chore(deps): bump the cargo-weekly group with 17 updates by dependabot[bot] · Pull Request #260 · foundry-rs/foundry-core

dependabot · 2026-10-16T22:14:01Z

Bumps the cargo-weekly group with 17 updates:

Package	From	To
zstd	`0.14.0`	`0.14.1`
zeroize	`1.9.0`	`1.9.1`
either	`1.18.0`	`1.19.0`
h2	`0.4.19`	`0.4.20`
hyper	`1.11.1`	`1.12.0`
jiff	`0.2.37`	`0.2.38`
jiff-static	`0.2.37`	`0.2.38`
jiff-tzdb	`0.1.8`	`0.1.9`
pest	`2.9.2`	`2.9.3`
serde_spanned	`1.1.1`	`1.1.2`
tokio-util	`0.7.19`	`0.7.20`
toml_datetime	`1.1.1+spec-1.1.0`	`1.1.2+spec-1.1.0`
toml_parser	`1.1.3+spec-1.1.0`	`1.1.5+spec-1.1.0`
toml_writer	`1.1.2+spec-1.1.0`	`1.1.3+spec-1.1.0`
windows-sys	`0.52.0`	`0.59.0`
zstd-safe	`8.0.0`	`8.2.0`
zstd-sys	`2.1.0+zstd.1.5.7`	`2.1.2+zstd.1.5.7`

Updates zstd from 0.14.0 to 0.14.1

Commits

9167d35 Release zstd 0.14.1, zstd-safe 8.1.0, and zstd-sys 2.1.1
b59becf Propagate C API deprecations through Rust bindings and wrappers
d8a325a Simplify Rust allocator constructors and test support
594e743 Delegate panicking dictionary constructors to fallible variants
779d39a Add fallible constructors for prepared dictionaries
fc5d2b7 Merge pull request #379 from gyscos/fix/pr-378-rust-allocator
18028cd Count actual newline bytes in dictionary training samples
0cb868f Fix Rust allocator validation and isolate allocation tests
3480b76 fix: formatting
f90a236 feat: check that cloning a context doesn't mix allocators
Additional commits viewable in compare view

Updates zeroize from 1.9.0 to 1.9.1

Commits

34a6ebc zeroize v1.9.1 (#1553)
e68c684 zeroize: test under cargo miri in CI (#1552)
4a53d7d Update Cargo.lock (#1545)
a2b1713 zeroize: fix fallback code used by optimization_barrier (#1551)
3c5aa70 ctutils v0.4.3 (#1550)
6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
f09945d ci: allow triggering workflows manually (#1543)
53493df dit v0.0.1-alpha (#1540)
c89949d Rename aarch64-dit to dit (#1539)
Additional commits viewable in compare view

Updates either from 1.18.0 to 1.19.0

Changelog

Sourced from either's changelog.

1.19.0 - 2026-10-06

Add is_left_or and is_right_or, by @A4-Tacks (#145)

Add #[inline] to fold functions, by @joshtriplett (#147)

Commits

1e4326d Merge pull request #148 from cuviper/release-1.19.0
5278988 Release 1.19.0
44a0670 Merge pull request #147 from joshtriplett/either-fold-inline
ecabe24 Add #[inline] to fold functions
50d4708 Merge pull request #145 from A4-Tacks/is-or
f9cbdd3 feat: Add is_left_or and is_right_or
See full diff in compare view

Updates h2 from 0.4.19 to 0.4.20

Release notes

Sourced from h2's releases.

v0.4.20

What's Changed

perf: decode two HPACK Huffman symbols per table lookup by @ArniDagur in hyperium/h2#927

perf: defer send buffer locking while receiving by @brentechols in hyperium/h2#933

perf: batch HPACK encoder writes per u32 by @seanmonstar in hyperium/h2#938

refactor: shrink HPACK encode tables by @seanmonstar in hyperium/h2#949

fix: reject GOAWAY frames with a non-zero stream identifier by @jaideeppyne in hyperium/h2#951

refactor: put decoder args onto a new FrameDecoder by @seanmonstar in hyperium/h2#953

chore: make CI have a single required job by @seanmonstar in hyperium/h2#954

style: apply clippy by @seanmonstar in hyperium/h2#955

fix: rare race during shutdown by @seanmonstar in hyperium/h2#956

fix(client): reject responses without :status by @0x676e67 in hyperium/h2#959

fix: count refused streams on local reset abuse counter by @seanmonstar in hyperium/h2#966

fix: reject duplicate content-lengths that differ by @seanmonstar in hyperium/h2#967

Update automatic DATA frame budget at runtime by @jeremyjpj0916 in hyperium/h2#965

fix: count reserved push promises against stream concurrency by @seanmonstar in hyperium/h2#968

perf: remove need to lock for pending_refusal for every recv call by @seanmonstar in hyperium/h2#969

Prepare v0.4.20 by @seanmonstar in hyperium/h2#970

New Contributors

@jaideeppyne made their first contribution in hyperium/h2#951

@jeremyjpj0916 made their first contribution in hyperium/h2#965

Full Changelog: hyperium/h2@v0.4.19...v0.4.20

Changelog

Sourced from h2's changelog.

0.4.20 (October 6, 2026)

Fix counting reserved push promises against stream concurrency limits.

Fix automatic small DATA frame budget to update when the connection window changes at runtime.

Fix rejecting duplicate content-length headers with different values.

Fix counting refused streams towards the local reset limit.

Fix client to reject responses without a :status pseudo header.

Fix rare race condition during shutdown.

Fix rejecting GOAWAY frames with a non-zero stream identifier.

Optimize HPACK Huffman encoding and decoding.

Reduce size of HPACK Huffman encoding tables.

Optimize receive performance by reducing send buffer locking.

Commits

b0e8908 v0.4.20
5b17a0e perf: remove need to lock for pending_refusal for every recv call (#969)
a26b427 fix: count reserved push promises against stream concurrency (#968)
96c15eb fix: update automatic DATA frame budget at runtime (#965)
d96d347 fix: reject duplicate content-lengths that differ (#967)
8e9655f fix: count refused streams on local reset abuse counter (#966)
3c5f61c fix(client): reject responses without :status (#959)
e43124b fix: rare race during shutdown (#956)
20cfc37 style: apply clippy (#955)
d785c5f chore: make CI have a single required job (#954)
Additional commits viewable in compare view

Updates hyper from 1.11.1 to 1.12.0

Release notes

Sourced from hyper's releases.

v1.12.0

Features

http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

Bug Fixes

http1:

withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)

remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)

always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)

let a Connection close token win over a later keep-alive (#4201) (5dadff76)

preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)

http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Everything

docs: fix typo responsibile -> responsible by @vaibhav8a in hyperium/hyper#4177

style: replace single-character lifetime names with descriptive names by @dox4 in hyperium/hyper#4173

refactor(http1): resolve collapsible_match lint by @nakaryo716 in hyperium/hyper#4178

hyper Improvement Proposals by @seanmonstar in hyperium/hyper#4131

perf(body): simpler custom Incoming channel by @seanmonstar in hyperium/hyper#4168

docs(maintainers): add 0x676e67 as a collaborator by @seanmonstar in hyperium/hyper#4184

fix(ext): remove broken OriginalHeaderOrder doctest by @cratelyn in hyperium/hyper#4188

build(deps): remove unused futures-channel from http1 feature by @0x676e67 in hyperium/hyper#4185

chore(ci): update to cargo-check-external-types 0.5.0 by @tottoto in hyperium/hyper#4189

style(lib): address ignored_unit_patterns lint by @nakaryo716 in hyperium/hyper#4193

