chore(deps): update rust-zerover-patch-updates #2203
No reviewers
Labels
No labels
Abandoned
Blocked
Bug
Changelog
Added
Changelog
Missing
Changelog
None
Cherry-picking
Database
Dependencies
Dependencies/Renovate
Difficulty
Easy
Difficulty
Hard
Difficulty
Medium
Documentation
Enhancement
Good first issue
Help wanted
Inherited
Matrix/Administration
Matrix/Appservices
Matrix/Auth
Matrix/Client
Matrix/Core
Matrix/E2EE
Matrix/Federation
Matrix/Hydra
Matrix/MSC
Matrix/Media
Matrix/T&S
Merge
Merge/Manual
Merge/Squash
Meta
Meta/CI
Meta/Packaging
Priority
Blocking
Priority
High
Priority
Low
Security
Status
Confirmed
Status
Duplicate
Status
Invalid
Status
Needs Investigation
Support
bob the builder
No milestone
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
continuwuation/continuwuity!2203
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/rust-zerover-patch-updates"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
0.16.0→0.16.10.16.0→0.16.10.26.1→0.26.30.13.4→0.13.50.23.43→0.23.440.35.2→0.35.40.5.1→0.5.20.7.0→0.7.1Release Notes
askama-rs/askama (askama)
v0.16.1Compare Source
What's Changed
let/setblock type by @GuillaumeGomez in #760New Contributors
Full Changelog: https://github.com/askama-rs/askama/compare/v0.16.0...v0.16.1
hickory-dns/hickory-dns (hickory-resolver)
v0.26.3Compare Source
This release fixes regressions introduced in v0.26.2 related to DNSSEC verification, QUIC servers, HTTP/3 servers, and minimum dependency versions.
What's Changed
Full Changelog: https://github.com/hickory-dns/hickory-dns/compare/v0.26.2...v0.26.3
v0.26.2Compare Source
This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.
This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.
Resolved advisories:
TrustAnchorsdoes not check name of DNSKEYName::hashdiscards label boundaries;ValidationCacheKey(u64)reuses the digest inEqimplementation, leaking an Insecure DNSSEC verdict across distinct owner namesNameServerPool::try_send(resource-exhaustion DoS)Special thanks go out to @qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @ATinyShoe, @kirk-baird, @thesmartshadow, @BeaCox, @jpds, @N0zoM1z0, and @JasonPap for reporting vulnerabilities as well.
If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @djc for commercial support.
What's Changed
Ed25519key encoding (0.26 backport) by @djc in #3772New Contributors
Full Changelog: https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.2
seanmonstar/reqwest (reqwest)
v0.13.5Compare Source
Error::is_dns()to identify errors caused by DNS resolution failures.ClientBuilder::http1_max_headers(usize)to configure the maximum number of headers accepted in an HTTP/1 response (default 100).TlsInfoextension.Ipv6AndIpv4strategy to prefer IPv6.Canop/termimad (termimad)
v0.35.4parse_colorreturning the light variant fordarkblue,darkcyananddarkyellow, and accepting strings merely containing a color namev0.35.3CropWriter::queue_charandqueue_unstyled_charnever writing in the last allowed columnCropWriter::queue_charreplaces tabs likequeue_unstyled_chardoesCropWriter's char-level writing, instead of letting a following narrower char take its columntokio-rs/tokio-metrics (tokio-metrics)
v0.5.2Compare Source
Added
Fixed
Other
tower-rs/tower-http (tower-http)
v0.7.1Compare Source
Added
fs: addServeDir::redirect_to_trailing_slash()to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)fs: addignore_multi_range_requests()toServeDirandServeFile, serving the full representation when a request asks for multiple byte ranges. The existing416 Range Not Satisfiableresponse remains the default (#727)request-id: the constructors and accessors on the request-id layers, services, andRequestIdare nowconst fn, so they can be used in const context (#716)Changed
fs: the minimumhttp-range-headerrequirement is now 0.4.2 (#661)Fixed
fs: makeServeDir::try_callpropagate expected filesystemI/O errors when no fallback is configured, as documented, instead of converting
them to
404 Not Foundresponses (#718)decompression: don't end the body when a data frame with no remaining bytesarrives after the decompressor reports end-of-stream. Trailers following such a
frame were dropped and could not be recovered (#722)
decompression: return a body error when a data frame with remaining bytesarrives after the decompressor reports end-of-stream, rather than silently
truncating. This regressed in 0.7.0 (#712)
fs: multipart range requests are now rejected before range validation, sothey consistently return
416 Range Not Satisfiablewith aCannot serve multipart range requestsbody instead of a genericunsatisfiable-range response (#661)
fs: range error responses no longer carry representation headers such asContent-TypeandContent-Encoding(#727)set-header:SetMultipleResponseHeadersLayerandSetMultipleResponseHeaderare now
Cloneregardless of the response body type, matching the fix appliedto the request-side types in 0.7.0 (#714)
All the changes
New Contributors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.
132dbca58b4c2892e344chore(deps): update rust crate tokio-metrics to v0.5.2to chore(deps): update rust-zerover-patch-updates4c2892e3449d1fd89b8c9d1fd89b8c489aec3bcd489aec3bcd6e822acb066e822acb064a4cbadc2c4a4cbadc2c4f831e224a4f831e224ae9c0ec2ba8Blocked on hickory 0.26.3: https://github.com/hickory-dns/hickory-dns/issues/3881
e9c0ec2ba85b3e3b7a4c5b3e3b7a4c593bf77b9c