Skip to content

build(deps): bump the cargo group with 13 updates#113

Merged
jaudiger merged 1 commit intomainfrom
dependabot/cargo/cargo-6100d9532c
Feb 9, 2026
Merged

build(deps): bump the cargo group with 13 updates#113
jaudiger merged 1 commit intomainfrom
dependabot/cargo/cargo-6100d9532c

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 8, 2026

Bumps the cargo group with 13 updates:

Package From To
brioche-pack 024349f 184db8e
clap 4.5.56 4.5.57
schemars 1.2.0 1.2.1
clap_builder 4.5.56 4.5.57
memchr 2.7.6 2.8.0
psm 0.1.29 0.1.30
schemars_derive 1.2.0 1.2.1
stacker 0.1.22 0.1.23
time 0.3.46 0.3.47
time-macros 0.2.26 0.2.27
zerocopy 0.8.37 0.8.39
zerocopy-derive 0.8.37 0.8.39
zmij 1.0.18 1.0.19

Updates brioche-pack from 024349f to 184db8e

Commits

Updates clap from 4.5.56 to 4.5.57

Release notes

Sourced from clap's releases.

v4.5.57

[4.5.57] - 2026-02-03

Fixes

  • Regression from 4.5.55 where having an argument with .value_terminator("--") caused problems with an argument with .last(true)
Changelog

Sourced from clap's changelog.

[4.5.57] - 2026-02-03

Fixes

  • Regression from 4.5.55 where having an argument with .value_terminator("--") caused problems with an argument with .last(true)
Commits
  • 69c0ddb chore: Release
  • 8206bba docs: Update changelog
  • c109d67 Merge pull request #6104 from epage/hide
  • 9d7f212 fix(complete): Hide dot files on dynamic completer
  • 77b3fdb test(complete): Show dot file behavior
  • f89b9b8 test(derive): Make stable across upgrade
  • 58eb8a9 chore: Release
  • 10a2a75 docs: Update changelog
  • a42eebf Merge pull request #6103 from epage/mut_subcommands
  • 5335f54 feat: Add Command::mut_subcommands
  • Additional commits viewable in compare view

Updates schemars from 1.2.0 to 1.2.1

Release notes

Sourced from schemars's releases.

v1.2.1

Fixed

  • transform attributes are now applied after the schema is otherwise fully constructed. In particular, they're now applied after all other attributes are processed. (GREsau/schemars#505)
Changelog

Sourced from schemars's changelog.

[1.2.1] - 2026-02-01

Fixed

  • transform attributes are now applied after the schema is otherwise fully constructed. In particular, they're now applied after all other attributes are processed. (GREsau/schemars#505)
Commits

Updates clap_builder from 4.5.56 to 4.5.57

Release notes

Sourced from clap_builder's releases.

v4.5.57

[4.5.57] - 2026-02-03

Fixes

  • Regression from 4.5.55 where having an argument with .value_terminator("--") caused problems with an argument with .last(true)
Changelog

Sourced from clap_builder's changelog.

[4.5.57] - 2026-02-03

Fixes

  • Regression from 4.5.55 where having an argument with .value_terminator("--") caused problems with an argument with .last(true)
Commits
  • 48c3b11 chore: Release
  • 4589490 docs: Update changelog
  • 78a7962 Merge pull request #6243 from epage/term
  • 21828f4 Merge pull request #6245 from epage/complete
  • b8c9ad5 test(complete): Update for new versions
  • 54f1ab8 Merge pull request #6244 from epage/typo
  • c40ad5c docs: Fix a typo
  • af904ae fix(parser): Resolve regression with value_terminator/last
  • 36eb896 test(parser): Add basic cases for value_terminator
  • 24cbf68 test(parser): Add cases for value_terminator and last
  • Additional commits viewable in compare view

Updates memchr from 2.7.6 to 2.8.0

Commits
  • 886ca4c 2.8.0
  • 7de50d0 memmem: add owned finder constructor variants
  • 1230fc5 benchmarks: fix date in file name
  • 43300c6 benchmarks: add latest x86-64 benchmark results
  • 9bf2301 benchmarks: update everything
  • See full diff in compare view

Updates psm from 0.1.29 to 0.1.30

Commits

Updates schemars_derive from 1.2.0 to 1.2.1

Release notes

Sourced from schemars_derive's releases.

v1.2.1

Fixed

  • transform attributes are now applied after the schema is otherwise fully constructed. In particular, they're now applied after all other attributes are processed. (GREsau/schemars#505)
Changelog

Sourced from schemars_derive's changelog.

[1.2.1] - 2026-02-01

Fixed

  • transform attributes are now applied after the schema is otherwise fully constructed. In particular, they're now applied after all other attributes are processed. (GREsau/schemars#505)
Commits

Updates stacker from 0.1.22 to 0.1.23

Commits

Updates time from 0.3.46 to 0.3.47

Release notes

Sourced from time's releases.

v0.3.47

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.47 [2026-02-05]

Security

  • The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit.

    This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

  • Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

  • Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually.
  • date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
  • [end] now has a trailing_input modifier which can either be prohibit (the default) or discard. When it is discard, all remaining input is ignored. Note that if there are components after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

  • More performance gains when parsing.

Fixed

  • If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct.
  • The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users.
Commits
  • d5144cd v0.3.47 release
  • f6206b0 Guard against integer overflow in release mode
  • 1c63dc7 Avoid denial of service when parsing Rfc2822
  • 5940df6 Add builder methods to avoid verbose construction
  • 00881a4 Manually format macros everywhere
  • bb723b6 Add trailing_input modifier to end
  • 31c4f8e Permit W12 in date! macro
  • 490a17b Mark error paths in well-known formats as cold
  • 6cb1896 Optimize Rfc2822 parsing
  • 6d264d5 Remove erroneous #[inline(never)] attributes
  • Additional commits viewable in compare view

Updates time-macros from 0.2.26 to 0.2.27

Changelog

Sourced from time-macros's changelog.

Changelog

All notable changes to the time project will be documented in this file.

The format is based on [Keep a Changelog]. This project adheres to [Semantic Versioning].

0.3.47 [2026-02-05]

Security

  • The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit.

    This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

  • Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

  • Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually.
  • date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
  • [end] now has a trailing_input modifier which can either be prohibit (the default) or discard. When it is discard, all remaining input is ignored. Note that if there are components after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

  • More performance gains when parsing.

Fixed

  • If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct.
  • The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users.

0.3.46 [2026-01-23]

... (truncated)

Commits

Updates zerocopy from 0.8.37 to 0.8.39

Release notes

Sourced from zerocopy's releases.

v0.8.39

What's Changed

Full Changelog: google/zerocopy@v0.8.38...v0.8.39

v0.8.38

What's Changed

Full Changelog: google/zerocopy@v0.8.37...v0.8.38

Commits

Updates zerocopy-derive from 0.8.37 to 0.8.39

Release notes

Sourced from zerocopy-derive's releases.

v0.8.39

What's Changed

Full Changelog: google/zerocopy@v0.8.38...v0.8.39

v0.8.38

What's Changed

Full Changelog: google/zerocopy@v0.8.37...v0.8.38

Commits

Updates zmij from 1.0.18 to 1.0.19

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the cargo group with 13 updates
1b9eb8a 
Bumps the cargo group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [brioche-pack](https://github.com/brioche-dev/brioche) | ``024349f`` | ``184db8e`` |
| [clap](https://github.com/clap-rs/clap) | `4.5.56` | `4.5.57` |
| [schemars](https://github.com/GREsau/schemars) | `1.2.0` | `1.2.1` |
| [clap_builder](https://github.com/clap-rs/clap) | `4.5.56` | `4.5.57` |
| [memchr](https://github.com/BurntSushi/memchr) | `2.7.6` | `2.8.0` |
| [psm](https://github.com/rust-lang/stacker) | `0.1.29` | `0.1.30` |
| [schemars_derive](https://github.com/GREsau/schemars) | `1.2.0` | `1.2.1` |
| [stacker](https://github.com/rust-lang/stacker) | `0.1.22` | `0.1.23` |
| [time](https://github.com/time-rs/time) | `0.3.46` | `0.3.47` |
| [time-macros](https://github.com/time-rs/time) | `0.2.26` | `0.2.27` |
| [zerocopy](https://github.com/google/zerocopy) | `0.8.37` | `0.8.39` |
| [zerocopy-derive](https://github.com/google/zerocopy) | `0.8.37` | `0.8.39` |
| [zmij](https://github.com/dtolnay/zmij) | `1.0.18` | `1.0.19` |


Updates `brioche-pack` from `024349f` to `184db8e`
- [Release notes](https://github.com/brioche-dev/brioche/releases)
- [Commits](brioche-dev/brioche@024349f...184db8e)

Updates `clap` from 4.5.56 to 4.5.57
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@clap_complete-v4.5.56...clap_complete-v4.5.57)

Updates `schemars` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/GREsau/schemars/releases)
- [Changelog](https://github.com/GREsau/schemars/blob/master/CHANGELOG.md)
- [Commits](GREsau/schemars@v1.2.0...v1.2.1)

Updates `clap_builder` from 4.5.56 to 4.5.57
- [Release notes](https://github.com/clap-rs/clap/releases)
- [Changelog](https://github.com/clap-rs/clap/blob/master/CHANGELOG.md)
- [Commits](clap-rs/clap@v4.5.56...v4.5.57)

Updates `memchr` from 2.7.6 to 2.8.0
- [Commits](BurntSushi/memchr@2.7.6...2.8.0)

Updates `psm` from 0.1.29 to 0.1.30
- [Commits](https://github.com/rust-lang/stacker/commits)

Updates `schemars_derive` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/GREsau/schemars/releases)
- [Changelog](https://github.com/GREsau/schemars/blob/master/CHANGELOG.md)
- [Commits](GREsau/schemars@v1.2.0...v1.2.1)

Updates `stacker` from 0.1.22 to 0.1.23
- [Commits](rust-lang/stacker@stacker-0.1.22...psm-0.1.23)

Updates `time` from 0.3.46 to 0.3.47
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.46...v0.3.47)

Updates `time-macros` from 0.2.26 to 0.2.27
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.2.26...v0.2.27)

Updates `zerocopy` from 0.8.37 to 0.8.39
- [Release notes](https://github.com/google/zerocopy/releases)
- [Changelog](https://github.com/google/zerocopy/blob/main/CHANGELOG.md)
- [Commits](google/zerocopy@v0.8.37...v0.8.39)

Updates `zerocopy-derive` from 0.8.37 to 0.8.39
- [Release notes](https://github.com/google/zerocopy/releases)
- [Changelog](https://github.com/google/zerocopy/blob/main/CHANGELOG.md)
- [Commits](google/zerocopy@v0.8.37...v0.8.39)

Updates `zmij` from 1.0.18 to 1.0.19
- [Release notes](https://github.com/dtolnay/zmij/releases)
- [Commits](dtolnay/zmij@1.0.18...1.0.19)

---
updated-dependencies:
- dependency-name: brioche-pack
  dependency-version: 184db8efc2bda24dd49a44f4c88804996324213c
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: clap
  dependency-version: 4.5.57
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: schemars
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: clap_builder
  dependency-version: 4.5.57
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: memchr
  dependency-version: 2.8.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: cargo
- dependency-name: psm
  dependency-version: 0.1.30
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: schemars_derive
  dependency-version: 1.2.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: stacker
  dependency-version: 0.1.23
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.47
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: time-macros
  dependency-version: 0.2.27
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: zerocopy
  dependency-version: 0.8.39
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: zerocopy-derive
  dependency-version: 0.8.39
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
- dependency-name: zmij
  dependency-version: 1.0.19
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Feb 8, 2026
jaudiger
jaudiger approved these changes Feb 9, 2026
View reviewed changes
Copy link
Contributor

@jaudiger jaudiger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me 🚀

@jaudiger jaudiger merged commit b224c9a into main Feb 9, 2026
10 checks passed
@jaudiger jaudiger deleted the dependabot/cargo/cargo-6100d9532c branch February 9, 2026 07:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jaudiger jaudiger jaudiger approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jaudiger