Bump the cargo group across 1 directories with 6 updates by dependabot[bot] · Pull Request #14 · gbip/sentry_tunnel

dependabot · 2024-01-09T15:07:57Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the cargo group with 6 updates in the /. directory:

Package	From	To
tokio	`1.12.0`	`1.16.1`
bumpalo	`3.7.1`	`3.14.0`
crossbeam-utils	`0.8.5`	`0.8.19`
h2	`0.3.6`	`0.3.22`
openssl-src	`111.16.0+1.1.1l`	`111.25.0+1.1.1t`
regex	`1.5.4`	`1.7.3`

Updates tokio from 1.12.0 to 1.16.1

Release notes

Sourced from tokio's releases.

Tokio v1.16.1

1.16.1 (January 28, 2022)

This release fixes a bug in #4428 with the change #4437.

#4428: tokio-rs/tokio#4428 #4437: tokio-rs/tokio#4437

Tokio v1.16.0

Fixes a soundness bug in io::Take (#4428). The unsoundness is exposed when leaking memory in the given AsyncRead implementation and then overwriting the supplied buffer:
impl AsyncRead for Buggy {
    fn poll_read(
        self: Pin<&mut Self>,
        cx: &mut Context<'_>,
        buf: &mut ReadBuf<'_>
    ) -> Poll<Result<()>> {
      let new_buf = vec![0; 5].leak();
      *buf = ReadBuf::new(new_buf);
      buf.put_slice(b"hello");
      Poll::Ready(Ok(()))
    }
}
Also, this release includes improvements to the multi-threaded scheduler that can increase throughput by up to 20% in some cases (#4383).

Fixed

io: soundness don't expose uninitialized memory when using io::Take in edge case (#4428)

fs: ensure File::write results in a write syscall when the runtime shuts down (#4316)

process: drop pipe after child exits in wait_with_output (#4315)

rt: improve error message when spawning a thread fails (#4398)

rt: reduce false-positive thread wakups in the multi-threaded scheduler (#4383)

sync: don't inherit Send from parking_lot::*Guard (#4359)

Added

net: TcpSocket::linger() and set_linger() (#4324)

net: impl UnwindSafe for socket types (#4384)

rt: impl UnwindSafe for JoinHandle (#4418)

sync: watch::Receiver::has_changed() (#4342)

sync: oneshot::Receiver::blocking_recv() (#4334)

sync: RwLock blocking operations (#4425)

Unstable

... (truncated)

Commits

91b9850 chore: prepare Tokio v1.16.1 release (#4438)
3c46705 io: fix take pointer check (#4437)
afd2189 chore: prepare Tokio v1.16 release (#4431)
986b88b chore: update year in LICENSE files (#4429)
257053e util: add spawn_pinned (#3370)
5af9e0d sync: add blocking lock methods to RwLock (#4425)
8f77ee8 net: add generic trait to combine UnixListener and TcpListener (#4385)
2747043 tests: enable running wasm32-unknown-unknown tests (#4421)
2a5071f feat: implement Framed::map_codec (#4427)
621790e io: fix take when using evil reader (#4428)
Additional commits viewable in compare view

Updates bumpalo from 3.7.1 to 3.14.0

Changelog

Sourced from bumpalo's changelog.

3.14.0

Released 2023-09-14.

Added

Added the std cargo feature, which enables implementations of std traits for various things. Right now that is just std::io::Write for bumpalo::collections::Vec, but could be more in the future.

3.13.0

Released 2023-05-22.

Added

New "allocator-api2" feature enables the use of the allocator API on stable. This feature uses a crate that mirrors the API of the unstable Rust allocator_api feature. If the feature is enabled, references to Bump will implement allocator_api2::Allocator. This allows Bump to be used as an allocator for collection types from allocator-api2 and any other crates that support allocator-api2.

Changed

The minimum supported Rust version (MSRV) is now 1.63.0.

3.12.2

Released 2023-05-09.

Changed

Added rust-version metadata to Cargo.toml which helps cargo with version resolution.

3.12.1

Released 2023-04-21.

Fixed

Fixed a bug where Bump::try_with_capacity(n) where n > isize::MAX could lead to attempts to create invalid Layouts.

... (truncated)

Commits

c610d5a Bump to version 3.14.0
7dbb89c Merge pull request #216 from marmeladema/std-io-write
cdaaae1 Implement std::io::Write for Vec\<'bump, u8>
86c63a4 Merge pull request #214 from waywardmonkeys/typo-fixes
9c6c38f Fix some typos.
9be533b Merge pull request #212 from waywardmonkeys/clippy-unnecessary-cast
4d4cb90 clippy: Remove unneccessary casts.
2c3ded0 Merge pull request #211 from frisoft/main
b6ea857 Merge pull request #1 from frisoft/update-license-field
abac21c Update license field following SPDX 2.1 license expression standard
Additional commits viewable in compare view

Updates crossbeam-utils from 0.8.5 to 0.8.19

Release notes

Sourced from crossbeam-utils's releases.

crossbeam-utils 0.8.19

Remove dependency on cfg-if. (#1072)

crossbeam-utils 0.8.18

Relax the minimum supported Rust version to 1.60. (#1056)

Improve scalability of AtomicCell fallback. (#1055)

crossbeam-utils 0.8.17

Bump the minimum supported Rust version to 1.61. (#1037)

Improve support for targets without atomic CAS or 64-bit atomic. (#1037)

Always implement UnwindSafe and RefUnwindSafe for AtomicCell. (#1045)

Improve compatibility with Miri, TSan, and loom. (#995, #1003)

Improve compatibility with unstable oom=panic. (#1045)

Improve implementation of CachePadded. (#1014, #1025)

Update loom dependency to 0.7.

crossbeam-utils 0.8.16

Improve implementation of CachePadded. (#967)

crossbeam-utils 0.8.15

Add #[clippy::has_significant_drop] to ShardedLock{Read,Write}Guard. (#958)

Improve handling of very large timeout. (#953)

Soft-deprecate thread::scope() in favor of the more efficient std::thread::scope that stabilized on Rust 1.63. (#954)

crossbeam-utils 0.8.14

Fix build script bug introduced in 0.8.13. (#932)

crossbeam-utils 0.8.13

Improve support for custom targets. (#922)

crossbeam-utils 0.8.12

Remove the dependency on the once_cell crate to restore the MSRV. (#913)

Work around rust-lang#98302, which causes compile error on windows-gnu when LTO is enabled. (#913)

crossbeam-utils 0.8.11

Bump the minimum supported Rust version to 1.38. (#877)

crossbeam-utils 0.8.10

Fix unsoundness of AtomicCell on types containing niches. (#834) This fix contains breaking changes, but they are allowed because this is a soundness bug fix. See #834 for more.

crossbeam-utils 0.8.9

Replace lazy_static with once_cell. (#817)

crossbeam-utils 0.8.8

Fix a bug when unstable loom support is enabled. (#787)

crossbeam-utils 0.8.7

Add AtomicCell<{i*,u*}>::{fetch_max,fetch_min}. (#785)

Add AtomicCell<{i*,u*,bool}>::fetch_nand. (#785)

... (truncated)

Commits

9c3182a Prepare for the next release
35a55d2 Remove dependency on cfg-if
0935295 epoch: Remove unused autocfg dependency
e02133b Use const thread_local
5a15fc2 More correct buffer allocation
7389cdf ci: Remove scripts that call single command
4ef4f09 Ignore dead_code warnings for tuple structs
95d0bd0 Prepare for the next release
65f0b07 Automatically cancel outdated CI runs on PR
ecc994e Update compile_fail doctest
Additional commits viewable in compare view

Updates h2 from 0.3.6 to 0.3.22

Release notes

Sourced from h2's releases.

v0.3.22

What's Changed

Add header_table_size(usize) option to client and server builders.

Improve throughput when vectored IO is not available.

Update indexmap to 2.

New Contributors

@tottoto made their first contribution in hyperium/h2#714

@xiaoyawei made their first contribution in hyperium/h2#712

@Protryon made their first contribution in hyperium/h2#719

@4JX made their first contribution in hyperium/h2#638

@vuittont60 made their first contribution in hyperium/h2#724

v0.3.21

What's Changed

Fix opening of new streams over peer's max concurrent limit.

Fix RecvStream to return data even if it has received a CANCEL stream error.

Update MSRV to 1.63.

New Contributors

@DDtKey made their first contribution in hyperium/h2#703

@jwilm made their first contribution in hyperium/h2#707

v0.3.20

Bug Fixes

Fix panic if a server received a request with a :status pseudo header in the 1xx range. (#695)

Fix panic if a reset stream had pending push promises that were more than allowed. (#685)

Fix potential flow control overflow by subtraction, instead returning a connection error. (#692)

New Contributors

@f0rki made their first contribution in hyperium/h2#690

v0.3.19

What's Changed

Fix counting reset streams when triggered by a GOAWAY.

Send too_many_resets in opaque debug data of GOAWAY when too many resets received.

New Contributors

@Herbstein made their first contribution in hyperium/h2#673

@foresterre made their first contribution in hyperium/h2#680

v0.3.18

What's Changed

fix: pending-accept remotely-reset streams pattern was checking is_local by @seanmonstar in hyperium/h2#676

v0.3.17

What's Changed

Add Error::is_library() method to check if the originated inside h2.

Add max_pending_accept_reset_streams(usize) option to client and server

... (truncated)

Changelog

Sourced from h2's changelog.

0.3.22 (November 15, 2023)

Add header_table_size(usize) option to client and server builders.

Improve throughput when vectored IO is not available.

Update indexmap to 2.

0.3.21 (August 21, 2023)

Fix opening of new streams over peer's max concurrent limit.

Fix RecvStream to return data even if it has received a CANCEL stream error.

Update MSRV to 1.63.

0.3.20 (June 26, 2023)

Fix panic if a server received a request with a :status pseudo header in the 1xx range.

Fix panic if a reset stream had pending push promises that were more than allowed.

Fix potential flow control overflow by subtraction, instead returning a connection error.

0.3.19 (May 12, 2023)

Fix counting reset streams when triggered by a GOAWAY.

Send too_many_resets in opaque debug data of GOAWAY when too many resets received.

0.3.18 (April 17, 2023)

Fix panic because of opposite check in is_remote_local().

0.3.17 (April 13, 2023)

Add Error::is_library() method to check if the originated inside h2.

Add max_pending_accept_reset_streams(usize) option to client and server builders.

Fix theoretical memory growth when receiving too many HEADERS and then RST_STREAM frames faster than an application can accept them off the queue. (CVE-2023-26964)

0.3.16 (February 27, 2023)

Set Protocol extension on requests when received Extended CONNECT requests.

Remove B: Unpin + 'static bound requiremented of bufs

Fix releasing of frames when stream is finished, reducing memory usage.

Fix panic when trying to send data and connection window is available, but stream window is not.

Fix spurious wakeups when stream capacity is not available.

0.3.15 (October 21, 2022)

Remove B: Buf bound on SendStream's parameter

add accessor for StreamId u32

0.3.14 (August 16, 2022)

... (truncated)

Commits

0f412d8 v0.3.22
c7ca62f docs: fix typos (#724)
ef743ec Add a setter for header_table_size (#638)
56651e6 fix lint about unused import
4aa7b16 Fix documentation for max_send_buffer_size (#718)
d03c54a chore(dependencies): update tracing minimal version to 0.1.35
3cdef96 fix(test): mark h2-support as private crate
05cf352 chore(ci): add minimal versions checking on stable rust
cbe7744 chore(ci): update to actions/checkout@v4 (#716)
1f247de Update indexmap to version 2 (#698)
Additional commits viewable in compare view

Updates openssl-src from 111.16.0+1.1.1l to 111.25.0+1.1.1t

Commits

See full diff in compare view

Updates regex from 1.5.4 to 1.7.3

Changelog

Sourced from regex's changelog.

1.7.3 (2023-03-24)

This is a small release that fixes a bug in Regex::shortest_match_at that could cause it to panic, even when the offset given is valid.

Bug fixes:

[BUG #969](rust-lang/regex#969): Fix a bug in how the reverse DFA was called for Regex::shortest_match_at.

1.7.2 (2023-03-21)

This is a small release that fixes a failing test on FreeBSD.

Bug fixes:

[BUG #967](rust-lang/regex#967): Fix "no stack overflow" test which can fail due to the small stack size.

1.7.1 (2023-01-09)

This release was done principally to try and fix the doc.rs rendering for the regex crate.

Performance improvements:

[PERF #930](rust-lang/regex#930): Optimize replacen. This also applies to replace, but not replace_all.

Bug fixes:

[BUG #945](rust-lang/regex#945): Maybe fix rustdoc rendering by just bumping a new release?

1.7.0 (2022-11-05)

This release principally includes an upgrade to Unicode 15.

New features:

[FEATURE #832](rust-lang/regex#916): Upgrade to Unicode 15.

1.6.0 (2022-07-05)

This release principally includes an upgrade to Unicode 14.

... (truncated)

Commits

9582040 1.7.3
9562ccd changelog: 1.7.3
d94f955 dfa: fix bug in how the reverse DFA is called
32fed94 1.7.2
6a7ba1e deps: bump to regex-syntax 0.6.29
72d482f regex-syntax-0.6.29
48b3ba4 changelog: 1.7.2
d8e22dd syntax: tweak the "no stack overflow" test
a9b2e02 1.7.1
98c1b63 changelog: 1.7.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the cargo group with 6 updates in the /. directory: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.12.0` | `1.16.1` | | [bumpalo](https://github.com/fitzgen/bumpalo) | `3.7.1` | `3.14.0` | | [crossbeam-utils](https://github.com/crossbeam-rs/crossbeam) | `0.8.5` | `0.8.19` | | [h2](https://github.com/hyperium/h2) | `0.3.6` | `0.3.22` | | [openssl-src](https://github.com/alexcrichton/openssl-src-rs) | `111.16.0+1.1.1l` | `111.25.0+1.1.1t` | | [regex](https://github.com/rust-lang/regex) | `1.5.4` | `1.7.3` | Updates `tokio` from 1.12.0 to 1.16.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.12.0...tokio-1.16.1) Updates `bumpalo` from 3.7.1 to 3.14.0 - [Changelog](https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md) - [Commits](fitzgen/bumpalo@3.7.1...3.14.0) Updates `crossbeam-utils` from 0.8.5 to 0.8.19 - [Release notes](https://github.com/crossbeam-rs/crossbeam/releases) - [Changelog](https://github.com/crossbeam-rs/crossbeam/blob/master/CHANGELOG.md) - [Commits](crossbeam-rs/crossbeam@crossbeam-utils-0.8.5...crossbeam-utils-0.8.19) Updates `h2` from 0.3.6 to 0.3.22 - [Release notes](https://github.com/hyperium/h2/releases) - [Changelog](https://github.com/hyperium/h2/blob/master/CHANGELOG.md) - [Commits](hyperium/h2@v0.3.6...v0.3.22) Updates `openssl-src` from 111.16.0+1.1.1l to 111.25.0+1.1.1t - [Release notes](https://github.com/alexcrichton/openssl-src-rs/releases) - [Commits](https://github.com/alexcrichton/openssl-src-rs/commits) Updates `regex` from 1.5.4 to 1.7.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](rust-lang/regex@1.5.4...1.7.3) --- updated-dependencies: - dependency-name: tokio dependency-type: direct:production dependency-group: cargo-security-group - dependency-name: bumpalo dependency-type: indirect dependency-group: cargo-security-group - dependency-name: crossbeam-utils dependency-type: indirect dependency-group: cargo-security-group - dependency-name: h2 dependency-type: indirect dependency-group: cargo-security-group - dependency-name: openssl-src dependency-type: indirect dependency-group: cargo-security-group - dependency-name: regex dependency-type: indirect dependency-group: cargo-security-group ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Jan 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the cargo group across 1 directories with 6 updates#14

Bump the cargo group across 1 directories with 6 updates#14
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/cargo-security-group-546d0d1cda

dependabot bot commented on behalf of github Jan 9, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Jan 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Tokio v1.16.1

1.16.1 (January 28, 2022)

Tokio v1.16.0

Fixed

Added

Unstable

3.14.0

Added

3.13.0

Added

Changed

3.12.2

Changed

3.12.1

Fixed

crossbeam-utils 0.8.19

crossbeam-utils 0.8.18

crossbeam-utils 0.8.17

crossbeam-utils 0.8.16

crossbeam-utils 0.8.15

crossbeam-utils 0.8.14

crossbeam-utils 0.8.13

crossbeam-utils 0.8.12

crossbeam-utils 0.8.11

crossbeam-utils 0.8.10

crossbeam-utils 0.8.9

crossbeam-utils 0.8.8

crossbeam-utils 0.8.7

v0.3.22

What's Changed

New Contributors

v0.3.21

What's Changed

New Contributors

v0.3.20

Bug Fixes

New Contributors

v0.3.19

What's Changed

New Contributors

v0.3.18

What's Changed

v0.3.17

What's Changed

0.3.22 (November 15, 2023)

0.3.21 (August 21, 2023)

0.3.20 (June 26, 2023)

0.3.19 (May 12, 2023)

0.3.18 (April 17, 2023)

0.3.17 (April 13, 2023)

0.3.16 (February 27, 2023)

0.3.15 (October 21, 2022)

0.3.14 (August 16, 2022)

1.7.3 (2023-03-24)

1.7.2 (2023-03-21)

1.7.1 (2023-01-09)

1.7.0 (2022-11-05)

1.6.0 (2022-07-05)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jan 9, 2024 •

edited

Loading