chore(deps): bump the cargo-patch-minor group across 1 directory with 23 updates by dependabot[bot] · Pull Request #1354 · sigp/anchor

dependabot · 2026-10-22T14:07:13Z

Bumps the cargo-patch-minor group with 23 updates in the / directory:

Package	From	To
arbitrary	`1.4.2`	`1.5.0`
axum	`0.8.8`	`0.8.9`
clap	`4.5.60`	`4.6.7`
futures	`0.3.32`	`0.3.34`
hyper	`1.8.1`	`1.12.0`
indexmap	`2.13.0`	`2.14.2`
once_cell	`1.21.3`	`1.21.4`
openssl	`0.10.75`	`0.10.81`
prometheus-client	`0.25.0`	`0.25.1`
rpassword	`7.4.0`	`7.5.4`
serde	`1.0.228`	`1.0.229`
serde_json	`1.0.149`	`1.0.154`
thiserror	`2.0.18`	`2.0.21`
tracing-appender	`0.2.4`	`0.2.5`
tracing-subscriber	`0.3.22`	`0.3.23`
unicode-normalization	`0.1.25`	`0.1.26`
yaml_serde	`0.10.4`	`0.10.7`
assert_cmd	`2.1.2`	`2.2.2`
fastrand	`2.3.0`	`2.5.0`
chrono	`0.4.44`	`0.4.45`
rayon	`1.11.0`	`1.12.0`
logroller	`0.1.10`	`0.1.12`
twox-hash	`2.1.2`	`2.1.5`

Updates arbitrary from 1.4.2 to 1.5.0

Changelog

Sourced from arbitrary's changelog.

1.5.0

Released 2026-10-05.

Added

Added support for deriving Arbitrary for types with raw identifiers.

Changed

Updated derive_arbitrary to syn 3. This raises the MSRV from 1.63.0 to 1.71.0, which is the MSRV of syn 3.

Fixed

Fixed soundness when generating arrays.

Fixed nonzero integer generation to always produce a nonzero value.

Updated derive_arbitrary to include fixes for fully qualified paths.

Commits

9807b59 Merge pull request #243 from fitzgen/bump-to-1.5.0
7a49e61 Bump to version 1.5.0
aa2802b Merge pull request #242 from drakeo338/claude/241-fix
a9f7ca5 Update derive_arbitrary to syn 3 and raise MSRV to 1.71
cd35bd2 Merge pull request #239 from Manishearth/fix-soundness
53a651d agent-driven: Fix soundness in try_create_array
df8afe9 Merge pull request #238 from baloo/baloo/push-lopsmyosqnpv
15f5c08 Bring fix for fully qualified path
341a8fd Merge pull request #237 from ngildenhuys/downgrading_msrv_deps
9b68ef4 ci: adding update commands to downgrade dependencies to fix MSRV test
Additional commits viewable in compare view

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)

changed: Update minimum rust version to 1.80 (#3620)

fixed: Set connect endpoint on correct field in MethodRouter (#3656)

fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

c59208c revert axum-core changelog changes
99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
23d7098 Revert "axum-core 0.5.6"
e8a39ad axum-macros 0.5.1
6e9a249 axum-extra 0.12.6
0ec9041 axum 0.8.9
c3fcebb axum-core 0.5.6
a8790fc update release notes
26ba7bb docs: consolidate state management docs in crate root (#3683)
9fc59ef Update to tokio-tungstenite 0.29 (#3689)
Additional commits viewable in compare view

Updates clap from 4.5.60 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

(derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

v4.6.6

[4.6.6] - 2026-08-06

Features

Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

(help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

(derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

(help) Say alias when there is only one

v4.6.1

[4.6.1] - 2026-04-15

Fixes

(derive) Ensure rebuilds happen when an read env variable is changed

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

(derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

[4.6.6] - 2026-08-06

Features

Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

(help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

Update to syn v3

[4.6.3] - 2026-07-20

Fixes

(derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

(help) Say alias when there is only one

[4.6.1] - 2026-04-15

Fixes

(derive) Ensure rebuilds happen when an read env variable is changed

[4.6.0] - 2026-03-12

Compatibility

Update MSRV to 1.85

[4.5.61] - 2026-03-12

... (truncated)

Commits

d3e59a9 chore: Release
d997f87 docs: Update changelog
fb6058c Merge pull request #6409 from heaths/pwsh-support
2310870 test(complete): Add tests for completer_for_path
5967c17 refactor(complete): Move shell detection to Shells
594602b fix(complete): Detect pwsh for PowerShell
3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
c968b13 chore(deps): Update Rust crate shlex to v2
8f247cb chore(deps): Update actions/checkout action to v7
Additional commits viewable in compare view

Updates futures from 0.3.32 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

Preserve cloned waker identity. (#3032)

Updato syn to 3. (#3028)

0.3.33

Fix ReadLine's soundness issue regarding to exception safety. (#3020)

Fix unsound Send impl for IterPinRef and Iter. (#3003)

Fix stacked borrows violation in compat01as03 implementation. (#3012)

Fix memory leak in FuturesUnordered::IntoIter. (#3005)

Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)

Re-export alloc::task::Wake. (#3010)

Update spin to 0.12. (#3014)

Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

Preserve cloned waker identity. (#3032)

Updato syn to 3. (#3028)

0.3.33 - 2026-07-18

Fix ReadLine's soundness issue regarding to exception safety. (#3020)

Fix unsound Send impl for IterPinRef and Iter. (#3003)

Fix stacked borrows violation in compat01as03 implementation. (#3012)

Fix memory leak in FuturesUnordered::IntoIter. (#3005)

Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)

Re-export alloc::task::Wake. (#3010)

Update spin to 0.12. (#3014)

Commits

705e6b5 Release 0.3.34
616dac7 compat: Inline RawWaker clone function
4176369 Inline remaining RawWaker clone functions
f17a895 Fix cloned FuturesUnordered waker identity
51d62ad macro: bump syn to v3 (#3028)
9e26177 ci: Reduce timeout-minutes
b2d0983 tsan: Enable Adaptive Delay
f733d0e Miri: Ignore compat tests
e5def2f Rename default branch to main
89cc254 Release 0.3.33
Additional commits viewable in compare view

Updates hyper from 1.8.1 to 1.12.0

Release notes

Sourced from hyper's releases.

v1.12.0

Features

http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

Bug Fixes

http1:

withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)

remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)

always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)

let a Connection close token win over a later keep-alive (#4201) (5dadff76)

preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)

http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Everything

docs: fix typo responsibile -> responsible by @vaibhav8a in hyperium/hyper#4177

style: replace single-character lifetime names with descriptive names by @dox4 in hyperium/hyper#4173

refactor(http1): resolve collapsible_match lint by @nakaryo716 in hyperium/hyper#4178

hyper Improvement Proposals by @seanmonstar in hyperium/hyper#4131

perf(body): simpler custom Incoming channel by @seanmonstar in hyperium/hyper#4168

docs(maintainers): add 0x676e67 as a collaborator by @seanmonstar in hyperium/hyper#4184

fix(ext): remove broken OriginalHeaderOrder doctest by @cratelyn in hyperium/hyper#4188

build(deps): remove unused futures-channel from http1 feature by @0x676e67 in hyperium/hyper#4185

chore(ci): update to cargo-check-external-types 0.5.0 by @tottoto in hyperium/hyper#4189

style(lib): address ignored_unit_patterns lint by @nakaryo716 in hyperium/hyper#4193

Preserve hop-by-hop when setting close or keep-alive by @dtolnay in hyperium/hyper#4196

fix(http2): do not reserve capacity for idle Upgraded streams by @Dev-next-gen in hyperium/hyper#4198

style(lib): Address clippy panics and missing_panics_doc lints by @Siech0 in hyperium/hyper#4191

docs: fix typos in capi README, MSRV and governance docs by @toyeshhm in hyperium/hyper#4204

style(lib): Address trivial, low quantity clippy lints. by @Siech0 in hyperium/hyper#4190

chore(clippy): allow clippy lints following 1.99.0 release by @dswij in hyperium/hyper#4219

style: remove useless_borrows_in_formatting from the clippy allowlist by @ump45nose in hyperium/hyper#4220

style(h1): mark partial Debug impls as non-exhaustive by @badimalex in hyperium/hyper#4218

style(lib): Address cast-possible-truncation clippy findings. by @Siech0 in hyperium/hyper#4192

feat(http1): add max_header_size limit for server and client by @Aditya-9-6 in hyperium/hyper#4183

fix(http1): let a Connection close token win over a later keep-alive by @shoemoney in hyperium/hyper#4201

fix(http1): always remove content-length if transfer-encoding is sent by @seanmonstar in hyperium/hyper#4223

fix(http1): remove invalid content-length if transfer-encoding is auto-added by @seanmonstar in hyperium/hyper#4224

fix(http1): withdraw a stale want when the client dispatcher takes a request by @shodoco in hyperium/hyper#4208

perf(body): skip waking a closed peer when a channel end drops by @0x676e67 in hyperium/hyper#4225

Prepare v1.12.0 by @seanmonstar in hyperium/hyper#4226

New Contributors

@vaibhav8a made their first contribution in hyperium/hyper#4177

@dox4 made their first contribution in hyperium/hyper#4173

@dtolnay made their first contribution in hyperium/hyper#4196

@Dev-next-gen made their first contribution in hyperium/hyper#4198

@Siech0 made their first contribution in hyperium/hyper#4191

@toyeshhm made their first contribution in hyperium/hyper#4204

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.12.0 (2026-10-06)

Bug Fixes

http1:

withdraw a stale want when the client dispatcher takes a request (#4208) (c44f1cc5)

remove content-length if transfer-encoding is auto-added (#4224) (69396fdd)

always remove content-length if transfer-encoding is sent (#4223) (a5d7fd78)

let a Connection close token win over a later keep-alive (#4201) (5dadff76)

preserve hop-by-hop when setting close or keep-alive (#4196) (74a39081)

http2: do not reserve capacity for idle Upgraded streams (#4198) (e89d0d93)

Features

http1: add max_header_size limit for server and client (#4183) (d1cd14ef, closes #3832)

v1.11.1 (2026-08-27)

Bug Fixes

http1:

detect TE: trailers caselessly and with other values (#4152) (72fcf545)

recognize \n\r\n as a head terminator in the partial-read fast path (#4147) (3534d75c, closes #4145)

flush bytes buffered by the write re-check before yielding (#4143) (f660f5bf)

evict pooled conn on request-side Connection: close (#4110) (da19be08)

v1.11.0 (2026-07-20)

Bug Fixes

http1:

discard content-length header when received before transfer-encoding (#4124) (540fff91, closes #4123)

use append for repeat trailer values in encoder (#4118) (de1483d7)

allow up to max_headers trailers (#4108) (f584091a)

use append for repeat trailers (#4107) (876effe1)

flush buffered data before shutdown (#4018) (72046cc7, closes #4022)

more strictly enforce max_buf_size when parsing (#4093) (90ede307, closes #4081)

http2: avoid buffering Upgraded writes without send capacity (#4102) (aecf5abf)

Features

rt: add ReadBufCursor::initialized_unfilled() method (#4115) (ccc1e850)

... (truncated)

Commits

7f67699 v1.12.0
254bf12 perf(body): skip waking a closed peer when a channel end drops (#4225)
c44f1cc fix(http1): withdraw a stale want when the client dispatcher takes a request ...
69396fd fix(http1): remove content-length if transfer-encoding is auto-added (#4224)
a5d7fd7 fix(http1): always remove content-length if transfer-encoding is sent (#4223)
5dadff7 fix(http1): let a Connection close token win over a later keep-alive (#4201)
d1cd14e feat(http1): add max_header_size limit for server and client (#4183)
714c7cf style(lib): address cast-possible-truncation clippy findings (#4192)
0d47440 style(lib): mark partial Debug impls as non-exhaustive (#4218)
da3b1b1 style(lib): remove useless_borrows_in_formatting from the clippy allowlist (#...
Additional commits viewable in compare view

Updates indexmap from 2.13.0 to 2.14.2

Changelog

Sourced from indexmap's changelog.

2.14.2 (2026-09-04)

Fix item hygiene in map and set macros. Previously, an internal const CAP could shadow the same name in the caller's namespace.

Allow const initialization of empty indexmap_with_default! and indexset_with_default!. The hasher may also be omitted if it's inferrable.

2.14.1 (2026-08-28)

Simplify comparisons where Equivalent isn't needed (Q = K).

Unify index assertions for bounds checks.

Fix (or expect) clippy lints.

2.14.0 (2026-04-09)

MSRV: Rust 1.85.0 or later is now required.

Updated the hashbrown dependency to 0.17.

Made more map::Slice methods const: new_mut, first_mut, last_mut, split_at_mut, split_at_mut_checked, split_first_mut, split_last_mut

2.13.1 (2026-04-02)

Made some Slice methods const:

map::Slice::{first,last,split_at,split_at_checked,split_first,split_last}

set::Slice::{first,last,split_at,split_at_checked,split_first,split_last}

Commits

41a8708 Merge pull request #450 from cuviper/macros
0fb7b5c Release 2.14.2
55e6b28 Improve the empty macro cases
c067355 Fix item hygiene in user macros
fdf7e17 Merge pull request #449 from cuviper/release-2.14.1
ada540e Release 2.14.1
af93b43 expect clippy::redundant_slicing in tests
c95da18 fix clippy::derivable_impls
2196365 fix clippy::useless_vec (and more) in tests
1c2be7b use inherent usize::MAX
Additional commits viewable in compare view

Updates once_cell from 1.21.3 to 1.21.4

Changelog

Sourced from once_cell's changelog.

1.21.4

Fix unsoundness in OnceCell::wait under --features=parking_lot, #295.

If thread A calls wait, while thread B calls get_or_try_init(f), and, furthermore, f panics, the wait incorrectly returns and thread A observes uninitialized memory.

Kudos to @meng-xu-cs for a nice find!

Commits

80fe900 Merge pull request #296 from matklad/matklad/plfix
a5e09c9 release 1.21.4
2426d45 Merge pull request #295 from matklad/matklad/plfix
a144121 Merge pull request #290 from alexanderkjall/run-tests-with-no-default-features
232a1a4 Merge pull request #292 from phil-opp/doc-fix
d31767b fix OnceCell::wait with features=parking_lot
28d29ae Fix: sync::OnceCell::try_insert docs should import sync variant
0f78fb0 make the command 'cargo test --no-default-features' work
fda60a6 Merge pull request #287 from AbeZbm/add-tests
b5b98c0 Add tests for OnceRef
See full diff in compare view

Updates openssl from 0.10.75 to 0.10.81

Release notes

Sourced from openssl's releases.

openssl-v0.10.81

What's Changed

Bump aws-ls-sys to 0.41 by @joshgodsiff in rust-openssl/rust-openssl#2640

Add brainpoolP224r1 and brainpoolP224t1 NID constants by @sfarestam-iproov in rust-openssl/rust-openssl#2642

x509: add minimal support for CRL building by @DavidFontaineOcd in rust-openssl/rust-openssl#2538

add mldsa.h to the boringssl bindgen by @reaperhulk in rust-openssl/rust-openssl#2650

Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string by @alex in rust-openssl/rust-openssl#2652

Fix verify_mode() panic on unmodeled verify mode bits by @alex in rust-openssl/rust-openssl#2651

Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in rust-openssl/rust-openssl#2653

Release openssl 0.10.81 and openssl-sys 0.9.117 by @reaperhulk in rust-openssl/rust-openssl#2655

New Contributors

@joshgodsiff made their first contribution in rust-openssl/rust-openssl#2640

@sfarestam-iproov made their first contribution in rust-openssl/rust-openssl#2642

@DavidFontaineOcd made their first contribution in rust-openssl/rust-openssl#2538

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.80...openssl-v0.10.81

openssl-v0.10.80

What's Changed

Prefer Homebrew openssl@4 and stop looking for openssl@1.1 by @alex in rust-openssl/rust-openssl#2633

Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-padding by @alex in rust-openssl/rust-openssl#2638

Release openssl 0.10.80 and openssl-sys 0.9.116 by @alex in rust-openssl/rust-openssl#2639

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

openssl-v0.10.79

What's Changed

Bump actions/cache from 5.0.4 to 5.0.5 by @dependabot[bot] in rust-openssl/rust-openssl#2610

Try to fix OpenSSL 1.1.0l download by @botovq in rust-openssl/rust-openssl#2614

Require &mut BigNumContextRef for EcPointRef mul/invert by @alex in rust-openssl/rust-openssl#2615

Fix UB in EcGroupRef::generator on groups without a generator by @alex in rust-openssl/rust-openssl#2617

Replace use libc::*; with targeted imports in openssl-sys by @alex in rust-openssl/rust-openssl#2618

Add PKeyRef::is_a and KeyType for name-based key identification by @reaperhulk in rust-openssl/rust-openssl#2619

Add PKey::{public,private}_key_from_raw_bytes_ex by @reaperhulk in rust-openssl/rust-openssl#2620

Bump MSRV to 1.80 by @reaperhulk in rust-openssl/rust-openssl#2622

Drop once_cell in favor of std::sync::{LazyLock, OnceLock} by @reaperhulk in rust-openssl/rust-openssl#2623

Add PKey::private_key_from_seed for ML-DSA/ML-KEM key import by @reaperhulk in rust-openssl/rust-openssl#2621

parallelize more builds in CI for cold caches by @reaperhulk in rust-openssl/rust-openssl#2625

Add PKeyRef::seed_into for ML-DSA/ML-KEM seed extraction by @reaperhulk in rust-openssl/rust-openssl#2626

Fix process abort when verify/PSK callbacks fire after SSL_CTX swap by @alex in rust-openssl/rust-openssl#2624

Bind OSSL_PARAM_modified and use it for seed_into by @reaperhulk in rust-openssl/rust-openssl#2628

Add PkeyCtxRef::set_context_string for ML-DSA by @reaperhulk in rust-openssl/rust-openssl#2629

Reject non-UTF-8 OCSP responder URLs in X509Ref::ocsp_responders by @alex in rust-openssl/rust-openssl#2631

Fix output buffer overflow for AES key-wrap-with-padding ciphers by @alex in rust-openssl/rust-openssl#2630

Release openssl 0.10.79 and openssl-sys 0.9.115 by @reaperhulk in rust-openssl/rust-openssl#2632

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.78...openssl-v0.10.79

... (truncated)

Commits

db9c9e2 Release openssl 0.10.81 and openssl-sys 0.9.117 (#2655)
3a7fb56 Bump actions/checkout from 6.0.2 to 6.0.3 (#2653)
d059c43 Fix verify_mode() panic on unmodeled verify mode bits (#2651)
8b1519e Deprecate Asn1StringRef::as_utf8 in favor of a NUL-safe to_string (#2652)
d5713d6 add mldsa.h to the boringssl bindgen (#2650)
9fac317 Merge pull request #2538 from ocdlroux/feat/crl-full
4dae20b x509: adding minimal support for X509CrlBuilder
47f7777 Add brainpoolP224r1 and brainpoolP224t1 NID constants (#2642)
659da17 Bump aws-ls-sys to 0.41 (#2640)
35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
Additional commits viewable in compare view

Updates prometheus-client from 0.25.0 to 0.25.1

Release notes

Sourced from prometheus-client's releases.

v0.25.1

Fixed

The EncodeLabelSet and EncodeLabelValue derive macros now emit spanned compile errors for invalid input instead of panicking, so diagnostics point at the offending type or attribute rather than at the derive site. See PR 307.

Changed

Updated prometheus-client-derive-encode to v0.5.1, which updates its syn dependency to v3.

Changelog

Sourced from prometheus-client's changelog.

[0.25.1]

Fixed

The EncodeLabelSet and EncodeLabelValue derive macros now emit spanned compile errors for invalid input instead of panicking, so diagnostics point at the offending type or attribute rather than at the derive site. See PR 307.

Changed

Updated prometheus-client-derive-encode to v0.5.1, which updates its syn dependency to v3.

Commits

3e3d55c chore: prepare v0.25.1 release (#340)
914f390 build(deps): bump the github-actions group with 2 updates (#339)
f4c8b2d build(deps): bump the cargo-minor-patch group with 2 updates (#338)
b40c935 build(deps): bump the cargo-minor-patch group with 2 updates (#337)
b7bd092 build(deps): bump the cargo-minor-patch group with 2 updates (#336)
1d60861 build(deps): bump the cargo-minor-patch group with 3 updates (#335)
861f451 build(deps): bump the cargo-major group across 1 directory with 3 updates (#333)
0053b6d benches: use std::hint::black_box (#334)
539871e build(deps): bump the cargo-minor-patch group across 1 directory with 7 updat...
390bc8d ci: avoid duplicate runs, harden checkout, use rust-cache (#325)
Additional commits viewable in compare view

Updates rpassword from 7.4.0 to 7.5.4

Release notes

Sourced from rpassword's releases.

v7.5.4

No functional changes.

I've added license checks with Cargo Deny to ensure that the Apache 2.0 license is compatible with dependencies.

This release also updates the description to make it clear this library is cross-platform on crates.io.

v7.5.3

Fixes compile errors with Rust 1.85. Thanks @nwalfield for reporting in conradkleinespel/rpassword#130.

Backwards compatible. No breaking change.

v7.5.2

Fixes a Unicode parsing bug which could lead to unwarranted panic (conradkleinespel/rpassword@6c19a1e).

Backwards compatible. No breaking change.

v7.5.1

This release fixes a cross-platform compilation issue that appeared in v.7.5.0 (conradkleinespel/rpassword@60ee071).

Thanks @aharpervc for bringing this to my attention in conradkleinespel/rpassword#126.

Backwards compatible. No breaking change.

v7.5.0

This release comes with lots of stuff. It should be fully backward compatible.

New features

Support for masking or partially masking a password as it's being typed. Thank you, @chipsenkbeil, for your contribution.

New API. The documentation has been vastly improved to support this, see https://docs.rs/rpassword/. To sum up, you can now call read_password_with_config(config) and there is a ConfigBuilder that allows you to configure how passwords should be read. This makes the library much more flexible and means new options will be added without breaking existing code.

Fixes

Fix for CVE-2025-64170 which affects rpassword on versions v7.4.0 and below. Thank you, @squell and @DevLaTron, for reporting this.

Better support for multibyte characters and more reliable handling of control characters and terminal escape sequences. Thank you again, @chipsenkbeil, for your contribution.

Deprecations

_from_bufread functions have been deprecated. You are encouraged to migrate to _with_config functions. See UPGRADE.md as well as the documentation which has examples that you can most likely drop into your code without other changes.

Misc

Update of the windows-sys dependency.

Update Rust edition from 2018 to 2024.

Better cross-platform testing, through more unit tests and a CI that runs Linux, Windows and Wasm.

Feedback is very much welcome.

Commits

1151510 add license checks
3ca2ece bump to 7.5.3
ed863bf remove cargo-tarpaulin build incompatible with rust 1.85 from ci
479012d fixes compile errors with rust 1.85
6ee4708 update nix config to use rust 1.85
6d3518d run ci with rust 1.85
e176edc bump to 7.5.2
6c19a1e make reading utf8 chars more reliable
1ecf07d bump to 7.5.1
60ee071 remove errno clean up, not cross-platform
Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

Update to syn ...
Description has been truncated

dependabot · 2026-10-22T14:07:16Z

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

cla-assistant · 2026-10-22T14:08:15Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

… 23 updates Bumps the cargo-patch-minor group with 23 updates in the / directory: | Package | From | To | | --- | --- | --- | | [arbitrary](https://github.com/rust-fuzz/arbitrary) | `1.4.2` | `1.5.0` | | [axum](https://github.com/tokio-rs/axum) | `0.8.8` | `0.8.9` | | [clap](https://github.com/clap-rs/clap) | `4.5.60` | `4.6.7` | | [futures](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.34` | | [hyper](https://github.com/hyperium/hyper) | `1.8.1` | `1.12.0` | | [indexmap](https://github.com/indexmap-rs/indexmap) | `2.13.0` | `2.14.2` | | [once_cell](https://github.com/matklad/once_cell) | `1.21.3` | `1.21.4` | | [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.75` | `0.10.81` | | [prometheus-client](https://github.com/prometheus/client_rust) | `0.25.0` | `0.25.1` | | [rpassword](https://github.com/conradkleinespel/rpassword) | `7.4.0` | `7.5.4` | | [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` | | [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.154` | | [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.21` | | [tracing-appender](https://github.com/tokio-rs/tracing) | `0.2.4` | `0.2.5` | | [tracing-subscriber](https://github.com/tokio-rs/tracing) | `0.3.22` | `0.3.23` | | [unicode-normalization](https://github.com/unicode-rs/unicode-normalization) | `0.1.25` | `0.1.26` | | [yaml_serde](https://github.com/yaml/yaml-serde) | `0.10.4` | `0.10.7` | | [assert_cmd](https://github.com/assert-rs/assert_cmd) | `2.1.2` | `2.2.2` | | [fastrand](https://github.com/smol-rs/fastrand) | `2.3.0` | `2.5.0` | | [chrono](https://github.com/chronotope/chrono) | `0.4.44` | `0.4.45` | | [rayon](https://github.com/rayon-rs/rayon) | `1.11.0` | `1.12.0` | | [logroller](https://github.com/alasdairpan/logroller) | `0.1.10` | `0.1.12` | | [twox-hash](https://github.com/shepmaster/twox-hash) | `2.1.2` | `2.1.5` | Updates `arbitrary` from 1.4.2 to 1.5.0 - [Changelog](https://github.com/rust-fuzz/arbitrary/blob/main/CHANGELOG.md) - [Commits](rust-fuzz/arbitrary@v1.4.2...v1.5.0) Updates `axum` from 0.8.8 to 0.8.9 - [Release notes](https://github.com/tokio-rs/axum/releases) - [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md) - [Commits](tokio-rs/axum@axum-v0.8.8...axum-v0.8.9) Updates `clap` from 4.5.60 to 4.6.7 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/main/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.5.60...clap_complete-v4.6.7) Updates `futures` from 0.3.32 to 0.3.34 - [Release notes](https://github.com/rust-lang/futures-rs/releases) - [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md) - [Commits](rust-lang/futures-rs@0.3.32...0.3.34) Updates `hyper` from 1.8.1 to 1.12.0 - [Release notes](https://github.com/hyperium/hyper/releases) - [Changelog](https://github.com/hyperium/hyper/blob/master/CHANGELOG.md) - [Commits](hyperium/hyper@v1.8.1...v1.12.0) Updates `indexmap` from 2.13.0 to 2.14.2 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](indexmap-rs/indexmap@2.13.0...2.14.2) Updates `once_cell` from 1.21.3 to 1.21.4 - [Changelog](https://github.com/matklad/once_cell/blob/master/CHANGELOG.md) - [Commits](matklad/once_cell@v1.21.3...v1.21.4) Updates `openssl` from 0.10.75 to 0.10.81 - [Release notes](https://github.com/rust-openssl/rust-openssl/releases) - [Commits](rust-openssl/rust-openssl@openssl-v0.10.75...openssl-v0.10.81) Updates `prometheus-client` from 0.25.0 to 0.25.1 - [Release notes](https://github.com/prometheus/client_rust/releases) - [Changelog](https://github.com/prometheus/client_rust/blob/master/CHANGELOG.md) - [Commits](prometheus/client_rust@v0.25.0...v0.25.1) Updates `rpassword` from 7.4.0 to 7.5.4 - [Release notes](https://github.com/conradkleinespel/rpassword/releases) - [Commits](conradkleinespel/rpassword@v7.4.0...v7.5.4) Updates `serde` from 1.0.228 to 1.0.229 - [Release notes](https://github.com/serde-rs/serde/releases) - [Commits](serde-rs/serde@v1.0.228...v1.0.229) Updates `serde_json` from 1.0.149 to 1.0.154 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.149...v1.0.154) Updates `thiserror` from 2.0.18 to 2.0.21 - [Release notes](https://github.com/dtolnay/thiserror/releases) - [Commits](dtolnay/thiserror@2.0.18...2.0.21) Updates `tracing-appender` from 0.2.4 to 0.2.5 - [Release notes](https://github.com/tokio-rs/tracing/releases) - [Commits](tokio-rs/tracing@tracing-appender-0.2.4...tracing-appender-0.2.5) Updates `tracing-subscriber` from 0.3.22 to 0.3.23 - [Release notes](https://github.com/tokio-rs/tracing/releases) - [Commits](tokio-rs/tracing@tracing-subscriber-0.3.22...tracing-subscriber-0.3.23) Updates `unicode-normalization` from 0.1.25 to 0.1.26 - [Commits](https://github.com/unicode-rs/unicode-normalization/commits/v0.1.26) Updates `yaml_serde` from 0.10.4 to 0.10.7 - [Commits](yaml/yaml-serde@0.10.4...0.10.7) Updates `assert_cmd` from 2.1.2 to 2.2.2 - [Changelog](https://github.com/assert-rs/assert_cmd/blob/master/CHANGELOG.md) - [Commits](assert-rs/assert_cmd@v2.1.2...v2.2.2) Updates `fastrand` from 2.3.0 to 2.5.0 - [Release notes](https://github.com/smol-rs/fastrand/releases) - [Changelog](https://github.com/smol-rs/fastrand/blob/master/CHANGELOG.md) - [Commits](smol-rs/fastrand@v2.3.0...v2.5.0) Updates `chrono` from 0.4.44 to 0.4.45 - [Release notes](https://github.com/chronotope/chrono/releases) - [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md) - [Commits](chronotope/chrono@v0.4.44...v0.4.45) Updates `rayon` from 1.11.0 to 1.12.0 - [Changelog](https://github.com/rayon-rs/rayon/blob/main/RELEASES.md) - [Commits](rayon-rs/rayon@rayon-core-v1.11.0...rayon-core-v1.12.0) Updates `logroller` from 0.1.10 to 0.1.12 - [Changelog](https://github.com/alasdairpan/logroller/blob/main/CHANGELOG.md) - [Commits](alasdairpan/logroller@0.1.10...0.1.12) Updates `twox-hash` from 2.1.2 to 2.1.5 - [Changelog](https://github.com/shepmaster/twox-hash/blob/main/CHANGELOG.md) - [Commits](shepmaster/twox-hash@v2.1.2...v2.1.5) --- updated-dependencies: - dependency-name: arbitrary dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: assert_cmd dependency-version: 2.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: axum dependency-version: 0.8.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: chrono dependency-version: 0.4.45 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: clap dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: fastrand dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: futures dependency-version: 0.3.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: hyper dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: indexmap dependency-version: 2.14.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: logroller dependency-version: 0.1.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: once_cell dependency-version: 1.21.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: openssl dependency-version: 0.10.81 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: prometheus-client dependency-version: 0.25.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: rayon dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: rpassword dependency-version: 7.5.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-patch-minor - dependency-name: serde dependency-version: 1.0.229 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: serde_json dependency-version: 1.0.154 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: thiserror dependency-version: 2.0.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: tracing-appender dependency-version: 0.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: tracing-subscriber dependency-version: 0.3.23 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: twox-hash dependency-version: 2.1.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: unicode-normalization dependency-version: 0.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor - dependency-name: yaml_serde dependency-version: 0.10.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-patch-minor ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot force-pushed the dependabot/cargo/unstable/cargo-patch-minor-7e0dbdf388 branch from 7c64a2c to 199004e Compare October 22, 2026 14:47

dependabot Bot force-pushed the dependabot/cargo/unstable/cargo-patch-minor-7e0dbdf388 branch from 199004e to b1b078f Compare October 22, 2026 17:48

Navigation Menu

Repository navigation

chore(deps): bump the cargo-patch-minor group across 1 directory with 23 updates - #1354

chore(deps): bump the cargo-patch-minor group across 1 directory with 23 updates#1354
dependabot[bot] wants to merge 1 commit into
unstablefrom
dependabot/cargo/unstable/cargo-patch-minor-7e0dbdf388

dependabot Bot commented on behalf of github Oct 22, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 22, 2026

Uh oh!

cla-assistant Bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.5.0

Added

Changed

Fixed

axum-v0.8.9

v4.6.7

[4.6.7] - 2026-09-14

Features

v4.6.6

[4.6.6] - 2026-08-06

Features

v4.6.5

[4.6.5] - 2026-07-31

Fixes

v4.6.4

[4.6.4] - 2026-07-21

Internal

v4.6.3

[4.6.3] - 2026-07-20

Fixes

v4.6.2

[4.6.2] - 2026-07-15

Fixes

v4.6.1

[4.6.1] - 2026-04-15

Fixes

[4.6.7] - 2026-09-14

Features

[4.6.6] - 2026-08-06

Features

[4.6.5] - 2026-07-31

Fixes

[4.6.4] - 2026-07-21

Internal

[4.6.3] - 2026-07-20

Fixes

[4.6.2] - 2026-07-15

Fixes

[4.6.1] - 2026-04-15

Fixes

[4.6.0] - 2026-03-12

Compatibility

[4.5.61] - 2026-03-12

0.3.34

0.3.33

0.3.34 - 2026-08-11

0.3.33 - 2026-07-18

v1.12.0

Features

Bug Fixes

Everything

New Contributors

v1.12.0 (2026-10-06)

Bug Fixes

Features

v1.11.1 (2026-08-27)

Bug Fixes

v1.11.0 (2026-07-20)

Bug Fixes

Features

2.14.2 (2026-09-04)

2.14.1 (2026-08-28)

2.14.0 (2026-04-09)

2.13.1 (2026-04-02)

1.21.4

openssl-v0.10.81

What's Changed

New Contributors

openssl-v0.10.80

What's Changed

openssl-v0.10.79

What's Changed

v0.25.1

Fixed

Changed

[0.25.1]

Fixed

dependabot Bot commented on behalf of github Oct 22, 2026 •

edited

Loading