chore(deps): bump the cargo group across 1 directory with 3 updates - #24
chore(deps): bump the cargo group across 1 directory with 3 updates#24dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the cargo group with 3 updates in the /rust_tauri_svelte directory: [quinn-proto](https://github.com/quinn-rs/quinn), [serde_with](https://github.com/jonasbb/serde_with) and [tar](https://github.com/composefs/tar-rs). Updates `quinn-proto` from 0.11.14 to 0.11.17 - [Release notes](https://github.com/quinn-rs/quinn/releases) - [Commits](quinn-rs/quinn@quinn-proto-0.11.14...quinn-proto-0.11.17) Updates `serde_with` from 3.18.0 to 3.22.0 - [Release notes](https://github.com/jonasbb/serde_with/releases) - [Commits](jonasbb/serde_with@v3.18.0...v3.22.0) Updates `tar` from 0.4.45 to 0.4.46 - [Release notes](https://github.com/composefs/tar-rs/releases) - [Commits](composefs/tar-rs@0.4.45...0.4.46) --- updated-dependencies: - dependency-name: quinn-proto dependency-version: 0.11.17 dependency-type: indirect dependency-group: cargo - dependency-name: serde_with dependency-version: 3.22.0 dependency-type: indirect dependency-group: cargo - dependency-name: tar dependency-version: 0.4.46 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
|
🤖 Review skipped: reviews for bot-created pull requests are not allowed on free accounts. Upgrade to a paid plan to enable bot reviews. |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
Up to standards ✅🟢 Issues
|
![llamapreview[bot]](https://avatars.githubusercontent.com/in/1023541?s=60&v=4){kind=small}
There was a problem hiding this comment.
LlamaPReview — Conditional code-review clear
This lockfile-only dependency bump is safe to merge: it updates three transitive crates and their dependencies coherently without changing any source, and it carries security fixes from the release notes.
Exact-head CI remains unresolved (29 failed); no CI-dependent merge-safety claim is made.
Review details and evidence
Material unknowns
- Whether the new lockfile resolves and compiles successfully for the rust_tauri_svelte crate. A successful
cargo checkorcargo metadata --lockedwould raise confidence to High; a reproducible resolution or compile failure caused by the new lockfile would become a blocking finding.- Check: Run a Rust build or resolution check against rust_tauri_svelte at PR head.
- Whether the full lockfile is internally consistent; only changed records and edges were read, not the entire file. A full read showing an inconsistent or duplicate edge would change the merge judgment; no exact-head evidence shows such a conflict.
- Check: Optionally read the complete lockfile to confirm no edge conflicts.
LlamaPReview checks
- Read the complete PR-head file
.github/workflows/rust-clippy.yml. - Reviewed changed regions in
rust_tauri_svelte/Cargo.lock. - Read bounded PR-head context from
rust_tauri_svelte/Cargo.lock.
LlamaPReview is an open-source pull request reviewer. Run the same reviewer on your own account.
Bumps the cargo group with 3 updates in the /rust_tauri_svelte directory: quinn-proto, serde_with and tar.
Updates
quinn-protofrom 0.11.14 to 0.11.17Release notes
Sourced from quinn-proto's releases.
Commits
0343120proto: bump version to 0.11.17d7bf3d0Limit total memory used to buffer outgoing datagrams31ca5d2Limit total memory used to buffer incoming datagrams3a78b60Factor out DatagramBuffer for queues in either directionb37ced3proto: check limits when processing already retired CIDs6a984b8proto: extract method for checking CID retirements499dba8proto: bound assembler chunk count regardless of over-allocation33ce0c2congestion: saturate CUBIC window increment to avoid overflowc8ad7e6fix(ci): fix clippy lintsa96949fTake semver-compatible update for anyhowUpdates
serde_withfrom 3.18.0 to 3.22.0Release notes
Sourced from serde_with's releases.
... (truncated)
Commits
88f576aBump version to 3.22.0 (#991)931e664Bump version to 3.22.0e26930eBump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group (...92cd5a0Bump github/codeql-action in the github-actions group32be66fGuard with_capacity_and_hasher against untrusted size_hint (DoS) (#971)33871cdMerge branch 'master' into fix/duplicate-key-impls-capacity-overflowbb1e064Change function position within impl (#968)202d3ddImprove the time unit macros to remove unnecessary repetition and make the co...b347efbMove theuse_duration_signed_ser/*_demacros utils6590545chrono_0_4: Implement the same time unit macro cleanup as jiff_0_2Updates
tarfrom 0.4.45 to 0.4.46Release notes
Sourced from tar's releases.
Commits
fc459c1Release 0.4.4643e05a8ci: Add crates.io trusted publishing workflowbba5666Update repo linkscd94c46docs: Document TOCTOU / concurrent-mutation threat model1b4997cbuilder: Expand docs for follow_symlinks and append_dir_allbab14ddarchive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm)2349b49Add support of absolute paths39d0311Update some links59d803eUpdate astral-tokio-tar requirement from 0.5 to 0.68296b9aci: Fix and re-enable reverse dependency testing (#444)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by Bito
Summary by cubic
Updates the cargo group in
rust_tauri_svelte:quinn-proto0.11.17,serde_with3.22.0, andtar0.4.46. These releases fix memory exhaustion and deserialization DoS issues.Written for commit 2b293b0. Summary will update on new commits.