Bump the cargo group across 4 directories with 3 updates by dependabot[bot] · Pull Request #901 · HelixDB/helix-db

dependabot · 2026-04-14T02:40:59Z

Bumps the cargo group with 3 updates in the / directory: rand, quinn-proto and rustls-webpki.
Bumps the cargo group with 2 updates in the /helix-cli directory: quinn-proto and rustls-webpki.
Bumps the cargo group with 2 updates in the /helix-container directory: rand and rustls-webpki.
Bumps the cargo group with 1 update in the /hql-tests directory: rustls-webpki.

Updates rand from 0.9.1 to 0.9.3

Changelog

Sourced from rand's changelog.

[0.9.3] — 2026-02-11

This release back-ports a fix from v0.10. See also #1763.

Changes

Deprecate feature log (#1764)

Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

[0.9.2] — 2025-07-20

Deprecated

Deprecate rand::rngs::mock module and StepRng generator (#1634)

Additions

Enable WeightedIndex<usize> (de)serialization (#1646)

Commits

1aeee9f Prepare v0.9.3: deprecate feature log (#1764)
98473ee Prepare rand 0.9.2 (#1648)
031a1f5 examples/print-next.rs (#1647)
6cb75ee Make UniformUsize serializable (#1646)
0c955c5 Add some tests for BlockRng, BlockRng64 and Xoshiro RNGs (#1639)
204084a Fix: Remove accidental editor swap file (#1636)
86262ac Deprecate rand::rngs::mock module and StepRng (#1634)
a6e217f Update statrs link (#1630)
db993ec Prepare rand v0.9.1 (#1629)
3057641 Remove zerocopy from rand (#1579)
Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.14

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.14

@jxs reported a denial of service issue in quinn-proto 5 days ago:

GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

Fix over-permissive proto dependency edge by @Ralith in quinn-rs/quinn#2385

0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @djc in quinn-rs/quinn#2559

Commits

2c315aa proto: bump version to 0.11.14
8ad47f4 Use newer rustls-pki-types PEM parser API
c81c028 ci: fix workflow syntax
0050172 ci: pin wasm-bindgen-cli version
8a6f82c Take semver-compatible dependency updates
e52db4a Apply suggestions from clippy 1.91
6df7275 chore: Fix unnecessary_unwrap clippy
c8eefa0 proto: avoid unwrapping varint decoding during parameters parsing
9723a97 fuzz: add fuzzing target for parsing transport parameters
eaf0ef3 Fix over-permissive proto dependency edge (#2385)
Additional commits viewable in compare view

Updates rustls-webpki from 0.103.1 to 0.103.3

Release notes

Sourced from rustls-webpki's releases.

0.103.3

Add support for RSA signature algorithms that don't include parameters. Per RFC 4055 section 5, implementations of the SHA-1/SHA-2 one-way hash functions "MUST accept the parameters being absent as well as present".

What's Changed

Support RSA PKCS#1 signatures with absent parameters by @ctz in rustls/webpki#346

0.103.2

Maintain context for key usage mismatch errors in order to make them easier to interpret.

Accept certificates with an empty extension sequence.

What's Changed

Fix CI build failures, tidy cargo-deny config by @cpu in rustls/webpki#339

Update semver-compatible dependencies by @djc in rustls/webpki#341

Remove tests from package that is published by @SwishSwushPow in rustls/webpki#340

Allow x509v3 empty extensions (redux) by @ctz in rustls/webpki#342

tests: use rcgen for client_auth tests by @djc in rustls/webpki#343

tests: remove test certs for client_auth tests by @djc in rustls/webpki#344

Maintain context for key usage mismatch errors by @djc in rustls/webpki#337

Refine CI workflow triggers by @djc in rustls/webpki#345

Commits

34a2392 Bump version to 0.103.3
16abda1 Support RSA PKCS#1 signatures with absent parameters
0ac75b1 cargo-check-external-types: update toolchain
1e923bf ci: enable triggering CI workflow manually
f4a8783 ci: skip push triggers for most branches
9cf30f6 Bump version to 0.103.2
baac0b0 Maintain context for key usage mismatch errors
85d885d tests: remove test certs for client_auth tests
7badc0e tests: move check_cert() down
5b3dae1 tests: use rcgen for client_auth tests
Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.14

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.14

@jxs reported a denial of service issue in quinn-proto 5 days ago:

GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

Fix over-permissive proto dependency edge by @Ralith in quinn-rs/quinn#2385

0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @djc in quinn-rs/quinn#2559

Commits

2c315aa proto: bump version to 0.11.14
8ad47f4 Use newer rustls-pki-types PEM parser API
c81c028 ci: fix workflow syntax
0050172 ci: pin wasm-bindgen-cli version
8a6f82c Take semver-compatible dependency updates
e52db4a Apply suggestions from clippy 1.91
6df7275 chore: Fix unnecessary_unwrap clippy
c8eefa0 proto: avoid unwrapping varint decoding during parameters parsing
9723a97 fuzz: add fuzzing target for parsing transport parameters
eaf0ef3 Fix over-permissive proto dependency edge (#2385)
Additional commits viewable in compare view

Updates rustls-webpki from 0.103.9 to 0.103.11

Release notes

Sourced from rustls-webpki's releases.

0.103.3

Add support for RSA signature algorithms that don't include parameters. Per RFC 4055 section 5, implementations of the SHA-1/SHA-2 one-way hash functions "MUST accept the parameters being absent as well as present".

What's Changed

Support RSA PKCS#1 signatures with absent parameters by @ctz in rustls/webpki#346

0.103.2

Maintain context for key usage mismatch errors in order to make them easier to interpret.

Accept certificates with an empty extension sequence.

What's Changed

Fix CI build failures, tidy cargo-deny config by @cpu in rustls/webpki#339

Update semver-compatible dependencies by @djc in rustls/webpki#341

Remove tests from package that is published by @SwishSwushPow in rustls/webpki#340

Allow x509v3 empty extensions (redux) by @ctz in rustls/webpki#342

tests: use rcgen for client_auth tests by @djc in rustls/webpki#343

tests: remove test certs for client_auth tests by @djc in rustls/webpki#344

Maintain context for key usage mismatch errors by @djc in rustls/webpki#337

Refine CI workflow triggers by @djc in rustls/webpki#345

Commits

34a2392 Bump version to 0.103.3
16abda1 Support RSA PKCS#1 signatures with absent parameters
0ac75b1 cargo-check-external-types: update toolchain
1e923bf ci: enable triggering CI workflow manually
f4a8783 ci: skip push triggers for most branches
9cf30f6 Bump version to 0.103.2
baac0b0 Maintain context for key usage mismatch errors
85d885d tests: remove test certs for client_auth tests
7badc0e tests: move check_cert() down
5b3dae1 tests: use rcgen for client_auth tests
Additional commits viewable in compare view

Updates rand from 0.9.2 to 0.9.3

Changelog

Sourced from rand's changelog.

[0.9.3] — 2026-02-11

This release back-ports a fix from v0.10. See also #1763.

Changes

Deprecate feature log (#1764)

Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

[0.9.2] — 2025-07-20

Deprecated

Deprecate rand::rngs::mock module and StepRng generator (#1634)

Additions

Enable WeightedIndex<usize> (de)serialization (#1646)

Commits

1aeee9f Prepare v0.9.3: deprecate feature log (#1764)
98473ee Prepare rand 0.9.2 (#1648)
031a1f5 examples/print-next.rs (#1647)
6cb75ee Make UniformUsize serializable (#1646)
0c955c5 Add some tests for BlockRng, BlockRng64 and Xoshiro RNGs (#1639)
204084a Fix: Remove accidental editor swap file (#1636)
86262ac Deprecate rand::rngs::mock module and StepRng (#1634)
a6e217f Update statrs link (#1630)
db993ec Prepare rand v0.9.1 (#1629)
3057641 Remove zerocopy from rand (#1579)
Additional commits viewable in compare view

Updates rustls-webpki from 0.103.9 to 0.103.11

Release notes

Sourced from rustls-webpki's releases.

0.103.3

Add support for RSA signature algorithms that don't include parameters. Per RFC 4055 section 5, implementations of the SHA-1/SHA-2 one-way hash functions "MUST accept the parameters being absent as well as present".

What's Changed

Support RSA PKCS#1 signatures with absent parameters by @ctz in rustls/webpki#346

0.103.2

Maintain context for key usage mismatch errors in order to make them easier to interpret.

Accept certificates with an empty extension sequence.

What's Changed

Fix CI build failures, tidy cargo-deny config by @cpu in rustls/webpki#339

Update semver-compatible dependencies by @djc in rustls/webpki#341

Remove tests from package that is published by @SwishSwushPow in rustls/webpki#340

Allow x509v3 empty extensions (redux) by @ctz in rustls/webpki#342

tests: use rcgen for client_auth tests by @djc in rustls/webpki#343

tests: remove test certs for client_auth tests by @djc in rustls/webpki#344

Maintain context for key usage mismatch errors by @djc in rustls/webpki#337

Refine CI workflow triggers by @djc in rustls/webpki#345

Commits

34a2392 Bump version to 0.103.3
16abda1 Support RSA PKCS#1 signatures with absent parameters
0ac75b1 cargo-check-external-types: update toolchain
1e923bf ci: enable triggering CI workflow manually
f4a8783 ci: skip push triggers for most branches
9cf30f6 Bump version to 0.103.2
baac0b0 Maintain context for key usage mismatch errors
85d885d tests: remove test certs for client_auth tests
7badc0e tests: move check_cert() down
5b3dae1 tests: use rcgen for client_auth tests
Additional commits viewable in compare view

Updates rustls-webpki from 0.103.7 to 0.103.11

Release notes

Sourced from rustls-webpki's releases.

0.103.3

Add support for RSA signature algorithms that don't include parameters. Per RFC 4055 section 5, implementations of the SHA-1/SHA-2 one-way hash functions "MUST accept the parameters being absent as well as present".

What's Changed

Support RSA PKCS#1 signatures with absent parameters by @ctz in rustls/webpki#346

0.103.2

Maintain context for key usage mismatch errors in order to make them easier to interpret.

Accept certificates with an empty extension sequence.

What's Changed

Fix CI build failures, tidy cargo-deny config by @cpu in rustls/webpki#339

Update semver-compatible dependencies by @djc in rustls/webpki#341

Remove tests from package that is published by @SwishSwushPow in rustls/webpki#340

Allow x509v3 empty extensions (redux) by @ctz in rustls/webpki#342

tests: use rcgen for client_auth tests by @djc in rustls/webpki#343

tests: remove test certs for client_auth tests by @djc in rustls/webpki#344

Maintain context for key usage mismatch errors by @djc in rustls/webpki#337

Refine CI workflow triggers by @djc in rustls/webpki#345

Commits

34a2392 Bump version to 0.103.3
16abda1 Support RSA PKCS#1 signatures with absent parameters
0ac75b1 cargo-check-external-types: update toolchain
1e923bf ci: enable triggering CI workflow manually
f4a8783 ci: skip push triggers for most branches
9cf30f6 Bump version to 0.103.2
baac0b0 Maintain context for key usage mismatch errors
85d885d tests: remove test certs for client_auth tests
7badc0e tests: move check_cert() down
5b3dae1 tests: use rcgen for client_auth tests
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Greptile Summary

This PR bumps rand (0.9.x → 0.9.3), quinn-proto (0.11.13 → 0.11.14), and rustls-webpki (0.103.x → latest) across four workspace directories (/, /helix-cli, /helix-container, /hql-tests). The quinn-proto update is security-relevant, patching a denial-of-service vulnerability (GHSA-6xvm-j4wr-6v98) caused by an unchecked VarInt decode during QUIC transport parameter parsing. The helix-cli/Cargo.lock regeneration is notably larger than the other lock files because the CLI workspace had accumulated additional unresolved changes (new helix-enterprise-ql dep, reqwest 0.13.2, aws-lc-rs crypto backend) that were flushed through alongside the targeted bumps.

Important Files Changed

Filename	Overview
Cargo.lock	Root workspace lock file: bumps rand 0.9.1→0.9.3, quinn-proto 0.11.13→0.11.14 (DoS security fix), and rustls-webpki 0.103.1→0.103.3. Clean, minimal changes.
helix-cli/Cargo.lock	CLI lock file has the largest changeset: quinn-proto 0.11.13→0.11.14 (security fix), rustls-webpki 0.103.9→0.103.11, plus transitive new crates (aws-lc-rs/aws-lc-sys, reqwest 0.13.2, helix-enterprise-ql, tui-banner, rustls-platform-verifier) flushed through from an already-updated Cargo.toml. Adds cmake/C build requirement via aws-lc-sys.
helix-container/Cargo.lock	Container lock file: rand 0.9.2→0.9.3, rustls-webpki 0.103.9→0.103.11, plus transitive sonic-rs 0.5.6→0.5.8 and windows-sys 0.59→0.61 bumps. No issues.
helix-container/Cargo.toml	Bumps rand version constraint from "0.9.1" to "0.9.3". Straightforward and correct.
helix-db/Cargo.toml	Bumps rand from "0.9.0" to "0.9.3" in both [dependencies] and [dev-dependencies]. Clean update.
hql-tests/Cargo.lock	HQL tests lock file: rustls-webpki 0.103.7→0.103.11. Minimal, correct change.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[dependabot PR 901] --> B[root workspace]
    A --> C[helix-cli]
    A --> D[helix-container]
    A --> E[hql-tests]

    B --> B1["rand 0.9.1 to 0.9.3"]
    B --> B2["quinn-proto 0.11.13 to 0.11.14 - DoS fix"]
    B --> B3["rustls-webpki 0.103.1 to 0.103.3"]

    C --> C1["quinn-proto 0.11.13 to 0.11.14 - DoS fix"]
    C --> C2["rustls-webpki 0.103.9 to 0.103.11"]
    C --> C3["aws-lc-rs added transitively"]

    D --> D1["rand 0.9.2 to 0.9.3"]
    D --> D2["rustls-webpki 0.103.9 to 0.103.11"]

    E --> E1["rustls-webpki 0.103.7 to 0.103.11"]

    style B2 fill:#f96,color:#000
    style C1 fill:#f96,color:#000

_{Reviews (1): Last reviewed commit: "Bump the cargo group across 4 directorie..." | Re-trigger Greptile}

Bumps the cargo group with 3 updates in the / directory: [rand](https://github.com/rust-random/rand), [quinn-proto](https://github.com/quinn-rs/quinn) and [rustls-webpki](https://github.com/rustls/webpki). Bumps the cargo group with 2 updates in the /helix-cli directory: [quinn-proto](https://github.com/quinn-rs/quinn) and [rustls-webpki](https://github.com/rustls/webpki). Bumps the cargo group with 2 updates in the /helix-container directory: [rand](https://github.com/rust-random/rand) and [rustls-webpki](https://github.com/rustls/webpki). Bumps the cargo group with 1 update in the /hql-tests directory: [rustls-webpki](https://github.com/rustls/webpki). Updates `rand` from 0.9.1 to 0.9.3 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/0.9.3/CHANGELOG.md) - [Commits](rust-random/rand@rand_core-0.9.1...0.9.3) Updates `quinn-proto` from 0.11.13 to 0.11.14 - [Release notes](https://github.com/quinn-rs/quinn/releases) - [Commits](quinn-rs/quinn@quinn-proto-0.11.13...quinn-proto-0.11.14) Updates `rustls-webpki` from 0.103.1 to 0.103.3 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.1...v/0.103.3) Updates `quinn-proto` from 0.11.13 to 0.11.14 - [Release notes](https://github.com/quinn-rs/quinn/releases) - [Commits](quinn-rs/quinn@quinn-proto-0.11.13...quinn-proto-0.11.14) Updates `rustls-webpki` from 0.103.9 to 0.103.11 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.1...v/0.103.3) Updates `rand` from 0.9.2 to 0.9.3 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/0.9.3/CHANGELOG.md) - [Commits](rust-random/rand@rand_core-0.9.1...0.9.3) Updates `rustls-webpki` from 0.103.9 to 0.103.11 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.1...v/0.103.3) Updates `rustls-webpki` from 0.103.7 to 0.103.11 - [Release notes](https://github.com/rustls/webpki/releases) - [Commits](rustls/webpki@v/0.103.1...v/0.103.3) --- updated-dependencies: - dependency-name: rand dependency-version: 0.9.3 dependency-type: direct:production dependency-group: cargo - dependency-name: quinn-proto dependency-version: 0.11.14 dependency-type: indirect dependency-group: cargo - dependency-name: rustls-webpki dependency-version: 0.103.3 dependency-type: indirect dependency-group: cargo - dependency-name: quinn-proto dependency-version: 0.11.14 dependency-type: indirect dependency-group: cargo - dependency-name: rustls-webpki dependency-version: 0.103.11 dependency-type: indirect dependency-group: cargo - dependency-name: rand dependency-version: 0.9.3 dependency-type: direct:production dependency-group: cargo - dependency-name: rustls-webpki dependency-version: 0.103.11 dependency-type: indirect dependency-group: cargo - dependency-name: rustls-webpki dependency-version: 0.103.11 dependency-type: indirect dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Apr 14, 2026

This was referenced Apr 14, 2026

Bump the cargo group across 4 directories with 2 updates #892

Closed

Bump the cargo group across 3 directories with 2 updates #895

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the cargo group across 4 directories with 3 updates#901

Bump the cargo group across 4 directories with 3 updates#901
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/cargo-ad2cf3dfa0

dependabot bot commented on behalf of github Apr 14, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 14, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

[0.9.3] — 2026-02-11

Changes

[0.9.2] — 2025-07-20

Deprecated

Additions

quinn-proto 0.11.14

What's Changed

0.103.3

What's Changed

0.103.2

What's Changed

quinn-proto 0.11.14

What's Changed

0.103.3

What's Changed

0.103.2

What's Changed

[0.9.3] — 2026-02-11

Changes

[0.9.2] — 2025-07-20

Deprecated

Additions

0.103.3

What's Changed

0.103.2

What's Changed

0.103.3

What's Changed

0.103.2

What's Changed

Greptile Summary

Important Files Changed

Flowchart

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Apr 14, 2026 •

edited by greptile-apps bot

Loading