Skip to content

chore(deps): bump the prod-dependencies group across 1 directory with 40 updates #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the prod-dependencies group across 1 directory with 40 updates #266

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 28, 2026 •
edited
Loading

Bumps the prod-dependencies group with 40 updates in the / directory:

Package From To
anyhow 1.0.98 1.0.100
async-trait 0.1.83 0.1.89
chrono 0.4.38 0.4.43
clap 4.5.41 4.5.55
colored 2.1.0 3.1.1
derive_builder 0.20.1 0.20.2
directories 5.0.1 6.0.0
educe 0.5.11 0.6.0
fake 2.10.0 4.4.0
gethostname 0.4.3 1.1.0
glob 0.3.1 0.3.3
human-panic 2.0.2 2.0.6
ignore 0.4.23 0.4.25
inquire 0.6.2 0.9.2
itertools 0.13.0 0.14.0
jsonschema 0.30.0 0.33.0
jsonwebtoken 10.2.0 10.3.0
minijinja 2.3.1 2.15.1
mockall 0.12.1 0.14.0
normpath 1.3.0 1.5.0
pathdiff 0.2.2 0.2.3
petgraph 0.6.5 0.8.3
regex 1.11.1 1.12.2
reqwest 0.12.9 0.12.28
secrecy 0.8.0 0.10.3
sha256 1.5.0 1.6.0
shellexpand 3.1.0 3.1.1
strip-ansi-escapes 0.2.0 0.2.1
strum 0.26.3 0.27.2
thiserror 1.0.69 2.0.12
time 0.3.41 0.3.46
tokio 1.46.1 1.49.0
tonic 0.14.2 0.14.3
tracing-appender 0.2.3 0.2.4
which 6.0.3 8.0.0
assert_cmd 2.0.16 2.1.2
assert_fs 1.1.2 1.1.3
escargot 0.5.12 0.5.15
predicates 3.1.2 3.1.3
tempfile 3.20.0 3.24.0

Updates anyhow from 1.0.98 to 1.0.100

Release notes

Sourced from anyhow's releases.

1.0.100

  • Teach clippy to lint formatting arguments in bail!, ensure!, anyhow! (#426)

1.0.99

  • Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#420)
Commits
  • 18c2598 Release 1.0.100
  • f271988 Merge pull request #426 from dtolnay/clippyfmt
  • 52f2115 Mark macros with clippy::format_args
  • da5fd9d Raise minimum tested compiler to rust 1.76
  • 211e409 Opt in to generate-macro-expansion when building on docs.rs
  • b48fc02 Enforce trybuild >= 1.0.108
  • d5f59fb Update ui test suite to nightly-2025-09-07
  • 238415d Update ui test suite to nightly-2025-08-24
  • 3bab070 Update actions/checkout@v4 -> v5
  • 4249254 Order cap-lints flag in the same order as thiserror build script
  • Additional commits viewable in compare view

Updates async-trait from 0.1.83 to 0.1.89

Release notes

Sourced from async-trait's releases.

0.1.89

0.1.88

  • Fix lifetime bounding on generic parameters that have cfg (#289)

0.1.87

  • Documentation improvements

0.1.86

  • Documentation improvements

0.1.85

  • Omit Self: 'async_trait bound in impl when not needed by signature (#284)

0.1.84

  • Support impl Trait in return type (#282)
Commits
  • a7e91e9 Release 0.1.89
  • fbcfcac Merge pull request 293 from Veykril/lw/quote_spanned
  • fd93990 Improve use of spans in quote_spanned
  • a5093fe Add type-mismatch ui test
  • 6d12b44 Revert "Pin nightly toolchain used for miri job"
  • dd9e4ba Hide unused_variables warning in consider-restricting.rs ui test
  • b454fc8 Update ui test suite to nightly-2025-08-03
  • 9c880e8 Update ui test suite to nightly-2025-07-30
  • 7ca751d Ignore unused_parens warning in test
  • 2bccfeb Update ui test suite to nightly-2025-05-28
  • Additional commits viewable in compare view

Updates chrono from 0.4.38 to 0.4.43

Release notes

Sourced from chrono's releases.

0.4.43

What's Changed

0.4.42

What's Changed

v0.4.41

What's Changed

0.4.40

What's Changed

... (truncated)

Commits
  • 45caaa9 Update copyright year to 2026 in LICENSE.txt
  • 1c0b8f0 Bump version to 0.4.43
  • a03e43b Upgrade windows-bindgen to 0.66
  • 4fedaba Ignore bincode advisory
  • f4b7bbd Bump actions/checkout from 5 to 6
  • db12973 Added doctest for the NaiveDate years_since function (#1755)
  • 34b5f49 chore: minor improvement for docs
  • 8c82711 Bump actions/setup-node from 5 to 6
  • ea1f11b Drop deny lints, eager Debug impls are a mixed blessing
  • 35f9f2d Add feature gated defmt support.
  • Additional commits viewable in compare view

Updates clap from 4.5.41 to 4.5.55

Release notes

Sourced from clap's releases.

v4.5.55

[4.5.55] - 2026-01-27

Fixes

  • Fix inconsistency in precedence between positionals with a value_terminator("--") and escapes (--) where ./foo -- bar means the first arg is empty, rather than escaping future args

v4.5.54

[4.5.54] - 2026-01-02

Fixes

  • (help) Move [default] to its own paragraph when PossibleValue::help is present in --help

v4.5.53

[4.5.53] - 2025-11-19

Features

  • Add default_values_if, default_values_ifs

v4.5.52

[4.5.52] - 2025-11-17

Fixes

  • Don't panic when args_conflicts_with_subcommands conflicts with an ArgGroup

v4.5.51

[4.5.51] - 2025-10-29

Fixes

  • (help) Correctly calculate padding for short flags that take a value
  • (help) Don't panic on short flags using ArgAction::Count

v4.5.50

[4.5.50] - 2025-10-20

Features

  • Accept Cow where String and &str are accepted

v4.5.48

[4.5.48] - 2025-09-19

Documentation

  • Add a new CLI Concepts document as another way of framing clap
  • Expand the typed_derive cookbook entry

... (truncated)

Changelog

Sourced from clap's changelog.

[4.5.55] - 2026-01-27

Fixes

  • Fix inconsistency in precedence between positionals with a value_terminator("--") and escapes (--) where ./foo -- bar means the first arg is empty, rather than escaping future args

[4.5.54] - 2026-01-02

Fixes

  • (help) Move [default] to its own paragraph when PossibleValue::help is present in --help

[4.5.53] - 2025-11-19

Features

  • Add default_values_if, default_values_ifs

[4.5.52] - 2025-11-17

Fixes

  • Don't panic when args_conflicts_with_subcommands conflicts with an ArgGroup

[4.5.51] - 2025-10-29

Fixes

  • (help) Correctly calculate padding for short flags that take a value
  • (help) Don't panic on short flags using ArgAction::Count

[4.5.50] - 2025-10-20

Features

  • Accept Cow where String and &str are accepted

[4.5.49] - 2025-10-13

Fixes

  • (help) Correctly wrap when ANSI escape codes are present

[4.5.48] - 2025-09-19

Documentation

  • Add a new CLI Concepts document as another way of framing clap
  • Expand the typed_derive cookbook entry

... (truncated)

Commits
  • 4c03930 chore: Release
  • fb948a2 docs: Update changelog
  • 0f60239 Merge pull request #6057 from GilShoshan94/master
  • 83d4206 test: Update fixture to cover all cases + styling
  • b13274d fix: Rename pvs to dvs for default values
  • df92ea0 feat(help): Allow styling for inline context
  • 0e535e5 chore(deps): Update compatible (dev) (#6054)
  • de57287 chore(deps): Update Rust Stable to v1.88 (#6048)
  • 5504a13 Merge pull request #6047 from clap-rs/revert-6045-cleanup-docsrs
  • c1c243c Revert "Cleanup docs.rs related issues"
  • Additional commits viewable in compare view

Updates colored from 2.1.0 to 3.1.1

Release notes

Sourced from colored's releases.

v3.1.1

No release notes provided.

v3.1.0

No release notes provided.

v3.0.0

  • [BREAKING CHANGE]: Upgrade MSRV to 1.80 and remove the then unnecessary lazy_static dependency.

v2.2.0

No release notes provided.

Changelog

Sourced from colored's changelog.

Unreleased

  • Added methods ansi_color and on_ansi_color to Colorize.

3.0.0

  • [BREAKING CHANGE]: Upgrade MSRV to 1.80 and remove the then unnecessary lazy_static dependency.

2.2.0

  • Updated top-level docs to include a note about ColoredString's role in the Colorize pipeline as well as link to it to suggest learning more about how to manipulate existing ColoredString's.
  • Changes to ColoredString:
    • Expose fields.
    • [DEPRECATION]: Deprecated methods fgcolor, bgcolor, and style due to their obsolescence in the face of the exposing of their represented fields.
    • Add methods for clearing specific elements of fgcolor, bgcolor, and style.
    • Change Default implementation to be via derive as Style now implements Default (see changes to Style below).
    • Add implementation of DerefMut.
    • Updated docs to reflect the above changes as well as generally greatly expand them.
  • Changes to Style:
    • Implemented Default for Style (returns CLEAR). This exposes a method by which users can create plain Style's from scratch.
    • Implemented From<Styles> for Style. This lets users easily create Style's from specific styles.
    • Exposed previously private method add.
    • Created method remove which essentially does the opposite.
    • Added builder-style methods in the vein of Colorize to add stylings (e.g. bold, underline, italic, strikethrough).
    • Implemented bitwise operators BitAnd, BitOr, BitXor, and Not as well as their representative assignment operators. You can also use a Styles as an operand for these.
    • Implemented FromIterator<Styles> for Style.
  • Changes to Styles:
    • Implemented bitwise operators BitAnd, BitOr, BitXor, and Not which all combine Styles's and output Style's. These can also take a Style as an operand.
  • Added additional testing for all of the above changes.
  • Added methods with_style and with_color_and_style to Colorize.
Commits

Updates derive_builder from 0.20.1 to 0.20.2

Release notes

Sourced from derive_builder's releases.

v0.20.2

  • Allow unquoted expressions in builder(default = ...) #331
Commits
  • fc18dd2 Bump version to 0.20.2
  • b809d0e add documentation for private build method
  • 65c87d3 Skip rustfmt for manually-written output
  • d2efc54 Remove DeprecationNotes feature
  • 2418ab4 Allow unquoted expressions in default = ...
  • 1203dfa Fix compiletest error message
  • 5cca75a Remove last pretty_assertions dependency
  • fdc50aa Remove prettyassertions
  • 0a163af Fix nightly clippy violation
  • be3795e Bump darling version to fix clippy issue
  • Additional commits viewable in compare view

Updates directories from 5.0.1 to 6.0.0

Commits

Updates educe from 0.5.11 to 0.6.0

Commits
  • bc05181 bump version
  • b867288 Merge branch 'ijackson-leaking-bounds'
  • 3f98647 Merge branch 'leaking-bounds' of github.com:ijackson/rust-educe into ijackson...
  • 47bd92f update doc
  • f962522 bump version
  • 9e23e34 Merge branch 'ijackson-all-bounds'
  • b7567cb Merge branch 'all-bounds' of github.com:ijackson/rust-educe into ijackson-all...
  • fca9263 fix the bound_4 test case in ord_struct
  • e40c20e add an empty line
  • 63114a8 fix the bound_4 test case in partial_ord_struct
  • Additional commits viewable in compare view

Updates fake from 2.10.0 to 4.4.0

Release notes

Sourced from fake's releases.

v4.4.0

What's Changed

New Contributors

Full Changelog: cksac/fake-rs@v4.3.0...v4.4.0

v4.3.0

No release notes provided.

v3.2.0

No release notes provided.

v3.1.0

No release notes provided.

Commits

Updates gethostname from 0.4.3 to 1.1.0

Updates glob from 0.3.1 to 0.3.3

Release notes

Sourced from glob's releases.

v0.3.3

  • Optimize memory allocations (#147)
  • Bump the MSRV to 1.63 (#172)
  • Fix spelling in pattern documentation (#164)
  • Fix version numbers and some formatting (#157)
  • Style fixes (#137)

v0.3.2

What's Changed

New Contributors

Full Changelog: rust-lang/glob@0.3.1...v0.3.2

Changelog

Sourced from glob's changelog.

0.3.3 - 2025-08-11

  • Optimize memory allocations (#147)
  • Bump the MSRV to 1.63 (#172)
  • Fix spelling in pattern documentation (#164)
  • Fix version numbers and some formatting (#157)
  • Style fixes (#137)

0.3.2 - 2024-12-28

What's Changed

New Contributors

Full Changelog: rust-lang/glob@0.3.1...0.3.2

Commits

Updates human-panic from 2.0.2 to 2.0.6

Changelog

Sourced from human-panic's changelog.

[2.0.6] - 2025-12-29

Features

  • Added Metadata::repository as a fallback for Metadata::homepage

[2.0.5] - 2025-12-26

Performance

  • Improve build times on some platforms by changing from os_info to sysinfo

[2.0.4] - 2025-10-28

[2.0.3] - 2025-07-08

Internal

  • Update toml
Commits

Updates ignore from 0.4.23 to 0.4.25

Commits

Updates inquire from 0.6.2 to 0.9.2

Release notes

Sourced from inquire's releases.

v0.9.2

  • Bumped MSRV from 1.80 -> 1.82 due to new requirements of dependencies.
  • Expose the sorting function used by Select (thanks @​devjgm!)

v0.9.1

  • Fix panicking when terminal backend reports size with 0 width. Thanks @​sebhoss for reporting!

v0.9.0

Features

Adds Selectable derive macro for enums! You can now easily create enum-based prompts (e.g. menus) by using the Selectable derive macro on your enums.

See the example for more details. Thank you @​TheBearodactyl for the contribution!

Dependencies

  • Updated unicode-width to 0.2.
  • Updated crossterm to 0.29.
  • Updated termion to 4.0.
  • Updated console to 0.16.

v0.9.1

v0.9

v0.9.0

Features

Adds Selectable derive macro for enums! You can now easily create enum-based prompts (e.g. menus) by using the Selectable derive macro on your enums.

See the example for more details. Thank you @​TheBearodactyl for the contribution!

Dependencies

  • Updated unicode-width to 0.2.
  • Updated crossterm to 0.29.
  • Updated termion to 4.0.
  • Updated console to 0.16.

v0.9.1

  • Fix panicking when terminal backend reports size with 0 width. Thanks @​sebhoss for reporting!

v0.9.0

Features

Adds Selectable derive macro for enums! You can now easily create enum-based prompts (e.g. menus) by using the Selectable derive macro on your enums.

... (truncated)

Changelog

Sourced from inquire's changelog.

[0.9.2] - 2026-01-17

  • Bumped MSRV from 1.80 -> 1.82 due to new requirements of dependencies.
  • Expose the sorting function used by Select (thanks @​devjgm!)

[0.9.1] - 2025-09-16

Fixes

  • Fix panicking when terminal backend reports size with 0 width.

[0.9.0] - 2025-09-16

Features

Adds Selectable derive macro for enums! You can now easily create enum-based prompts (e.g. menus) by using the Selectable derive macro on your enums.

See the example for more details. Thank you @​TheBearodactyl for the contribution!

Dependencies

  • Updated unicode-width to 0.2.
  • Updated crossterm to 0.29.
  • Updated termion to 4.0.
  • Updated console to 0.16.

[0.8.0] - 2025-09-14

Features

  • Improve end user experience when prompting for input without a message.
  • Implement raw_prompt_skippable for Select.

Fixes

  • Fix bug where inputs spanning 3+ lines would break text rendering.
  • Fix bug where Select and MultiSelect prompts would render the first option incorrectly when filtering is disabled.
  • Fix autocomplete suggestions not being updated after a suggestion is accepted.
  • Fix incorrect cursor placement when inputting CJK characters.

API Changes

  • Don't require static lifetime for autocompleter and validator.

Dependencies

  • Upgraded crossterm to 0.28.1.
  • Raised minimum supported Rust version to 1.80.0.
  • Migrate from once_cell to stdlib.
  • Migrate from fxhash to stdlib.

... (truncated)

Commits
  • 4fb68e6 chore: release v0.9.2
  • cc477ea Updaete CHANGELOG
  • 0a5ebad Expose the sorting function used by Select (#326)
  • 947d560 Bump MSRV to 1.81 due to dep requirements (#327)
  • d443a94 Bump tj-actions/changed-files (#308)
  • 15ecb4b chore: update Cargo.toml to conditionally include dependencies for non-Window...
  • 358b054 refactor: remove unused height method from TerminalSize struct
  • f90026a fix: conditionally include tests for non-Windows platforms
  • 61d72bf chore: release v0.9.1
  • d0921a1 Enhance terminal size handling and fix panicking when terminal size is report...
  • Additional commits viewable in compare view

Updates itertools from 0.13.0 to 0.14.0

Changelog

Sourced from itertools's changelog.

0.14.0

Breaking

  • Increased MSRV to 1.63.0 (#960)
  • Removed generic parameter from cons_tuples (#988)

Added

  • Added array_combinations (#991)
  • Added k_smallest_relaxed and variants (#925)
  • Added next_array and collect_array (#560)
  • Implemented DoubleEndedIterator for FilterOk (#948)
  • Implemented DoubleEndedIterator for FilterMapOk (#950)

Changed

  • Allow Q: ?Sized in Itertools::contains (#971)
  • Improved hygiene of chain! (#943)
  • Improved into_group_map_by documentation (#1000)
  • Improved tree_reduce documentation (#955)
  • Improved discoverability of merge_join_by (#966)
  • Improved discoverability of take_while_inclusive (#972)
  • Improved documentation of find_or_last and find_or_first (#984)
  • Prevented exponentially large type sizes in tuple_combinations (

@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jan 28, 2026
@socket-security
Copy link

socket-security bot commented Jan 28, 2026 •
edited
Loading

Caution

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. For more information please check in at #security-help. For License Policy Violations please also tag @Aoife in #security-help.

Action Severity Alert  (click "▶" to expand/collapse)
Block High
License policy violation: cargo colored under MPL-2.0

Location: Package overview

From: Cargo.toml → cargo/colored@3.1.1

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/colored@3.1.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block High
License policy violation: cargo petgraph under CC-BY-SA-4.0

License: CC-BY-SA-4.0 - the applicable license policy does not allow this license (4) (petgraph-0.8.3/assets/images/LICENSE.md)

From: Cargo.toml → cargo/petgraph@0.8.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/petgraph@0.8.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
chore(deps): bump the prod-dependencies group across 1 directory with…
dbb5bb8 
… 40 updates

Bumps the prod-dependencies group with 40 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.98` | `1.0.100` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.83` | `0.1.89` |
| [chrono](https://github.com/chronotope/chrono) | `0.4.38` | `0.4.43` |
| [clap](https://github.com/clap-rs/clap) | `4.5.41` | `4.5.55` |
| [colored](https://github.com/mackwic/colored) | `2.1.0` | `3.1.1` |
| [derive_builder](https://github.com/colin-kiegel/rust-derive-builder) | `0.20.1` | `0.20.2` |
| [directories](https://github.com/soc/directories-rs) | `5.0.1` | `6.0.0` |
| [educe](https://github.com/magiclen/educe) | `0.5.11` | `0.6.0` |
| [fake](https://github.com/cksac/fake-rs) | `2.10.0` | `4.4.0` |
| gethostname | `0.4.3` | `1.1.0` |
| [glob](https://github.com/rust-lang/glob) | `0.3.1` | `0.3.3` |
| [human-panic](https://github.com/rust-cli/human-panic) | `2.0.2` | `2.0.6` |
| [ignore](https://github.com/BurntSushi/ripgrep) | `0.4.23` | `0.4.25` |
| [inquire](https://github.com/mikaelmello/inquire) | `0.6.2` | `0.9.2` |
| [itertools](https://github.com/rust-itertools/itertools) | `0.13.0` | `0.14.0` |
| [jsonschema](https://github.com/Stranger6667/jsonschema) | `0.30.0` | `0.33.0` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.2.0` | `10.3.0` |
| [minijinja](https://github.com/mitsuhiko/minijinja) | `2.3.1` | `2.15.1` |
| [mockall](https://github.com/asomers/mockall) | `0.12.1` | `0.14.0` |
| [normpath](https://github.com/dylni/normpath) | `1.3.0` | `1.5.0` |
| [pathdiff](https://github.com/Manishearth/pathdiff) | `0.2.2` | `0.2.3` |
| [petgraph](https://github.com/petgraph/petgraph) | `0.6.5` | `0.8.3` |
| [regex](https://github.com/rust-lang/regex) | `1.11.1` | `1.12.2` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.9` | `0.12.28` |
| [secrecy](https://github.com/iqlusioninc/crates) | `0.8.0` | `0.10.3` |
| [sha256](https://github.com/baoyachi/sha256-rs) | `1.5.0` | `1.6.0` |
| [shellexpand](https://gitlab.com/ijackson/rust-shellexpand) | `3.1.0` | `3.1.1` |
| [strip-ansi-escapes](https://github.com/luser/strip-ansi-escapes) | `0.2.0` | `0.2.1` |
| [strum](https://github.com/Peternator7/strum) | `0.26.3` | `0.27.2` |
| [thiserror](https://github.com/dtolnay/thiserror) | `1.0.69` | `2.0.12` |
| [time](https://github.com/time-rs/time) | `0.3.41` | `0.3.46` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.46.1` | `1.49.0` |
| [tonic](https://github.com/hyperium/tonic) | `0.14.2` | `0.14.3` |
| [tracing-appender](https://github.com/tokio-rs/tracing) | `0.2.3` | `0.2.4` |
| [which](https://github.com/harryfei/which-rs) | `6.0.3` | `8.0.0` |
| [assert_cmd](https://github.com/assert-rs/assert_cmd) | `2.0.16` | `2.1.2` |
| [assert_fs](https://github.com/assert-rs/assert_fs) | `1.1.2` | `1.1.3` |
| [escargot](https://github.com/crate-ci/escargot) | `0.5.12` | `0.5.15` |
| [predicates](https://github.com/assert-rs/predicates-rs) | `3.1.2` | `3.1.3` |
| [tempfile](https://github.com/Stebalien/tempfile) | `3.20.0` | `3.24.0` |



Updates `anyhow` from 1.0.98 to 1.0.100
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.98...1.0.100)

Updates `async-trait` from 0.1.83 to 0.1.89
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.83...0.1.89)

Updates `chrono` from 0.4.38 to 0.4.43
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.38...v0.4.43)

Updates `clap` from 4.5.41 to 4.5.55
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.41...clap_complete-v4.5.55)

Updates `colored` from 2.1.0 to 3.1.1
- [Release notes](https://github.com/mackwic/colored/releases)
- [Changelog](https://github.com/colored-rs/colored/blob/master/CHANGELOG.md)
- [Commits](colored-rs/colored@v2.1.0...v3.1.1)

Updates `derive_builder` from 0.20.1 to 0.20.2
- [Release notes](https://github.com/colin-kiegel/rust-derive-builder/releases)
- [Commits](colin-kiegel/rust-derive-builder@v0.20.1...v0.20.2)

Updates `directories` from 5.0.1 to 6.0.0
- [Commits](https://github.com/soc/directories-rs/commits)

Updates `educe` from 0.5.11 to 0.6.0
- [Commits](magiclen/educe@v0.5.11...v0.6.0)

Updates `fake` from 2.10.0 to 4.4.0
- [Release notes](https://github.com/cksac/fake-rs/releases)
- [Commits](https://github.com/cksac/fake-rs/commits/v4.4.0)

Updates `gethostname` from 0.4.3 to 1.1.0

Updates `glob` from 0.3.1 to 0.3.3
- [Release notes](https://github.com/rust-lang/glob/releases)
- [Changelog](https://github.com/rust-lang/glob/blob/master/CHANGELOG.md)
- [Commits](rust-lang/glob@0.3.1...v0.3.3)

Updates `human-panic` from 2.0.2 to 2.0.6
- [Changelog](https://github.com/rust-cli/human-panic/blob/master/CHANGELOG.md)
- [Commits](rust-cli/human-panic@v2.0.2...v2.0.6)

Updates `ignore` from 0.4.23 to 0.4.25
- [Release notes](https://github.com/BurntSushi/ripgrep/releases)
- [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md)
- [Commits](BurntSushi/ripgrep@ignore-0.4.23...ignore-0.4.25)

Updates `inquire` from 0.6.2 to 0.9.2
- [Release notes](https://github.com/mikaelmello/inquire/releases)
- [Changelog](https://github.com/mikaelmello/inquire/blob/main/CHANGELOG.md)
- [Commits](mikaelmello/inquire@v0.6.2...v0.9.2)

Updates `itertools` from 0.13.0 to 0.14.0
- [Changelog](https://github.com/rust-itertools/itertools/blob/master/CHANGELOG.md)
- [Commits](rust-itertools/itertools@v0.13.0...v0.14.0)

Updates `jsonschema` from 0.30.0 to 0.33.0
- [Release notes](https://github.com/Stranger6667/jsonschema/releases)
- [Changelog](https://github.com/Stranger6667/jsonschema/blob/master/CHANGELOG.md)
- [Commits](Stranger6667/jsonschema@rust-v0.30.0...rust-v0.33.0)

Updates `jsonwebtoken` from 10.2.0 to 10.3.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.2.0...v10.3.0)

Updates `minijinja` from 2.3.1 to 2.15.1
- [Release notes](https://github.com/mitsuhiko/minijinja/releases)
- [Changelog](https://github.com/mitsuhiko/minijinja/blob/main/CHANGELOG.md)
- [Commits](mitsuhiko/minijinja@2.3.1...minijinja-go/v2.15.1)

Updates `mockall` from 0.12.1 to 0.14.0
- [Changelog](https://github.com/asomers/mockall/blob/master/CHANGELOG.md)
- [Commits](asomers/mockall@v0.12.1...v0.14.0)

Updates `normpath` from 1.3.0 to 1.5.0
- [Release notes](https://github.com/dylni/normpath/releases)
- [Commits](dylni/normpath@1.3.0...1.5.0)

Updates `pathdiff` from 0.2.2 to 0.2.3
- [Commits](https://github.com/Manishearth/pathdiff/commits/v0.2.3)

Updates `petgraph` from 0.6.5 to 0.8.3
- [Release notes](https://github.com/petgraph/petgraph/releases)
- [Changelog](https://github.com/petgraph/petgraph/blob/master/CHANGELOG.md)
- [Commits](https://github.com/petgraph/petgraph/compare/petgraph@v0.6.5...petgraph@v0.8.3)

Updates `regex` from 1.11.1 to 1.12.2
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.11.1...1.12.2)

Updates `reqwest` from 0.12.9 to 0.12.28
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.12.9...v0.12.28)

Updates `secrecy` from 0.8.0 to 0.10.3
- [Commits](https://github.com/iqlusioninc/crates/commits)

Updates `sha256` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/baoyachi/sha256-rs/releases)
- [Commits](baoyachi/sha256-rs@1.5.0...1.6.0)

Updates `shellexpand` from 3.1.0 to 3.1.1
- [Commits](https://gitlab.com/ijackson/rust-shellexpand/compare/shellexpand-3.1.0...shellexpand-3.1.1)

Updates `strip-ansi-escapes` from 0.2.0 to 0.2.1
- [Commits](https://github.com/luser/strip-ansi-escapes/commits)

Updates `strum` from 0.26.3 to 0.27.2
- [Release notes](https://github.com/Peternator7/strum/releases)
- [Changelog](https://github.com/Peternator7/strum/blob/master/CHANGELOG.md)
- [Commits](Peternator7/strum@v0.26.3...v0.27.2)

Updates `thiserror` from 1.0.69 to 2.0.12
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@1.0.69...2.0.12)

Updates `time` from 0.3.41 to 0.3.46
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.41...v0.3.46)

Updates `tokio` from 1.46.1 to 1.49.0
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.46.1...tokio-1.49.0)

Updates `tonic` from 0.14.2 to 0.14.3
- [Release notes](https://github.com/hyperium/tonic/releases)
- [Changelog](https://github.com/hyperium/tonic/blob/master/CHANGELOG.md)
- [Commits](hyperium/tonic@v0.14.2...v0.14.3)

Updates `tracing-appender` from 0.2.3 to 0.2.4
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](tokio-rs/tracing@tracing-appender-0.2.3...tracing-appender-0.2.4)

Updates `which` from 6.0.3 to 8.0.0
- [Release notes](https://github.com/harryfei/which-rs/releases)
- [Changelog](https://github.com/harryfei/which-rs/blob/master/CHANGELOG.md)
- [Commits](harryfei/which-rs@6.0.3...8.0.0)

Updates `assert_cmd` from 2.0.16 to 2.1.2
- [Changelog](https://github.com/assert-rs/assert_cmd/blob/master/CHANGELOG.md)
- [Commits](assert-rs/assert_cmd@v2.0.16...v2.1.2)

Updates `assert_fs` from 1.1.2 to 1.1.3
- [Changelog](https://github.com/assert-rs/assert_fs/blob/master/CHANGELOG.md)
- [Commits](assert-rs/assert_fs@v1.1.2...v1.1.3)

Updates `escargot` from 0.5.12 to 0.5.15
- [Changelog](https://github.com/crate-ci/escargot/blob/master/CHANGELOG.md)
- [Commits](crate-ci/escargot@v0.5.12...v0.5.15)

Updates `predicates` from 3.1.2 to 3.1.3
- [Changelog](https://github.com/assert-rs/predicates-rs/blob/master/CHANGELOG.md)
- [Commits](assert-rs/predicates-rs@v3.1.2...v3.1.3)

Updates `tempfile` from 3.20.0 to 3.24.0
- [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md)
- [Commits](Stebalien/tempfile@v3.20.0...v3.24.0)

---
updated-dependencies:
- dependency-name: anyhow
  dependency-version: 1.0.100
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: async-trait
  dependency-version: 0.1.89
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: chrono
  dependency-version: 0.4.43
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: clap
  dependency-version: 4.5.55
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: colored
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: derive_builder
  dependency-version: 0.20.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: directories
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: educe
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: fake
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: gethostname
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: glob
  dependency-version: 0.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: human-panic
  dependency-version: 2.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: ignore
  dependency-version: 0.4.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: inquire
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: itertools
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: jsonschema
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: jsonwebtoken
  dependency-version: 10.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: minijinja
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: mockall
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: normpath
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: pathdiff
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: petgraph
  dependency-version: 0.8.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: regex
  dependency-version: 1.12.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: reqwest
  dependency-version: 0.12.28
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: secrecy
  dependency-version: 0.10.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: sha256
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: shellexpand
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: strip-ansi-escapes
  dependency-version: 0.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: strum
  dependency-version: 0.27.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.12
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: time
  dependency-version: 0.3.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: tokio
  dependency-version: 1.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: tonic
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: tracing-appender
  dependency-version: 0.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: which
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-dependencies
- dependency-name: assert_cmd
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
- dependency-name: assert_fs
  dependency-version: 1.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: escargot
  dependency-version: 0.5.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: predicates
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-dependencies
- dependency-name: tempfile
  dependency-version: 3.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/cargo/prod-dependencies-1317241ca8 branch from 95e2f00 to dbb5bb8 Compare January 31, 2026 07:13
@dryrunsecurity
Copy link

dryrunsecurity bot commented Jan 31, 2026

DryRun Security

This pull request leaves several dependencies pinned as wildcards ('*') in Cargo.toml (including jsonwebtoken, octocrab, tonic, and opentelemetry), which broadens the supply-chain attack surface and can pull breaking or malicious versions on updates — and since the crate is marked publish = true this is non‑compliant with crates.io rules and risky for release. It should replace wildcards with explicit version constraints and ensure lockfile or provenance controls are used to prevent unexpected upgrades.

Wildcard Dependencies in Cargo.toml
Vulnerability Wildcard Dependencies
Description The project uses wildcard versions ('*') for several dependencies in Cargo.toml, including critical ones like jsonwebtoken, octocrab, tonic, and opentelemetry. In Rust, using a wildcard version allows Cargo to pull any future version of a dependency, including major versions that may contain breaking changes or, more critically, malicious code if a crate is compromised. This significantly increases the supply chain attack surface. While a Cargo.lock file is present, it only mitigates the risk for existing builds; any cargo update or new installation (where a lock file isn't used) will pull the latest versions. Furthermore, wildcard dependencies are forbidden for packages published to crates.io, and since this project has publish = true, it is in a non-compliant and insecure state for its intended release cycle.

scope/Cargo.toml

Lines 43 to 46 in dbb5bb8

jsonwebtoken = "*"
lazy_static = "1.5.0"
minijinja = { version = "2.15.1", features = ["loader"] }
mockall = "0.14.0"

All finding details can be found in the DryRun Security Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants