chore(deps): bump the cargo group across 1 directory with 2 updates

[dependabot]

Bumps the cargo group with 2 updates in the / directory: suppaftp and ureq.

Updates suppaftp from 6.3.0 to 12.1.1

Release notes

Sourced from suppaftp's releases.

v12.1.1

12.1.1

Released on 2026-09-28

Fixed

• report a control connection closed before the reply as EOF (#184)

When the server closed the control connection before sending any byte of a reply, the sync, tokio and smol clients returned FtpError::BadResponse, as if the server had sent a malformed reply. EOF in the middle of a multiline reply was already reported as FtpError::ConnectionError with ErrorKind::UnexpectedEof; EOF before the first line now is too, so callers can tell a dropped connection from a broken server.

In the async clients, a first line that a cancelled read left unfinished is still parsed at EOF, as before, the same way the sync client parses a first line that ends at EOF.

v12.1.0

12.1.0

Released on 2026-09-25

Fixed

• bound the size of control-connection replies (#179)

The reply reader used read_until without a byte limit, and a multiline reply was gathered until its terminal line, so a server could make the client buffer without bound, starting with the greeting before any authentication. The same held for the continuation lines feat reads.

A reply may now take at most 256 KiB, every line included. Past that, the sync, tokio and smol clients fail with FtpError::ConnectionError holding the new public ReplyTooLarge, without reading further. The async readers keep their cancellation safety: bytes already held from a cancelled read count toward the same bound.

• accept active-mode data connections only from the server (#181)

In active mode the client listened for the data connection and took whichever one arrived first, only logging its address. Anyone able to reach the listener could connect before the server and hand the client a forged listing or download, or receive an upload meant for the server.

The sync, tokio and smol clients now accept the data connection only from an address allowed by ActivePeerCheck. The default,

... (truncated)

Changelog

Sourced from suppaftp's changelog.

12.1.1

Released on 2026-09-28

Fixed

• report a control connection closed before the reply as EOF (#184)

When the server closed the control connection before sending any byte of a reply, the sync, tokio and smol clients returned FtpError::BadResponse, as if the server had sent a malformed reply. EOF in the middle of a multiline reply was already reported as FtpError::ConnectionError with ErrorKind::UnexpectedEof; EOF before the first line now is too, so callers can tell a dropped connection from a broken server.

In the async clients, a first line that a cancelled read left unfinished is still parsed at EOF, as before, the same way the sync client parses a first line that ends at EOF.

12.1.0

Released on 2026-09-25

Fixed

• bound the size of control-connection replies (#179)

The reply reader used read_until without a byte limit, and a multiline reply was gathered until its terminal line, so a server could make the client buffer without bound, starting with the greeting before any authentication. The same held for the continuation lines feat reads.

A reply may now take at most 256 KiB, every line included. Past that, the sync, tokio and smol clients fail with FtpError::ConnectionError holding the new public ReplyTooLarge, without reading further. The async readers keep their cancellation safety: bytes already held from a cancelled read count toward the same bound.

• accept active-mode data connections only from the server (#181)

In active mode the client listened for the data connection and took whichever one arrived first, only logging its address. Anyone able to reach the listener could connect before the server and hand the client a forged listing or download, or receive an upload meant for the server.

The sync, tokio and smol clients now accept the data connection only from an address allowed by ActivePeerCheck. The default, ControlPeer, accepts only the server on the control connection. Any accepts every address, as before this check existed. Allow

... (truncated)

Commits

• c5d0e1a chore: release 12.1.1 (#185)
• 1daf405 fix: report a control connection closed before the reply as EOF (#184)
• c841f5e chore: release 12.1.0
• 7d2ef53 fix: accept active-mode data connections only from the server (#181)
• 0952f3b fix: bound the size of control-connection replies (#179)
• 1cec113 fix: expose TLS connector traits (#177)
• 38f17ee feat!: make data streams finalize themselves (#175)
• f3b22c1 chore: release 11.0.0
• 95fb2a4 fix(smol)!: close retrieval streams gracefully
• 65e7939 fix(tokio)!: send close_notify on finalize_retr_stream
• Additional commits viewable in compare view

Updates ureq from 2.12.1 to 3.4.2

Changelog

Sourced from ureq's changelog.

3.4.2

• Bump ureq-proto to 0.6.3 (fixes network-path references in redirects)
• Bypass pooling for request connection settings incompatible with the Agent #1201
• Try the next resolved address on unreachable/unavailable connect errors #1195

3.4.1

• Bump ureq-proto to 0.6.2 (fixes to parsing and headers) #1199
• Do not pool connections with unconsumed buffered input #1198
• Fix timeout budgets restarting and applying to later phases #1194
• Complete TLS handshake during connect so timeout_connect covers it #1193
• Speed up read_json for responses with a known, small body size #1191

3.4.0

• Seal RequestExt (technically breaking) #1189
• Send canonical Basic authentication scheme to CONNECT proxies #1185
• Establish target TLS through HTTPS CONNECT proxies #1183
• Update rustls-platform-verifier to 0.7.0 #1174
• Fix pooled connections never aging out according to max_idle_age #1172
• Strip brackets from IPv6-literal hosts before TLS SNI/ServerName #1171
• RequestExt::middleware_config for conf inside middleware #1169

3.3.0

• Bump MSRV 1.71 -> 1.85, edition 2024 #1167

3.2.1

• Switch archived utf-8 crate for utf8-zero #1163

3.2.0

• Strip Content-Encoding/Content-Length headers after decompression #1156
• Timeout per resolved ip for try_connect #1152
• Fix body header bug on redirect #1140
• ureq-proto 0.5.3 to fix unsolicited 100-continue #1139
• Make socks5:// locally resolve before calling proxy #1138
• Add socks5h:// which DOESN'T locally resolve before calling proxy #1138

3.1.4

• Set content-type with new Multipart form #1133

3.1.3

• Fix short read with multi-byte charset #1131
• Replace rustls-pemfile usage with rustls-pki-types #1122
• Support for env NO_PROXY and proxy config #1118

... (truncated)

Commits

• 2e9ef24 3.4.2
• b983841 Bump ureq-proto to 0.6.3
• 075a1d7 Respect request connection settings when pooling
• fb634de Try the next resolved address when a connect fails for that address only (#1195)
• cf4a3cd 3.4.1
• 9559d7b Bump ureq-proto to 0.6.2 (#1199)
• 9eb654c Do not pool a connection with unconsumed input (#1198)
• 5b81318 Anchor timeout budgets to phase boundaries (#1194)
• d480543 Complete TLS handshakes while connecting (#1193)
• 662410b Buffer read_json into memory when Content-Length is below the limit (#1191)
• Additional commits viewable in compare view

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml