deps: bump the cargo group across 1 directory with 9 updates by dependabot[bot] · Pull Request #93 · somoore/hellbox

dependabot · 2026-11-13T03:35:01Z

Bumps the cargo group with 9 updates in the /rs-cli directory:

Package	From	To
tokio	`1.53.3`	`1.54.1`
toml	`1.1.8+spec-1.1.0`	`1.2.0+spec-1.1.0`
aws-config	`1.12.0`	`1.13.0`
aws-sdk-s3	`1.146.1`	`1.157.0`
aws-sdk-lambdamicrovms	`1.8.0`	`1.19.0`
aws-sdk-cloudformation	`1.125.0`	`1.136.0`
aws-sdk-sts	`1.114.0`	`1.126.0`
zip	`9.0.5`	`9.4.0`
webbrowser	`1.2.4`	`1.2.6`

Updates tokio from 1.53.3 to 1.54.1

Release notes

Sourced from tokio's releases.

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

time: revert "remove the runtime handle from timers" (#8692)

#8692: tokio-rs/tokio#8692

Tokio v1.54.0

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#8514)

Added

fs: add File::set_times, File::set_modified, and fs::FileTimes (#8504)

net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#8378)

runtime: add Builder::max_io_events_per_busy_tick (#8410)

runtime: stabilize tokio::runtime::worker_index() (#8431)

sync: add SemaphorePermit::semaphore() (#8482)

sync: add blocking_acquire methods to Semaphore (#8269)

sync: add watch::Receiver::is_closed (#8481)

wasm: support JSPI for Emscripten target (#8285, #8627)

wasm: support the wasm32-unknown-emscripten target (#8281, #8422, #8528, #8628)

Changed

fs: reject zero in File::set_max_buf_size (#8449)

io: make copy_buf cooperative (#8459)

io: panic when BufReader or BufStream is created with zero capacity (#8494)

io: panic when in-memory pipe is created with zero capacity (#8397)

io: reject zero buffer size in copy_bidirectional_with_sizes (#8454)

io: support vectored writes in Sink (#8663)

net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#8444)

net: start accepted sockets as readable and writable (#8435)

net: support UCred on Fuchsia (#8257)

process: use mio::unix::pipe for Unix child stdio (#8603)

runtime: cache-pad the shared injection queue and idle state (#8622)

runtime: decide auto-boxing of spawned futures at monomorphization time (#8414)

runtime: make enable_io available whenever rt is enabled (#8387)

runtime: move block_in_place setup into a non-generic function (#8315)

runtime: move the multi-thread inject queue to its own mutex (#8382)

runtime: panic when max_io_events_per_tick is zero (#8476)

runtime: suggest .await in nested block_on panic message (#8501)

sync: avoid atomic reader count in broadcast slots (#8357)

sync: use acquire/release orderings in Notify (#8325)

time: remove the runtime handle from timers (#8458)

... (truncated)

Commits

b53b200 chore: prepare Tokio v1.54.1 (#8693)
5ed619b time: revert "remove the runtime handle from timers" (#8692)
66d34e4 chore: prepare Tokio v1.54.0 (#8667)
0d322ce io: support vectored writes in sink (#8663)
4167c56 codec: expose I/O sources from codec errors (#8665)
cdd9dae fs: propagate iouring stress test failures (#8644)
52ac781 ci: run the emscripten JSPI tests as an auto-initialized ES module (#8640)
4890d02 stream: implement FusedStream for JoinSetStream (#8629)
a6bd8e1 wasm: check Emscripten version when using JSPI (#8627)
9dd749d Merge 'tokio-1.53.3' into 'master' (#8641)
Additional commits viewable in compare view

Updates toml from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0

Commits

8ffe3c5 chore: Release
fa51878 docs: Update changelog
f8ad91e perf(serde): Reuse key allocations (#1261)
fe51467 perf(serde): Reuse key allocations
7024319 perf(writer): Expand coverage of the fast path (#1259)
be196a8 perf(writer): Expand coverage of the fast path
932704c perf(serde): Pre-allocate serialization buffers (#1258)
52b563d perf(serde): Pre-allocate serialization buffers
e346a79 perff(writer): Add key and string fast paths (#1257)
ab695e6 perf(writer): Add a fast path for writing string types
Additional commits viewable in compare view

Updates aws-config from 1.12.0 to 1.13.0

Commits

See full diff in compare view

Updates aws-sdk-s3 from 1.146.1 to 1.157.0

Commits

See full diff in compare view

Updates aws-sdk-lambdamicrovms from 1.8.0 to 1.19.0

Commits

See full diff in compare view

Updates aws-sdk-cloudformation from 1.125.0 to 1.136.0

Commits

See full diff in compare view

Updates aws-sdk-sts from 1.114.0 to 1.126.0

Commits

See full diff in compare view

Updates zip from 9.0.5 to 9.4.0

Release notes

Sourced from zip's releases.

v9.4.0

🚀 Features

Implement ZipIterable::files_with_reader (#1267)

v9.3.0

🚀 Features

(write) implement TryFrom for PreparedZipFile (#1258)

v9.2.3

🐛 Bug Fixes

(ci) resolve typos false-positive, fix upath smuggling test, and add Turkish tests (#1256)

🚜 Refactor

Replace std:: with core:: where possible (#1253)

v9.2.2

🚜 Refactor

Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.1

🚜 Refactor

Eliminate the use of SwitchWriterFunction (a Box<dyn FnOnce<_>>) (#1235)

⚙️ Miscellaneous Tasks

Fix build error (can't convert getrandom::Error to io::Error without getrandom/std) (#1240)

v9.2.0

🚀 Features

(write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)

add index_for_name_raw (#1210)

(extract) multi-threaded parallel extraction engine and safe extent pre-allocation (#1207)

(read) add index-free iterable ZIP reader (#1218)

🐛 Bug Fixes

by_name().get_metadata() and by_index().get_metadata() now succeed even when compression method is unsupported (#1228)

(read) keep ZipIterable::len at the central directory entry count (#1221)

(fuzz) count reopens in copy bases when tracking comment shrink (#1222)

... (truncated)

Changelog

Sourced from zip's changelog.

9.4.0 - 2026-11-05

🚀 Features

Implement ZipIterable::files_with_reader (#1267)

9.3.0 - 2026-11-03

🚀 Features

(write) implement TryFrom<ZipFileBuilder> for PreparedZipFile (#1258)

9.2.3 - 2026-11-03

🚜 Refactor

Replace most equivalent uses of std:: with core:: (#1253)

9.2.2 - 2026-11-01

🚜 Refactor

Eliminate use of a Box<dyn FnOnce<_>> when starting and finishing an entry (#1235)

9.2.0 - 2026-10-31

🚀 Features

(write) add parallel compression and batch appending for ZipWriter with Rayon (#1225)

add index_for_name_raw (#1210)

(extract) multi-threaded parallel extraction engine and safe extent pre-allocation (#1207)

(read) add ZipIterable, an iterable ZIP reader that doesn't store the archive directory in memory (#1218)

🐛 Bug Fixes

by_name().get_metadata() and by_index().get_metadata() now succeed even when compression method is unsupported (#1228)

⚡ Performance

(read) eliminate redundant pre-scan I/O and atomic contention in par_extract (#1227)

(read) eliminate redundant clone and heap allocations in safe_prepare_path (#1224)

9.1.3 - 2026-10-27

🚀 Features

(extra_fields) support 0xd935 Android ZIP alignment extra field (#928) (#1198)

🐛 Bug Fixes

... (truncated)

Commits

f347dd4 chore: release v9.4.0 (#1269)
e9b7dcd feat: Implement ZipIterable::files_with_reader (#1267)
47765a9 docs(security): Clarify that some "vulnerabilities" are necessary for legitim...
53cfe46 ci(deps): bump useblacksmith/checkout from 1.8.1 to 1.8.2 (#1260)
b66f6b1 ci(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 (#1262)
3dccdf1 ci(deps): bump release-plz/action from 0.5.146 to 0.5.147 (#1261)
dcd8d15 chore: release v9.3.0 (#1259)
1191ea5 feat(write): implement TryFrom<ZipFileBuilder> for PreparedZipFile (#1258)
d1f1ed9 chore: release v9.2.3 (#1257)
2063fdf refactor: Replace std:: with core:: where possible (#1253)
Additional commits viewable in compare view

Updates webbrowser from 1.2.4 to 1.2.6

Release notes

Sourced from webbrowser's releases.

v1.2.6

This is an urgent security fix release for GHSA-j2mc-vg6q-w75p which affects any systems running on WSL2 environment using this crate.

Platforms other than WSL2 are not affected.

Fixed

WSL2: fix command injection vulnerability. See advisory GHSA-j2mc-vg6q-w75p

v1.2.5

Fixed

Windows: use raw-dylib for shlwapi to fix GNU/LLD linking. See #123

Changelog

Sourced from webbrowser's changelog.

[1.2.6] - 2026-10-31

Fixed

WSL2: fix command injection vulnerability. See advisory GHSA-j2mc-vg6q-w75p

[1.2.5] - 2026-10-22

Fixed

Windows: use raw-dylib for shlwapi to fix GNU/LLD linking. See #123

Commits

29065db Release v1.2.6
b68a559 wsl: Fix command injection in WSL browser launch (GHSA-j2mc-vg6q-w75p)
278ec1b Release v1.2.5
19127fc Merge branch 'tasnimjabir-fix/windows-raw-dylib'. See PR #123
da8736f Fix i686 GNU CI runtime setup
98ab38b fix build
96d1973 Fix Windows GNU linking with raw-dylib
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the cargo group with 9 updates in the /rs-cli directory: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.3` | `1.54.1` | | [toml](https://github.com/toml-rs/toml) | `1.1.8+spec-1.1.0` | `1.2.0+spec-1.1.0` | | [aws-config](https://github.com/smithy-lang/smithy-rs) | `1.12.0` | `1.13.0` | | [aws-sdk-s3](https://github.com/awslabs/aws-sdk-rust) | `1.146.1` | `1.157.0` | | [aws-sdk-lambdamicrovms](https://github.com/awslabs/aws-sdk-rust) | `1.8.0` | `1.19.0` | | [aws-sdk-cloudformation](https://github.com/awslabs/aws-sdk-rust) | `1.125.0` | `1.136.0` | | [aws-sdk-sts](https://github.com/awslabs/aws-sdk-rust) | `1.114.0` | `1.126.0` | | [zip](https://github.com/zip-rs/zip2) | `9.0.5` | `9.4.0` | | [webbrowser](https://github.com/amodm/webbrowser-rs) | `1.2.4` | `1.2.6` | Updates `tokio` from 1.53.3 to 1.54.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.3...tokio-1.54.1) Updates `toml` from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0 - [Commits](toml-rs/toml@toml-v1.1.8...toml-v1.2.0) Updates `aws-config` from 1.12.0 to 1.13.0 - [Release notes](https://github.com/smithy-lang/smithy-rs/releases) - [Changelog](https://github.com/smithy-lang/smithy-rs/blob/main/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-rs/commits) Updates `aws-sdk-s3` from 1.146.1 to 1.157.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `aws-sdk-lambdamicrovms` from 1.8.0 to 1.19.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `aws-sdk-cloudformation` from 1.125.0 to 1.136.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `aws-sdk-sts` from 1.114.0 to 1.126.0 - [Release notes](https://github.com/awslabs/aws-sdk-rust/releases) - [Commits](https://github.com/awslabs/aws-sdk-rust/commits) Updates `zip` from 9.0.5 to 9.4.0 - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](zip-rs/zip2@v9.0.5...v9.4.0) Updates `webbrowser` from 1.2.4 to 1.2.6 - [Release notes](https://github.com/amodm/webbrowser-rs/releases) - [Changelog](https://github.com/amodm/webbrowser-rs/blob/main/CHANGELOG.md) - [Commits](amodm/webbrowser-rs@v1.2.4...v1.2.6) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.54.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: toml dependency-version: 1.2.0+spec-1.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: aws-config dependency-version: 1.13.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: aws-sdk-s3 dependency-version: 1.157.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: aws-sdk-lambdamicrovms dependency-version: 1.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: aws-sdk-cloudformation dependency-version: 1.136.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: aws-sdk-sts dependency-version: 1.126.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: zip dependency-version: 9.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: webbrowser dependency-version: 1.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Dependabot: dependencies rust Dependabot: rust labels Nov 13, 2026

Navigation Menu

Repository navigation

deps: bump the cargo group across 1 directory with 9 updates - #93

deps: bump the cargo group across 1 directory with 9 updates#93
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rs-cli/cargo-56ff8c1444

dependabot Bot commented on behalf of github Nov 13, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 13, 2026

Tokio v1.54.1

1.54.1 (October 21st, 2026)

Fixed

Tokio v1.54.0

1.54.0 (October 19th, 2026)

Added

Changed

v9.4.0

🚀 Features

v9.3.0

🚀 Features

v9.2.3

🐛 Bug Fixes

🚜 Refactor

v9.2.2

🚜 Refactor

⚙️ Miscellaneous Tasks

v9.2.1

🚜 Refactor

⚙️ Miscellaneous Tasks

v9.2.0

🚀 Features

🐛 Bug Fixes

9.4.0 - 2026-11-05

🚀 Features

9.3.0 - 2026-11-03

🚀 Features

9.2.3 - 2026-11-03

🚜 Refactor

9.2.2 - 2026-11-01

🚜 Refactor

9.2.0 - 2026-10-31

🚀 Features

🐛 Bug Fixes

⚡ Performance

9.1.3 - 2026-10-27

🚀 Features

🐛 Bug Fixes

v1.2.6

Fixed

v1.2.5

Fixed

[1.2.6] - 2026-10-31

Fixed

[1.2.5] - 2026-10-22

Fixed

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants