build(deps): bump tower-sessions from 0.11.1 to 0.14.0

[dependabot]

Bumps tower-sessions from 0.11.1 to 0.14.0.

Release notes

Sourced from tower-sessions's releases.

v0.14.0

What's Changed

• Breaking Update axum-core to v0.5.0. maxcountryman/tower-sessions#231

Full Changelog: maxcountryman/tower-sessions@v0.13.0...v0.14.0

v0.13.0

What's Changed

• Add option to always save session by @​0rzech in maxcountryman/tower-sessions#216

New Contributors

• @​0rzech made their first contribution in maxcountryman/tower-sessions#216

Full Changelog: maxcountryman/tower-sessions@v0.12.3...v0.13.0

v0.12.3

What's Changed

• Ensure continuously_delete_expired waits for initial run maxcountryman/tower-sessions#208

New Contributors

• @​Calum4 made their first contribution in maxcountryman/tower-sessions#208

Full Changelog: maxcountryman/tower-sessions@v0.12.2...v0.12.3

v0.12.2

What's Changed

• Ensure set_expiry mutates Max-Age by @​Katze864 in maxcountryman/tower-sessions#191

New Contributors

• @​Katze864 made their first contribution in maxcountryman/tower-sessions#191

Full Changelog: maxcountryman/tower-sessions@v0.12.1...v0.12.2

v0.12.1

What's Changed

Important Security Update

• Ensure ID cycling invokes create. #188

Because cycling the session ID involves creating a new ID, this must follow the same semantics as normal session creation. Therefore prior to this fix session ID collision could occur through this vector.

New Contributors

• @​myOmikron made their first contribution in maxcountryman/tower-sessions#187

Full Changelog: maxcountryman/tower-sessions@v0.12.0...v0.12.1

... (truncated)

Changelog

Sourced from tower-sessions's changelog.

0.14.0

• Update axum-core to v0.5.0. #231

This also includes an version bump to tower-cookies, now at v0.11.0.

0.13.0

• Add option to always save session. #216

0.12.3

• Ensure continuously_delete_expired waits for initial run. #208

0.12.2

• Ensure set_expiry mutates Max-Age. #191

This addresses a bug where using set_expiry on a session with no initial expiry time would not add the Max-age attribute to the cookie leading to an inconsitency between the cookie and the database.

0.12.1

Important Security Update

• Ensure ID cycling invokes create. #188

Because cycling the session ID involves creating a new ID, this must follow the same semantics as normal session creation. Therefore prior to this fix session ID collision could occur through this vector.

0.12.0

Important Security Update

• Id collision mitigation. #181

This release introduces a new method, create, to the SessionStore trait to distinguish between creating a new session and updating an existing one. This distinction is crucial for mitigating the potential for session ID collisions.

Although the probability of session ID collisions is statistically low, given that IDs are composed of securely-random i128 values, such collisions pose a significant security risk. A store that does not differentiate between session creation and updates could inadvertently allow an existing session to be accessed, leading to potential session takeovers.

Session store authors are strongly encouraged to update and implement create such that potential ID collisions are handled, either by generating a new ID or returning an error.

As a transitional measure, we have provided a default implementation of create that wraps the existing save method. However, this default is not immune to the original issue. Therefore, it is imperative that stores override the create method with an implementation that adheres to the required uniqueness semantics, thereby effectively mitigating the risk of session ID collisions.

Commits

• b58463d mark 0.14.0
• c005ac5 axum-core v0.5
• 3b94a4c Bump codecov/codecov-action from 4 to 5
• e25d522 Update thiserror requirement from 1.0.50 to 2.0.0
• d5592f1 add tower-sessions-file-store (#222)
• 66983f5 mark 0.13.0
• fe33b77 Add option to always save session (#216)
• 02e4c55 bump tower (#214)
• c6ee4e1 mark 0.12.3
• 31ea841 fix(tower-sessions-core): continuously_delete_expired ran delete_expired twic...
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.