Update Rust Dependencies #5147
Open
Update Rust Dependencies #5147
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.1.88->0.1.891.0.141->1.0.1452.0.12->2.0.171.47.1->1.48.00.3.19->0.3.200.29.4->0.30.00.13.0->0.14.00.10.0->0.11.0Release Notes
dtolnay/async-trait (async-trait)
v0.1.89Compare Source
serde-rs/json (serde_json)
v1.0.145Compare Source
v1.0.144Compare Source
v1.0.143Compare Source
v1.0.142Compare Source
dtolnay/thiserror (thiserror)
v2.0.17Compare Source
v2.0.16Compare Source
v2.0.15Compare Source
Error::provideAPI becoming unavailable from a future new compiler lint (#427)v2.0.14Compare Source
v2.0.13Compare Source
tokio-rs/tokio (tokio)
v1.48.0: Tokio v1.48.0Compare Source
1.48.0 (October 14th, 2025)
The MSRV is increased to 1.71.
Added
File::max_buf_size(#7594)ChainofAsyncReadExt::chain(#7599)SocketAddr::as_abstract_name(#7491)TcpStream::quickackandTcpStream::set_quickack(#7490)AsRef<Self>forTcpStreamandUnixStream(#7573)LocalKey::try_get(#7666)Ordfortask::Id(#7530)Changed
max_buf_sizewhen cloning aFile(#7593)clippy::unwrap_in_resultin#[tokio::main](#7651)PollEventednoise from Debug formats (#7675)Command::spawn_withto useFnOnce(#7511)SetOnce(#7554)UnsafeCell::get_mutinMutex::get_mutandRwLock::get_mut(#7569)Timeout<T>::poll(#7535)Fixed
join!andtry_join!(#7638)wake_by_ref()even if already woken (#7622)broadcast::Senderinbroadcast::Sender::new()(#7629)RwLock::try_*methods (#7587)Unstable
--cfgflags fortaskdumpandio_uring(#7655, #7621)io_uringinfs::write(#7567)io_uringwithFile::open()(#7617)io_uringwithOpenOptions(#7321)localruntime flavor (#7375, #7597)Documented
AsyncRead::poll_read(#7580)AsyncFdreadiness guards (#7583)UCred::pid()on Cygwin (#7611)set_reuseport()andreuseport()(#7628)SO_REUSEADDRis only set on Unix (#7533)Handle::block_on(#7665)Builder::global_queue_interval()(#7605)tokio::sync::watch::Receiver(#7584)SetOnce::wait(#7506)parking_lotfeature flag (#7663)UnboundedSender::send(#7661)sync::watch(#7601)spawn_localmethods (#7669)poll_proceed(#7586)v1.47.2Compare Source
tokio-rs/tracing (tracing-subscriber)
v0.3.20: tracing-subscriber 0.3.20Compare Source
Security Fix: ANSI Escape Sequence Injection (CVE-TBD)
Impact
Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:
In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.
Solution
Version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.
Affected Versions
All versions of tracing-subscriber prior to 0.3.20 are affected by this vulnerability.
Recommendations
Immediate Action Required: We recommend upgrading to tracing-subscriber 0.3.20 immediately, especially if your application:
Migration
This is a patch release with no breaking API changes. Simply update your Cargo.toml:
Acknowledgments
We would like to thank zefr0x who responsibly reported the issue at
[email protected].If you believe you have found a security vulnerability in any tokio-rs project, please email us at
[email protected].mozilla/uniffi-rs (uniffi)
v0.30.0Compare Source
#[uniffi::trait_interface]attribute.This will look like
class PyTraitName(RustTraitName):What's new?
name = "NewName"attribute (like already supported for methods and constructors) (#2661)Display,Hash,Eqetc) (#2555)Ordtrait, allowing objects to be ordered by Rust (#2583).#[uniffi(default)]literals are now optional - eg,#[uniffi(default)]and#[uniffi(default = 0)]are equivalent.Similarly for args;
#[uniffi::export(default(arg_name))].When no literal is specifed, named types (objects, records, etc) can be used as long as they have suitable default values.
(#2543).
Custom types too (#2603)
enumandobjecttypes can be used as error type (#2658)NoPointerplaceholder object used to create fake interface instances has been renamed toNoHandleThis makes the generated source files deterministic.
uniffi_bindgen::backendhas been removed.#[uniffi(default)]changes how defaults are represented.FfiType::RustArcPtrhas been removed and the FFI type for objects/interfaces is now au64.Bindings authors will need to update their code to reflect this:
u64valuesu64handle rather than a raw pointeru64handle rather than a raw pointerEnumsandRecordscan have methods, so theMethodnow carriesself_typeinstead of the object name.In the templates, for
Callable.takes_self()is replaced withCallable.self_type().free,clone, followed by a field for each interface method.Note That
freeis now at the start of the vtable rather than the end.When Lifting/lowering trait interface handles, check if the handle was generated from Rust or the foreign side.
All changes in v0.30.0.
webrtc-rs/webrtc (webrtc)
v0.14.0Compare Source
What's Changed
Optionvalue by @cppcoffee in #686listen_udp_in_port_rangeby @lucamuscat in #719max-message-sizeSDP attribute in datachannels by @lucamuscat in #722randversion 0.9.1 or greater, asrand::distr::Alphabeticdoes not exist in0.9.0, which is currently allowed by @lucamuscat in #732New Contributors
Full Changelog: webrtc-rs/webrtc@v0.13.0...v0.14.0
webrtc-rs/webrtc (webrtc-media)
v0.11.0Compare Source
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.