chore(deps)(deps): bump the cargo-all group with 12 updates#11
chore(deps)(deps): bump the cargo-all group with 12 updates#11dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the cargo-all group with 12 updates: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.97` | `1.0.102` | | [log](https://github.com/rust-lang/log) | `0.4.26` | `0.4.29` | | [clap](https://github.com/clap-rs/clap) | `4.5.32` | `4.5.60` | | [env_logger](https://github.com/rust-cli/env_logger) | `0.11.7` | `0.11.10` | | [mimalloc](https://github.com/purpleprotocol/mimalloc_rust) | `0.1.43` | `0.1.48` | | [num_cpus](https://github.com/seanmonstar/num_cpus) | `1.16.0` | `1.17.0` | | [regex](https://github.com/rust-lang/regex) | `1.11.1` | `1.12.3` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.12.14` | `0.12.28` | | [sha2](https://github.com/RustCrypto/hashes) | `0.10.9` | `0.11.0` | | [toml](https://github.com/toml-rs/toml) | `0.8.23` | `0.9.6` | | [tempfile](https://github.com/Stebalien/tempfile) | `3.19.0` | `3.27.0` | | [built](https://github.com/lukaslueg/built) | `0.7.7` | `0.8.0` | Updates `anyhow` from 1.0.97 to 1.0.102 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](dtolnay/anyhow@1.0.97...1.0.102) Updates `log` from 0.4.26 to 0.4.29 - [Release notes](https://github.com/rust-lang/log/releases) - [Changelog](https://github.com/rust-lang/log/blob/master/CHANGELOG.md) - [Commits](rust-lang/log@0.4.26...0.4.29) Updates `clap` from 4.5.32 to 4.5.60 - [Release notes](https://github.com/clap-rs/clap/releases) - [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md) - [Commits](clap-rs/clap@clap_complete-v4.5.32...clap_complete-v4.5.60) Updates `env_logger` from 0.11.7 to 0.11.10 - [Release notes](https://github.com/rust-cli/env_logger/releases) - [Changelog](https://github.com/rust-cli/env_logger/blob/main/CHANGELOG.md) - [Commits](rust-cli/env_logger@v0.11.7...v0.11.10) Updates `mimalloc` from 0.1.43 to 0.1.48 - [Release notes](https://github.com/purpleprotocol/mimalloc_rust/releases) - [Commits](purpleprotocol/mimalloc_rust@v0.1.43...v0.1.48) Updates `num_cpus` from 1.16.0 to 1.17.0 - [Release notes](https://github.com/seanmonstar/num_cpus/releases) - [Changelog](https://github.com/seanmonstar/num_cpus/blob/master/CHANGELOG.md) - [Commits](seanmonstar/num_cpus@v1.16.0...v1.17.0) Updates `regex` from 1.11.1 to 1.12.3 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](rust-lang/regex@1.11.1...1.12.3) Updates `reqwest` from 0.12.14 to 0.12.28 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.12.14...v0.12.28) Updates `sha2` from 0.10.9 to 0.11.0 - [Commits](RustCrypto/hashes@sha2-v0.10.9...sha2-v0.11.0) Updates `toml` from 0.8.23 to 0.9.6 - [Commits](toml-rs/toml@toml-v0.8.23...toml-v0.9.6) Updates `tempfile` from 3.19.0 to 3.27.0 - [Changelog](https://github.com/Stebalien/tempfile/blob/master/CHANGELOG.md) - [Commits](Stebalien/tempfile@v3.19.0...v3.27.0) Updates `built` from 0.7.7 to 0.8.0 - [Changelog](https://github.com/lukaslueg/built/blob/master/CHANGELOG.md) - [Commits](lukaslueg/built@0.7.7...0.8.0) --- updated-dependencies: - dependency-name: anyhow dependency-version: 1.0.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-all - dependency-name: log dependency-version: 0.4.29 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-all - dependency-name: clap dependency-version: 4.5.60 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-all - dependency-name: env_logger dependency-version: 0.11.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-all - dependency-name: mimalloc dependency-version: 0.1.48 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-all - dependency-name: num_cpus dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-all - dependency-name: regex dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-all - dependency-name: reqwest dependency-version: 0.12.28 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-all - dependency-name: sha2 dependency-version: 0.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-all - dependency-name: toml dependency-version: 0.9.6 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-all - dependency-name: tempfile dependency-version: 3.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-all - dependency-name: built dependency-version: 0.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo-all ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
📝 WalkthroughWalkthroughMultiple Rust dependencies in Cargo.toml were updated to newer patch and minor versions, including anyhow, clap, env_logger, mimalloc, num_cpus, reqwest, sha2, toml, tempfile, and the built build-dependency. No new dependencies were added or removed, and the git2 feature for built was retained. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
Cargo.toml (1)
31-51: Consider consistent version specification style.The dependency versions use mixed specification styles: some use full 3-part versions (e.g.,
"1.0.102","4.5.60"), while others use 2-part versions (e.g.,"0.4","0.11","3.27"). Both approaches are valid, but consistency improves maintainability.Recommendation: Choose one style consistently—either specify full versions for explicit control, or use major.minor versions to allow Cargo to resolve compatible patch updates automatically.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Cargo.toml` around lines 31 - 51, The Cargo.toml dependency list mixes version styles (e.g., anyhow = "1.0.102" and clap = "4.5.60" vs log = "0.4" and env_logger = "0.11.10" vs tempfile = "3.27"), so pick a consistent scheme and update the version strings for the affected dependencies (anyhow, clap, log, env_logger, mimalloc, num_cpus, regex, reqwest, sha2, toml, serde_json, tar, flate2, tempfile, built, crates_io_api) to that style; for example, change all to full semver "MAJOR.MINOR.PATCH" or all to "MAJOR.MINOR" format and ensure build-dependencies and dev-dependencies (built and tempfile) follow the same convention so the file is uniform.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@Cargo.toml`:
- Around line 40-41: Update and verify dependency upgrades: ensure sha2 0.11
usage in src/lib/source.rs (Sha256::new, hasher.update, hasher.finalize) still
compiles and meets MSRV, and more importantly adjust toml 0.9 parsing in
src/lib/crate_inspector.rs by replacing any use of Value::from_str or
str.parse() expecting a full document with toml::de::from_str::<toml::Value>()
(or explicitly use toml::de::Deserializer to parse a full table) in the
CargoMetadata::from_toml_str() and parse_cargo_lock_str() functions so they
parse full TOML documents rather than single values; run cargo test and if
parsing breaks, revert toml to 0.8 or follow the toml 0.9 migration guide to
update parsing code.
---
Nitpick comments:
In `@Cargo.toml`:
- Around line 31-51: The Cargo.toml dependency list mixes version styles (e.g.,
anyhow = "1.0.102" and clap = "4.5.60" vs log = "0.4" and env_logger = "0.11.10"
vs tempfile = "3.27"), so pick a consistent scheme and update the version
strings for the affected dependencies (anyhow, clap, log, env_logger, mimalloc,
num_cpus, regex, reqwest, sha2, toml, serde_json, tar, flate2, tempfile, built,
crates_io_api) to that style; for example, change all to full semver
"MAJOR.MINOR.PATCH" or all to "MAJOR.MINOR" format and ensure build-dependencies
and dev-dependencies (built and tempfile) follow the same convention so the file
is uniform.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: fa9bf387-6971-478b-a14a-fb31450522bb
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
Cargo.toml
| sha2 = "0.11" | ||
| toml = "0.9" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find usages of sha2 and toml APIs to assess impact of version changes
echo "=== Searching for sha2 usage ==="
rg -n --type=rust -C3 'use.*sha2|Sha256|Sha512|Digest' -g '!target/**'
echo -e "\n=== Searching for toml usage ==="
rg -n --type=rust -C3 'use.*toml|from_str.*toml|to_string.*toml|toml::' -g '!target/**'
echo -e "\n=== Checking if Cargo builds with updated dependencies ==="
cargo check 2>&1 | head -50Repository: fg-labs/redskull
Length of output: 3650
🌐 Web query:
sha2 0.11 changelog breaking changes RustCrypto
💡 Result:
RustCrypto sha2 0.11.0 (released 2026-03-25) includes these notable breaking / migration-relevant changes:
- MSRV bump + edition: crate moved to Rust 2024 edition and MSRV is now Rust 1.85. [1]
- Trait/dependency bump: updated to
digestv0.11 (this commonly forces downstream API updates to match the newdigesttrait versions). [1] - Public API shape changes: type aliases replaced with newtypes. [1]
- Module/API moves:
compress256/compress512moved to theblock_apimodule. [1] - Feature flag removals (may break
Cargo.tomlfeature usage): removedasm,asm-aarch64,loongarch64_asm,compress,soft,force-soft-compact, andstdfeatures. [1] - Backend selection changes: (new/changed) configuration flags for backend selection. [1]
- State serialization: implements
SerializableStatetrait. [1]
Sources: RustCrypto/hashes sha2 changelog for 0.11.0 [1] and the 0.11.0 release commit message (same items) [2].
References: [1] https://github.com/RustCrypto/hashes/blob/sha2-v0.11.0/sha2/CHANGELOG.md [2] RustCrypto/hashes@ffe0939
🌐 Web query:
toml 0.9 changelog breaking changes toml-rs
💡 Result:
toml 0.9.0 (toml-rs) changelog section: 2025-07-08. (github.com)
Breaking changes called out in the 0.9.0 changelog
from_str,Deserializer, etc. no longer preserve key order unless you enable thepreserve_orderfeature (likeTable). (github.com)- Serde support moved behind the default
serdefeature (i.e., it’s now feature-gated). (github.com) stdsupport moved behind the defaultstdfeature. (github.com)- Deserializing a value without a
Spannedwill fail fast. (github.com) impl FromStr for Valuenow parses TOML values, not full documents. (github.com)Deserializer::new/ValueDeserializer::newnow return errors. (github.com)Serializer::new/Serializer::prettynow take&mut Bufferinstead of&mut String. (github.com)- Associated
serde::Serializer::Oktypes changed:Serializer::Okis now&mut BufferValueSerializer::Okis now&mut String(github.com)
Changelog’s migration note
If you previously used default-features = false, the changelog suggests: cargo add toml -F serde,std. (github.com)
Citations:
- 1: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 2: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 3: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 4: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 5: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 6: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 7: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 8: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 9: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
- 10: https://github.com/toml-rs/toml/blob/main/crates/toml/CHANGELOG.md
Verify sha2 0.11 and toml 0.9 breaking changes in build and tests.
Both dependencies have confirmed breaking changes:
-
sha2 0.11: Updates to digest v0.11, type aliases replaced with newtypes, removed feature flags (asm, std, compress), MSRV bumped to Rust 1.85. The basic API usage in
src/lib/source.rs(Sha256::new(),hasher.update(),hasher.finalize()) uses stable Digest trait methods and appears compatible. -
toml 0.9: Multiple breaking changes including key order not preserved by default, and critically—
impl FromStr for Valuenow parses single TOML values instead of full documents. This directly impactssrc/lib/crate_inspector.rswhich uses.parse()to parse full Cargo.toml and Cargo.lock files. Verify that this behavior change does not break the parsing logic inCargoMetadata::from_toml_str()andparse_cargo_lock_str().
Run cargo test to ensure all tests pass with these updated dependencies. If toml parsing fails, consult the toml 0.9 migration guide or consider reverting to 0.8 pending an API update.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@Cargo.toml` around lines 40 - 41, Update and verify dependency upgrades:
ensure sha2 0.11 usage in src/lib/source.rs (Sha256::new, hasher.update,
hasher.finalize) still compiles and meets MSRV, and more importantly adjust toml
0.9 parsing in src/lib/crate_inspector.rs by replacing any use of
Value::from_str or str.parse() expecting a full document with
toml::de::from_str::<toml::Value>() (or explicitly use toml::de::Deserializer to
parse a full table) in the CargoMetadata::from_toml_str() and
parse_cargo_lock_str() functions so they parse full TOML documents rather than
single values; run cargo test and if parsing breaks, revert toml to 0.8 or
follow the toml 0.9 migration guide to update parsing code.
Bumps the cargo-all group with 12 updates:
1.0.971.0.1020.4.260.4.294.5.324.5.600.11.70.11.100.1.430.1.481.16.01.17.01.11.11.12.30.12.140.12.280.10.90.11.00.8.230.9.63.19.03.27.00.7.70.8.0Updates
anyhowfrom 1.0.97 to 1.0.102Release notes
Sourced from anyhow's releases.
Commits
5c657b3Release 1.0.102e737fb6Merge pull request #442 from dtolnay/backtrace7fe62b5Further simply backtrace conditional compilationc8cb5caMerge pull request #441 from dtolnay/backtracede27df7Delete CI use of --features=backtrace9b67e5dMerge pull request #440 from dtolnay/backtraceefdb11aSimplifystd_backtraceconditional codeb8a9a70Merge pull request #439 from dtolnay/backtracea42fc2cRemovefeature = "backtrace"conditional code2a2a3ceRe-word backtrace feature commentUpdates
logfrom 0.4.26 to 0.4.29Release notes
Sourced from log's releases.
Changelog
Sourced from log's changelog.
Commits
b1e2df7Merge pull request #719 from rust-lang/cargo/0.4.293fe1a54prepare for 0.4.29 release7a432d9Merge pull request #718 from rust-lang/ci/msrv0689d56rebump msrv to 1.68.046b448etry drop msrv back to 1.61.0929ab38fix up doc test feature gate957cecebump serde-dependent cratesbea40c8bump msrv to 1.68.0c540184Merge pull request #716 from rust-lang/ci-smaller-matrix2c971e63Merge branch 'master' into ci-smaller-matrix2Updates
clapfrom 4.5.32 to 4.5.60Release notes
Sourced from clap's releases.
... (truncated)
Changelog
Sourced from clap's changelog.
... (truncated)
Commits
33d24d8chore: Release9332409docs: Update changelogb7adce5Merge pull request #6166 from fabalchemy/fix-dynamic-powershell-completion009bba4fix(clap_complete): Improve powershell registrationd89d57dchore: Releasef18b67edocs: Update changelog9d218ebMerge pull request #6165 from epage/shirt126440cfix(help): Correctly calculate padding for short-only args9e3c05etest(help): Show panic with short, valueless argc9898d0test(help): Verify short with valueUpdates
env_loggerfrom 0.11.7 to 0.11.10Release notes
Sourced from env_logger's releases.
Changelog
Sourced from env_logger's changelog.
Commits
41320bfchore: Releasede8c74fdocs: Update changelogd550741docs(gh): Add sponsor link458b075chore(deps): Update Rust Stable to v1.94 (#401)8bc3fc3Merge pull request #400 from epage/update143fa64chore: Upgrade incompatibleb687a24chore: Upgrade compatible8cf1ba9Merge pull request #397 from rust-cli/renovate/crate-ci-typos-1.x094ecf7Merge pull request #396 from rust-cli/renovate/crate-ci-committed-1.x34ad626chore(deps): Update pre-commit hook crate-ci/typos to v1.44.0Updates
mimallocfrom 0.1.43 to 0.1.48Release notes
Sourced from mimalloc's releases.
Commits
a5a76fdv0.1.4831607bfMerge pull request #144 from gschulze/feature/3.xaaa0114Allow unused macros in generated test code54d6262Allow unused imports in generated test code1f527f1Proper feature flag propagation in binding testsedee487Fix clippy lints29c44c2Add workflows for v3af52306Add support for testing v3 in CId84e46eFix excludes in Cargo manifest747b5b1Introduce feature flag to switch between mimalloc major versionsUpdates
num_cpusfrom 1.16.0 to 1.17.0Changelog
Sourced from num_cpus's changelog.
Commits
342af76v1.17.0e970a82Bump hermit-abi version (#144)797f827Update LICENSE-MIT (#143)b6ca8a4ci: worker cpus has been increasedf06cd50ci: remove asmjs job41e39ddci: mips is not tier 3, remove CI jobs13af26cremove special support for nacl815551cci: pin libc for msrv jobUpdates
regexfrom 1.11.1 to 1.12.3Changelog
Sourced from regex's changelog.
... (truncated)
Commits
b028e4f1.12.35e195deregex-automata-0.4.14a3433f6regex-syntax-0.8.90c07faeregex-lite-0.1.96a81006cargo: exclude development scripts and fuzzing data4733e28automata: fixonepass::DFA::try_search_slotspanic when too many slots are ...5ea3eb11.12.2ab0b071regex-automata-0.4.13691d514regex-syntax-0.8.81dd9077docs: swapdoc_auto_cfgwithdoc_cfgUpdates
reqwestfrom 0.12.14 to 0.12.28Release notes
Sourced from reqwest's releases.
... (truncated)
Changelog
Sourced from reqwest's changelog.
... (truncated)
Commits
d978599v0.12.28ef2768afix: correctly import TokioIo on Windows (#2896)1bf6441v0.12.274967b1bfeat: add windows_named_pipe() option to client builder (#2789)ef5b239chore: Use http_body_util::BodyDataStream (#2892)a810004chore: Disable unused tokio-util codec feature (#2893)01f03a4v0.12.26e908f57fix(http3): correct compression defaults (#2890)509c904fix: disable default compression from tower-http if not enabled in reqwest (#...896aaeadeps: update cookie_store to 0.22 (#2886)Updates
sha2from 0.10.9 to 0.11.0Commits
ffe0939Release sha2 0.11.0 (#806)8991b65Use the standard order of the[package]section fields (#807)3d2bc57sha2: refactor backends (#802)faa55fbsha3: bumpkeccakto v0.2 (#803)d3e6489sha3 v0.11.0-rc.9 (#801)bbf6f51sha2: tweak backend docs (#800)155dbbfsha3: add default value for theDSgeneric parameter onTurboShake128/256...ed514f2Use published version ofkeccakv0.2 (#799)702bcd8Migrate to closure-basedkeccak(#796)827c043sha3 v0.11.0-rc.8 (#794)Updates
tomlfrom 0.8.23 to 0.9.6Commits
4695fb0chore: Release6a77ed7docs: Update changelogc1e8197refactor: Switch serde dependency to serde_core (#1036)d85d6cdrefactor: Switch serde dependency to serde_core9154dcbchore: Release38f445cdocs: Update changelog1ce8a75feat(edit): Expose Table::span (#1031)290c28ffeat(edit): Expose Table::spanb2bc739chore(deps): Update Rust Stable to v1.89 (#1026)bd21148chore: ReleaseUpdates
tempfilefrom 3.19.0 to 3.27.0Changelog
Sourced from tempfile's changelog.
... (truncated)
Commits
5c8fa12chore: release 3.27.0e34e574test: disable uds conflict test on redox772c795test: add CWD guards2632fb9fix: resolve relative paths when constructingTempPath929a112chore: release 3.26.029d6ac5Add Redox OS CI (#394)375067fdoc(README): document supported platformsd353717feat(redox): implement persist() (#393)64114d7Fix typos in documentation (#392)9a38b8dchore: release 3.25.0Updates
builtfrom 0.7.7 to 0.8.0Changelog
Sourced from built's changelog.
Commits
2d84b23Add override-variables9468c3aFix pedantic clippy warning in generated codeDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit