deps: bump the deps-patches group across 1 directory with 10 updates by dependabot[bot] · Pull Request #905 · beyondessential/bestool

dependabot · 2026-09-16T11:33:29Z

Bumps the deps-patches group with 10 updates in the / directory:

Package	From	To
reqwest	`0.13.4`	`0.13.5`
bon	`3.10.0`	`3.10.1`
duct	`1.1.1`	`1.1.2`
hickory-resolver	`0.26.1`	`0.26.2`
rustls	`0.23.43`	`0.23.44`
tokio-rustls	`0.26.4`	`0.26.5`
binstalk-downloader	`0.13.45`	`0.13.46`
detect-targets	`0.1.90`	`0.1.91`
toml	`1.1.4+spec-1.1.0`	`1.1.5+spec-1.1.0`
indexmap	`2.14.1`	`2.14.2`

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

Add Error::is_dns() to identify errors caused by DNS resolution failures.

Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).

Add TLS version to TlsInfo extension.

Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.

Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

fix(blocking): preserve version and extensions in TryFromhttp::Request by @wwhsaber in seanmonstar/reqwest#3050

Remove unnecessary clones by @FranciscoTGouveia in seanmonstar/reqwest#3052

Add Referrer and Referrer Policy methods to WASM Request API by @Billy-Sheppard in seanmonstar/reqwest#3049

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in seanmonstar/reqwest#3058

feat: add Error::is_dns() to identify DNS resolution failures by @JoakoI98 in seanmonstar/reqwest#3057

Fix blocking client timeout panic by @V-Mann-Nick in seanmonstar/reqwest#3060

Use LookupIpStrategy::Ipv6AndIpv4 to actually prefer IPv6 when using hickory-dns by @FalkWoldmann in seanmonstar/reqwest#3063

feat: Add ClientBuilder::http1_max_headers by @smaeda-ks in seanmonstar/reqwest#3065

feat: expose the negotiated TLS version via TlsInfo by @dennisameling in seanmonstar/reqwest#3067

fix(error): detect timeouts wrapped in body decode errors by @raphaelroshan in seanmonstar/reqwest#3064

Remove unnecessary clones and a cast by @FranciscoTGouveia in seanmonstar/reqwest#3071

chore(deps): upgrade base64 to 0.23 by @paolobarbolini in seanmonstar/reqwest#3074

perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody by @spellsaif in seanmonstar/reqwest#3085

fix(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture::poll by @spellsaif in seanmonstar/reqwest#3084

src/async_impl/request.rs_improved_doc_for_json_fn: by @Athleteg in seanmonstar/reqwest#3082

fix: proxy could use wrong credentials if many matched by @seanmonstar in seanmonstar/reqwest#3098

New Contributors

@wwhsaber made their first contribution in seanmonstar/reqwest#3050

@FranciscoTGouveia made their first contribution in seanmonstar/reqwest#3052

@Billy-Sheppard made their first contribution in seanmonstar/reqwest#3049

@JoakoI98 made their first contribution in seanmonstar/reqwest#3057

@V-Mann-Nick made their first contribution in seanmonstar/reqwest#3060

@FalkWoldmann made their first contribution in seanmonstar/reqwest#3063

@smaeda-ks made their first contribution in seanmonstar/reqwest#3065

@raphaelroshan made their first contribution in seanmonstar/reqwest#3064

@spellsaif made their first contribution in seanmonstar/reqwest#3085

@Athleteg made their first contribution in seanmonstar/reqwest#3082

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

Add Error::is_dns() to identify errors caused by DNS resolution failures.

Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).

Add TLS version to TlsInfo extension.

Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.

Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

Commits

de55373 v0.13.5
4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
9f06fd2 docs: improve description of JSON method (#3082)
5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
4e9a3c7 chore: add pull request template for human-written content
17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
221abe9 chore: Remove unnecessary clones and a cast (#3071)
99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
Additional commits viewable in compare view

Updates bon from 3.10.0 to 3.10.1

Release notes

Sourced from bon's releases.

v3.10.1

Changed

Strip the r# prefix from raw identifiers in derive(Debug) (#402). Thanks @MaxFreedomPollard for the contribution!

Commits

fdefce2 chore: release v3.10.1 (#403)
300abd6 Strip the r# prefix from raw identifiers in derive(Debug) (#402)
See full diff in compare view

Updates duct from 1.1.1 to 1.1.2

Commits

0195544 version 1.1.2
781f545 Clippy fixes
e85aafd document that wait_timeout panics on overflow
ba535d5 comment updates
9c71ebe docs formatting fix
See full diff in compare view

Updates hickory-resolver from 0.26.1 to 0.26.2

Release notes

Sourced from hickory-resolver's releases.

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone

GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records

GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN

GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence

GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records

GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3

GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut

GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut

GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks

GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion

GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names

GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists

GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses

GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer

GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY

GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names

GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries

GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled

GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS

GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS

GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines

GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section

GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses

GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)

GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor

GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget

GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses

GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing

GHSA-2f4m-fq7w-mrgx: Remote memory exhaustion in Hickory DNS through incomplete DNS-over-QUIC request bodies

GHSA-g8wg-4mwh-fjfv: DoQ server has no timeout when reading request

GHSA-5r56-v84h-c3w5: DoH request body is buffered without a size limit

GHSA-6f2x-v7q7-m7m5: Resolver follows irrelevant CNAME records

GHSA-xv7c-h5g9-x25x: transient DS-fetch error inappropriately cached as BOGUS

GHSA-9px7-7m25-f6q2: Recursive resolver: Empty connection pool is cached after failed IP lookup

GHSA-29q9-p769-j8gq: Bogus answers cached for the attacker-supplied record TTL

GHSA-4jwp-xjwm-333g: Missing IPv4-Mapped IPv6 address canonicalization

Special thanks go out to @qifan-sailboat and Palo Alto Networks for their research and for reporting the bulk of these vulnerabilities. Thanks to @ATinyShoe, @kirk-baird, @thesmartshadow, @BeaCox, @jpds, @N0zoM1z0, and @JasonPap for reporting vulnerabilities as well.

If your organization is interested in coordinated disclosure of future security vulnerabilities, please contact @djc for commercial support.

What's Changed

... (truncated)

Commits

48323ef Bump version to 0.26.2
ccd6952 Only follow one CNAME record from each response
c04ad2b Better distinguish NODATA response and wildcards
64b4291 Add test for bogus wildcard expansion
478998b proto: constrain peer-controlled allocation sizes
8392769 resolver: avoid caching empty nameserver pools
e2d21d8 Replace use of SOA name with NSEC3 record parents
84fa8ab Check for correct zone name in covering NSEC3s too
09803ba Look for correct zone name in matching NSEC3s
26f45d3 Rename Nsec3RecordPair to Nsec3RecordInfo
Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.44

Commits

64ad386 Bump version to 0.23.44
1efbf66 bogo: remove PostQuantum setup
e78162f aws-lc-rs: add support for ML-DSA signatures
d880772 bogo: extract Options::provider() helper
87201d6 bogo: force all callers to get provider from Options
93657e3 server: limit 1.2 certificate requests to 1.2-compatible signature schemes
bbd3c9a client: avoid sending 1.3-only signature schemes if no cipher suites configured
eb57688 tls12: require known signature algorithm
e7a9cef tls12: send illegal_parameter alert for kx signed with wrong algorithm
06a546d bogo: take latest
Additional commits viewable in compare view

Updates tokio-rustls from 0.26.4 to 0.26.5

Release notes

Sourced from tokio-rustls's releases.

0.26.5

What's Changed

Exclude bad test keys from the published package by @weiznich in rustls/tokio-rustls#140

chore: improve code comments clarity by @xibeiyoumian in rustls/tokio-rustls#152

client/server timeout examples, doc pass hinting towards timeouts. by @cpu in rustls/tokio-rustls#187

return more data at once from TlsStream::poll_read by @trinity-1686a in rustls/tokio-rustls#198

Commits

f8832d2 Bump version to 0.26.5
c0fad2f return more data at once from TlsStream::poll_read (#198)
edc7306 build(deps): bump futures-util from 0.3.33 to 0.3.34
baeadaa build(deps): bump rcgen from 0.14.8 to 0.14.9
1e138ad build(deps): bump taiki-e/cache-cargo-install-action from 3.0.7 to 3.0.8
b4ecff6 build(deps): bump taiki-e/cache-cargo-install-action from 3 to 3.0.7
f47a689 build(deps): bump rustls from 0.23.42 to 0.23.43
e25578e build(deps): bump tokio from 1.53.0 to 1.53.1
d2a6d98 server: add rustdoc hinting towards timeout wrapping
c2e9b4a client: add rustdoc hinting towards timeout wrapping
Additional commits viewable in compare view

Updates binstalk-downloader from 0.13.45 to 0.13.46

Release notes

Sourced from binstalk-downloader's releases.

binstalk-downloader-v0.13.46

Other

(deps) bump astral-tokio-tar from 0.6.4 to 0.7.0 in the deps group (#2654)

Commits

92a3953 chore: release (#2648)
5baa196 fix: prefix human-readable logs with cargo-binstall (#2645)
bbdafe4 build(deps): bump astral-tokio-tar from 0.6.4 to 0.7.0 in the deps group (#2654)
9ef12fa dep: Upgrade transitive dependencies (#2653)
5aafaac dep: Upgrade transitive dependencies (#2647)
75b4bfa release: cargo-binstall v1.22.0 (#2640)
See full diff in compare view

Updates detect-targets from 0.1.90 to 0.1.91

Release notes

Sourced from detect-targets's releases.

detect-targets-v0.1.91

Other

update Cargo.lock dependencies

Commits

92a3953 chore: release (#2648)
5baa196 fix: prefix human-readable logs with cargo-binstall (#2645)
bbdafe4 build(deps): bump astral-tokio-tar from 0.6.4 to 0.7.0 in the deps group (#2654)
9ef12fa dep: Upgrade transitive dependencies (#2653)
5aafaac dep: Upgrade transitive dependencies (#2647)
75b4bfa release: cargo-binstall v1.22.0 (#2640)
See full diff in compare view

Updates toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0

Commits

e93ed4e chore: Release
d23436d docs: Update changelog
151afcd fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat (#1211)
26a4050 fix(de): Ensure DeValue::make_owned includes DeInteger/DeFloat
232f136 chore(deps): Update Prek to v0.5.1 (#1209)
9ee4b4e chore(deps): Update crate-ci/typos digest to 4d9c206 (#1208)
525f352 chore(deps): Update crate-ci/committed digest to 800a04e (#1207)
46043ed chore(deps): Update crate-ci/typos digest to 4d9c206
c00e894 chore(deps): Update crate-ci/committed digest to 800a04e
1ae0158 chore(deps): Update Prek to v0.5.0 (#1205)
Additional commits viewable in compare view

Updates indexmap from 2.14.1 to 2.14.2

Changelog

Sourced from indexmap's changelog.

2.14.2 (2026-09-04)

Fix item hygiene in map and set macros. Previously, an internal const CAP could shadow the same name in the caller's namespace.

Allow const initialization of empty indexmap_with_default! and indexset_with_default!. The hasher may also be omitted if it's inferrable.

Commits

41a8708 Merge pull request #450 from cuviper/macros
0fb7b5c Release 2.14.2
55e6b28 Improve the empty macro cases
c067355 Fix item hygiene in user macros
See full diff in compare view

Bumps the deps-patches group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` | | [bon](https://github.com/elastio/bon) | `3.10.0` | `3.10.1` | | [duct](https://github.com/oconnor663/duct.rs) | `1.1.1` | `1.1.2` | | [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.26.1` | `0.26.2` | | [rustls](https://github.com/rustls/rustls) | `0.23.43` | `0.23.44` | | [tokio-rustls](https://github.com/rustls/tokio-rustls) | `0.26.4` | `0.26.5` | | [binstalk-downloader](https://github.com/cargo-bins/cargo-binstall) | `0.13.45` | `0.13.46` | | [detect-targets](https://github.com/cargo-bins/cargo-binstall) | `0.1.90` | `0.1.91` | | [toml](https://github.com/toml-rs/toml) | `1.1.4+spec-1.1.0` | `1.1.5+spec-1.1.0` | | [indexmap](https://github.com/indexmap-rs/indexmap) | `2.14.1` | `2.14.2` | Updates `reqwest` from 0.13.4 to 0.13.5 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5) Updates `bon` from 3.10.0 to 3.10.1 - [Release notes](https://github.com/elastio/bon/releases) - [Changelog](https://github.com/elastio/bon/blob/master/release-plz.toml) - [Commits](elastio/bon@v3.10.0...v3.10.1) Updates `duct` from 1.1.1 to 1.1.2 - [Commits](oconnor663/duct.rs@1.1.1...1.1.2) Updates `hickory-resolver` from 0.26.1 to 0.26.2 - [Release notes](https://github.com/hickory-dns/hickory-dns/releases) - [Changelog](https://github.com/hickory-dns/hickory-dns/blob/main/CHANGELOG.md) - [Commits](hickory-dns/hickory-dns@v0.26.1...v0.26.2) Updates `rustls` from 0.23.43 to 0.23.44 - [Release notes](https://github.com/rustls/rustls/releases) - [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md) - [Commits](rustls/rustls@v/0.23.43...v/0.23.44) Updates `tokio-rustls` from 0.26.4 to 0.26.5 - [Release notes](https://github.com/rustls/tokio-rustls/releases) - [Commits](rustls/tokio-rustls@v/0.26.4...v/0.26.5) Updates `binstalk-downloader` from 0.13.45 to 0.13.46 - [Release notes](https://github.com/cargo-bins/cargo-binstall/releases) - [Changelog](https://github.com/cargo-bins/cargo-binstall/blob/main/release-plz.toml) - [Commits](cargo-bins/cargo-binstall@binstalk-downloader-v0.13.45...binstalk-downloader-v0.13.46) Updates `detect-targets` from 0.1.90 to 0.1.91 - [Release notes](https://github.com/cargo-bins/cargo-binstall/releases) - [Changelog](https://github.com/cargo-bins/cargo-binstall/blob/main/release-plz.toml) - [Commits](cargo-bins/cargo-binstall@detect-targets-v0.1.90...detect-targets-v0.1.91) Updates `toml` from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0 - [Commits](toml-rs/toml@toml-v1.1.4...toml-v1.1.5) Updates `indexmap` from 2.14.1 to 2.14.2 - [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md) - [Commits](indexmap-rs/indexmap@2.14.1...2.14.2) --- updated-dependencies: - dependency-name: binstalk-downloader dependency-version: 0.13.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: bon dependency-version: 3.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: detect-targets dependency-version: 0.1.91 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: duct dependency-version: 1.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: hickory-resolver dependency-version: 0.26.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: indexmap dependency-version: 2.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: reqwest dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: rustls dependency-version: 0.23.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: tokio-rustls dependency-version: 0.26.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches - dependency-name: toml dependency-version: 1.1.5+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: deps-patches ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Sep 16, 2026

dependabot Bot force-pushed the dependabot/cargo/deps-patches-ec3abce6bb branch from c4c5570 to 9332335 Compare September 16, 2026 16:05

Navigation Menu

Uh oh!

deps: bump the deps-patches group across 1 directory with 10 updates - #905

deps: bump the deps-patches group across 1 directory with 10 updates#905
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/deps-patches-ec3abce6bb

dependabot Bot commented on behalf of github Sep 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.13.5

tl;dr

What's Changed

New Contributors

v0.13.5

v3.10.1

Changed

v0.26.2

What's Changed

0.26.5

What's Changed

binstalk-downloader-v0.13.46

Other

detect-targets-v0.1.91

Other

2.14.2 (2026-09-04)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 16, 2026 •

edited

Loading