Skip to content

deps: bump the rust-dependencies group across 1 directory with 6 updates#26

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/rust-dependencies-c42c3896b6
Open

deps: bump the rust-dependencies group across 1 directory with 6 updates#26
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/rust-dependencies-c42c3896b6

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Mar 30, 2026

Updates the requirements on lz4_flex, hkdf, sha2, hmac, generic-array and getrandom to permit the latest version.
Updates lz4_flex to 0.13.0

Release notes

Sourced from lz4_flex's releases.

0.13.0

What's Changed

New Contributors

Full Changelog: PSeitz/lz4_flex@0.12.0...0.13.0

Changelog

Sourced from lz4_flex's changelog.

0.13.0 (2026-03-15)

Features

Fixes

Invalid match offsets (offset == 0) during decompression were not properly
handled, which could lead to invalid memory reads. This is a security fix
that was also backported to 0.12.1 and 0.11.6.
  • Fix get_maximum_output_size overflow on 32-bit targets #205 (thanks @​dglittle)
Cast input_len to u64 before multiplying by 110, avoiding overflow on
32-bit targets (e.g. wasm32) where input_len * 110 overflows usize
when input_len > ~39MB.

0.12.1 (2026-03-14)

Security Fix

Invalid match offsets (offset == 0) during decompression were not properly
handled, which could lead to invalid memory reads on untrusted input.
Users on 0.12.x should upgrade to 0.12.1.

0.12.0 (2025-11-11)

  • Fix integer overflows when decoding large payloads #192 (thanks @​teh-cmc)
This fixes an u32 integer overflow when decoding large payloads in the block format.
Note: The block format is not suitable for such large payloads, since it
keeps everything in memory. Consider using the frame format for large data.

This change also removes a unsafe fast-path for write_integer to simplify the code.

The performance impact is on incompressible data, which is already fast enough.

0.11.6 (2026-03-14)

Security Fix

Invalid match offsets (offset == 0) during decompression were not properly
handled, which could lead to invalid memory reads on untrusted input.
Users on 0.11.x should upgrade to 0.11.6.

... (truncated)

Commits
  • bfaae84 release 0.13.0
  • 055502e fix handling of invalid match offsets during decompression
  • 7191df8 make hashtable visibility crate public
  • 1bdafca add doc comments
  • c90fc91 lz4_block exposes option to reuse compression dict
  • 22e77f9 Delete .github/workflows/typos.yml
  • 2991a09 fix get_maximum_output_size overflow on 32-bit targets
  • 7b5fb80 add minimal security policy
  • See full diff in compare view

Updates hkdf to 0.13.0

Commits

Updates sha2 to 0.11.0

Commits

Updates hmac to 0.13.0

Commits

Updates generic-array to 1.3.5

Changelog

Sourced from generic-array's changelog.

  • (unreleased)

    • Add subtle, arbitrary, bytemuck, bitvec and as-slice implementations for GenericArray.
    • Add GenericSequence::repeat for creating sequences/arrays with repeated elements.
    • Add FallibleGenericSequence with try_generate and from_fallible_iter for fallible generation of sequences/arrays.
    • Add try_fold and try_map to FunctionalSequence for fallible folding/mapping of sequences/arrays.
    • Add try_from_fallible_iter to GenericArray for fallible construction from fallible iterators.
    • Add each_ref/each_mut methods to GenericArray for creating arrays of references to the elements.

  • 1.3.5

    • Fixed const_transmute not compiling between Rust versions 1.74.0 and 1.83.0. Yanked 1.3.4.

  • 1.3.4

    • Significantly improve stack usage of GenericArray methods in unoptimized (-C opt-level=0) build modes.
    • Introduce the hybrid-array-0_4 feature to allow interop between generic-array 1.x and hybrid-array 0.4 versions.
    • Add ConstGenericArray type alias for easier usage with literal const usizes.
    • Implement ZeroizeOnDrop for GenericArray when T: ZeroizeOnDrop (when using the zeroize feature).

  • 1.3.2

    • Introduce the compat-0_14 feature to allow interop between generic-array 1.x and 0.14 versions.

  • 1.3.1

    • Lower MSRV to 1.65.0 (minimum required for GATs)
    • Make some functions const only on Rust 1.83.0 or newer, otherwise they are non-const.
    • Implement core::error::Error for LengthError on Rust 1.81.0 or newer.

