Bump actions-rust-lang/rustfmt from 1.1.1 to 1.1.2

[dependabot]

Bumps actions-rust-lang/rustfmt from 1.1.1 to 1.1.2.

Release notes

Sourced from actions-rust-lang/rustfmt's releases.

v1.1.2

What's Changed

Fixed

• Fixed a command injection vulnerability via the manifest-path input parameter.

  The code was using GitHub action templates to inject the value directly into the shell command, which does not perform the necessary escaping. For fixing the issue, the value is passed via an environment variable, which performs the proper escaping. This is only an issue if the manifest-path parameter was set from some other untrusted source. Using a static string to call the action is safe.

  Thanks to @​mleblebici for reporting and fixing the issue.

New Contributors

• @​mleblebici made their first contribution in actions-rust-lang/rustfmt#9

Full Changelog: actions-rust-lang/rustfmt@v1.1.1...v1.1.2

Changelog

Sourced from actions-rust-lang/rustfmt's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.1.2] - 2025-12-14

Fixed

• Fixed a command injection vulnerability via the manifest-path input parameter.

  The code was using GitHub action templates to inject the value directly into the shell command, which does not perform the necessary escaping. For fixing the issue, the value is passed via an environment variable, which performs the proper escaping. This is only an issue if the manifest-path parameter was set from some other untrusted source. Using a static string to call the action is safe.

  Thanks to @​mleblebici for reporting and fixing the issue.

[1.1.1] - 2024-10-01

Fixed

• Parse the new rustfmt file and line number format

  The format changed in rust-lang/rustfmt#5971

  Thanks to @​0xcypher02 for pointing out the problem.

[1.1.0] - 2022-11-21

Added

• Add the input manifest-path to set the --manifest-path argument of rustfmt. #1 This allows formatting any cargo project in the repository independent of the location.

[1.0.1] - 2022-10-13

Changed

• Switch from set-output to $GITHUB_OUTPUT to avoid warning https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

[1.0.0] - 2022-07-19

Initial Version

Commits

• 4066006 Update changelog
• b6f69bb Merge pull request #9 from mleblebici/patch-1
• fcc2366 fix: mitigate command injection issue
• 2d2b6c0 Merge pull request #7 from actions-rust-lang/dependabot/github_actions/action...
• 852dcdb Bump actions/checkout from 5 to 6
• 5eeb7d2 Merge pull request #6 from actions-rust-lang/dependabot/github_actions/action...
• 5b27ffa Bump actions/checkout from 4 to 5
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)