build(deps): bump the cargo-minor group across 1 directory with 10 updates by dependabot[bot] · Pull Request #547 · stellar-scaffold/cli

dependabot · 2026-06-19T23:57:44Z

Bumps the cargo-minor group with 10 updates in the / directory:

Package	From	To
tar	`0.4.45`	`0.4.46`
serde_json	`1.0.149`	`1.0.150`
tokio	`1.52.1`	`1.52.3`
ignore	`0.4.25`	`0.4.26`
regex	`1.12.3`	`1.12.4`
assert_cmd	`2.2.1`	`2.2.2`
assert_fs	`1.1.3`	`1.1.4`
uuid	`1.23.1`	`1.23.3`
syn	`2.0.117`	`2.0.118`
reflink-copy	`0.1.29`	`0.1.30`

Updates tar from 0.4.45 to 0.4.46

Release notes

Sourced from tar's releases.

0.4.46

Security

archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by @cgwalters in composefs/tar-rs#454

See also GHSA-3cv2-h65g-fgmm

Other changes

ci: Fix and re-enable reverse dependency testing by @cgwalters in composefs/tar-rs#444

Update astral-tokio-tar requirement from 0.5 to 0.6 by @dependabot[bot] in composefs/tar-rs#446

Update some links by @atouchet in composefs/tar-rs#445

Add support of absolute paths by @zxvfc in composefs/tar-rs#426

docs: Expand notes on concurrent mutations and following symlinks by @cgwalters in composefs/tar-rs#453

Update repo links by @cgwalters in composefs/tar-rs#451

ci: Add crates.io trusted publishing workflow by @cgwalters in composefs/tar-rs#456

Release 0.4.46 by @cgwalters in composefs/tar-rs#455

New Contributors

@dependabot[bot] made their first contribution in composefs/tar-rs#446

@atouchet made their first contribution in composefs/tar-rs#445

@zxvfc made their first contribution in composefs/tar-rs#426

Full Changelog: composefs/tar-rs@0.4.45...0.4.46

Commits

fc459c1 Release 0.4.46
43e05a8 ci: Add crates.io trusted publishing workflow
bba5666 Update repo links
cd94c46 docs: Document TOCTOU / concurrent-mutation threat model
1b4997c builder: Expand docs for follow_symlinks and append_dir_all
bab14dd archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm)
2349b49 Add support of absolute paths
39d0311 Update some links
59d803e Update astral-tokio-tar requirement from 0.5 to 0.6
8296b9a ci: Fix and re-enable reverse dependency testing (#444)
See full diff in compare view

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

Reject non-string enum object keys (#1324, thanks @puneetdixit200)

Commits

a1ae73a Release 1.0.150
1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
2037b63 Reject non-string enum object keys
5d30df6 Resolve manual_assert_eq pedantic clippy lint
dc8003a Raise required compiler for preserve_order feature to 1.85
a42fa98 Unpin CI miri toolchain
684a60e Pin CI miri to nightly-2026-02-11
7c7da33 Raise required compiler to Rust 1.71
acf4850 Simplify Number::is_f64
6b8ceab Resolve unnecessary_map_or clippy lint
Additional commits viewable in compare view

Updates tokio from 1.52.1 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

sync: fix underflow in mpsc channel len() (#8062)

sync: notify receivers in mpsc OwnedPermit::release() method (#8075)

sync: require that an RwLock has max_readers != 0 (#8076)

sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Commits

d875691 chore: prepare Tokio v1.52.3 (#8130)
e1aebb0 Merge 'tokio-1.51.3' into 'tokio-1.52.x' (#8129)
fd63094 chore: prepare Tokio v1.51.3 (#8127)
8c600d0 Merge 'tokio-1.47.5' into 'tokio-1.51.x' (#8123)
11bfc13 chore: prepare Tokio v1.47.5 (#8122)
f085b62 sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
30d25cc sync: require that an RwLock has max_readers != 0 (#8076)
9fccf53 sync: return Empty from try_recv() when mpsc is closed with outstanding p...
ebf61b4 sync: fix underflow in mpsc channel len() (#8062)
4abe9d7 chore: prepare Tokio v1.52.2 (#8115)
Additional commits viewable in compare view

Updates ignore from 0.4.25 to 0.4.26

Commits

82313cf ignore-0.4.26
43e2f08 ignore: fix parent gitignore matching across multiple roots
79a23e0 ignore: use named fields in Ignore
4519153 doc: clarify half-boundary syntax for the -w/--word-regexp flag
cb66736 core: bleat a DEBUG message when RIPGREP_CONFIG_PATH is not set
9b84e15 ignore/types: add container type that covers both Dockerfile and `Contain...
cd1f981 fix: derive Default when possible
See full diff in compare view

Updates regex from 1.12.3 to 1.12.4

Changelog

Sourced from regex's changelog.

1.12.4 (2025-06-09)

This release includes a performance optimization for compilation of regexes with very large character classes.

Improvements:

#1308: Avoid re-canonicalizing the entire interval set when pushing new class ranges.

Commits

7b96fdc 1.12.4
7b89cf0 deps: update to regex-syntax 0.8.11
1401679 regex-syntax-0.8.11
d709000 changelog: 1.12.4
9825c74 syntax: avoid re-canonicalizing the entire IntervalSet on push (#1308)
a7f2ff6 docs: clarify regex-lite word boundaries
2c7b172 docs: clarify unsupported Anchored::Pattern searches
839d16b regex-syntax-0.8.10
c4865a0 syntax: fix negation handling in HIR translation
d8761c0 cargo: also include benches
Additional commits viewable in compare view

Updates assert_cmd from 2.2.1 to 2.2.2

Changelog

Sourced from assert_cmd's changelog.

[2.2.2] - 2026-05-11

Fixes

Ensure #[track_caller] works for better panic messages

Commits

feece89 chore: Release assert_cmd version 2.2.2
367cdf7 docs: Update changelog
a98cc85 Merge pull request #289 from marcospb19/track_caller
cd2e167 fix: .success() not reporting panic location
45a1c74 chore(deps): Update Prek to v0.3.13 (#293)
f1d9b5b chore(deps): Update Prek to v0.3.12 (#292)
1d34bab Merge pull request #291 from epage/template
d9a70ad style: Make clippy happy
4f5b5af chore: Update from _rust template
1e1d586 chore(renovate): Fix the tag
Additional commits viewable in compare view

Updates assert_fs from 1.1.3 to 1.1.4

Changelog

Sourced from assert_fs's changelog.

[1.1.4] - 2026-05-26

Performance

Default to the old tempfile behavior for faster builds

Commits

e943103 chore: Release assert_fs version 1.1.4
cb3f854 docs: Update changelog
6c1f14a Merge pull request #170 from cschwan/remove-default-features-tempfile
ad41375 chore(deps): Update Prek to v0.4.2 (#171)
738e445 Disable default features of tempfile dependency
7a3ec6a chore(deps): Update Prek to v0.4.1 (#168)
a6612ad chore(deps): Update Prek to v0.4.0 (#167)
62c5cd7 chore(deps): Update Prek to v0.3.13 (#166)
0e2bc10 chore(deps): Update Prek to v0.3.12 (#165)
bf08330 Merge pull request #164 from epage/template
Additional commits viewable in compare view

Updates uuid from 1.23.1 to 1.23.3

Release notes

Sourced from uuid's releases.

v1.23.3

What's Changed

Fix up parser panic on empty input by @KodrAus in uuid-rs/uuid#886

Prepare for 1.23.3 release by @KodrAus in uuid-rs/uuid#887

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

What's Changed

Improve error messages for ambiguous formats by @KodrAus in uuid-rs/uuid#882

Prepare for 1.23.2 release by @KodrAus in uuid-rs/uuid#883

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

Commits

20da78b Merge pull request #887 from uuid-rs/cargo/v1.23.3
62232ca prepare for 1.23.3 release
2320c6a Merge pull request #886 from uuid-rs/fix/parser-panics
2d034d4 fix some invalid indexers on error reporting
a8b9f14 update fuzz infra and run in CI
d119657 Merge pull request #883 from uuid-rs/cargo/v1.23.2
0651cfc prepare for 1.23.2 release
e8dea0c Merge pull request #882 from uuid-rs/fix/error-msgs
bdc429a fix up serde messages
d4342e4 make indexes 0 based and fix up more error messages
Additional commits viewable in compare view

Updates syn from 2.0.117 to 2.0.118

Release notes

Sourced from syn's releases.

2.0.118

Documentation improvements

Commits

f033ef1 Release 2.0.118
45f65f7 Wrap long lint attributes
b3f9bf8 Mirror PR 1975 from readme to crate-level rustdoc
97dc117 Wrap PR 1975 to 80 columns
0085b7a Lint repr_transparent_non_zst_fields has been removed
9fc1c9d Update test suite to nightly-2026-06-12
504bcc7 Update test suite to nightly-2026-06-09
353d20b Update test suite to nightly-2026-06-06
f257a16 Update test suite to nightly-2026-05-25
b706e6e Update test suite to nightly-2026-05-13
Additional commits viewable in compare view

Updates reflink-copy from 0.1.29 to 0.1.30

Changelog

Sourced from reflink-copy's changelog.

0.1.30 - 2026-06-18

Other

Fix reflink: copy over permissions (#174)

Commits

897c9ba chore: release v0.1.30 (#175)
5245310 Bump samypr100/setup-dev-drive from 3 to 4 (#147)
8ef7ef4 Fix reflink: copy over permissions (#174)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the cargo-minor group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tar](https://github.com/composefs/tar-rs) | `0.4.45` | `0.4.46` | | [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.150` | | [tokio](https://github.com/tokio-rs/tokio) | `1.52.1` | `1.52.3` | | [ignore](https://github.com/BurntSushi/ripgrep) | `0.4.25` | `0.4.26` | | [regex](https://github.com/rust-lang/regex) | `1.12.3` | `1.12.4` | | [assert_cmd](https://github.com/assert-rs/assert_cmd) | `2.2.1` | `2.2.2` | | [assert_fs](https://github.com/assert-rs/assert_fs) | `1.1.3` | `1.1.4` | | [uuid](https://github.com/uuid-rs/uuid) | `1.23.1` | `1.23.3` | | [syn](https://github.com/dtolnay/syn) | `2.0.117` | `2.0.118` | | [reflink-copy](https://github.com/cargo-bins/reflink-copy) | `0.1.29` | `0.1.30` | Updates `tar` from 0.4.45 to 0.4.46 - [Release notes](https://github.com/composefs/tar-rs/releases) - [Commits](composefs/tar-rs@0.4.45...0.4.46) Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.149...v1.0.150) Updates `tokio` from 1.52.1 to 1.52.3 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.52.1...tokio-1.52.3) Updates `ignore` from 0.4.25 to 0.4.26 - [Release notes](https://github.com/BurntSushi/ripgrep/releases) - [Changelog](https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md) - [Commits](BurntSushi/ripgrep@ignore-0.4.25...ignore-0.4.26) Updates `regex` from 1.12.3 to 1.12.4 - [Release notes](https://github.com/rust-lang/regex/releases) - [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md) - [Commits](rust-lang/regex@1.12.3...1.12.4) Updates `assert_cmd` from 2.2.1 to 2.2.2 - [Changelog](https://github.com/assert-rs/assert_cmd/blob/master/CHANGELOG.md) - [Commits](assert-rs/assert_cmd@v2.2.1...v2.2.2) Updates `assert_fs` from 1.1.3 to 1.1.4 - [Changelog](https://github.com/assert-rs/assert_fs/blob/master/CHANGELOG.md) - [Commits](assert-rs/assert_fs@v1.1.3...v1.1.4) Updates `uuid` from 1.23.1 to 1.23.3 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.23.1...v1.23.3) Updates `syn` from 2.0.117 to 2.0.118 - [Release notes](https://github.com/dtolnay/syn/releases) - [Commits](dtolnay/syn@2.0.117...2.0.118) Updates `reflink-copy` from 0.1.29 to 0.1.30 - [Release notes](https://github.com/cargo-bins/reflink-copy/releases) - [Changelog](https://github.com/cargo-bins/reflink-copy/blob/main/CHANGELOG.md) - [Commits](cargo-bins/reflink-copy@v0.1.29...v0.1.30) --- updated-dependencies: - dependency-name: tar dependency-version: 0.4.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: tokio dependency-version: 1.52.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: ignore dependency-version: 0.4.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: regex dependency-version: 1.12.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: assert_cmd dependency-version: 2.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: assert_fs dependency-version: 1.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: uuid dependency-version: 1.23.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: syn dependency-version: 2.0.118 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor - dependency-name: reflink-copy dependency-version: 0.1.30 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo-minor ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-06-19T23:58:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Vulnerability	Quality
cargo/tokio@1.52.1 ⏵ 1.52.3
cargo/assert_cmd@2.2.1 ⏵ 2.2.2
cargo/serde_json@1.0.149 ⏵ 1.0.150
cargo/assert_fs@1.1.3 ⏵ 1.1.4		⁺⁴
cargo/ignore@0.4.25 ⏵ 0.4.26
cargo/reflink-copy@0.1.29 ⏵ 0.1.30
cargo/regex@1.12.3 ⏵ 1.12.4
cargo/tar@0.4.45 ⏵ 0.4.46	⁺²
cargo/uuid@1.23.1 ⏵ 1.23.3
cargo/syn@2.0.117 ⏵ 2.0.118

View full report

socket-security · 2026-06-19T23:58:25Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo `tokio` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Cargo.lock → `cargo/tokio@1.52.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/tokio@1.52.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot · 2026-06-26T23:57:20Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Jun 19, 2026

dependabot Bot closed this Jun 26, 2026

dependabot Bot deleted the dependabot/cargo/cargo-minor-647785e72b branch June 26, 2026 23:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the cargo-minor group across 1 directory with 10 updates#547

build(deps): bump the cargo-minor group across 1 directory with 10 updates#547
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-minor-647785e72b

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 19, 2026

Uh oh!

socket-security Bot commented Jun 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.4.46

Security

Other changes

New Contributors

v1.0.150

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

Tokio v1.52.2

1.52.2 (May 4th, 2026)

1.12.4 (2025-06-09)

[2.2.2] - 2026-05-11

Fixes

[1.1.4] - 2026-05-26

Performance

v1.23.3

What's Changed

v1.23.2

What's Changed

2.0.118

0.1.30 - 2026-06-18

Other

Uh oh!

socket-security Bot commented Jun 19, 2026

Uh oh!

socket-security Bot commented Jun 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jun 19, 2026 •

edited

Loading