Skip to content

build(deps): bump the rust-dependencies group across 1 directory with 3 updates - #15

Merged
ShiroKSH merged 4 commits into
masterfrom
dependabot/cargo/rust-dependencies-76d299fc08
Aug 12, 2026
Merged

build(deps): bump the rust-dependencies group across 1 directory with 3 updates#15
ShiroKSH merged 4 commits into
masterfrom
dependabot/cargo/rust-dependencies-76d299fc08

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group with 3 updates in the / directory: base64, ureq and zip.

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates ureq from 3.3.0 to 3.4.0

Changelog

Sourced from ureq's changelog.

3.4.0

  • Seal RequestExt (technically breaking) #1189
  • Send canonical Basic authentication scheme to CONNECT proxies #1185
  • Establish target TLS through HTTPS CONNECT proxies #1183
  • Update rustls-platform-verifier to 0.7.0 #1174
  • Fix pooled connections never aging out according to max_idle_age #1172
  • Strip brackets from IPv6-literal hosts before TLS SNI/ServerName #1171
  • RequestExt::middleware_config for conf inside middleware #1169
Commits

Updates zip from 6.0.0 to 8.6.0

Release notes

Sourced from zip's releases.

v8.6.0

🚀 Features

  • add compression not supported as enum error (#774)

🐛 Bug Fixes

  • allow for [u8] as filename (#775)

🚜 Refactor

  • mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
  • use and simplify is_dir (#776)

v8.5.1

🚜 Refactor

  • change magic finder to stack buffer (#763)
  • simplify extra field parsing (#764)

v8.5.0

🐛 Bug Fixes

  • remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

  • remove useless magic in struct (#730)
  • change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

  • cleanup README (#758)

v8.4.0

🚀 Features

  • add a check for building benches (#748)

🚜 Refactor

  • split part of read.rs for code readability (#744)
  • remove unused allow (#745)

⚡ Performance

  • skip BufReader for Stored files in make_reader (#739)

⚙️ Miscellaneous Tasks

... (truncated)

Changelog

Sourced from zip's changelog.

8.6.0 - 2026-04-25

🚀 Features

  • add compression not supported as enum error (#774)

🐛 Bug Fixes

  • allow for [u8] as filename (#775)

🚜 Refactor

  • mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
  • use and simplify is_dir (#776)

8.5.1 - 2026-04-06

🚜 Refactor

  • change magic finder to stack buffer (#763)
  • simplify extra field parsing (#764)

8.5.0 - 2026-04-01

🐛 Bug Fixes

  • remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

  • remove useless magic in struct (#730)
  • change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

  • cleanup README (#758)

8.4.0 - 2026-03-23

🚀 Features

  • add a check for building benches (#748)

🚜 Refactor

  • split part of read.rs for code readability (#744)
  • remove unused allow (#745)

⚡ Performance

... (truncated)

Commits
  • 771dfc5 chore: release v8.6.0 (#781)
  • 8e480cc chore(deps): update sha1 requirement from 0.10 to 0.11 (#767)
  • 2513bbe chore(deps): update aes requirement from 0.8 to 0.9 (#787)
  • 957e240 ci(deps): bump actions/cache from 5.0.4 to 5.0.5 (#786)
  • 0329d9d fix: allow for [u8] as filename (#775)
  • ddcf854 ci(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#788)
  • 42323a8 ci(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 (#785)
  • 901014a ci(deps): bump crate-ci/typos from 1.45.0 to 1.45.1 (#784)
  • 07702d4 feat: add compression not supported as enum error (#774)
  • 2d0c46b ci(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#783)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the rust-dependencies group across 1 directory with…
5bd409c 
… 3 updates

Bumps the rust-dependencies group with 3 updates in the / directory: [base64](https://github.com/marshallpierce/rust-base64), [ureq](https://github.com/algesten/ureq) and [zip](https://github.com/zip-rs/zip2).


Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `ureq` from 3.3.0 to 3.4.0
- [Changelog](https://github.com/algesten/ureq/blob/main/CHANGELOG.md)
- [Commits](algesten/ureq@3.3.0...3.4.0)

Updates `zip` from 6.0.0 to 8.6.0
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v6.0.0...v8.6.0)

---
updated-dependencies:
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: ureq
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: zip
  dependency-version: 8.6.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Dependency updates and supply-chain maintenance rust Pull requests that update rust code labels Aug 12, 2026
@dependabot
dependabot Bot requested a review from ShiroKSH as a code owner August 12, 2026 20:05
@dependabot dependabot Bot added the dependencies Dependency updates and supply-chain maintenance label Aug 12, 2026
@dependabot
dependabot Bot requested a review from Anerson-Auf as a code owner August 12, 2026 20:05
@dependabot dependabot Bot added the rust Pull requests that update rust code label Aug 12, 2026
ShiroKSH
ShiroKSH requested changes Aug 12, 2026
View reviewed changes

@ShiroKSH ShiroKSH left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Author context: Dependabot automated maintenance bot; no human contributor history applicable.

Changes requested. Zip 8 changes data_start to return an optional offset, but the artifact validators still use it as a u64. The current head fails to compile in crates/rustferry-github/src/artifact.rs at lines 943 and 1788, artifact_offline.rs at lines 606 and 610, and artifact_store.rs at line 783. CI, platform artifacts, and the Linux extension fixture all fail as a result.

Keep the Zip dependency on the compatible major version, or update every archive validation path to reject a missing offset as an invalid archive and add coverage for that case. These validators form part of the untrusted-archive boundary, so an unwrap or default value would not be an acceptable migration.

ShiroKSH
ShiroKSH previously approved these changes Aug 12, 2026
View reviewed changes

@ShiroKSH ShiroKSH left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. The follow-up handles the optional Zip 8 data offset before archive-range arithmetic, mapping an unavailable offset to the existing invalid-archive errors. That preserves fail-closed behavior at the untrusted-archive boundary. The affected crate passed its all-features check and 339 unit tests locally.

@ShiroKSH
ShiroKSH enabled auto-merge (squash) August 12, 2026 21:03
ShiroKSH
ShiroKSH approved these changes Aug 12, 2026
View reviewed changes

@ShiroKSH ShiroKSH left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. The follow-up regenerates the reviewed Cargo dependency inventory for the new lockfile. The complete license check passes with the refreshed inventory.

@ShiroKSH
ShiroKSH merged commit f53a936 into master Aug 12, 2026
25 of 26 checks passed
@ShiroKSH
ShiroKSH deleted the dependabot/cargo/rust-dependencies-76d299fc08 branch August 12, 2026 22:10
@ShiroKSH ShiroKSH mentioned this pull request Aug 12, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ShiroKSH ShiroKSH ShiroKSH approved these changes
@Anerson-Auf Anerson-Auf Awaiting requested review from Anerson-Auf Anerson-Auf is a code owner

Assignees

No one assigned

Labels

dependencies Dependency updates and supply-chain maintenance rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ShiroKSH