build(deps): bump the cargo group across 1 directory with 2 updates

[dependabot]

Bumps the cargo group with 2 updates in the /iroh-sidecar directory: hickory-resolver and rustls.

Updates hickory-resolver from 0.26.1 to 0.26.3

Release notes

Sourced from hickory-resolver's releases.

v0.26.3

This release fixes regressions introduced in v0.26.2 related to DNSSEC verification, QUIC servers, HTTP/3 servers, and minimum dependency versions.

What's Changed

• Fix warnings (release/0.26) by @​divergentdave in hickory-dns/hickory-dns#3877
• resolver: use lenient resolv.conf parsing by @​djc in hickory-dns/hickory-dns#3879
• backport: Fix multi rrsig validation 0.26 by @​MartB in hickory-dns/hickory-dns#3892
• Bump version to 0.26.3 by @​djc in hickory-dns/hickory-dns#3895
• Exclude accepting QUIC connections from timeouts - 0.26 branch by @​divergentdave in hickory-dns/hickory-dns#3906
• [0.26] net: fix insecure ancestor delegation by @​djc in hickory-dns/hickory-dns#3907

Full Changelog: hickory-dns/hickory-dns@v0.26.2...v0.26.3

v0.26.2

This release fixes a large number of security vulnerabilities. Most of the issues were related to DNSSEC validation, denial of service and resource consumption attacks, and reachable panics in parsers. Other issues were related to UDP spoofing defenses, caching issues, and general DNS protocol correctness issues.

This is our first post-vulnpocalypse release, and most of these vulnerabilities were discovered through LLM-based workflows. The sheer volume of reports has been a challenge for our volunteer maintainers.

Resolved advisories:

• GHSA-2vgh-3wfw-qj7c: RRSIG Signer's Name not checked against the RRset's zone
• GHSA-57pw-897j-v4j6: Improper check of signature validity of NSEC and NSEC3 records
• GHSA-wjgj-fvg9-65w9: DNSSEC validation ignores bogus records with a DNS class other than IN
• GHSA-588m-chg6-8jqj: Inverted NSEC3 comparison allows forgery of proofs of nonexistence
• GHSA-qw83-5pm2-ggp5: DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC records
• GHSA-3jvh-8vj5-65rq: NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3
• GHSA-3r6v-f3jh-vvqm: ancestor-delegation NSEC accepted as proof of nonexistence below the zone cut
• GHSA-624w-vvww-xvpw: ancestor-delegation NSEC3 accepted as proof of nonexistence at and below the zone cut
• GHSA-7php-9j59-g3ch: DNSSEC validation is missing RFC 6840 §4.4 checks
• GHSA-vrv5-968r-5ggm: DNSSEC validation accepts bogus positive response with wildcard expansion
• GHSA-p2jv-r3m3-7wf4: Nonexistence proof forgery due to insufficient checks on NSEC3 record names
• GHSA-86vr-jm6c-7cpg: NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the covering NSEC proves exists
• GHSA-8hq4-5836-w6q4: Server does not check validation status of SOA record in negative responses
• GHSA-5j98-2g5x-46v6: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
• GHSA-929p-gjf6-5hqj: DNSSEC validation accepts responses with the wrong RRset as a positive answer
• GHSA-j2rc-wxwh-62g9: TrustAnchors does not check name of DNSKEY
• GHSA-rx82-4p2j-j5cv: Name::hash discards label boundaries; ValidationCacheKey(u64) reuses the digest in Eq implementation, leaking an Insecure DNSSEC verdict across distinct owner names
• GHSA-2hxp-x833-73f7: Hickory DNS recursor: ghost domain attack via child-side NS RRset queries
• GHSA-x962-5xwx-fr8x: Unchecked subtraction in TSIG RDATA decoding panics when overflow checks are enabled
• GHSA-wgfr-mphw-j5g4: Panic in zone file parser for SVCB and HTTPS
• GHSA-hx8c-fjhc-hmf5: Panic in zone file parser for SVCB and HTTPS
• GHSA-4rph-pmrw-mwpw: Zone file parser panics when parsing long lines
• GHSA-3w89-7rx5-hpwx: Responses with QDCOUNT=0 bypass check for matching question section
• GHSA-vcjp-57rr-mpfw: Out-of-bailiwick filtering is not applied to negative responses
• GHSA-6w6g-hm98-mhgm: Unbounded TC-retry loop in NameServerPool::try_send (resource-exhaustion DoS)
• GHSA-cx5j-p54p-q756: Cyclic sibling domain name server referrals without glue records cause exponential upstream query amplification in the recursor
• GHSA-6h5c-jjg5-wj59: Glueless-NS referral fan-out without per-query work budget
• GHSA-v44v-c8m4-gc43: Denial of service of client UDP connections via spoofed malformed responses
• GHSA-67wc-6jq8-ghrc: Remote memory-amplification DoS via attacker-controlled RR counts in DNS message parsing

... (truncated)

Commits

• bd37caf net: require authenticated insecure-delegation proofs
• 5a79511 Add conformance test for regression
• c268442 net: fix ancestor delegation issues
• 9488e8e Exclude accepting QUIC connections from timeouts
• 4ad16c3 Bump version to 0.26.3
• cfab556 proto: ignore RRSIGs in DnssecSummary::from_records
• 819a6bc net: try every RRSIG before marking an RRset bogus
• 688231e resolver: use lenient resolv.conf parsing
• ca5d1a1 resolver: Fix 'unused method' with features blocklist,tls-ring
• 678b01b Fix unnecessary qualification warning
• Additional commits viewable in compare view

Updates rustls from 0.23.43 to 0.23.45

Commits

• 2976d90 Prepare 0.23.45
• f9d4ee9 Handshake "alignment" check covers previously-received messages
• c4e92e8 Keep data needed for HRR processing together
• e553a7a server: TLS1.2 is not available after a HRR
• 5dff9da Test whether server negotiates TLS1.2 after HRR
• 185a063 reject a second ClientHello that changes the cipher suite
• 9fafe6d reject a second ClientHello that drops pre_shared_key
• 1b42c5f providers: zeroize private key DER
• 64ad386 Bump version to 0.23.44
• 1efbf66 bogo: remove PostQuantum setup
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	edgesync-docs	352d96f	Commit Preview URL Branch Preview URL	Oct 11 2026, 01:51 AM