  • 1.3.0

    • Restrict ArrayLength to lengths representable by usize to fix soundness issues #156 (may break invalid code)
    • Flatten internal representation to improve miri performance #157
    • Use serde_core instead of serde

  • 1.2.1

    • Replace doc_auto_cfg with doc_cfg #155

  • 1.2.0

    • Mark more functions as const
    • Bump MSRV to 1.83.0 (reverted in generic-array 1.3.1)

  • 1.1.1

    • Add Flatten and Unflatten traits for converting between nested arrays.

  • 1.1.0

    • Add Remove trait that adds remove/swap_remove to GenericArray (inspired by #147)
    • Soft-deprecate internals::ArrayBuilder in favor of internals::IntrusiveArrayBuilder

  • 1.0.1

    • Update faster-hex dependency
    • Mark from_iter as #[inline] to significantly improve codegen.

  • 1.0.0

    • Use GATs for ArrayLength !

... (truncated)

Commits

Updates getrandom to 0.4.2

Changelog

Sourced from getrandom's changelog.

0.4.2 - 2026-03-03

Changed

  • Bump r-efi dependency to v6 #814

Fixed

  • Read errno only when it is set #810
  • Check the return value of ProcessPrng on Windows #811

#810: rust-random/getrandom#810 #811: rust-random/getrandom#811 #814: rust-random/getrandom#814

0.4.1 - 2026-02-03

Fixed

  • Documentation build on docs.rs #801

#801: rust-random/getrandom#801

0.4.0 - 2026-02-02

Added

  • RawOsError type alias #739
  • SysRng behind new feature sys_rng #751
  • WASIp3 support #779
  • extern_impl opt-in backend #786 #794
  • Motor OS support #797

Changed

  • Use Edition 2024 and MSRV 1.85 #749

#739: rust-random/getrandom#739 #749: rust-random/getrandom#749 #751: rust-random/getrandom#751 #779: rust-random/getrandom#779 #786: rust-random/getrandom#786 #794: rust-random/getrandom#794 #797: rust-random/getrandom#797

[0.3.4] - 2025-10-14

Major change to wasm_js backend

Now, when the wasm_js feature is enabled, the wasm_js backend will be used by default. Users of wasm32-unknown-unknown targeting JavaScript environments like the Web and Node.js will no longer need to specify:

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the rust-dependencies group across 1 directory with 6 updates
3300719 
Updates the requirements on [lz4_flex](https://github.com/pseitz/lz4_flex), [hkdf](https://github.com/RustCrypto/KDFs), [sha2](https://github.com/RustCrypto/hashes), [hmac](https://github.com/RustCrypto/MACs), [generic-array](https://github.com/fizyk20/generic-array) and [getrandom](https://github.com/rust-random/getrandom) to permit the latest version.

Updates `lz4_flex` to 0.13.0
- [Release notes](https://github.com/pseitz/lz4_flex/releases)
- [Changelog](https://github.com/PSeitz/lz4_flex/blob/main/CHANGELOG.md)
- [Commits](PSeitz/lz4_flex@0.12.0...0.13.0)

Updates `hkdf` to 0.13.0
- [Commits](RustCrypto/KDFs@hkdf-v0.12.0...hkdf-v0.13.0)

Updates `sha2` to 0.11.0
- [Commits](RustCrypto/hashes@groestl-v0.10.0...sha2-v0.11.0)

Updates `hmac` to 0.13.0
- [Commits](RustCrypto/MACs@hmac-v0.12.0...hmac-v0.13.0)

Updates `generic-array` to 1.3.5
- [Release notes](https://github.com/fizyk20/generic-array/releases)
- [Changelog](https://github.com/fizyk20/generic-array/blob/master/CHANGELOG.md)
- [Commits](https://github.com/fizyk20/generic-array/commits)

Updates `getrandom` to 0.4.2
- [Changelog](https://github.com/rust-random/getrandom/blob/master/CHANGELOG.md)
- [Commits](rust-random/getrandom@v0.2.0...v0.4.2)

---
updated-dependencies:
- dependency-name: lz4_flex
  dependency-version: 0.13.0
  dependency-type: direct:production
  dependency-group: rust-dependencies
- dependency-name: hkdf
  dependency-version: 0.13.0
  dependency-type: direct:production
  dependency-group: rust-dependencies
- dependency-name: sha2
  dependency-version: 0.11.0
  dependency-type: direct:production
  dependency-group: rust-dependencies
- dependency-name: hmac
  dependency-version: 0.13.0
  dependency-type: direct:production
  dependency-group: rust-dependencies
- dependency-name: generic-array
  dependency-version: 1.3.5
  dependency-type: direct:production
  dependency-group: rust-dependencies
- dependency-name: getrandom
  dependency-version: 0.4.2
  dependency-type: direct:production
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants