Skip to content

chore(deps): bump the cargo-dependencies group with 5 updates - #281

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-8d0cb6826c
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-dependencies-8d0cb6826c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo-dependencies group with 5 updates:

Package From To
reqwest 0.13.3 0.13.5
uuid 1.20.0 1.26.1
backtrace 0.3.74 0.3.76
sha1 0.10.7 0.11.0
axum 0.8.8 0.8.9

Updates reqwest from 0.13.3 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

v0.13.4

tl;dr

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.5

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

v0.13.4

  • Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
  • Add ClientBuilder::http2_keep_alive_* options for the blocking client.
  • Add TLS 1.3 support when using native-tls backend.
  • Fix redirect handling to strip sensitive headers when the scheme changes.
  • Fix HTTP/3 happy-eyeball connection creation.
  • Upgrade hickory-resolver to 0.26.
Commits
  • de55373 v0.13.5
  • 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
  • 9f06fd2 docs: improve description of JSON method (#3082)
  • 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
  • ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
  • 4e9a3c7 chore: add pull request template for human-written content
  • 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
  • 221abe9 chore: Remove unnecessary clones and a cast (#3071)
  • 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
  • fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
  • Additional commits viewable in compare view

Updates uuid from 1.20.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

... (truncated)

Commits
  • 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
  • d4df8f0 prepare for 1.26.1 release
  • 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
  • fda00eb don't panic in overflowing Timestamp to SystemTime conversion
  • c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
  • ac065a6 Align the counter diagram
  • 34ec102 Seat the v7 counter below the version nibble
  • cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
  • 34e4f49 don't test macros under miri
  • d9e7242 update nightly used for miri
  • Additional commits viewable in compare view

Updates backtrace from 0.3.74 to 0.3.76

Release notes

Sourced from backtrace's releases.

backtrace-v0.3.76

Behavior

  • Fix inverted polarity of "full printing" logic in rust-lang/backtrace-rs#726: Previously we used to do the opposite of what you would expect.

Platform Support

Dependencies

Changelog

Sourced from backtrace's changelog.

0.3.76 - 2025-09-26

Behavior

  • Fix inverted polarity of "full printing" logic in rust-lang/backtrace-rs#726: Previously we used to do the opposite of what you would expect.

Platform Support

Dependencies

Commits
  • 775f6a1 modify CHANGELOG.md to not be a git log dump
  • bb0cdc3 chore: release v0.3.76
  • a8b55f0 Merge of rust-lang/backtrace-rs#725: Fix missing alignment check for ELF note...
  • 0b83800 Expand take_nhdr doc-comment
  • a405950 Merge pull request #737 from workingjubilee/address-dbghelp-soundness-risks
  • 06dca9a Expand doc-comment on do_resolve
  • 05ad047 Remove padding bytes risk in dbghelp with MaybeUninit
  • dccdb4d Upgrade cpp_demanglerust-lang/backtrace-rs#732
  • 50fe434rust-lang/backtrace-rs#734
  • 79d3514 Switch from windows-targets to windows-linkrust-lang/backtrace-rs#727
  • Additional commits viewable in compare view

Updates sha1 from 0.10.7 to 0.11.0

Commits

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the cargo-dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.3` | `0.13.5` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.20.0` | `1.26.1` |
| [backtrace](https://github.com/rust-lang/backtrace-rs) | `0.3.74` | `0.3.76` |
| [sha1](https://github.com/RustCrypto/hashes) | `0.10.7` | `0.11.0` |
| [axum](https://github.com/tokio-rs/axum) | `0.8.8` | `0.8.9` |


Updates `reqwest` from 0.13.3 to 0.13.5
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.13.3...v0.13.5)

Updates `uuid` from 1.20.0 to 1.26.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.20.0...v1.26.1)

Updates `backtrace` from 0.3.74 to 0.3.76
- [Release notes](https://github.com/rust-lang/backtrace-rs/releases)
- [Changelog](https://github.com/rust-lang/backtrace-rs/blob/master/CHANGELOG.md)
- [Commits](rust-lang/backtrace-rs@0.3.74...backtrace-v0.3.76)

Updates `sha1` from 0.10.7 to 0.11.0
- [Commits](RustCrypto/hashes@sha1-v0.10.7...sha1-v0.11.0)

Updates `axum` from 0.8.8 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.8.8...axum-v0.8.9)

---
updated-dependencies:
- dependency-name: reqwest
  dependency-version: 0.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: uuid
  dependency-version: 1.26.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: backtrace
  dependency-version: 0.3.76
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
- dependency-name: sha1
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: cargo-dependencies
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 9, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 9, 2026 04:44
@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

posthog-rs-v0 Compliance Report

Date: 2026-10-09 04:47:51 UTC
Duration: 15551ms

✅ All Tests Passed!

46/46 tests passed


Capture Tests

✅ 29/29 tests passed

View Details
Test Status Duration
Format Validation.Event Has Required Fields ✅ 127ms
Format Validation.Event Has Uuid ✅ 139ms
Format Validation.Event Has Lib Properties ✅ 139ms
Format Validation.Distinct Id Is String ✅ 139ms
Format Validation.Token Is Present ✅ 138ms
Format Validation.Custom Properties Preserved ✅ 138ms
Format Validation.Event Has Timestamp ✅ 139ms
Retry Behavior.Retries On 503 ✅ 5140ms
Retry Behavior.Does Not Retry On 400 ✅ 2140ms
Retry Behavior.Does Not Retry On 401 ✅ 2144ms
Retry Behavior.Respects Retry After Header ✅ 5115ms
Retry Behavior.Implements Backoff ✅ 15104ms
Retry Behavior.Retries On 500 ✅ 5103ms
Retry Behavior.Retries On 502 ✅ 5101ms
Retry Behavior.Retries On 504 ✅ 5101ms
Retry Behavior.Max Retries Respected ✅ 15103ms
Deduplication.Generates Unique Uuids ✅ 107ms
Deduplication.Preserves Uuid On Retry ✅ 5024ms
Deduplication.Preserves Uuid And Timestamp On Retry ✅ 10035ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5038ms
Deduplication.No Duplicate Events In Batch ✅ 28ms
Deduplication.Different Events Have Different Uuids ✅ 25ms
Compression.Sends Gzip When Enabled ✅ 24ms
Batch Format.Uses Proper Batch Structure ✅ 27ms
Batch Format.Flush With No Events Sends Nothing ✅ 71ms
Batch Format.Multiple Events Batched Together ✅ 132ms
Error Handling.Does Not Retry On 403 ✅ 2077ms
Error Handling.Does Not Retry On 413 ✅ 2096ms
Error Handling.Retries On 408 ✅ 5102ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 71ms
Request Payload.Flags Request Uses V2 Query Param ✅ 46ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 33ms
Request Payload.Flags Request Omits Authorization Header ✅ 31ms
Request Payload.Token In Flags Body Matches Init ✅ 56ms
Request Payload.Groups Round Trip ✅ 42ms
Request Payload.Groups Default To Empty Object ✅ 46ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 32ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 41ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 38ms
Request Lifecycle.No Flags Request On Init Alone ✅ 33ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 55ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 55ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 42ms
Retry Behavior.Retries Flags On 502 ✅ 232ms
Retry Behavior.Retries Flags On 504 ✅ 245ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 50ms

@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

posthog-rs-v1 Compliance Report

Date: 2026-10-09 04:48:11 UTC
Duration: 22636ms

✅ All Tests Passed!

111/111 tests passed


Capture_V1 Tests

✅ 94/94 tests passed

View Details
Test Status Duration
Endpoint And Method.Targets V1 Endpoint ✅ 110ms
Endpoint And Method.Does Not Use Legacy Endpoints ✅ 109ms
Required Headers.Has Authorization Bearer Header ✅ 103ms
Required Headers.Has Content Type Json ✅ 109ms
Required Headers.Has Posthog Sdk Info Format ✅ 102ms
Required Headers.Has Posthog Attempt Header ✅ 109ms
Required Headers.Has Posthog Request Id ✅ 109ms
Required Headers.Has Posthog Request Timestamp ✅ 102ms
Required Headers.Has User Agent ✅ 107ms
Body Format.Body Has Created At And Batch ✅ 108ms
Body Format.No Api Key In Body ✅ 94ms
Body Format.No Sent At In Body ✅ 94ms
Event Format.Event Has Required Root Fields ✅ 94ms
Event Format.Event Uuid Is Valid ✅ 89ms
Event Format.Event Timestamp Is Rfc3339 ✅ 88ms
Event Format.Distinct Id Is String ✅ 88ms
Event Format.Distinct Id At Root Not Properties ✅ 88ms
Event Format.Custom Properties Preserved ✅ 87ms
Event Format.Set Properties Preserved ✅ 87ms
Event Format.Set Once Properties Preserved ✅ 90ms
Event Format.Groups Properties Preserved ✅ 81ms
Event Format.Sdk Generates Uuid If Not Provided ✅ 88ms
Event Format.Event Has Required Root Fields Batch ✅ 107ms
Event Format.Event Uuid Is Valid Batch ✅ 103ms
Event Format.Event Timestamp Is Rfc3339 Batch ✅ 102ms
Event Format.Distinct Id Is String Batch ✅ 102ms
Event Format.Distinct Id At Root Not Properties Batch ✅ 107ms
Event Format.Custom Properties Preserved Batch ✅ 102ms
Event Format.Set Properties Preserved Batch ✅ 102ms
Event Format.Set Once Properties Preserved Batch ✅ 129ms
Event Format.Groups Properties Preserved Batch ✅ 98ms
Event Format.Sdk Generates Uuid If Not Provided Batch ✅ 102ms
Batch Behavior.Multiple Events In Single Batch ✅ 143ms
Batch Behavior.Batch Envelope Smoke ✅ 93ms
Batch Behavior.Flush With No Events Sends Nothing ✅ 44ms
Batch Behavior.Flush At Triggers Batch ✅ 1095ms
Batch Behavior.Created At Reflects Batch Creation Time ✅ 86ms
Deduplication.Generates Unique Uuids ✅ 138ms
Deduplication.Different Events Same Content Different Uuids ✅ 86ms
Deduplication.Preserves Uuid On Retry ✅ 5070ms
Deduplication.Preserves Timestamp On Retry ✅ 5063ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5070ms
Deduplication.No Duplicate Events In Batch ✅ 88ms
Header Behavior On Retry.Attempt Header Starts At One ✅ 50ms
Header Behavior On Retry.Attempt Header Increments On Retry ✅ 10053ms
Header Behavior On Retry.Request Id Preserved On Retry ✅ 5054ms
Header Behavior On Retry.Different Requests Have Different Request Ids ✅ 2039ms
Header Behavior On Retry.Request Timestamp Changes On Retry ✅ 5032ms
Response Format Validation.Success Response Has Uuid Keyed Results ✅ 37ms
Response Format Validation.Success Response Has Ok For Each Event ✅ 23ms
Response Format Validation.Success No Retry After When All Ok ✅ 21ms
Response Format Validation.Success Retry After Present When Retry Events ✅ 22ms
Response Format Validation.Success No Retry After When Drop Only ✅ 23ms
Response Format Validation.Response Echoes Request Id ✅ 20ms
Retry Behavior.Retries On 408 ✅ 5022ms
Retry Behavior.Retries On 500 ✅ 5017ms
Retry Behavior.Retries On 503 ✅ 5019ms
Retry Behavior.Retries On 504 ✅ 5017ms
Retry Behavior.Retryable Errors Have Retry After ✅ 2022ms
Retry Behavior.Respects Retry After On Retryable Error ✅ 8018ms
Retry Behavior.Does Not Retry On 400 ✅ 2022ms
Retry Behavior.Does Not Retry On 401 ✅ 2028ms
Retry Behavior.Does Not Retry On 402 ✅ 2016ms
Retry Behavior.Does Not Retry On 413 ✅ 2017ms
Retry Behavior.Does Not Retry On 415 ✅ 2017ms
Retry Behavior.Non Retryable Errors Have No Retry After ✅ 2018ms
Retry Behavior.Implements Backoff ✅ 15024ms
Retry Behavior.Max Retries Respected ✅ 15019ms
Partial Batch Handling.Handles 200 Full Success ✅ 2017ms
Partial Batch Handling.Handles 200 With All Ok ✅ 3022ms
Partial Batch Handling.Does Not Retry Dropped Events ✅ 3022ms
Partial Batch Handling.Does Not Retry Limited Events ✅ 3017ms
Partial Batch Handling.Prunes Ok Events On Partial Retry ✅ 5017ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry ✅ 5018ms
Partial Batch Handling.Retries Only Retry Events From Partial ✅ 5020ms
Partial Batch Handling.Partial Retry Preserves Uuids ✅ 5018ms
Partial Batch Handling.Partial Retry Attempt Header Increments ✅ 5020ms
Partial Batch Handling.Partial Retry Request Id Preserved ✅ 5021ms
Partial Batch Handling.Respects Retry After On Partial ✅ 5017ms
Partial Batch Handling.Unknown Result Treated As Terminal ✅ 3018ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry ✅ 3019ms
Compression.Sends Gzip Content Encoding ✅ 15ms
Compression.No Content Encoding When Disabled ✅ 15ms
Compression.Compressed Body Is Decompressible ✅ 15ms
Error Handling.Does Not Retry On Unknown 4Xx ✅ 2017ms
Event Options.Cookieless Mode Override ✅ 17ms
Event Options.Disable Skew Correction Override ✅ 16ms
Event Options.Process Person Profile Override ✅ 15ms
Event Options.Product Tour Id Override ✅ 15ms
Event Options.Unset Options Omitted ✅ 15ms
Event Options.Options Override In Batch ✅ 15ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties ✅ 15ms
Geoip And Historical Migration.Historical Migration Set In Body ✅ 15ms
Geoip And Historical Migration.Historical Migration Absent By Default ✅ 15ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 9ms
Request Payload.Flags Request Uses V2 Query Param ✅ 11ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 11ms
Request Payload.Flags Request Omits Authorization Header ✅ 9ms
Request Payload.Token In Flags Body Matches Init ✅ 10ms
Request Payload.Groups Round Trip ✅ 10ms
Request Payload.Groups Default To Empty Object ✅ 10ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 11ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 9ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 11ms
Request Lifecycle.No Flags Request On Init Alone ✅ 7ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 15ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 12ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 10ms
Retry Behavior.Retries Flags On 502 ✅ 216ms
Retry Behavior.Retries Flags On 504 ✅ 219ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 15ms

@ioannisj

Copy link
Copy Markdown
Contributor

Closing this one. Four of the five bumps need a newer Rust than the 1.78 we still support, so both MSRV checks fail (cargo 1.78 can't parse the edition 2024 manifest of sha1 0.11.0):

  • sha1 0.11 and the digest 0.11 family it pulls in: 1.85, edition 2024
  • reqwest 0.13.4+: 1.85
  • uuid 1.21+ (plus getrandom 0.4): 1.85
  • backtrace 0.3.75+: 1.82

axum 0.8.9 is fine (needs 1.80, and it's only used by the compliance adapter), so it can come back in the next group. No security advisory affects the versions we have locked, so we don't lose a security fix by skipping these.

Same reason as #283 and the earlier sha1 closes in #211, #214 and #217. We can pick these up if we ever raise the MSRV.

@ioannisj ioannisj closed this Oct 12, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/cargo/cargo-dependencies-8d0cb6826c branch October 12, 2026 17:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant