Skip to content

Bump the cargo group across 2 directories with 11 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/tools/argument-comment-lint/cargo-81229b0126
Open

Bump the cargo group across 2 directories with 11 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/tools/argument-comment-lint/cargo-81229b0126

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps the cargo group with 9 updates in the /codex-rs directory:

Package From To
gix 0.81.0 0.83.0
jsonwebtoken 9.3.1 10.3.0
opentelemetry_sdk 0.31.0 0.32.1
serde_with 3.17.0 3.21.0
tar 0.4.45 0.4.46
actix-http 3.11.2 3.13.1
cmov 0.5.3 0.5.4
openssl 0.10.75 0.10.81
quinn-proto 0.11.14 0.11.16

Bumps the cargo group with 1 update in the /tools/argument-comment-lint directory: tar.

Updates gix from 0.81.0 to 0.83.0

Release notes

Sourced from gix's releases.

gix-odb v0.83.0

Bug Fixes

  • retry cleared object database pack slots The fix is very lean and updates load_one() to do the same as its sibling function, which triggers a refresh of its internal index and it can recover just fine.

    --- agent

  • pass through the allocation limit This is particularly important in untrusted repositories, which get a reduced allocation limit.

Bug Fixes (BREAKING)

  • respect configured loose-object compression levels Make loose object stores and object database handles carry an explicit compression level instead of relying on the deflate stream hard-coded default. The default remains the fastest level, matching git unless core.looseCompression or core.compression says otherwise.

Commit Statistics

  • 20 commits contributed to the release.
  • 31 days passed between releases.
  • 3 commits were understood as conventional.
  • 2 unique issues were worked on: #2024, #2723

Thanks Clippy

Clippy helped 1 time to make code idiomatic.

Commit Details

  • #2024
    • Respect configured loose-object compression levels (7c5db0c)
  • #2723
    • Retry cleared object database pack slots (dac9fd5)
  • Uncategorized
    • Update changelogs prior to release (cb6ec7d)
    • Release gix-trace v0.1.21, gix-validate v0.11.3, gix-path v0.12.3, gix-utils v0.3.5, gix-config-value v0.19.0, gix-prompt v0.16.0, gix-sec v0.14.2, gix-url v0.37.0, gix-credentials v0.39.0, safety bump 18 crates (f0ec710)
    • Merge pull request #2726 from GitoxideLabs/odb-fix-unreachable (dca93be)
    • Merge pull request #2722 from GitoxideLabs/reasons (c16b5a1)
    • Replace lint allowances with expectations (43ff87a)
    • Merge pull request #2714 from GitoxideLabs/fix-credentials-parsing (cf3053a)
    • Release gix-path v0.12.2, gix-error v0.2.5, gix-utils v0.3.4, gix-date v0.15.6, gix-url v0.36.2, gix-credentials v0.38.2 (27aec47)
    • Merge pull request #2695 from ameyypawar/fix/2024-compression-level (6e1c4a2)
    • Review (f1ac335)
    • Merge pull request #2707 from ameyypawar/fix/2703-inflate-error (6d95da6)
    • Adapt to changes in gix-features, use gix-zlib accordingly. (9c2977a)

... (truncated)

Commits
  • 53f880c Release gix-error v0.2.3, gix-date v0.15.3, gix-actor v0.41.0, gix-path v0.12...
  • 09687eb fix CI - and probably prevent can't connect to localhost in journey tests
  • d5f9bf5 feat: add Category::is_remote_tracking_branch().
  • 87b2da8 address auto-review
  • 731248f feat!: add sha-256 support to gix-ref.
  • 91bfab0 Adapt to changes in gix-object
  • d4439cd fix!: Limit Commit and Tag parsing to a given gix_hash::Kind
  • 5127973 fix: Allow more pathological cases during parsing just like Git
  • 91c854e fix!: remove winnow and replace it with hand-implemented parsers everywhere.
  • b060eb2 fix!: remove winnow from the public gix-actor API for parsing (#2545)
  • Additional commits viewable in compare view

Updates jsonwebtoken from 9.3.1 to 10.3.0

Changelog

Sourced from jsonwebtoken's changelog.

10.3.0 (2026-01-27)

  • Export everything needed to define your own CryptoProvider
  • Fix type confusion with exp/nbf when not required

10.2.0 (2025-11-06)

  • Remove Clone bound from decode functions

10.1.0 (2025-10-18)

  • add dangerous::insecure_decode
  • Implement TryFrom &Jwk for DecodingKey

10.0.0 (2025-09-29)

  • BREAKING: now using traits for crypto backends, you have to choose between aws_lc_rs and rust_crypto
  • Add Clone bound to decode
  • Support decoding byte slices
  • Support JWS
Commits

Updates opentelemetry_sdk from 0.31.0 to 0.32.1

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

  1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

  2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

  3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

  1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

  2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits
  • 74cb6f3 chore: Release opentelemetry-semantic-conventions 0.32.1 (#3562)
  • 10dde18 chore(sdk): add missing changelog entry (#3550)
  • ec2da12 refactor: leverage static str key when possible (#3529)
  • 90a39a0 feat(api): accept quoted-key fields in otel logging macros (#3567)
  • 8c922bc feat(appender-tracing): add builder support for custom instrumentation scope ...
  • fb2af9d feat(metrics): add BoundUpDownCounter under experimental_metrics_bound_instru...
  • 1b3846c feat(metrics): add BoundGauge under experimental_metrics_bound_instruments (#...
  • ee359db fix: remove reqwest-rustls-webpki-roots (#3524)
  • 4d4fd4d chore: Bump semantic-conventions to v1.42.0 (#3561)
  • 69213f2 fix(prometheus-exporter): Concatenate metric attributes with Scope during col...
  • Additional commits viewable in compare view

Updates serde_with from 3.17.0 to 3.21.0

Release notes

Sourced from serde_with's releases.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

Added

  • Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#943)

Fixed

serde_with v3.19.0

Added

  • Add support for hashbrown v0.17 (#940)

    This extends the existing support for hashbrown to the newly released version.

serde_with v3.18.0

Added

  • Support OneOrMany with more sequence and set types (#929)

Changed

  • Bump MSRV to 1.88 due to the darling dependency
Commits
  • 0f4ca67 Update changelog for 3.21.0 (#967)
  • 7654841 Update changelog for 3.21.0
  • c8a1d82 Protect all collection creations against capacity overflow by using `size_hin...
  • 6ad5fa5 Properly feature gate the vec_with_capacity_cautious function
  • ef7d141 Protect all collection creations against capacity overflow by using `size_hin...
  • a348da3 Add serde_as deserialize_as explain (#958)
  • 2e5bc20 Bump the github-actions group with 3 updates (#965)
  • 927a3d6 Bump the github-actions group with 3 updates
  • 62d14ec Enable link-to-definition on docs.rs again, after the upstream issue was reso...
  • 4584d94 Enable link-to-definition on docs.rs again, after the upstream issue was reso...
  • Additional commits viewable in compare view

Updates tar from 0.4.45 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits

Updates actix-http from 3.11.2 to 3.13.1

Release notes

Sourced from actix-http's releases.

actix-http: v3.13.1

3.13.1

  • Fix HTTP/1 WebSocket upgrade responses being overwritten with Connection: close when the upgraded request payload remains open. #4115

#4115: actix/actix-web#4115

actix-http: v3.13.0

3.13.0

  • When configured, gracefully close HTTP/1 connections after early responses to unread request bodies. #3967
  • Wake HTTP/1 payload receivers with an incomplete-payload error when the sender is dropped before EOF. #3100
  • Update foldhash dependency to 0.2.

#3967: actix/actix-web#3967 #3100: actix/actix-web#3100

actix-http: v3.12.1

Notice: This release contains a security fix. Users are encouraged to update to this version ASAP.

  • SECURITY: Reject HTTP/1 requests with ambiguous request framing from Content-Length and Transfer-Encoding headers to prevent request smuggling.
  • Encode the HTTP/1 Connection: Upgrade header in Camel-Case when camel-case header formatting is enabled.#3953
  • Fix HeaderMap iterators' len() and size_hint() implementations for multi-value headers.
  • Update rand dependency to 0.10.
  • Update sha1 dependency to 0.11.

#3953: actix/actix-web#3953

actix-http: v3.12.0

  • Minimum supported Rust version (MSRV) is now 1.88.
  • Increase default HTTP/2 flow control window sizes. #3638
  • Expose configuration methods to improve upload throughput. #3638
  • Fix truncated body ending without error when connection closed abnormally. #3067
  • Add config/method for TCP_NODELAY. #3918
  • Do not compress 206 Partial Content responses. #3191
  • Fix lingering sockets and client stalls when responding early to dropped chunked request payloads. #2972

#3638: actix/actix-web#3638 #3067: actix/actix-web#3067 #3918: actix/actix-web#3918 #3191: actix/actix-web#3191 #2972: actix/actix-web#2972

Commits

Updates cmov from 0.5.3 to 0.5.4

Commits

Updates gix-fs from 0.19.2 to 0.21.2

Changelog

Sourced from gix-fs's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

New Features

  • add configurable terminal screen modes.

  • hide revision ancestry in tix

  • add tix to the gix CLI

  • add explicit gix config show subcommand.

  • add gix config list for showing the git-configuration files.

  • add the gix config fmt subcommand Expose the gix-config whitespace formatter as gix config fmt [--in-place] [in-file] [out-file]: with no in-file it formats the repository-local configuration, and with no out-file it writes to stdout. The repository is only opened when the repository-local configuration is needed, so formatting an explicit file works outside a repository too.

  • add gix status --untracked flag This allows to control how untracked files are folded, but also can completely turn dirwalking off.

  • add gix free remote refs to list and write remote refs. Add gix free remote refs to perform an upload-pack handshake, discover the remote reference advertisement, and print the refs without negotiating or receiving a pack.

    The command can also write the advertised refs into a standalone ref store:

    gix free remote refs --refs-directory out-refs <url>

Bug Fixes

  • preserve multiple remote URLs Configured remotes can have multiple remote..url or remote..pushUrl values, but gix::Remote kept only one value because lookup used the singular config accessor. That meant the most recent config value won, while Git exposes every effective URL and uses the first one for the singular get-url form.

    Add ordered URL storage to gix::Remote and expose Remote::urls(Direction) for all effective URLs. Keep Remote::url(Direction) as the singular compatibility API, now returning the first effective URL. Fetch URLs used as push fallbacks try pushInsteadOf first and then insteadOf, matching Git behavior.

... (truncated)

Commits
  • 10c58bb Release gix-error v0.2.4, gix-date v0.15.4, gix-actor v0.41.1, gix-trace v0.1...
  • b6c41cb Montly report for May 2026
  • faecc23 Merge pull request #2607 from SarthakB11/fix/issue-1842
  • 8323858 fix: Derive $0 for sh -c from the shell's basename
  • d62e33c Add tests for $0 deriving from the actually-running shell
  • f6433ac Update downstream test assertions for sh $0 change
  • 6752a96 Pass sh (not --) as $0 to sh -c
  • 4377485 Merge pull request #2612 from GitoxideLabs/improvements
  • 123cdaf spawn_git_daemon now spawns the git daemon on a free port automatically
  • cad26e9 fix: disable automatic Git maintenance in gix-testtools, add `apply_git_confi...
  • Additional commits viewable in compare view

Updates gix-pack from 0.68.0 to 0.70.0

Commits
  • 53f880c Release gix-error v0.2.3, gix-date v0.15.3, gix-actor v0.41.0, gix-path v0.12...
  • 09687eb fix CI - and probably prevent can't connect to localhost in journey tests
  • d5f9bf5 feat: add Category::is_remote_tracking_branch().
  • 87b2da8 address auto-review
  • 731248f feat!: add sha-256 support to gix-ref.
  • 91bfab0 Adapt to changes in gix-object
  • d4439cd fix!: Limit Commit and Tag parsing to a given gix_hash::Kind
  • 5127973 fix: Allow more pathological cases during parsing just like Git
  • 91c854e fix!: remove winnow and replace it with hand-implemented parsers everywhere.
  • b060eb2 fix!: remove winnow from the public gix-actor API for parsing (#2545)
  • Additional commits viewable in compare view

Updates openssl from 0.10.75 to 0.10.81

Release notes

Sourced from openssl's releases.

openssl-v0.10.81

What's Changed

New Contributors

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.80...openssl-v0.10.81

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

... (truncated)

Commits
  • db9c9e2 Release openssl 0.10.81 and openssl-sys 0.9.117 (#2655)
  • 3a7fb56 Bump actions/checkout from 6.0.2 to 6.0.3 (#2653)
  • d059c43 Fix verify_mode() panic on unmodeled verify mode bits (#2651)
  • 8b1519e Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string (#2652)
  • d5713d6 add mldsa.h to the boringssl bindgen (#2650)
  • 9fac317 Merge pull request #2538 from ocdlroux/feat/crl-full
  • 4dae20b x509: adding minimal support for X509CrlBuilder
  • 47f7777 Add brainpoolP224r1 and brainpoolP224t1 NID constants (#2642)
  • 659da17 Bump aws-ls-sys to 0.41 (#2640)
  • 35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
  • Additional commits viewable in compare view

Updates quinn-proto from 0.11.14 to 0.11.16

Release notes

Sourced from quinn-proto's releases.

quinn-proto-0.11.16

What's Changed

Commits
  • a96949f Take semver-compatible update for anyhow
  • 5429f60 udp: bump version to 0.5.15
  • 262a493 proto: bump version to 0.11.16
  • c19b63a Upgrade rustls-platform-verifier to 0.7
  • aff3652 Disable default features for fastbloom
  • 01b2eee Upgrade fastbloom to 0.17
  • 2c82013 Switch BBR RNG to PCG
  • 544dd9e Upgrade to rand 0.10.1
  • a7499b8 Bump versions for release
  • 7c1970f proto: yield error on too many gaps in assembler
  • Additional commits viewable in compare view

Updates tar from 0.4.45 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits

Updates tar from 0.4.44 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

See also GHSA-3cv2-h65g-fgmm

Other changes

New Contributors

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Aug 3, 2026
Bumps the cargo group with 9 updates in the /codex-rs directory:

| Package | From | To |
| --- | --- | --- |
| [gix](https://github.com/GitoxideLabs/gitoxide) | `0.81.0` | `0.83.0` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `9.3.1` | `10.3.0` |
| [opentelemetry_sdk](https://github.com/open-telemetry/opentelemetry-rust) | `0.31.0` | `0.32.1` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.17.0` | `3.21.0` |
| [tar](https://github.com/composefs/tar-rs) | `0.4.45` | `0.4.46` |
| [actix-http](https://github.com/actix/actix-web) | `3.11.2` | `3.13.1` |
| [cmov](https://github.com/RustCrypto/utils) | `0.5.3` | `0.5.4` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.75` | `0.10.81` |
| [quinn-proto](https://github.com/quinn-rs/quinn) | `0.11.14` | `0.11.16` |

Bumps the cargo group with 1 update in the /tools/argument-comment-lint directory: [tar](https://github.com/composefs/tar-rs).


Updates `gix` from 0.81.0 to 0.83.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-v0.81.0...gix-v0.83.0)

Updates `jsonwebtoken` from 9.3.1 to 10.3.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v9.3.1...v10.3.0)

Updates `opentelemetry_sdk` from 0.31.0 to 0.32.1
- [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md)
- [Commits](open-telemetry/opentelemetry-rust@v0.31.0...opentelemetry-semantic-conventions-0.32.1)

Updates `serde_with` from 3.17.0 to 3.21.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.17.0...v3.21.0)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `actix-http` from 3.11.2 to 3.13.1
- [Release notes](https://github.com/actix/actix-web/releases)
- [Changelog](https://github.com/actix/actix-web/blob/main/CHANGES.md)
- [Commits](actix/actix-web@http-v3.11.2...http-v3.13.1)

Updates `cmov` from 0.5.3 to 0.5.4
- [Commits](RustCrypto/utils@cmov-v0.5.3...cmov-v0.5.4)

Updates `gix-fs` from 0.19.2 to 0.21.2
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-fs-v0.19.2...gix-fs-v0.21.2)

Updates `gix-pack` from 0.68.0 to 0.70.0
- [Release notes](https://github.com/GitoxideLabs/gitoxide/releases)
- [Changelog](https://github.com/GitoxideLabs/gitoxide/blob/main/CHANGELOG.md)
- [Commits](GitoxideLabs/gitoxide@gix-pack-v0.68.0...gix-pack-v0.70.0)

Updates `openssl` from 0.10.75 to 0.10.81
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.75...openssl-v0.10.81)

Updates `quinn-proto` from 0.11.14 to 0.11.16
- [Release notes](https://github.com/quinn-rs/quinn/releases)
- [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.16)

Updates `tar` from 0.4.45 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `tar` from 0.4.44 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

Updates `tar` from 0.4.44 to 0.4.46
- [Release notes](https://github.com/composefs/tar-rs/releases)
- [Commits](composefs/tar-rs@0.4.45...0.4.46)

---
updated-dependencies:
- dependency-name: actix-http
  dependency-version: 3.13.1
  dependency-type: indirect
- dependency-name: cmov
  dependency-version: 0.5.4
  dependency-type: indirect
- dependency-name: gix
  dependency-version: 0.83.0
  dependency-type: direct:production
- dependency-name: gix-fs
  dependency-version: 0.21.2
  dependency-type: indirect
- dependency-name: gix-pack
  dependency-version: 0.70.0
  dependency-type: indirect
- dependency-name: jsonwebtoken
  dependency-version: 10.3.0
  dependency-type: direct:production
- dependency-name: openssl
  dependency-version: 0.10.81
  dependency-type: indirect
- dependency-name: opentelemetry_sdk
  dependency-version: 0.32.1
  dependency-type: direct:production
- dependency-name: quinn-proto
  dependency-version: 0.11.16
  dependency-type: indirect
- dependency-name: serde_with
  dependency-version: 3.21.0
  dependency-type: direct:production
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: indirect
- dependency-name: tar
  dependency-version: 0.4.46
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/tools/argument-comment-lint/cargo-81229b0126 branch from 0a3d103 to 449a5ca Compare August 4, 2026 06:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants