continuwuation/continuwuity

Fork 125

chore(deps): update rust-zerover-patch-updates #2203

Open

renovate wants to merge 1 commit from renovate/rust-zerover-patch-updates into main

renovate commented

2026-08-30 05:04:28 +00:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
hickory-resolver (source)	workspace.dependencies	patch	`0.26.1` → `0.26.2`
termimad	workspace.dependencies	patch	`0.35.2` → `0.35.3`
tokio-metrics (source)	workspace.dependencies	patch	`0.5.1` → `0.5.2`
tower-http	workspace.dependencies	patch	`0.7.0` → `0.7.1`

Release Notes

hickory-dns/hickory-dns (hickory-resolver)

`v0.26.2`

Compare Source

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY
GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names
GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing
GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies
GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request
GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit
GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records
GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS
GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup
GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL
GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization

Special thanks go out to @qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @ATinyShoe, @kirk-baird, @thesmartshadow, @BeaCox, @jpds, @N0zoM1z0, and @JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @djc for commercial support.

What's Changed

Reintroduce LookupIp into_iter by @tisonkun in #3639
fix(resolver): thread bind_addr through TLS and HTTPS connections (backport to 0.26) by @kakarot-dev in #3654
Raise minimum versions of dependencies by @divergentdave in #3661
Canonicalize addresses consistently - 0.26 backport by @divergentdave in #3687
fix: apply per-request timeout for DoH, DoQ, and DoH3 (0.26 backport) by @dsundquist in #3686
fix(proto): verify RSASHA1-NSEC3-SHA1 (alg 7) with the same crypto as RSASHA1 (0.26 backport) by @edevil in #3693
Add simple constructor for ResolverConfig by @divergentdave in #3710
resolver: reconnect once when a reused pooled connection was closed (backport to 0.26) by @cf-rhett in #3719
Update quinn-proto - backport by @divergentdave in #3748
server: return NXDOMAIN for SOA queries on non-existent names (backport to 0.26) by @eyupcanakman in #3724
Remove recursion from domain::name::read_inner (backport to 0.26) by @aochagavia in #3752
Update anyhow to 1.0.103 - backport by @divergentdave in #3761
add drop_privileges config option to skip privilege dropping - backport by @Webrowse in #3763
Server: copy the DO bit of the query in the response (backport to 0.26) by @aochagavia in #3766
tests: fix Ed25519 key encoding (0.26 backport) by @djc in #3772
Update crossbeam-epoch - backport by @divergentdave in #3777
Fix Clippy lints - backport by @divergentdave in #3780
fix(server): backport CNAME answer section fix to 0.26 by @mortn in #3783
backport r0.26: Fix DS::from_key not using DNSKEY RDATA by @AlveElde in #3787
release/0.26 backport: Include CNAME records when calculating minimum TTL for caching purposes by @sejoker in #3794
resolver: parse packed system search domains (backport to 0.26) by @cf-rhett in #3803
bin: better error when a store type needs a disabled Cargo feature by @Webrowse in #3810
release/0.26 backport: recursor: add config for qname minimization with relaxed mode. by @avnyu in #3809
resolver: Export per-connection query metrics (backport to 0.26) by @pdelong in #3821
backport r0.26: Limit non-EDNS UDP responses to 512 by @AlveElde in #3825
proto: Implement size_hint for RecordSet iterators (backport to 0.26) by @WinterCore in #3826
Update h2 to 0.4.16 - backport by @divergentdave in #3840
Fix CI on release/0.26 branch by @divergentdave in #3862
Allow absolute blocklist paths (0.26 backport) by @liff in #3864
Security fixes (release/0.26, part 1) by @divergentdave in #3870
Security fixes (release/0.26, part 2) by @divergentdave in #3871

New Contributors

@dsundquist made their first contribution in #3686
@sejoker made their first contribution in #3794

Full Changelog: https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2

Canop/termimad (termimad)

`v0.35.3`

fix CropWriter::queue_char and queue_unstyled_char never writing in the last allowed column
CropWriter::queue_char replaces tabs like queue_unstyled_char does
a char which doesn't fit the remaining width stops CropWriter's char-level writing, instead of letting a following narrower char take its column

tokio-rs/tokio-metrics (tokio-metrics)

`v0.5.2`

Compare Source

Added

add per-request task metrics via FutureMonitor (#127)

Fixed

add explicit Value shape and unit to metrique bridge (#134)

Other

update release-plz action to v0.5.127 (#133)

tower-rs/tower-http (tower-http)

`v0.7.1`

Compare Source

Added

fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

behavioral change: fs: make ServeDir::try_call propagate expected filesystem
I/O errors when no fallback is configured, as documented, instead of converting
them to 404 Not Found responses (#718)
decompression: don't end the body when a data frame with no remaining bytes
arrives after the decompressor reports end-of-stream. Trailers following such a
frame were dropped and could not be recovered (#722)
decompression: return a body error when a data frame with remaining bytes
arrives after the decompressor reports end-of-stream, rather than silently
truncating. This regressed in 0.7.0 (#712)
fs: multipart range requests are now rejected before range validation, so
they consistently return 416 Range Not Satisfiable with a
Cannot serve multipart range requests body instead of a generic
unsatisfiable-range response (#661)
fs: range error responses no longer carry representation headers such as
Content-Type and Content-Encoding (#727)
set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader
are now Clone regardless of the response body type, matching the fix applied
to the request-side types in 0.7.0 (#714)

All the changes

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #708
fix(compression): reject non-empty data frames after codec is EOF by @seanmonstar in #712
Remove Clone derivations from SetMultipleResponseHeader* types by @skeet70 in #714
feat(request-id): Allow request-id constructor in const context by @tottoto in #716
fs: Avoid unnecessary conversions between SystemTime and HttpDate by @tottoto in #717
fs: Use HeaderValue::is_empty to check for empty values by @tottoto in #720
fs: Use HeaderValue::to_str for date headers by @tottoto in #721
chore(deps): bump taiki-e/install-action from 2 to 2.85.4 by @dependabot[bot] in #715
chore(deps): bump taiki-e/install-action from 2.85.4 to 2.85.12 by @dependabot[bot] in #723
docs(example)/custom future with multiple bodies by @Reza-Darius in #711
fix(decompression): don't end the body on an empty data frame by @clemenslosbichler-cloud in #722
Propagate ServeDir::try_call I/O errors by @Boulea7 in #718
ci: Update to cargo-check-external-types 0.5.0 by @tottoto in #724
fix: reject multipart ranges before validation by @shblue21 in #661
chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 by @dependabot[bot] in #726
feat(services): configure directory redirects by @BreezeDelegate in #728
Allow ignoring unsupported multi-range requests by @BreezeDelegate in #727
chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 by @dependabot[bot] in #730
chore(release): prepare 0.7.1 by @jlizen in #729

New Contributors

@skeet70 made their first contribution in #714
@Reza-Darius made their first contribution in #711
@clemenslosbichler-cloud made their first contribution in #722
@Boulea7 made their first contribution in #718
@shblue21 made their first contribution in #661
@BreezeDelegate made their first contribution in #728

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [hickory-resolver](https://hickory-dns.org/) ([source](https://github.com/hickory-dns/hickory-dns)) | workspace.dependencies | patch | `0.26.1` → `0.26.2` | | [termimad](https://github.com/Canop/termimad) | workspace.dependencies | patch | `0.35.2` → `0.35.3` | | [tokio-metrics](https://tokio.rs) ([source](https://github.com/tokio-rs/tokio-metrics)) | workspace.dependencies | patch | `0.5.1` → `0.5.2` | | [tower-http](https://github.com/tower-rs/tower-http) | workspace.dependencies | patch | `0.7.0` → `0.7.1` | --- ### Release Notes <details> <summary>hickory-dns/hickory-dns (hickory-resolver)</summary> ### [`v0.26.2`](https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2) [Compare Source](https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2) This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues. This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers. Resolved advisories: - [GHSA-2vgh-3wfw-qj7c](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c): RRSIG Signer's Name not checked against the RRset's zone - [GHSA-57pw-897j-v4j6](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6): Improper check of signature validity of NSEC and NSEC3 records - [GHSA-wjgj-fvg9-65w9](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9): DNSSEC validation ignores bogus records with a DNS class other than IN - [GHSA-588m-chg6-8jqj](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj): Inverted NSEC3 comparison allows forgery of proofs of nonexistence - [GHSA-qw83-5pm2-ggp5](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5): DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records - [GHSA-3jvh-8vj5-65rq](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3jvh-8vj5-65rq): NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3 - [GHSA-3r6v-f3jh-vvqm](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3r6v-f3jh-vvqm): ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut - [GHSA-624w-vvww-xvpw](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw): ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut - [GHSA-7php-9j59-g3ch](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-7php-9j59-g3ch): DNSSEC validation is missing RFC 6840 §4.4 checks - [GHSA-vrv5-968r-5ggm](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vrv5-968r-5ggm): DNSSEC validation accepts bogus positive response with wildcard expansion - [GHSA-p2jv-r3m3-7wf4](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4): Nonexistence proof forgery due to insufficient checks on NSEC3 record names - [GHSA-86vr-jm6c-7cpg](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-86vr-jm6c-7cpg): NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists - [GHSA-8hq4-5836-w6q4](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-8hq4-5836-w6q4): Server does not check validation status of SOA record in negative responses - [GHSA-5j98-2g5x-46v6](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6): Resolver::lookup() and Resolver::lookup\_ip() APIs obscure DNSSEC validation failures - [GHSA-929p-gjf6-5hqj](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj): DNSSEC validation accepts responses with the wrong RRset as a positive answer - [GHSA-j2rc-wxwh-62g9](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9): `TrustAnchors` does not check name of DNSKEY - [GHSA-rx82-4p2j-j5cv](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-rx82-4p2j-j5cv): `Name::hash` discards label boundaries; `ValidationCacheKey(u64)` reuses the digest in `Eq` implementation, leaking an Insecure DNSSEC verdict across distinct owner names - [GHSA-2hxp-x833-73f7](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7): Hickory DNS recursor: ghost domain attack via child-side NS RRset queries - [GHSA-x962-5xwx-fr8x](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-x962-5xwx-fr8x): Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled - [GHSA-wgfr-mphw-j5g4](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4): Panic in zone file parser for SVCB and HTTPS - [GHSA-hx8c-fjhc-hmf5](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5): Panic in zone file parser for SVCB and HTTPS - [GHSA-4rph-pmrw-mwpw](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw): Zone file parser panics when parsing long lines - [GHSA-3w89-7rx5-hpwx](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3w89-7rx5-hpwx): Responses with QDCOUNT=0 bypass check for matching question section - [GHSA-vcjp-57rr-mpfw](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw): Out-of-bailiwick filtering is not applied to negative responses - [GHSA-6w6g-hm98-mhgm](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm): Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS) - [GHSA-cx5j-p54p-q756](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756): Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor - [GHSA-6h5c-jjg5-wj59](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59): Glueless-NS referral fan-out without per-query work budget - [GHSA-v44v-c8m4-gc43](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-v44v-c8m4-gc43): Denial of service of client UDP connections via spoofed malformed responses - [GHSA-67wc-6jq8-ghrc](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc): Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing - [GHSA-2f4m-fq7w-mrgx](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2f4m-fq7w-mrgx): Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies - [GHSA-g8wg-4mwh-fjfv](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g8wg-4mwh-fjfv): DoQ server has no timeout when reading request - [GHSA-5r56-v84h-c3w5](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5r56-v84h-c3w5): DoH request body is buffered without a size limit - [GHSA-6f2x-v7q7-m7m5](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6f2x-v7q7-m7m5): Resolver follows irrelevant CNAME records - [GHSA-xv7c-h5g9-x25x](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-xv7c-h5g9-x25x): transient DS-fetch error inappropriately cached as BOGUS - [GHSA-9px7-7m25-f6q2](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-9px7-7m25-f6q2): Recursive resolver: Empty connection pool is cached after failed IP lookup - [GHSA-29q9-p769-j8gq](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-29q9-p769-j8gq): Bogus answers cached for the attacker-supplied record TTL - [GHSA-4jwp-xjwm-333g](https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4jwp-xjwm-333g): Missing IPv4-Mapped IPv6 address canonicalization Special thanks go out to [@qifan-sailboat](https://github.com/qifan-sailboat) and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to [@ATinyShoe](https://github.com/ATinyShoe), [@kirk-baird](https://github.com/kirk-baird), [@thesmartshadow](https://github.com/thesmartshadow), [@BeaCox](https://github.com/BeaCox), [@jpds](https://github.com/jpds), [@N0zoM1z0](https://github.com/N0zoM1z0), and [@JasonPap](https://github.com/JasonPap) for reporting vulnerabilities as well. If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact [@djc](https://github.com/djc) for commercial support. #### What's Changed - Reintroduce LookupIp into\_iter by [@tisonkun](https://github.com/tisonkun) in [#3639](https://github.com/hickory-dns/hickory-dns/pull/3639) - fix(resolver): thread bind\_addr through TLS and HTTPS connections (backport to 0.26) by [@kakarot-dev](https://github.com/kakarot-dev) in [#3654](https://github.com/hickory-dns/hickory-dns/pull/3654) - Raise minimum versions of dependencies by [@divergentdave](https://github.com/divergentdave) in [#3661](https://github.com/hickory-dns/hickory-dns/pull/3661) - Canonicalize addresses consistently - 0.26 backport by [@divergentdave](https://github.com/divergentdave) in [#3687](https://github.com/hickory-dns/hickory-dns/pull/3687) - fix: apply per-request timeout for DoH, DoQ, and DoH3 (0.26 backport) by [@dsundquist](https://github.com/dsundquist) in [#3686](https://github.com/hickory-dns/hickory-dns/pull/3686) - fix(proto): verify RSASHA1-NSEC3-SHA1 (alg 7) with the same crypto as RSASHA1 (0.26 backport) by [@edevil](https://github.com/edevil) in [#3693](https://github.com/hickory-dns/hickory-dns/pull/3693) - Add simple constructor for ResolverConfig by [@divergentdave](https://github.com/divergentdave) in [#3710](https://github.com/hickory-dns/hickory-dns/pull/3710) - resolver: reconnect once when a reused pooled connection was closed (backport to 0.26) by [@cf-rhett](https://github.com/cf-rhett) in [#3719](https://github.com/hickory-dns/hickory-dns/pull/3719) - Update quinn-proto - backport by [@divergentdave](https://github.com/divergentdave) in [#3748](https://github.com/hickory-dns/hickory-dns/pull/3748) - server: return NXDOMAIN for SOA queries on non-existent names (backport to 0.26) by [@eyupcanakman](https://github.com/eyupcanakman) in [#3724](https://github.com/hickory-dns/hickory-dns/pull/3724) - Remove recursion from domain::name::read\_inner (backport to 0.26) by [@aochagavia](https://github.com/aochagavia) in [#3752](https://github.com/hickory-dns/hickory-dns/pull/3752) - Update anyhow to 1.0.103 - backport by [@divergentdave](https://github.com/divergentdave) in [#3761](https://github.com/hickory-dns/hickory-dns/pull/3761) - add drop\_privileges config option to skip privilege dropping - backport by [@Webrowse](https://github.com/Webrowse) in [#3763](https://github.com/hickory-dns/hickory-dns/pull/3763) - Server: copy the DO bit of the query in the response (backport to 0.26) by [@aochagavia](https://github.com/aochagavia) in [#3766](https://github.com/hickory-dns/hickory-dns/pull/3766) - tests: fix [`Ed25519`](https://github.com/hickory-dns/hickory-dns/commit/Ed25519) key encoding (0.26 backport) by [@djc](https://github.com/djc) in [#3772](https://github.com/hickory-dns/hickory-dns/pull/3772) - Update crossbeam-epoch - backport by [@divergentdave](https://github.com/divergentdave) in [#3777](https://github.com/hickory-dns/hickory-dns/pull/3777) - Fix Clippy lints - backport by [@divergentdave](https://github.com/divergentdave) in [#3780](https://github.com/hickory-dns/hickory-dns/pull/3780) - fix(server): backport CNAME answer section fix to 0.26 by [@mortn](https://github.com/mortn) in [#3783](https://github.com/hickory-dns/hickory-dns/pull/3783) - backport r0.26: Fix DS::from\_key not using DNSKEY RDATA by [@AlveElde](https://github.com/AlveElde) in [#3787](https://github.com/hickory-dns/hickory-dns/pull/3787) - release/0.26 backport: Include CNAME records when calculating minimum TTL for caching purposes by [@sejoker](https://github.com/sejoker) in [#3794](https://github.com/hickory-dns/hickory-dns/pull/3794) - resolver: parse packed system search domains (backport to 0.26) by [@cf-rhett](https://github.com/cf-rhett) in [#3803](https://github.com/hickory-dns/hickory-dns/pull/3803) - bin: better error when a store type needs a disabled Cargo feature by [@Webrowse](https://github.com/Webrowse) in [#3810](https://github.com/hickory-dns/hickory-dns/pull/3810) - release/0.26 backport: recursor: add config for qname minimization with relaxed mode. by [@avnyu](https://github.com/avnyu) in [#3809](https://github.com/hickory-dns/hickory-dns/pull/3809) - resolver: Export per-connection query metrics (backport to 0.26) by [@pdelong](https://github.com/pdelong) in [#3821](https://github.com/hickory-dns/hickory-dns/pull/3821) - backport r0.26: Limit non-EDNS UDP responses to 512 by [@AlveElde](https://github.com/AlveElde) in [#3825](https://github.com/hickory-dns/hickory-dns/pull/3825) - proto: Implement size\_hint for RecordSet iterators (backport to 0.26) by [@WinterCore](https://github.com/WinterCore) in [#3826](https://github.com/hickory-dns/hickory-dns/pull/3826) - Update h2 to 0.4.16 - backport by [@divergentdave](https://github.com/divergentdave) in [#3840](https://github.com/hickory-dns/hickory-dns/pull/3840) - Fix CI on release/0.26 branch by [@divergentdave](https://github.com/divergentdave) in [#3862](https://github.com/hickory-dns/hickory-dns/pull/3862) - Allow absolute blocklist paths (0.26 backport) by [@liff](https://github.com/liff) in [#3864](https://github.com/hickory-dns/hickory-dns/pull/3864) - Security fixes (release/0.26, part 1) by [@divergentdave](https://github.com/divergentdave) in [#3870](https://github.com/hickory-dns/hickory-dns/pull/3870) - Security fixes (release/0.26, part 2) by [@divergentdave](https://github.com/divergentdave) in [#3871](https://github.com/hickory-dns/hickory-dns/pull/3871) #### New Contributors - [@dsundquist](https://github.com/dsundquist) made their first contribution in [#3686](https://github.com/hickory-dns/hickory-dns/pull/3686) - [@sejoker](https://github.com/sejoker) made their first contribution in [#3794](https://github.com/hickory-dns/hickory-dns/pull/3794) **Full Changelog**: <https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2> </details> <details> <summary>Canop/termimad (termimad)</summary> ### [`v0.35.3`](https://github.com/Canop/termimad/blob/HEAD/CHANGELOG.md#v0353---2026-09-02) - fix `CropWriter::queue_char` and `queue_unstyled_char` never writing in the last allowed column - `CropWriter::queue_char` replaces tabs like `queue_unstyled_char` does - a char which doesn't fit the remaining width stops `CropWriter`'s char-level writing, instead of letting a following narrower char take its column </details> <details> <summary>tokio-rs/tokio-metrics (tokio-metrics)</summary> ### [`v0.5.2`](https://github.com/tokio-rs/tokio-metrics/blob/HEAD/CHANGELOG.md#052---2026-08-28) [Compare Source](https://github.com/tokio-rs/tokio-metrics/compare/v0.5.1...v0.5.2) ##### Added - add per-request task metrics via FutureMonitor ([#127](https://github.com/tokio-rs/tokio-metrics/pull/127)) ##### Fixed - add explicit Value shape and unit to metrique bridge ([#134](https://github.com/tokio-rs/tokio-metrics/pull/134)) ##### Other - update release-plz action to v0.5.127 ([#133](https://github.com/tokio-rs/tokio-metrics/pull/133)) </details> <details> <summary>tower-rs/tower-http (tower-http)</summary> ### [`v0.7.1`](https://github.com/tower-rs/tower-http/releases/tag/tower-http-0.7.1) [Compare Source](https://github.com/tower-rs/tower-http/compare/tower-http-0.7.0...tower-http-0.7.1) #### Added - `fs`: add `ServeDir::redirect_to_trailing_slash()` to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default ([#728]) - `fs`: add `ignore_multi_range_requests()` to `ServeDir` and `ServeFile`, serving the full representation when a request asks for multiple byte ranges. The existing `416 Range Not Satisfiable` response remains the default ([#727]) - `request-id`: the constructors and accessors on the request-id layers, services, and `RequestId` are now `const fn`, so they can be used in const context ([#716]) #### Changed - `fs`: the minimum `http-range-header` requirement is now 0.4.2 ([#661]) #### Fixed - **behavioral change:** `fs`: make `ServeDir::try_call` propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to `404 Not Found` responses ([#718]) - `decompression`: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered ([#722]) - `decompression`: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 ([#712]) - `fs`: multipart range requests are now rejected before range validation, so they consistently return `416 Range Not Satisfiable` with a `Cannot serve multipart range requests` body instead of a generic unsatisfiable-range response ([#661]) - `fs`: range error responses no longer carry representation headers such as `Content-Type` and `Content-Encoding` ([#727]) - `set-header`: `SetMultipleResponseHeadersLayer` and `SetMultipleResponseHeader` are now `Clone` regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 ([#714]) [#661]: https://github.com/tower-rs/tower-http/pull/661 [#712]: https://github.com/tower-rs/tower-http/pull/712 [#714]: https://github.com/tower-rs/tower-http/pull/714 [#716]: https://github.com/tower-rs/tower-http/pull/716 [#718]: https://github.com/tower-rs/tower-http/pull/718 [#722]: https://github.com/tower-rs/tower-http/pull/722 [#727]: https://github.com/tower-rs/tower-http/pull/727 [#728]: https://github.com/tower-rs/tower-http/pull/728 #### All the changes - chore(deps): bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#708](https://github.com/tower-rs/tower-http/pull/708) - fix(compression): reject non-empty data frames after codec is EOF by [@seanmonstar](https://github.com/seanmonstar) in [#712](https://github.com/tower-rs/tower-http/pull/712) - Remove Clone derivations from SetMultipleResponseHeader\* types by [@skeet70](https://github.com/skeet70) in [#714](https://github.com/tower-rs/tower-http/pull/714) - feat(request-id): Allow request-id constructor in const context by [@tottoto](https://github.com/tottoto) in [#716](https://github.com/tower-rs/tower-http/pull/716) - fs: Avoid unnecessary conversions between SystemTime and HttpDate by [@tottoto](https://github.com/tottoto) in [#717](https://github.com/tower-rs/tower-http/pull/717) - fs: Use HeaderValue::is\_empty to check for empty values by [@tottoto](https://github.com/tottoto) in [#720](https://github.com/tower-rs/tower-http/pull/720) - fs: Use HeaderValue::to\_str for date headers by [@tottoto](https://github.com/tottoto) in [#721](https://github.com/tower-rs/tower-http/pull/721) - chore(deps): bump taiki-e/install-action from 2 to 2.85.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#715](https://github.com/tower-rs/tower-http/pull/715) - chore(deps): bump taiki-e/install-action from 2.85.4 to 2.85.12 by [@dependabot](https://github.com/dependabot)\[bot] in [#723](https://github.com/tower-rs/tower-http/pull/723) - docs(example)/custom future with multiple bodies by [@Reza-Darius](https://github.com/Reza-Darius) in [#711](https://github.com/tower-rs/tower-http/pull/711) - fix(decompression): don't end the body on an empty data frame by [@clemenslosbichler-cloud](https://github.com/clemenslosbichler-cloud) in [#722](https://github.com/tower-rs/tower-http/pull/722) - Propagate ServeDir::try\_call I/O errors by [@Boulea7](https://github.com/Boulea7) in [#718](https://github.com/tower-rs/tower-http/pull/718) - ci: Update to cargo-check-external-types 0.5.0 by [@tottoto](https://github.com/tottoto) in [#724](https://github.com/tower-rs/tower-http/pull/724) - fix: reject multipart ranges before validation by [@shblue21](https://github.com/shblue21) in [#661](https://github.com/tower-rs/tower-http/pull/661) - chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#726](https://github.com/tower-rs/tower-http/pull/726) - feat(services): configure directory redirects by [@BreezeDelegate](https://github.com/BreezeDelegate) in [#728](https://github.com/tower-rs/tower-http/pull/728) - Allow ignoring unsupported multi-range requests by [@BreezeDelegate](https://github.com/BreezeDelegate) in [#727](https://github.com/tower-rs/tower-http/pull/727) - chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#730](https://github.com/tower-rs/tower-http/pull/730) - chore(release): prepare 0.7.1 by [@jlizen](https://github.com/jlizen) in [#729](https://github.com/tower-rs/tower-http/pull/729) #### New Contributors - [@skeet70](https://github.com/skeet70) made their first contribution in [#714](https://github.com/tower-rs/tower-http/pull/714) - [@Reza-Darius](https://github.com/Reza-Darius) made their first contribution in [#711](https://github.com/tower-rs/tower-http/pull/711) - [@clemenslosbichler-cloud](https://github.com/clemenslosbichler-cloud) made their first contribution in [#722](https://github.com/tower-rs/tower-http/pull/722) - [@Boulea7](https://github.com/Boulea7) made their first contribution in [#718](https://github.com/tower-rs/tower-http/pull/718) - [@shblue21](https://github.com/shblue21) made their first contribution in [#661](https://github.com/tower-rs/tower-http/pull/661) - [@BreezeDelegate](https://github.com/BreezeDelegate) made their first contribution in [#728](https://github.com/tower-rs/tower-http/pull/728) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate added the

Dependencies

Dependencies/Renovate

labels

2026-08-30 05:04:28 +00:00

renovate added 1 commit

2026-08-30 05:04:28 +00:00

chore(deps): update rust crate tokio-metrics to v0.5.2

Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 4s

Details

Checks / Prek / Check changed files (pull_request) Successful in 6s

Details

Documentation / Build and Deploy Documentation (pull_request) Successful in 1m0s

Details

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 7s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m20s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m40s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 10m3s

Details

132dbca58b

renovate force-pushed renovate/rust-zerover-patch-updates from 132dbca58b

Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 4s

Details

Checks / Prek / Check changed files (pull_request) Successful in 6s

Details

Documentation / Build and Deploy Documentation (pull_request) Successful in 1m0s

Details

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 7s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m20s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m40s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 10m3s

Details

to 4c2892e344

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 7s

Details

Checks / Prek / Check changed files (pull_request) Successful in 5s

Details

Documentation / Build and Deploy Documentation (pull_request) Successful in 1m3s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m14s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m19s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m46s

Details

2026-09-01 05:02:23 +00:00

Compare

renovate changed title from ~~chore(deps): update rust crate tokio-metrics to v0.5.2~~ to chore(deps): update rust-zerover-patch-updates

2026-09-01 05:02:24 +00:00

renovate force-pushed renovate/rust-zerover-patch-updates from 4c2892e344

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 7s

Details

Checks / Prek / Check changed files (pull_request) Successful in 5s

Details

Documentation / Build and Deploy Documentation (pull_request) Successful in 1m3s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m14s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m19s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 8m46s

Details

to 9d1fd89b8c

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 7s

Details

Checks / Prek / Check changed files (pull_request) Successful in 5s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m6s

Details

Documentation / Build and Deploy Documentation (pull_request) Successful in 1m7s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m26s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m28s

Details

2026-09-03 05:02:30 +00:00

Compare

renovate force-pushed renovate/rust-zerover-patch-updates from 9d1fd89b8c

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 7s

Details

Checks / Prek / Check changed files (pull_request) Successful in 5s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m6s

Details

Documentation / Build and Deploy Documentation (pull_request) Successful in 1m7s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m26s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m28s

Details

to 489aec3bcd

Documentation / Build and Deploy Documentation (pull_request) Failing after 2s

Details

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 13s

Details

Checks / Prek / Check changed files (pull_request) Successful in 5s

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m29s

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m30s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 2m22s

Details

2026-09-04 05:04:48 +00:00

Compare

Documentation / Build and Deploy Documentation (pull_request) Failing after 2s

Details

Checks / Changelog / Check changelog is added (pull_request_target) Successful in 13s

Required

Details

Checks / Prek / Check changed files (pull_request) Successful in 5s

Required

Details

Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 1m29s

Required

Details

Update flake hashes / update-flake-hashes (pull_request) Successful in 1m30s

Details

Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 2m22s

Required

Details

Some required checks were not successful.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/rust-zerover-patch-updates:renovate/rust-zerover-patch-updates

git switch renovate/rust-zerover-patch-updates

No reviewers

No labels

Dependencies/Renovate

Matrix/Administration

Rows
Columns