[dependabot]

Bumps actix-web from 4.18.1 to 4.18.2.

Release notes

Sourced from actix-web's releases.

actix-web: v4.18.2

• Increase the default form payload limit to 32 KiB.
• Bound decompressed request payloads using the same configured size limits for form, JSON, bytes, and string extractors. GHSA-qph8-7859-gq2f
• Add UrlencodedError::OverflowUnknownLength error enum variant for form payloads that exceed the limit while streaming.
• Add a UTF-8 encoded filename* parameter in ContentDisposition::attachment() for non-ASCII filenames.
• Return 405 with an Allow header from the built-in app default when method guards reject matching resources, including macro routes.

Commits

• d51138c chore(actix-web): prepare release 4.18.2
• dd8342b chore(actix-http): prepare release 3.20.1
• 0d0be61 fix(web): bound decompressed request payloads
• 41b54d2 fix(actix-http): add Decoder::limit()
• 036c0f4 chore(actix-multipart): prepare release 0.8.6
• 3396bd8 fix(multipart): keep bare CR before boundary text as field data (#4376)
• 41687b5 build(deps): bump useblacksmith/checkout from 1.8.1 to 1.8.2 (#4382)
• 45d9858 build(deps): bump taiki-e/install-action from 2.87.31 to 2.89.0 (#4383)
• c843c64 build(deps): bump local-waker from 0.1.4 to 0.1.5 (#4384)
• 0e93068 build(deps): bump log from 0.4.34 to 0.4.35 (#4385)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codspeed]

Merging this PR will degrade performance by 16.03%

1 warning

⚠️ 4 benchmarks with a significant change ran in a different software environment

Their base and head results were measured with a different OS or toolchain, such as compiler, runtime or library versions, so the changes might come from this difference rather than from the code. Open an affected benchmark to see what changed.

See affected benchmarks

⚡ 1 improved benchmark
❌ 3 regressed benchmarks
✅ 132 untouched benchmarks
⏩ 68 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Walltime	encode_stream_body[(1024, 1)]	1.2 µs	2.1 µs	-42.55%
❌	Walltime	encode_receiver_body[(1024, 1)]	2.1 µs	2.7 µs	-21.6%
❌	Walltime	decode_fragmented_message[(32, 7)]	1.4 µs	1.6 µs	-15.57%
⚡	Walltime	encode_receiver_body[(32, 1)]	1.8 µs	1.4 µs	+30.75%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing dependabot/cargo/actix-web-4.18.2 (df4d684) with main (d14247a)}

Footnotes

1. 68 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