code, documentation, design ideas, bug reports, and feedback. The following contributors' commits are included in this release:

@​Alc-Alc @​alex @​anuraaga @​BD103 @​bschoenmaeckers @​Cheukting @​chirizxc @​ChristopherRabotin @​clin1234 @​codeguru42 @​davidhewitt

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.29.0] - 2026-06-11

Packaging

• Support the new PEP 803 abi3t ABI with new abi3t and abi3t-py315 features. #5807
• pyo3-macros-backend no longer depends on pyo3-build-config. #5809
• Drop support for Python 3.13t (3.14t and above continue to be supported; CPython declared free-threading supported starting with Python 3.14). #5865
• Drop support for Python 3.7. #5912
• Extend range of supported versions of hashbrown optional dependency to include version 0.17. #5973
• Support Python 3.15.0b1. #6014
• pyo3-ffi is now no_std. #6022

Added

• Add PyErr::set_traceback to set the traceback of an exception object. #5349
• Add PyUnicodeDecodeError::new_err_from_utf8 to create a PyErr from a str::Utf8Error. #5668
• experimental-inspect: implement INPUT_TYPE and OUTPUT_TYPE on optional third-party crate conversions. #5770
• experimental-inspect: include doc comments in generated stubs. #5782
• Add pyo3_build_config::PythonAbi, pyo3_build_config::PythonAbiKind, pyo3_build_config::PythonAbiBuilder, pyo3_build_config::InterpreterConfig::target_abi, and pyo3_build_config::InterpreterConfigBuilder::target_abi. #5807
• Add Borrowed::get as an equivalent to Bound::get and Py::get. #5849
• Add PyFrame::new, PyTraceBack::new, and PyFrameMethods::line_number. #5857
• Add PyUntypedBuffer::obj to retrieve the Python object owning the buffer. #5870
• Add PyCapsule::new_with_value and PyCapsule::new_with_value_and_destructor. #5881
• Add PyErr::set_context and PyErr::context. #5887
• Add a small CLI to pyo3-introspection to generate stubs. #5904
• Add Python::version_str. #5921
• Add TryFrom<&Bound<T>> for PyRef<T>, PyRefMut<T>, PyClassGuard<T> and PyClassGuardMut<T>. #5922
• Add From<&Bound<T>> for Bound<T> and Py<T> #5922
• Add PyDictMethods::set_default and PyDictMethods::set_default_ref to allow atomically setting default values in a PyDict. #5955
• add PyFrameMethods::outer|code|var|builtins|globals|locals. #5967
• Add From conversions for PyErr from std::time::TryFromFloatSecsError, std::time::SystemTimeError, std::path::StripPrefixError, std::env::JoinPathsError, std::char::ParseCharError, and std::char::CharTryFromError. #6001
• Add pyo3_build_config::InterpreterConfigBuilder. #6034
• Add PyCapsule::import_pointer #6066
• Add PyClassGuardMapMut. #6073
• Expose PyListMethods::get_item_unchecked, PyTupleMethods::get_item_unchecked, and PyTupleMethods::get_borrowed_item_unchecked on abi3. #6075
• Add PyClassGuardMapSuper. #6104
• Add PyClassGuard and PyClassGuardMut to pyo3::prelude. #6112
• Add Debug impls for PyClassGuard and PyClassGuardMut. #6112
• Enable extending PyDateTime, PyDate, PyTime, PyDelta and PyTzInfo on abi3 with python 3.12+. #6115
• Expose PyFunction available on abi3. #6117
• FFI definitions:
  • Added FFI definitions PyUnstable_Object_IsUniquelyReferenced, PyUnstable_Object_IsUniquelyReferencedTemporary, PyUnstable_EnableTryIncref, and PyUnstable_TryIncref. #5828
  • Add FFI definitions ffi::PyErr_GetHandledException and ffi::PyErr_SetHandledException. #5887
  • Add FFI definition Py_HASH_SIPHASH13. #5891
  • Add FFI definition PyStructSequence_UnnamedField constant on Python 3.9 and up (or 3.11 with abi3 features). #5892
  • Add FFI definitions PyUnstable_InterpreterFrame_GetCode, PyUnstable_InterpreterFrame_GetLasti, PyUnstable_InterpreterFrame_GetLine, and PyUnstable_ExecutableKinds. #5932
  • Add FFI definitions PyMarshal_WriteLongToFile, PyMarshal_WriteObjectToFile, PyMarshal_ReadLongFromFile, PyMarshal_ReadShortFromFile, PyMarshal_ReadObjectFromFile, and PyMarshal_ReadLastObjectFromFile. #5934
  • Add FFI definitions PyObject_GetAIter, PyAIter_Check, PyMapping_HasKeyWithError, PyMapping_HasKeyStringWithError, PyMapping_GetOptionalItem, PyMapping_GetOptionalItemString, PySequence_ITEM, PySequence_Fast_GET_SIZE, PySequence_Fast_GET_ITEM, and PySequence_Fast_ITEMS. #5942
  • Add FFI definition compat::PyObject_HasAttrWithError. #5944
  • Add FFI definitions PyDict_SetDefault, PyDict_SetDefaultRef, PyDict_ContainsString, PyDict_Pop, PyDict_PopString, PyDict_ClearWatcher, PyDict_Watch, PyDict_Unwatch, and PyFrozenDict_New. #5947

... (truncated)

Commits

• 0f90242 release: 0.29.0 (#6107)
• cd128ed doc: mention abi3t, python3t.dll, and abi3t_compat folder in FAQ (#6124)
• 7e2ef18 Avoid type checks in methods where CPython already guarantees the received ty...
• f930199 docs: additional detail in migration guide for 0.29 (#6123)
• 91ab0d1 Enable Windows abi3t tests (#6106)
• fe0fdd5 add PyLong* API (3.14+) (#6016)
• f41b1df Hang when reattaching after detach during shutdown (#6085)
• 5ae66a8 Fix double import on RustPython (#6122)
• ad4a510 PyFunction: enable some extra tests with abi3 (#6118)
• c79ac0e ci: Add test for minimum supported debug build of Python (#5852)
• Additional commits viewable in compare view

Updates gix-validate from 0.8.5 to 0.11.3

Release notes

Sourced from gix-validate's releases.

gix-validate v0.11.3

Commit Statistics

• 3 commits contributed to the release.
• 58 days passed between releases.
• 0 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

• Uncategorized
  • Merge pull request #2722 from GitoxideLabs/reasons (c16b5a1)
  • Replace lint allowances with expectations (43ff87a)
  • Merge pull request #2618 from GitoxideLabs/report (f7d4f33)

Changelog

Sourced from gix-validate's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

• add configurable terminal screen modes.

• hide revision ancestry in tix

• add tix to the gix CLI

• add explicit gix config show subcommand.

• add gix config list for showing the git-configuration files.

• add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

• add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

• add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

  The command can also write the advertised refs into a standalone ref store:

  gix free remote refs --refs-directory out-refs <url>

Bug Fixes

• preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

  Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits

• f0ec710 Release gix-trace v0.1.21, gix-validate v0.11.3, gix-path v0.12.3, gix-utils ...
• 463a9f7 proofread report
• 2140142 feat: add configurable terminal screen modes.
• e8a9649 feat: limit commit selection highlighting.
• b5e7a45 fix: better memory handling (use less)
• 7118a84 feat: mailmap support with 'm' toggle.
• f2b4297 Just call me Byron
• a8a5528 report July 2026
• dbe7bb6 Merge pull request #2813 from GitoxideLabs/tix-authors
• cdbe465 feat: show bots and commit attributions in tix
• Additional commits viewable in compare view

Updates quinn-proto from 0.11.14 to 0.11.17

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

• fix(ci): fix clippy lints by @​LesnyRumcajs in quinn-rs/quinn#2752
• congestion: saturate CUBIC window increment to avoid overflow by @​LesnyRumcajs in quinn-rs/quinn#2751
• 0.11.x: Backport memory use fixes and prepare release by @​Ralith in quinn-rs/quinn#2790

Full Changelog: quinn-rs/quinn@quinn-proto-0.11.16...quinn-proto-0.11.17

quinn-proto-0.11.16

What's Changed

• 0.11.x: upgrade dependencies by @​djc in quinn-rs/quinn#2707

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

• Prepare 0.11.x branch for release by @​djc in quinn-rs/quinn#2645
• Backport of #2495 to 0.11.x by @​stablebits in quinn-rs/quinn#2674
• 0.11.x backport | quinn-proto: drop Initials silently when saturated by @​stablebits in quinn-rs/quinn#2688
• Backport #2677 to 0.11.x by @​syszery in quinn-rs/quinn#2690
• congestion: avoid double-reducing CUBIC fast convergence (0.11.x) by @​0xdeafbeef in quinn-rs/quinn#2641
• proto: yield error on too many gaps in assembler by @​djc in quinn-rs/quinn#2694

Commits

• 0343120 proto: bump version to 0.11.17
• d7bf3d0 Limit total memory used to buffer outgoing datagrams
• 31ca5d2 Limit total memory used to buffer incoming datagrams
• 3a78b60 Factor out DatagramBuffer for queues in either direction
• b37ced3 proto: check limits when processing already retired CIDs
• 6a984b8 proto: extract method for checking CID retirements
• 499dba8 proto: bound assembler chunk count regardless of over-allocation
• 33ce0c2 congestion: saturate CUBIC window increment to avoid overflow
• c8ad7e6 fix(ci): fix clippy lints
• a96949f Take semver-compatible update for anyhow
• Additional commits viewable in compare view

Updates rustls-webpki from 0.103.9 to 0.103.14

Release notes

Sourced from rustls-webpki's releases.

0.103.13

• Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
• For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

• Actually fail closed for URI matching against excluded subtrees by @​djc in rustls/webpki#473
• Prepare 0.103.13 by @​ctz in rustls/webpki#474

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

• GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
• GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

• Prepare 0.103.12 by @​djc in rustls/webpki#470

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

• Backport parsing trust anchors with unknown critical extensions to 0.103 by @​djc in rustls/webpki#466

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correctly provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @​1seal for the report.

What's Changed

• Freshen up rel-0.103 by @​ctz in rustls/webpki#455
• Prepare 0.103.10 by @​ctz in rustls/webpki#458

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.