Skip to content

chore(deps): bump the cargo-dependencies group across 1 directory with 10 updates - #314

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-abe54a0323
Open

chore(deps): bump the cargo-dependencies group across 1 directory with 10 updates#314
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-abe54a0323

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cargo-dependencies group with 10 updates in the / directory:

Package From To
reqwest 0.13.3 0.13.5
serde_json 1.0.151 1.0.154
uuid 1.20.0 1.28.0
backtrace 0.3.74 0.3.76
sha1 0.10.7 0.11.0
tokio 1.53.1 1.53.3
zstd 0.14.0 0.14.3
base64 0.22.1 0.23.1
axum 0.8.8 0.8.9
httpmock 0.8.3 0.9.0

Updates reqwest from 0.13.3 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

v0.13.4

tl;dr

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.5

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

v0.13.4

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.
Commits
  • de55373 v0.13.5
  • 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
  • 9f06fd2 docs: improve description of JSON method (#3082)
  • 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
  • ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
  • 4e9a3c7 chore: add pull request template for human-written content
  • 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
  • 221abe9 chore: Remove unnecessary clones and a cast (#3071)
  • 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
  • fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
  • Additional commits viewable in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

v1.0.153

v1.0.152

Commits
  • 20572a6 Release 1.0.154
  • a91bfaf Fix RandomState links in map documentation
  • 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
  • 4b2d726 Release 1.0.153
  • 83335ee Touch up PR 1345
  • 4b4810a Resolve range_plus_one pedantic clippy lint
  • 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
  • 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
  • c9f1e3b Release 1.0.152
  • 854fc70 Touch up PR 1347
  • Additional commits viewable in compare view

Updates uuid from 1.20.0 to 1.28.0

Release notes

Sourced from uuid's releases.

v1.28.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.27.0...v1.28.0

v1.27.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

v1.26.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

... (truncated)

Commits
  • 276c236 Merge pull request #918 from uuid-rs/cargo/v1.28.0
  • 4b3b9f5 prepare for 1.28.0 release
  • cbf9c81 Merge pull request #916 from RanaPriyansh/fix/optional-serde-adapters-840
  • 784a022 Inline expected tokens in optional compact serde test
  • a5678c3 Simplify optional serde adapter tests to option tokens
  • 638a518 Refactor optional serde adapter tests and share byte wrapper
  • b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
  • ffd8ec5 prepare for 1.27.0 release
  • 654fa5b Add optional serde format adapters
  • 4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
  • Additional commits viewable in compare view

Updates backtrace from 0.3.74 to 0.3.76

Release notes

Sourced from backtrace's releases.

backtrace-v0.3.76

Behavior

  • Fix inverted polarity of "full printing" logic in rust-lang/backtrace-rs#726: Previously we used to do the opposite of what you would expect.

Platform Support

Dependencies

Changelog

Sourced from backtrace's changelog.

0.3.76 - 2025-09-26

Behavior

  • Fix inverted polarity of "full printing" logic in rust-lang/backtrace-rs#726: Previously we used to do the opposite of what you would expect.

Platform Support

Dependencies

Commits
  • 775f6a1 modify CHANGELOG.md to not be a git log dump
  • bb0cdc3 chore: release v0.3.76
  • a8b55f0 Merge of rust-lang/backtrace-rs#725: Fix missing alignment check for ELF note...
  • 0b83800 Expand take_nhdr doc-comment
  • a405950 Merge pull request #737 from workingjubilee/address-dbghelp-soundness-risks
  • 06dca9a Expand doc-comment on do_resolve
  • 05ad047 Remove padding bytes risk in dbghelp with MaybeUninit
  • dccdb4d Upgrade cpp_demanglerust-lang/backtrace-rs#732
  • 50fe434rust-lang/backtrace-rs#734
  • 79d3514 Switch from windows-targets to windows-linkrust-lang/backtrace-rs#727
  • Additional commits viewable in compare view

Updates sha1 from 0.10.7 to 0.11.0

Commits

Updates tokio from 1.53.1 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

  • io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

  • io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

  • io: wake and drop DuplexStream wakers outside the lock (#8618)
  • macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
  • runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
  • sync: wake waiters outside the lock when closing a semaphore (#8529)
  • test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

  • rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

  • fs: handle integer overflow in buffered relative seek (#8574)
  • io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
  • process: unregister Windows wait before closing child handle (#8564)
  • rt: drop blocking pool mutex before shutting down rejected task (#8562)
  • sync: fix mpsc index wraparound in block reclamation (#8546)
  • sync: forget mpsc Permit before sending value (#8560)
  • sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
  • sync: wake broadcast Sender::closed outside mutex (#8558)
  • task: drop replaced waker outside lock in JoinSet (#8554)
  • time: drop timer lock before dropping waker in clear_entry (#8552)
  • time: expire timers directly on shutdown without rotating wheel (#8570)

... (truncated)

Commits
  • a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
  • df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
  • f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
  • 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
  • 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
  • c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
  • 0448618 sync: make tracing_sync tests synchronous (#8427)
  • 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
  • bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
  • 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
  • Additional commits viewable in compare view

Updates zstd from 0.14.0 to 0.14.3

Commits
  • 75bc740 Release zstd 0.14.3, zstd-safe 8.2.0, and zstd-sys 2.1.2
  • 1c580b6 zstd-safe: keep the one-shot reset check inline
  • 502ee2f zstd-safe: only reset after one-shot decompression if a stream may be open
  • 5ded6e0 zstd-safe: apply rustfmt
  • e224018 zstd-safe: refuse to unload a dictionary under unfinished zstdmt jobs
  • 6a1065b Stop a single_frame() decoder when finish_frame() ends the frame
  • c7156df Don't let finish_frame() start a frame nothing was read from
  • b0fb8a7 Add write::Decoder::finish() to report incomplete frames
  • ab34d01 Don't retry a panicked writer when dropping AutoFlushDecoder/AutoFinishEncoder
  • 74ace2d Reset the borrowed context's session in raw::{Encoder,Decoder}::with_context
  • Additional commits viewable in compare view

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

Updates httpmock from 0.8.3 to 0.9.0

Release notes

Sourced from httpmock's releases.

v0.9.0

The crate was upgraded to the Rust 2024 edition. The minimum supported Rust version remains 1.88.

Breaking changes

  • server::matchers is now crate-private (#312). Its matcher, comparator and reader types are implementation details rather than a supported extension API; there is no replacement public path. Custom predicates remain possible with When::is_true.
  • The body helpers is_blank, contains_str, contains_slice and contains_vec were removed (#246). Use request.body_string().contains(".."), which also works inside respond_with, or request.body_ref().windows(n).any(|w| w == b"..") with a non-empty needle, and When::body_includes when matching.
  • HttpMockRequest::query_params_map() was removed (#246). Collect query_params() instead: let params: HashMap<String, String> = request.query_params().into_iter().collect(); keeps the last value for duplicate keys, as the removed method did. query_params() has returned Vec<(String, String)> since 0.8.2.
  • The MockExt trait was removed and Mock's public id field is now private (#285). Remove MockExt imports and replace direct mock.id field access with mock.id(). Mock::new(id, &server) is unchanged.
  • The mock server only accepts cleartext HTTP/2 connections (prior knowledge, as gRPC clients send it) when the http2 cargo feature is enabled (#297). Previously this worked without the feature. It fails at runtime, not at compile time: the client sees the connection closed after the preface and the server logs "invalid HTTP version parsed (found HTTP2 preface)". Enable http2 to keep serving such clients; standalone and the Docker image already include it. HTTPS via ALPN is unaffected, as h2 was already only offered with the feature enabled. The crate also no longer enables tokio/signal or hyper/http2 for other crates in the build, so a crate that relied on that has to enable them itself.
  • server::state::MockServerState and server::state::HttpMockStateManager are now crate-private (#289, #326). Neither could be used from outside the crate beyond constructing it; code using the MockServer API is unaffected.
  • The empty experimental Cargo feature was removed (#316). Remove it from your dependency's feature list; it did not enable any functionality.
  • The Docker image now uses a slim Debian runtime without the Rust toolchain or source tree (#202, 1231c63). curl and wget are no longer installed, so healthchecks that call them need another probe: an httpGet probe against /__httpmock__/ping, or from inside the container bash -c 'exec 3<>/dev/tcp/127.0.0.1/5050'. The CA files are no longer in the image either; use certs/ca.pem from the repository or server::DEFAULT_CA_CERTIFICATE. The executable is now at /usr/local/bin/httpmock, with a compatibility symlink at /usr/local/cargo/bin/httpmock so existing absolute paths continue to work.
  • The tls-detect cargo feature was removed

... (truncated)

Changelog

Sourced from httpmock's changelog.

Version 0.9.0

The crate was upgraded to the Rust 2024 edition. The minimum supported Rust version remains 1.88.

Breaking changes

  • server::matchers is now crate-private (#312). Its matcher, comparator and reader types are implementation details rather than a supported extension API; there is no replacement public path. Custom predicates remain possible with When::is_true.
  • The body helpers is_blank, contains_str, contains_slice and contains_vec were removed (#246). Use request.body_string().contains(".."), which also works inside respond_with, or request.body_ref().windows(n).any(|w| w == b"..") with a non-empty needle, and When::body_includes when matching.
  • HttpMockRequest::query_params_map() was removed (#246). Collect query_params() instead: let params: HashMap<String, String> = request.query_params().into_iter().collect(); keeps the last value for duplicate keys, as the removed method did. query_params() has returned Vec<(String, String)> since 0.8.2.
  • The MockExt trait was removed and Mock's public id field is now private (#285). Remove MockExt imports and replace direct mock.id field access with mock.id(). Mock::new(id, &server) is unchanged.
  • The mock server only accepts cleartext HTTP/2 connections (prior knowledge, as gRPC clients send it) when the http2 cargo feature is enabled (#297). Previously this worked without the feature. It fails at runtime, not at compile time: the client sees the connection closed after the preface and the server logs "invalid HTTP version parsed (found HTTP2 preface)". Enable http2 to keep serving such clients; standalone and the Docker image already include it. HTTPS via ALPN is unaffected, as h2 was already only offered with the feature enabled. The crate also no longer enables tokio/signal or hyper/http2 for other crates in the build, so a crate that relied on that has to enable them itself.
  • server::state::MockServerState and server::state::HttpMockStateManager are now crate-private (#289, #326). Neither could be used from outside the crate beyond constructing it; code using the MockServer API is unaffected.
  • The empty experimental Cargo feature was removed (#316). Remove it from your dependency's feature list; it did not enable any functionality.
  • The Docker image now uses a slim Debian runtime without the Rust toolchain or source tree (#202, 1231c63). curl and wget are no longer installed, so healthchecks that call them need another probe: an httpGet probe against /__httpmock__/ping, or from inside the container bash -c 'exec 3<>/dev/tcp/127.0.0.1/5050'. The CA files are no longer in the image either; use certs/ca.pem from the repository or server::DEFAULT_CA_CERTIFICATE. The executable is now at /usr/local/bin/httpmock, with a compatibility symlink at /usr/local/cargo/bin/httpmock so existing absolute paths continue to work.

... (truncated)

Commits
  • d6fe1cc Release 0.9.0
  • 3926545 Stop exposing optional dependencies as cargo features
  • 8e4c443 Make HttpMockStateManager crate-private
  • 3a8cb6d chore: drop a stale comment about moving body helpers
  • e8699b5 docs: apply the 0.9 breaking-change review to the changelog
  • a1dbc8f docs: point the docs.rs front page at the guide and badge feature-gated items
  • 4ecf44c Use is_some_and for the authority IP check in the TLS resolver
  • 7f52d59 Take an AsyncFn in with_retry instead of a closure plus future pair
  • ee5a062 docs: regenerate website method docs for up_to_n_times
  • 95f07c3 ci(deps): bump the npm_and_yarn group across 1 directory with 3 updates (#334)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the cargo-dependencies group across 1 directory wit…
bbaef9a 
…h 10 updates

Bumps the cargo-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.3` | `0.13.5` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.151` | `1.0.154` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.28.0` |
| [backtrace](https://github.com/rust-lang/backtrace-rs) | `0.3.74` | `0.3.76` |
| [sha1](https://github.com/RustCrypto/hashes) | `0.10.7` | `0.11.0` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.3` |
| [zstd](https://github.com/gyscos/zstd-rs) | `0.14.0` | `0.14.3` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [axum](https://github.com/tokio-rs/axum) | `0.8.8` | `0.8.9` |
| [httpmock](https://github.com/httpmock/httpmock) | `0.8.3` | `0.9.0` |



Updates `reqwest` from 0.13.3 to 0.13.5
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.13.3...v0.13.5)

Updates `serde_json` from 1.0.151 to 1.0.154
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.151...v1.0.154)

Updates `uuid` from 1.20.0 to 1.28.0
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.20.0...v1.28.0)

Updates `backtrace` from 0.3.74 to 0.3.76
- [Release notes](https://github.com/rust-lang/backtrace-rs/releases)
- [Changelog](https://github.com/rust-lang/backtrace-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/backtrace-rs@0.3.74...backtrace-v0.3.76)

Updates `sha1` from 0.10.7 to 0.11.0
- [Commits](RustCrypto/hashes@sha1-v0.10.7...sha1-v0.11.0)

Updates `tokio` from 1.53.1 to 1.53.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.3)

Updates `zstd` from 0.14.0 to 0.14.3
- [Release notes](https://github.com/gyscos/zstd-rs/releases)
- [Commits](gyscos/zstd-rs@v0.14.0...v0.14.3)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `axum` from 0.8.8 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.8.8...axum-v0.8.9)

Updates `httpmock` from 0.8.3 to 0.9.0
- [Release notes](https://github.com/httpmock/httpmock/releases)
- [Changelog](https://github.com/httpmock/httpmock/blob/master/CHANGELOG.md)
- [Commits](httpmock/httpmock@v0.8.3...v0.9.0)

---
updated-dependencies:
- dependency-name: reqwest
  dependency-version: 0.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: serde_json
  dependency-version: 1.0.154
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: uuid
  dependency-version: 1.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: backtrace
  dependency-version: 0.3.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: sha1
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: tokio
  dependency-version: 1.53.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: zstd
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: httpmock
  dependency-version: 0.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 28, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 28, 2026 13:28
@github-actions

github-actions Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

posthog-rs-v1 Compliance Report

Date: 2026-10-28 13:32:18 UTC
Duration: 23062ms

✅ All Tests Passed!

111/111 tests passed

Capture_V1 Tests

✅ 94/94 tests passed

View Details
Test Status Duration
Endpoint And Method.Targets V1 Endpoint ✅ 152ms
Endpoint And Method.Does Not Use Legacy Endpoints ✅ 152ms
Required Headers.Has Authorization Bearer Header ✅ 151ms
Required Headers.Has Content Type Json ✅ 152ms
Required Headers.Has Posthog Sdk Info Format ✅ 150ms
Required Headers.Has Posthog Attempt Header ✅ 153ms
Required Headers.Has Posthog Request Id ✅ 155ms
Required Headers.Has Posthog Request Timestamp ✅ 152ms
Required Headers.Has User Agent ✅ 152ms
Body Format.Body Has Created At And Batch ✅ 150ms
Body Format.No Api Key In Body ✅ 140ms
Body Format.No Sent At In Body ✅ 141ms
Event Format.Event Has Required Root Fields ✅ 142ms
Event Format.Event Uuid Is Valid ✅ 142ms
Event Format.Event Timestamp Is Rfc3339 ✅ 139ms
Event Format.Distinct Id Is String ✅ 141ms
Event Format.Distinct Id At Root Not Properties ✅ 140ms
Event Format.Custom Properties Preserved ✅ 140ms
Event Format.Set Properties Preserved ✅ 139ms
Event Format.Set Once Properties Preserved ✅ 137ms
Event Format.Groups Properties Preserved ✅ 142ms
Event Format.Sdk Generates Uuid If Not Provided ✅ 140ms
Event Format.Event Has Required Root Fields Batch ✅ 166ms
Event Format.Event Uuid Is Valid Batch ✅ 187ms
Event Format.Event Timestamp Is Rfc3339 Batch ✅ 187ms
Event Format.Distinct Id Is String Batch ✅ 186ms
Event Format.Distinct Id At Root Not Properties Batch ✅ 166ms
Event Format.Custom Properties Preserved Batch ✅ 166ms
Event Format.Set Properties Preserved Batch ✅ 165ms
Event Format.Set Once Properties Preserved Batch ✅ 175ms
Event Format.Groups Properties Preserved Batch ✅ 156ms
Event Format.Sdk Generates Uuid If Not Provided Batch ✅ 156ms
Batch Behavior.Multiple Events In Single Batch ✅ 196ms
Batch Behavior.Batch Envelope Smoke ✅ 171ms
Batch Behavior.Flush With No Events Sends Nothing ✅ 116ms
Batch Behavior.Flush At Triggers Batch ✅ 1129ms
Batch Behavior.Created At Reflects Batch Creation Time ✅ 107ms
Deduplication.Generates Unique Uuids ✅ 209ms
Deduplication.Different Events Same Content Different Uuids ✅ 138ms
Deduplication.Preserves Uuid On Retry ✅ 5112ms
Deduplication.Preserves Timestamp On Retry ✅ 5077ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5112ms
Deduplication.No Duplicate Events In Batch ✅ 146ms
Header Behavior On Retry.Attempt Header Starts At One ✅ 89ms
Header Behavior On Retry.Attempt Header Increments On Retry ✅ 10082ms
Header Behavior On Retry.Request Id Preserved On Retry ✅ 5060ms
Header Behavior On Retry.Different Requests Have Different Request Ids ✅ 2077ms
Header Behavior On Retry.Request Timestamp Changes On Retry ✅ 5053ms
Response Format Validation.Success Response Has Uuid Keyed Results ✅ 53ms
Response Format Validation.Success Response Has Ok For Each Event ✅ 34ms
Response Format Validation.Success No Retry After When All Ok ✅ 35ms
Response Format Validation.Success Retry After Present When Retry Events ✅ 31ms
Response Format Validation.Success No Retry After When Drop Only ✅ 30ms
Response Format Validation.Response Echoes Request Id ✅ 33ms
Retry Behavior.Retries On 408 ✅ 5037ms
Retry Behavior.Retries On 500 ✅ 5023ms
Retry Behavior.Retries On 503 ✅ 5024ms
Retry Behavior.Retries On 504 ✅ 5025ms
Retry Behavior.Retryable Errors Have Retry After ✅ 2025ms
Retry Behavior.Respects Retry After On Retryable Error ✅ 8024ms
Retry Behavior.Does Not Retry On 400 ✅ 2037ms
Retry Behavior.Does Not Retry On 401 ✅ 2028ms
Retry Behavior.Does Not Retry On 402 ✅ 2023ms
Retry Behavior.Does Not Retry On 413 ✅ 2030ms
Retry Behavior.Does Not Retry On 415 ✅ 2027ms
Retry Behavior.Non Retryable Errors Have No Retry After ✅ 2026ms
Retry Behavior.Implements Backoff ✅ 15032ms
Retry Behavior.Max Retries Respected ✅ 15028ms
Partial Batch Handling.Handles 200 Full Success ✅ 2029ms
Partial Batch Handling.Handles 200 With All Ok ✅ 3037ms
Partial Batch Handling.Does Not Retry Dropped Events ✅ 3041ms
Partial Batch Handling.Does Not Retry Limited Events ✅ 3036ms
Partial Batch Handling.Prunes Ok Events On Partial Retry ✅ 5037ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry ✅ 5026ms
Partial Batch Handling.Retries Only Retry Events From Partial ✅ 5028ms
Partial Batch Handling.Partial Retry Preserves Uuids ✅ 5027ms
Partial Batch Handling.Partial Retry Attempt Header Increments ✅ 5031ms
Partial Batch Handling.Partial Retry Request Id Preserved ✅ 5034ms
Partial Batch Handling.Respects Retry After On Partial ✅ 5027ms
Partial Batch Handling.Unknown Result Treated As Terminal ✅ 3024ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry ✅ 3037ms
Compression.Sends Gzip Content Encoding ✅ 30ms
Compression.No Content Encoding When Disabled ✅ 22ms
Compression.Compressed Body Is Decompressible ✅ 23ms
Error Handling.Does Not Retry On Unknown 4Xx ✅ 2024ms
Event Options.Cookieless Mode Override ✅ 24ms
Event Options.Disable Skew Correction Override ✅ 24ms
Event Options.Process Person Profile Override ✅ 22ms
Event Options.Product Tour Id Override ✅ 23ms
Event Options.Unset Options Omitted ✅ 23ms
Event Options.Options Override In Batch ✅ 24ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties ✅ 24ms
Geoip And Historical Migration.Historical Migration Set In Body ✅ 23ms
Geoip And Historical Migration.Historical Migration Absent By Default ✅ 23ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 15ms
Request Payload.Flags Request Uses V2 Query Param ✅ 15ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 16ms
Request Payload.Flags Request Omits Authorization Header ✅ 15ms
Request Payload.Token In Flags Body Matches Init ✅ 15ms
Request Payload.Groups Round Trip ✅ 14ms
Request Payload.Groups Default To Empty Object ✅ 15ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 17ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 17ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 18ms
Request Lifecycle.No Flags Request On Init Alone ✅ 11ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 27ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 17ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 14ms
Retry Behavior.Retries Flags On 502 ✅ 218ms
Retry Behavior.Retries Flags On 504 ✅ 219ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 24ms

@github-actions

github-actions Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

posthog-rs-v0 Compliance Report

Date: 2026-10-28 13:32:27 UTC
Duration: 15516ms

✅ All Tests Passed!

46/46 tests passed

Capture Tests

✅ 29/29 tests passed

View Details
Test Status Duration
Format Validation.Event Has Required Fields ✅ 139ms
Format Validation.Event Has Uuid ✅ 155ms
Format Validation.Event Has Lib Properties ✅ 153ms
Format Validation.Distinct Id Is String ✅ 152ms
Format Validation.Token Is Present ✅ 152ms
Format Validation.Custom Properties Preserved ✅ 148ms
Format Validation.Event Has Timestamp ✅ 149ms
Retry Behavior.Retries On 503 ✅ 5159ms
Retry Behavior.Does Not Retry On 400 ✅ 2151ms
Retry Behavior.Does Not Retry On 401 ✅ 2151ms
Retry Behavior.Respects Retry After Header ✅ 5109ms
Retry Behavior.Implements Backoff ✅ 15101ms
Retry Behavior.Retries On 500 ✅ 5100ms
Retry Behavior.Retries On 502 ✅ 5099ms
Retry Behavior.Retries On 504 ✅ 5101ms
Retry Behavior.Max Retries Respected ✅ 15099ms
Deduplication.Generates Unique Uuids ✅ 104ms
Deduplication.Preserves Uuid On Retry ✅ 5024ms
Deduplication.Preserves Uuid And Timestamp On Retry ✅ 10034ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5043ms
Deduplication.No Duplicate Events In Batch ✅ 26ms
Deduplication.Different Events Have Different Uuids ✅ 24ms
Compression.Sends Gzip When Enabled ✅ 24ms
Batch Format.Uses Proper Batch Structure ✅ 27ms
Batch Format.Flush With No Events Sends Nothing ✅ 33ms
Batch Format.Multiple Events Batched Together ✅ 103ms
Error Handling.Does Not Retry On 403 ✅ 2081ms
Error Handling.Does Not Retry On 413 ✅ 2091ms
Error Handling.Retries On 408 ✅ 5086ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 64ms
Request Payload.Flags Request Uses V2 Query Param ✅ 64ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 31ms
Request Payload.Flags Request Omits Authorization Header ✅ 44ms
Request Payload.Token In Flags Body Matches Init ✅ 40ms
Request Payload.Groups Round Trip ✅ 46ms
Request Payload.Groups Default To Empty Object ✅ 31ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 44ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 44ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 48ms
Request Lifecycle.No Flags Request On Init Alone ✅ 40ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 42ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 67ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 42ms
Retry Behavior.Retries Flags On 502 ✅ 244ms
Retry Behavior.Retries Flags On 504 ✅ 235ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 36ms

marandaneto
marandaneto reviewed Oct 30, 2026
View reviewed changes

@marandaneto marandaneto left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated advisory code review.

Comment thread Cargo.lock

[[package]]
name = "sha1"
version = "0.11.0"

@marandaneto marandaneto Oct 30, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

blocking: Keep the locked runtime graph compatible with Rust 1.78 — The update selects sha1 0.11.0, pulling Rust-2024 crypto dependencies into every library build, although Cargo.toml still promises Rust 1.78 and CI explicitly checks that compiler. Both documented MSRV commands now fail before compiling the SDK, whereas the same commands pass on the exact merge base. This is not limited to development dependencies: the update also selects reqwest 0.13.5 (Rust 1.85), uuid 1.28.0 (Rust 1.89), and default-enabled backtrace 0.3.76 (Rust 1.82), so downgrading SHA-1 alone would not restore the contract. Retain compatible versions across the runtime graph rather than silently raising the supported compiler in this dependency chore. Reproduction: reproduced — both cargo +1.78.0 check --locked --package posthog-rs --lib --features capture-v1 and its --no-default-features --features error-tracking,capture-v1 variant exit 101 on the reviewed head with an edition2024 rejection for cpufeatures 0.3.1, and pass on merge base b62853dfa370b643ccf63c4e9c8feace61062238.

@marandaneto
marandaneto requested a review from a team October 30, 2026 13:15

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marandaneto marandaneto marandaneto left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@marandaneto