Preserve hop-by-hop when setting close or keep-alive by @dtolnay in hyperium/hyper#4196

fix(http2): do not reserve capacity for idle Upgraded streams by @Dev-next-gen in hyperium/hyper#4198

style(lib): Address clippy panics and missing_panics_doc lints by @Siech0 in hyperium/hyper#4191

docs: fix typos in capi README, MSRV and governance docs by @toyeshhm in hyperium/hyper#4204

style(lib): Address trivial, low quantity clippy lints. by @Siech0 in hyperium/hyper#4190

chore(clippy): allow clippy lints following 1.99.0 release by @dswij in hyperium/hyper#4219

style: remove useless_borrows_in_formatting from the clippy allowlist by @ump45nose in hyperium/hyper#4220

style(h1): mark partial Debug impls as non-exhaustive by @badimalex in hyperium/hyper#4218

style(lib): Address cast-possible-truncation clippy findings. by @Siech0 in hyperium/hyper#4192

feat(http1): add max_header_size limit for server and client by @Aditya-9-6 in hyperium/hyper#4183

fix(http1): let a Connection close token win over a later keep-alive by @shoemoney in hyperium/hyper#4201

fix(http1): always remove content-length if transfer-encoding is sent by @seanmonstar in hyperium/hyper#4223

fix(http1): remove invalid content-length if transfer-encoding is auto-added by @seanmonstar in hyperium/hyper#4224

fix(http1): withdraw a stale want when the client dispatcher takes a request by @shodoco in hyperium/hyper#4208

perf(body): skip waking a closed peer when a channel end drops by @0x676e67 in hyperium/hyper#4225

Prepare v1.12.0 by @seanmonstar in hyperium/hyper#4226

New Contributors

@vaibhav8a made their first contribution in hyperium/hyper#4177

@dox4 made their first contribution in hyperium/hyper#4173

@dtolnay made their first contribution in hyperium/hyper#4196

@Dev-next-gen made their first contribution in hyperium/hyper#4198

@Siech0 made their first contribution in hyperium/hyper#4191

@toyeshhm made their first contribution in hyperium/hyper#4204

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.12.0 (2026-10-06)

Bug Fixes

http1:

withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)

remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)

always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)

let a Connection close token win over a later keep-alive (#4201) (5dadff76)

preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)

http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Features

http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

Commits

7f67699 v1.12.0
254bf12 perf(body): skip waking a closed peer when a channel end drops (#4225)
c44f1cc fix(http1): withdraw a stale want when the client dispatcher takes a request ...
69396fd fix(http1): remove content-length if transfer-encoding is auto-added (#4224)
a5d7fd7 fix(http1): always remove content-length if transfer-encoding is sent (#4223)
5dadff7 fix(http1): let a Connection close token win over a later keep-alive (#4201)
d1cd14e feat(http1): add max_header_size limit for server and client (#4183)
714c7cf style(lib): address cast-possible-truncation clippy findings (#4192)
0d47440 style(lib): mark partial Debug impls as non-exhaustive (#4218)
da3b1b1 style(lib): remove useless_borrows_in_formatting from the clippy allowlist (#...
Additional commits viewable in compare view

Updates jiff from 0.2.37 to 0.2.38

Changelog

Sourced from jiff's changelog.

0.2.38 (2026-10-06)

This release updates Jiff's bundled copy of the [IANA Time Zone Database] to 2026e. See the 2026e release announcement for more details.

Commits

4ce3e20 0.2.38
bca7bb9 jiff-tzdb-0.1.9
374afc2 jiff-tzdb: update to tzdb 2026e
5416198 doc: include readme in published crate
See full diff in compare view

Updates jiff-static from 0.2.37 to 0.2.38

Changelog

Sourced from jiff-static's changelog.

0.2.38 (2026-10-06)

This release updates Jiff's bundled copy of the [IANA Time Zone Database] to 2026e. See the 2026e release announcement for more details.

Commits

4ce3e20 0.2.38
bca7bb9 jiff-tzdb-0.1.9
374afc2 jiff-tzdb: update to tzdb 2026e
5416198 doc: include readme in published crate
See full diff in compare view

Updates jiff-tzdb from 0.1.8 to 0.1.9

Changelog

Sourced from jiff-tzdb's changelog.

0.1.9 (2024-08-23)

This release introduces new options for controlling the precision of fractional seconds when printing Zoned, Timestamp, civil::DateTime or civil::Time values. This is principally exposed via jiff::fmt::temporal::DateTimePrinter::precision, but it's also available via the standard library's formatting machinery. For example, if zdt is a jiff::Zoned, then format!("{zdt:.6}") will format it into a string with microsecond precision, even if its fractional component is zero.

Enhancements:

#92: Support setting the precision of fractional seconds when printing datetimes.

Commits

4ce3e20 0.2.38
bca7bb9 jiff-tzdb-0.1.9
374afc2 jiff-tzdb: update to tzdb 2026e
5416198 doc: include readme in published crate
4100a7c 0.2.37
c1febcb changelog: 0.2.37
7bd0c36 doc: fix include paths, redux
aa8008e Revert "doc: fix include paths"
8c2585c doc: fix include paths
7e81331 0.2.36
Additional commits viewable in compare view

Updates pest from 2.9.2 to 2.9.3

Release notes

Sourced from pest's releases.

v2.9.3

What's Changed

bump syn to 3 by @tomtau in pest-parser/pest#1210

Detect left recursion behind a prefix that can match empty (fixes #411) by @breken-ai in pest-parser/pest#1211

Limit parse depth by @tomtau in pest-parser/pest#1212

Remove reqwest dependency from pest_debugger by @tomtau with @Copilot in pest-parser/pest#1209

New Contributors

@breken-ai made their first contribution in pest-parser/pest#1211

Full Changelog: pest-parser/pest@v2.9.2...v2.9.3

Warning: Semantic Versioning

Note that the node tag feature in 2.6.0 was a technically semver-breaking change even though it is a backwards-compatible / non-breaking change in the meta-grammar. There may be similar non-breaking changes to the meta-grammar between minor versions in the future. These non-breaking changes, however, may translate into semver-breaking changes due to the additional variants propagated from the generated Rule enum.

This new feature caused issues in some Cargo version resolution situations where Cargo mixed different versions of pest dependencies. For this reason, these "grammar non-breaking but semver-breaking" changes are now available only under the "grammar-extras" feature flag. If you would like to use node tags (or other future grammar features), you can do so by enabling this flag on the pest_derive crate in your Cargo.toml:
...
pest_derive = { version = "2.9", features = ["grammar-extras"] }

Commits

4248cbd bump version to 2.9.3 (#1228)
429e893 Limit parse depth (#1212)
3cdface Detect left recursion behind a prefix that can match empty (fixes #411) (#1211)
9124917 Add AI contribution and usage policy (#1221)
9abf9e5 bump syn to 3 (#1210)
acf7fd9 Remove reqwest dependency from pest_debugger (#1209)
c32c2da Remove workflow-wide actions write permission (#1208)
See full diff in compare view

Updates serde_spanned from 1.1.1 to 1.1.2

Commits

f72038c chore: Release
1ae5851 docs: Update changelog
40edb38 perf(parser): Improve pre-allocation estimate (#1241)
23ba129 perf(parser): Improve pre-allocation estimate
9750f43 chore(deps): Update Rust Stable to v1.99 (#1227)
66cdc5e style: Make clippy happy
8ab3cc9 chore(deps): Update Rust Stable to v1.99
08ef261 bench: Include tokio's published manifest (#1232)
7054f9e bench: Include tokio's published manifest
3423628 chore(deps): Update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.1 (...
Additional commits viewable in compare view

Updates tokio-util from 0.7.19 to 0.7.20

Commits

5ec9e6b chore: prepare tokio-util v0.7.20 (#8608)
afd1b26 docs: fix stray braces and broken links in rustdoc (#8605)
3eb95a4 wasm: use sleep on emscripten without JSPI (#8528)
b22c802 wasm: link emscripten_promise_await for Emscripten 4.x compatibility (#8528)
16b1f9d ci: pin libc to 0.2.189 on FreeBSD (#8594)
b263675 time: clean up stale Err(Invalid) doc and typo (#8590)
5d5cd8b Merge 'tokio-1.53.2' into 'master' (#8578)
ff0c406 chore: prepare Tokio v1.53.2 (#8580)
a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
ec31a9f chore: prepare Tokio v1.51.5 (#8579)
Additional commits viewable in compare view

Updates toml_datetime from 1.1.1+spec-1.1.0 to 1.1.2+spec-1.1.0

Commits

f72038c chore: Release
1ae5851 docs: Update changelog
40edb38 perf(parser): Improve pre-allocation estimate (#1241)
23ba129 perf(parser): Improve pre-allocation estimate
9750f43 chore(deps): Update Rust Stable to v1.99 (#1227)
66cdc5e style: Make clippy happy
8ab3cc9 chore(deps): Update Rust Stable to v1.99
08ef261 bench: Include tokio's published manifest (#1232)
7054f9e bench: Include tokio's published manifest
3423628 chore(deps): Update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.1 (...
Additional commits viewable in compare view

Updates toml_parser from 1.1.3+spec-1.1.0 to 1.1.5+spec-1.1.0

Commits

ceac6e4 chore: Release
0fe9e93 docs: Update changelog
e3a64aa fix(display): Ensure all keys are encoded (#1245)
76484d0 fix(display): Ensure all keys are encoded
711b1ba refactor(display): Clarify that we are working with encoded keys
4f73ebd test(display): Reproduce the key bug
6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
4d45944 perf(parser): Remove no-op code (#1243)
189c91c perf(parser): Remove no-op code
Additional commits viewable in compare view

Updates toml_writer from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

f72038c chore: Release
1ae5851 docs: Update changelog
40edb38 perf(parser): Improve pre-allocation estimate (#1241)
23ba129 perf(parser): Improve pre-allocation estimate
9750f43 chore(deps): Update Rust Stable to v1.99 (#1227)
66cdc5e style: Make clippy happy
8ab3cc9 chore(deps): Update Rust Stable to v1.99
08ef261 bench: Include tokio's published manifest (#1232)
7054f9e bench: Include tokio's published manifest
3423628 chore(deps): Update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.1 (...
Additional commits viewable in compare view

Updates windows-sys from 0.52.0 to 0.59.0

Release notes

Sourced from windows-sys's releases.

0.59.0

This release includes an update to the windows-sys crate only. The windows-sys crate is updated very infrequently and only when there is an explicit need to do so. The 0.59.0 release includes a rollup of API fixes, updates, and additions since the 0.52.0 release nine months ago. Notably:

This update introduces support for Arm64EC (#2957)

Updated bindings for the latest APIs https://github.com/microsoft/windows-rs/tree/0.59.0/crates/libs/bindgen/default

Derive standard traits (#3041)

Updates to code generation to handle newer Rust warnings and lints

Overall smaller crate and more efficient code gen to reduce build time

Support for feature search https://microsoft.github.io/windows-rs/features/#/0.59.0

MSRV is updated to 1.60

Full Changelog: microsoft/windows-rs@0.52.0...0.59.0

0.58.0

This release includes updates to metadata for new or fixed API definitions (#3111, #3136), various improvements and fixes to code generation, compliance with new Rust warnings, additional COM authoring support improvements (#3065), limited non-Windows support (#3135), and more.

It includes major updates to the following crates, mainly due to breaking changes in metadata for API definitions.

riddle 0.58.0

windows 0.58.0

windows-bindgen 0.58.0

windows-core 0.58.0

windows-implement 0.58.0

windows-interface 0.58.0

windows-metadata 0.58.0

It also includes major updates to the following utility crates.

windows-result 0.2.0

windows-registry 0.2.0

The windows-result crate now provides limited non-Windows support, and the windows-registry crate offers new lossless queries for binary and wide string values.

And it includes minor updates to the windows-targets crates, with the addition of several new APIs.

windows-targets 0.52.6

This release also includes the first published version of the windows-strings crate, moving the string types from the windows-core crate into a dedicated crate as a smaller dependency. It also offers an efficient HSTRING builder (#3133).

To clarify, the only crates that continue to support limited non-Windows builds are:

windows-bindgen and windows-metadata for code generation on non-Windows platforms.

windows-core and windows-result for COM support on non-Windows platforms.

What's Changed

Fix default rustfmt for repo by @kennykerr in microsoft/windows-rs#3084

Simplify standalone test by calling windows-bindgen directly by @kennykerr in microsoft/windows-rs#3086

Disable docs and tests for test crates by @kennykerr in microsoft/windows-rs#3085

Simplify pointer writes in generated code by @kennykerr in microsoft/windows-rs#3089

Infer return type in generated bindings by @kennykerr in microsoft/windows-rs#3090

... (truncated)

Commits

308e08e Release 0.59.0 (#3182)
429666e Fix support for no_std (#3180)
02c4f29 Update component sample to use static factory (#3154)
7cec74f Implement static COM objects (#3144)
12f4621 Reduce boilerplate code in windows-core crate for VARIANT support (#3151)
db06b51 Release 0.58.0 (#3140)
ab03721 Make new windows-strings crate Windows-only (#3143)
f6c49f4 Ensure that HSTRING builder provides initialized memory (#3141)
12a60df Remove Future implementation (#3142)
9f96662 Implement Send and Sync for Weak\<T> (#3138)
Additional commits viewable in compare view

Updates zstd-safe from 8.0.0 to 8.2.0

Commits

75bc740 Release zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2
1c580b6 zstd-safe: keep the one-shot reset check inline
502ee2f zstd-safe: only reset after one-shot decompression if a stream may be open
5ded6e0 zstd-safe: apply rustfmt
e224018 zstd-safe: refuse to unload a dictionary under unfinished zstdmt jobs
6a1065b Stop a single_frame() decoder when finish_frame() ends the frame
c7156df Don't let finish_frame() start a frame nothing was read from
b0fb8a7 Add write::Decoder::finish() to report incomplete frames
ab34d01 Don't retry a panicked writer when dropping AutoFlushDecoder/AutoFinishEncoder
74ace2d Reset the borrowed context's session in raw::{Encoder,Decoder}::with_context
Additional commits viewable in compare view

Updates zstd-sys from 2.1.0+zstd.1.5.7 to 2.1.2+zstd.1.5.7

Commits

75bc740 Release zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2
1c580b6 zstd-safe: keep the one-shot reset check inline
502ee2f zstd-safe: only reset after one-shot decompression if a stream may be open
5ded6e0 zstd-safe: apply rustfmt
e224018 zstd-safe: refuse to unload a dictionary under unfinished zstdmt jobs
6a1065b Stop a single_frame() decoder when finish_frame() ends the frame
c7156df Don't let finish_frame() start a frame nothing was read from
b0fb8a7 Add write::Decoder::finish() to report incomplete frames
ab34d01 Don't retry a panicked writer when dropping AutoFlushDecoder/AutoFinishEncoder
74ace2d Reset the borrowed context's session in raw::{Encoder,Decoder}::with_context
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
`@dependabot unignore <de...

Description has been truncated

Bumps the cargo-weekly group with 17 updates: | Package | From | To | | --- | --- | --- | | [zstd](https://github.com/gyscos/zstd-rs) | `0.14.0` | `0.14.1` | | [zeroize](https://github.com/RustCrypto/utils) | `1.9.0` | `1.9.1` | | [either](https://github.com/rayon-rs/either) | `1.18.0` | `1.19.0` | | [h2](https://github.com/hyperium/h2) | `0.4.19` | `0.4.20` | | [hyper](https://github.com/hyperium/hyper) | `1.11.1` | `1.12.0` | | [jiff](https://github.com/BurntSushi/jiff) | `0.2.37` | `0.2.38` | | [jiff-static](https://github.com/BurntSushi/jiff) | `0.2.37` | `0.2.38` | | [jiff-tzdb](https://github.com/BurntSushi/jiff) | `0.1.8` | `0.1.9` | | [pest](https://github.com/pest-parser/pest) | `2.9.2` | `2.9.3` | | [serde_spanned](https://github.com/toml-rs/toml) | `1.1.1` | `1.1.2` | | [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.19` | `0.7.20` | | [toml_datetime](https://github.com/toml-rs/toml) | `1.1.1+spec-1.1.0` | `1.1.2+spec-1.1.0` | | [toml_parser](https://github.com/toml-rs/toml) | `1.1.3+spec-1.1.0` | `1.1.5+spec-1.1.0` | | [toml_writer](https://github.com/toml-rs/toml) | `1.1.2+spec-1.1.0` | `1.1.3+spec-1.1.0` | | [windows-sys](https://github.com/microsoft/windows-rs) | `0.52.0` | `0.59.0` | | [zstd-safe](https://github.com/gyscos/zstd-rs) | `8.0.0` | `8.2.0` | | [zstd-sys](https://github.com/gyscos/zstd-rs) | `2.1.0+zstd.1.5.7` | `2.1.2+zstd.1.5.7` | Updates `zstd` from 0.14.0 to 0.14.1 - [Release notes](https://github.com/gyscos/zstd-rs/releases) - [Commits](gyscos/zstd-rs@v0.14.0...v0.14.1) Updates `zeroize` from 1.9.0 to 1.9.1 - [Commits](RustCrypto/utils@zeroize-v1.9.0...zeroize-v1.9.1) Updates `either` from 1.18.0 to 1.19.0 - [Changelog](https://github.com/rayon-rs/either/blob/main/RELEASES.md) - [Commits](rayon-rs/either@1.18.0...1.19.0) Updates `h2` from 0.4.19 to 0.4.20 - [Release notes](https://github.com/hyperium/h2/releases) - [Changelog](https://github.com/hyperium/h2/blob/master/CHANGELOG.md) - [Commits](hyperium/h2@v0.4.19...v0.4.20) Updates `hyper` from 1.11.1 to 1.12.0 - [Release notes](https://github.com/hyperium/hyper/releases) - [Changelog](https://github.com/hyperium/hyper/blob/master/CHANGELOG.md) - [Commits](hyperium/hyper@v1.11.1...v1.12.0) Updates `jiff` from 0.2.37 to 0.2.38 - [Release notes](https://github.com/BurntSushi/jiff/releases) - [Changelog](https://github.com/BurntSushi/jiff/blob/master/CHANGELOG.md) - [Commits](BurntSushi/jiff@jiff-static-0.2.37...jiff-static-0.2.38) Updates `jiff-static` from 0.2.37 to 0.2.38 - [Release notes](https://github.com/BurntSushi/jiff/releases) - [Changelog](https://github.com/BurntSushi/jiff/blob/master/CHANGELOG.md) - [Commits](BurntSushi/jiff@jiff-static-0.2.37...jiff-static-0.2.38) Updates `jiff-tzdb` from 0.1.8 to 0.1.9 - [Release notes](https://github.com/BurntSushi/jiff/releases) - [Changelog](https://github.com/BurntSushi/jiff/blob/master/CHANGELOG.md) - [Commits](BurntSushi/jiff@jiff-tzdb-0.1.8...jiff-tzdb-0.1.9) Updates `pest` from 2.9.2 to 2.9.3 - [Release notes](https://github.com/pest-parser/pest/releases) - [Commits](pest-parser/pest@v2.9.2...v2.9.3) Updates `serde_spanned` from 1.1.1 to 1.1.2 - [Commits](toml-rs/toml@serde_spanned-v1.1.1...serde_spanned-v1.1.2) Updates `tokio-util` from 0.7.19 to 0.7.20 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-util-0.7.19...tokio-util-0.7.20) Updates `toml_datetime` from 1.1.1+spec-1.1.0 to 1.1.2+spec-1.1.0 - [Commits](toml-rs/toml@toml_datetime-v1.1.1...toml_datetime-v1.1.2) Updates `toml_parser` from 1.1.3+spec-1.1.0 to 1.1.5+spec-1.1.0 - [Commits](toml-rs/toml@toml_parser-v1.1.3...toml_parser-v1.1.5) Updates `toml_writer` from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0 - [Commits](toml-rs/toml@toml_writer-v1.1.2...toml_writer-v1.1.3) Updates `windows-sys` from 0.52.0 to 0.59.0 - [Release notes](https://github.com/microsoft/windows-rs/releases) - [Commits](microsoft/windows-rs@0.52.0...0.59.0) Updates `zstd-safe` from 8.0.0 to 8.2.0 - [Release notes](https://github.com/gyscos/zstd-rs/releases) - [Commits](gyscos/zstd-rs@zstd-safe-8.0.0...zstd-safe-8.2.0) Updates `zstd-sys` from 2.1.0+zstd.1.5.7 to 2.1.2+zstd.1.5.7 - [Release notes](https://github.com/gyscos/zstd-rs/releases) - [Commits](gyscos/zstd-rs@zstd-sys-2.1.0...zstd-sys-2.1.2) --- updated-dependencies: - dependency-name: zstd dependency-version: 0.14.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: zeroize dependency-version: 1.9.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: either dependency-version: 1.19.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-weekly - dependency-name: h2 dependency-version: 0.4.20 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: hyper dependency-version: 1.12.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-weekly - dependency-name: jiff dependency-version: 0.2.38 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: jiff-static dependency-version: 0.2.38 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: jiff-tzdb dependency-version: 0.1.9 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: pest dependency-version: 2.9.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: serde_spanned dependency-version: 1.1.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: tokio-util dependency-version: 0.7.20 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: toml_datetime dependency-version: 1.1.2+spec-1.1.0 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: toml_parser dependency-version: 1.1.5+spec-1.1.0 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: toml_writer dependency-version: 1.1.3+spec-1.1.0 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly - dependency-name: windows-sys dependency-version: 0.59.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-weekly - dependency-name: zstd-safe dependency-version: 8.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: cargo-weekly - dependency-name: zstd-sys dependency-version: 2.1.2+zstd.1.5.7 dependency-type: indirect update-type: version-update:semver-patch dependency-group: cargo-weekly ... Signed-off-by: dependabot[bot] <support@github.com>

pest 2.9.4, zstd-safe 8.2.0 and zstd-sys 2.1.2 were published on 2026-10-16, so Socket blocks their download in CI. Keep the previous releases until they age out.

Pulls in zip 9, which fixes RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369. zip stays at 9.0.1 because newer releases are still inside the Socket cooldown.

dependabot Bot requested review from DaniPopes, grandizzy and mattsse as code owners October 16, 2026 22:14

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 16, 2026

dependabot Bot requested review from 0xrusowsky, figtracer, mablr, onbjerg and stevencartavia as code owners October 16, 2026 22:14

dependabot Bot added the rust Pull requests that update rust code label Oct 16, 2026

fix(deps): hold back crates inside the Socket cooldown

23cbae4

pest 2.9.4, zstd-safe 8.2.0 and zstd-sys 2.1.2 were published on 2026-10-16, so Socket blocks their download in CI. Keep the previous releases until they age out.

DaniPopes mentioned this pull request Oct 17, 2026

fix(deps): bump zip to 9 alloy-rs/svm-rs#269

Merged

fix(deps): bump svm-rs to 0.5.30

84b2a81

Pulls in zip 9, which fixes RUSTSEC-2026-0367, RUSTSEC-2026-0368 and RUSTSEC-2026-0369. zip stays at 9.0.1 because newer releases are still inside the Socket cooldown.

mattsse approved these changes Oct 17, 2026

View reviewed changes

mattsse merged commit 4d4e592 into main Oct 17, 2026
21 checks passed

mattsse deleted the dependabot/cargo/cargo-weekly-96ed5e16a4 branch October 17, 2026 09:08

Navigation Menu

Repository navigation

chore(deps): bump the cargo-weekly group with 17 updates - #260

chore(deps): bump the cargo-weekly group with 17 updates#260
mattsse merged 3 commits into
mainfrom
dependabot/cargo/cargo-weekly-96ed5e16a4

dependabot Bot commented on behalf of github Oct 16, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 16, 2026

v0.4.20

What's Changed

New Contributors

0.4.20 (October 6, 2026)

v1.12.0

Features

Bug Fixes

Everything

New Contributors

v1.12.0 (2026-10-06)

Bug Fixes

Features

0.2.38 (2026-10-06)

0.2.38 (2026-10-06)

0.1.9 (2024-08-23)

v2.9.3

What's Changed

New Contributors

Warning: Semantic Versioning

0.59.0

0.58.0

What's Changed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants