Skip to content

chore(deps): bump the cargo group across 4 directories with 9 updates#64

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/cargo-36a76951a8
Open

chore(deps): bump the cargo group across 4 directories with 9 updates#64
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/cargo/cargo-36a76951a8

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Feb 20, 2026 •
edited
Loading

Bumps the cargo group with 5 updates in the / directory:

Package From To
aws-sdk-kms 1.59.0 1.85.0
keccak 0.1.5 0.1.6
rsa 0.9.8 0.9.10
ruint 1.17.0 1.17.2
zip 2.2.2 2.4.2

Bumps the cargo group with 7 updates in the /build/risczero/hana directory:

Package From To
tokio 1.43.0 1.46.1
bytes 1.10.1 1.11.1
keccak 0.1.5 0.1.6
ring 0.17.8 0.17.14
rsa 0.9.8 0.9.10
ruint 1.17.0 1.17.2
time 0.3.37 0.3.47

Bumps the cargo group with 7 updates in the /build/risczero/hokulea directory:

Package From To
tokio 1.43.0 1.46.1
bytes 1.10.1 1.11.1
keccak 0.1.5 0.1.6
ring 0.17.8 0.17.14
rsa 0.9.8 0.9.10
ruint 1.17.0 1.17.2
time 0.3.37 0.3.47

Bumps the cargo group with 7 updates in the /build/risczero/kona directory:

Package From To
tokio 1.43.0 1.46.1
bytes 1.10.1 1.11.1
keccak 0.1.5 0.1.6
ring 0.17.8 0.17.14
rsa 0.9.8 0.9.10
ruint 1.17.0 1.17.2
time 0.3.37 0.3.47

Updates aws-sdk-kms from 1.59.0 to 1.85.0

Commits

Updates keccak from 0.1.5 to 0.1.6

Commits

Updates rsa from 0.9.8 to 0.9.10

Changelog

Sourced from rsa's changelog.

0.9.10 (2026-01-06)

Fixed

  • do not panic on a prime being 1 when loading a secret key (#624)

#624: RustCrypto/RSA#624

0.9.9 (2025-11-13)

Fixed

  • Support for cryptographic operations with larger keys (#594)

#594: RustCrypto/RSA#594

Commits

Updates ruint from 1.17.0 to 1.17.2

Release notes

Sourced from ruint's releases.

v1.17.2

What's Changed

Full Changelog: recmo/uint@v1.17.1...v1.17.2

v1.17.1

What's Changed

Full Changelog: recmo/uint@v1.17.0...v1.17.1

Changelog

Sourced from ruint's changelog.

[1.17.2] - 2025-12-28

Fixed

  • fix(docsrs): remove doc_auto_cfg (#554)

#554: recmo/uint#554

[1.17.1] - 2025-12-26

Changed

  • Added unsafe to many unstable API functions in algorithms module, and documented their conditions of use (COU). (#552)

#552: recmo/uint#552

Commits
  • 5bd4cff Merge pull request #555 from DaniPopes/release-1.17.2
  • 953a994 chore: release 1.17.2
  • 9110e53 Merge pull request #554 from DaniPopes/doc_auto_cfg
  • 2d242c9 fix(docsrs): remove doc_auto_cfg
  • bc3fad7 Merge pull request #553 from Evalir/evalir/prestwich/rustsec-safety
  • 6d82291 chore: bump version
  • 51fdde2 chore: changelog
  • 8090e7f chore: update unsafe function and improve documentation and safety notes
  • 17c9b3e Merge pull request #544 from Evalir/evalir/prestwich-fix-codspeed
  • 370e2e5 fix: crates badge
  • Additional commits viewable in compare view

Updates zip from 2.2.2 to 2.4.2

Release notes

Sourced from zip's releases.

v2.4.2

🐛 Bug Fixes

  • deep_copy_file produced a mangled file header on big-endian platforms (#309)

v2.4.1

🐛 Bug Fixes

  • type issue in test
  • double as_ref().canonicalize()?
  • CI failures
  • Create directory for extraction if necessary (#314)

v2.4.0

🚀 Features

  • ZipArchive::root_dir and ZipArchive::extract_unwrapped_root_dir (#304)

🐛 Bug Fixes

  • wasm build failure due to a missing use statement (#313)

v2.3.0

🚀 Features

  • Add support for NTFS extra field (#279)

🐛 Bug Fixes

  • (test) Conditionalize a zip64 doctest (#308)
  • fix failing tests, remove symlink loop check
  • Canonicalize output path to avoid false negatives
  • Symlink handling in stream extraction
  • Canonicalize output paths and symlink targets, and ensure they descend from the destination

⚙️ Miscellaneous Tasks

  • Fix clippy and cargo fmt warnings (#310)

v2.2.3

🚜 Refactor

  • Change the inner structure of DateTime (#267)

⚙️ Miscellaneous Tasks

  • cargo fix --edition
Changelog

Sourced from zip's changelog.

2.4.2 - 2025-03-18

🐛 Bug Fixes

  • deep_copy_file produced a mangled file header on big-endian platforms (#309)

2.4.1 - 2025-03-17

🐛 Bug Fixes

  • type issue in test
  • double as_ref().canonicalize()?
  • CI failures
  • Create directory for extraction if necessary (#314)

2.4.0 - 2025-03-17

🚀 Features

  • ZipArchive::root_dir and ZipArchive::extract_unwrapped_root_dir (#304)

🐛 Bug Fixes

  • wasm build failure due to a missing use statement (#313)

2.3.0 - 2025-03-16

🚀 Features

  • Add support for NTFS extra field (#279)

🐛 Bug Fixes

  • (test) Conditionalize a zip64 doctest (#308)
  • fix failing tests, remove symlink loop check
  • Canonicalize output path to avoid false negatives
  • Symlink handling in stream extraction
  • Canonicalize output paths and symlink targets, and ensure they descend from the destination (CVE-2025-29787)

⚙️ Miscellaneous Tasks

  • Fix clippy and cargo fmt warnings (#310)

2.2.3 - 2025-02-26

🚜 Refactor

  • Change the inner structure of DateTime (#267)

⚙️ Miscellaneous Tasks

... (truncated)

Commits
  • 2283915 chore: release v2.4.2 (#320)
  • 31c8a65 ci(fuzz): Update timeout
  • 5322a59 ci(fuzz): Restore missing corpus
  • ed78171 fix: deep_copy_file produced a mangled file header on big-endian platforms
  • 6aaf857 Create SECURITY.md
  • e2539e3 ci(fuzz): Increase fuzz duration to 2 hours
  • f9a6da2 ci(fuzz): Update fuzz corpora
  • cfdec05 chore: release v2.4.1 (#317)
  • 2dea0e7 fix: type issue in test
  • 1b6000d fix: double as_ref().canonicalize()?
  • Additional commits viewable in compare view

Updates tokio from 1.43.0 to 1.46.1

Release notes

Sourced from tokio's releases.

Tokio v1.46.1

1.46.1 (July 4th, 2025)

This release fixes incorrect spawn locations in runtime task hooks for tasks spawned using tokio::spawn rather than Runtime::spawn. This issue only effected the spawn location in TaskMeta::spawned_at, and did not effect task locations in Tracing events.

Unstable

  • runtime: add TaskMeta::spawn_location tracking where a task was spawned (#7440)

#7440: tokio-rs/tokio#7440

Tokio v1.46.0

1.46.0 (July 2nd, 2025)

Fixed

  • net: fixed TcpStream::shutdown incorrectly returning an error on macOS (#7290)

Added

  • sync: mpsc::OwnedPermit::{same_channel, same_channel_as_sender} methods (#7389)
  • macros: biased option for join! and try_join!, similar to select! (#7307)
  • net: support for cygwin (#7393)
  • net: support pope::OpenOptions::read_write on Android (#7426)
  • net: add Clone implementation for net::unix::SocketAddr (#7422)

Changed

  • runtime: eliminate unnecessary lfence while operating on queue::Local<T> (#7340)
  • task: disallow blocking in LocalSet::{poll,drop} (#7372)

Unstable

  • runtime: add TaskMeta::spawn_location tracking where a task was spawned (#7417)
  • runtime: removed borrow from LocalOptions parameter to runtime::Builder::build_local (#7346)

Documented

  • io: clarify behavior of seeking when start_seek is not used (#7366)
  • io: document cancellation safety of AsyncWriteExt::flush (#7364)
  • net: fix docs for recv_buffer_size method (#7336)
  • net: fix broken link of RawFd in TcpSocket docs (#7416)
  • net: update AsRawFd doc link to current Rust stdlib location (#7429)
  • readme: fix double period in reactor description (#7363)
  • runtime: add doc note that on_*_task_poll is unstable (#7311)
  • sync: update broadcast docs on allocation failure (#7352)
  • time: add a missing panic scenario of time::advance (#7394)

#7290: tokio-rs/tokio#7290 #7307: tokio-rs/tokio#7307

... (truncated)

Commits
  • ab3ff69 chore: prepare to release v1.46.1 (#7444)
  • a0d5b8a runtime(unstable): fix task hook spawn locations for tokio::spawn (#7440)
  • a1ee3ef chore: fix some minor typos in the comments (#7442)
  • 171cd14 changelog: fix typo in pipe::OpenOptions for 1.46.0 (#7439)
  • 3f1f268 chore: prepare Tokio v1.46.0 (#7437)
  • 3e890cc rt(unstable): add spawn Location to TaskMeta (#7417)
  • 69290a6 net: derive Clone for net::unix::SocketAddr (#7422)
  • e2b1758 fuzz: cfg fuzz tests under cfg(test) (#7428)
  • b7a75b5 net: update AsRawFd doc link to current Rust stdlib location (#7429)
  • 6b705b3 net: allow pipe::OpenOptions::read_write on Android (#7426)
  • Additional commits viewable in compare view

Updates bytes from 1.10.1 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Commits

Updates keccak from 0.1.5 to 0.1.6

Commits

Updates ring from 0.17.8 to 0.17.14

Changelog

Sourced from ring's changelog.

Version 0.17.14 (2025-03-11)

Fixed a performance bug in the AVX2-based AES-GCM implementation added in ring 0.17.13. This will be another notable performance improvement for most newish x86-64 systems. The performance issue impacted not just AES-GCM.

Compatibility with GNU binutils 2.29 (used on Amazon Linux 2), and probably even earlier versions, was restored. It is expected that ring 0.17.14 will build on all the systems that 0.17.12 would build on.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

  • Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

  • Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

Commits

Updates rsa from 0.9.8 to 0.9.10

Changelog

Sourced from rsa's changelog.

0.9.10 (2026-01-06)

Fixed

  • do not panic on a prime being 1 when loading a secret key (#624)

#624: RustCrypto/RSA#624

0.9.9 (2025-11-13)

Fixed

  • Support for cryptographic operations with larger keys (#594)

#594: RustCrypto/RSA#594

Commits

Updates ruint from 1.17.0 to 1.17.2

Release notes

Sourced from ruint's releases.

v1.17.2

What's Changed

Full Changelog: recmo/uint@v1.17.1...v1.17.2

v1.17.1

What's Changed

Full Changelog: recmo/uint@v1.17.0...v1.17.1

Changelog

Sourced from ruint's changelog.

[1.17.2] - 2025-12-28

Fixed

  • fix(docsrs): remove doc_auto_cfg (#554)

#554: recmo/uint#554

[1.17.1] - 2025-12-26

Changed

  • Added unsafe to many unstable API functions in algorithms module, and documented their conditions of use (COU). (#552)

#552: recmo/uint#552

Commits
  • 5bd4cff Merge pull request #555 from DaniPopes/release-1.17.2
  • 953a994 chore: release 1.17.2
  • 9110e53 Merge pull request #554 from DaniPopes/doc_auto_cfg
  • 2d242c9 fix(docsrs): remove doc_auto_cfg
  • bc3fad7 Merge pull request #553 from Evalir/evalir/prestwich/rustsec-safety
  • 6d82291 chore: bump version
  • 51fdde2 chore: changelog
  • 8090e7f chore: update unsafe function and improve documentation and safety notes
  • 17c9b3e Merge pull request #544 from Evalir/evalir/prestwich-fix-codspeed
  • 370e2e5 fix: crates badge
  • Additional commits viewable in compare view

Updates time from 0.3.37 to 0.3.47

Release notes

Sourced from time's releases.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

v0.3.44

See the changelog for details.

v0.3.43

See the changelog for details.

v0.3.42

See the changelog for details.

v0.3.41

See the changelog for details.

v0.3.40

See the changelog for details.

v0.3.39

See the changelog for details.

v0.3.38

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.47 [2026-02-05]

Security

  • The possibility of a stack exhaustion denial of service attack when parsing RFC 2822 has been eliminated. Previously, it was possible to craft input that would cause unbounded recursion. Now, the depth of the recursion is tracked, causing an error to be returned if it exceeds a reasonable limit.

    This attack vector requires parsing user-provided input, with any type, using the RFC 2822 format.

Compatibility

  • Attempting to format a value with a well-known format (i.e. RFC 3339, RFC 2822, or ISO 8601) will error at compile time if the type being formatted does not provide sufficient information. This would previously fail at runtime. Similarly, attempting to format a value with ISO 8601 that is only configured for parsing (i.e. Iso8601::PARSING) will error at compile time.

Added

  • Builder methods for format description modifiers, eliminating the need for verbose initialization when done manually.
  • date!(2026-W01-2) is now supported. Previously, a space was required between W and 01.
  • [end] now has a trailing_input modifier which can either be prohibit (the default) or discard. When it is discard, all remaining input is ignored. Note that if there are components after [end], they will still attempt to be parsed, likely resulting in an error.

Changed

  • More performance gains when parsing.

Fixed

  • If manually formatting a value, the number of bytes written was one short for some components. This has been fixed such that the number of bytes written is always correct.
  • The possibility of integer overflow when parsing an owned format description has been effectively eliminated. This would previously wrap when overflow checks were disabled. Instead of storing the depth as u8, it is stored as u32. This would require multiple gigabytes of nested input to overflow, at which point we've got other problems and trivial mitigations are available by downstream users.

0.3.46 [2026-01-23]

Added

  • All possible panics are now documented for the relevant methods.
  • The need to use #[serde(default)] when using custom serde formats is documented. This applies only when deserializing an Option<T>.
  • Duration::nanoseconds_i128 has been made public, mirroring std::time::Duration::from_nanos_u128.

... (truncated)

Commits
  • d5144cd v0.3.47 release
  • f6206b0 Guard against integer overflow in release mode
  • 1c63dc7 Avoid denial of service when parsing Rfc2822
  • 5940df6 Add builder methods to avoid verbose construction
  • 00881a4 Manually format macros everywhere
  • bb723b6 Add trailing_input modifier to end
  • 31c4f8e Permit W12 in date! macro
  • 490a17b Mark error paths in well-known formats as cold
  • 6cb1896 Optimize Rfc2822 parsing
  • 6d264d5 Remove erroneous #[inline(never)] attributes
  • Additional commits viewable in compare view

Updates tokio from 1.43.0 to 1.46.1

Release notes

Sourced from tokio's releases.

Tokio v1.46.1

1.46.1 (July 4th, 2025)

This release fixes incorrect spawn locations in runtime task hooks for tasks spawned using tokio::spawn rather than Runtime::spawn. This issue only effected the spawn location in TaskMeta::spawned_at, and did not effect task locations in Tracing events.

Unstable

  • runtime: add TaskMeta::spawn_location tracking where a task was spawned (#7440)

#7440: tokio-rs/tokio#7440

Tokio v1.46.0

1.46.0 (July 2nd, 2025)

Fixed

  • net: fixed TcpStream::shutdown incorrectly returning an error on macOS (#7290)

Added

  • sync: mpsc::OwnedPermit::{same_channel, same_channel_as_sender} methods (#7389)
  • macros: biased option for join! and try_join!, similar to select! (#7307)
  • net: support for cygwin (#7393)
  • net: support pope::OpenOptions::read_write on Android (#7426)
  • net: add Clone implementation for net::unix::SocketAddr (#7422)

Changed

  • runtime: eliminate unnecessary lfence while operating on queue::Local<T> (#7340)
  • task: disallow blocking in LocalSet::{poll,drop} (#7372)

Unstable

  • runtime: add TaskMeta::spawn_location tracking where a task was spawned (#7417)
  • runtime: removed borrow from LocalOptions parameter to runtime::Builder::build_local (#7346)

Documented

  • io: clarify behavior of seeking when start_seek is not used (#7366)
  • io: document cancellation safety of AsyncWriteExt::flush (#7364)
  • net: fix docs for recv_buffer_size method (#7336)
  • net: fix broken link of RawFd in TcpSocket docs (#7416)
  • net: update AsRawFd doc link to current Rust stdlib location (#7429)
  • readme: fix double period in reactor description (#7363)
  • runtime: add doc note that on_*_task_poll is unstable (#7311)
  • sync: update broadcast docs on allocation failure (#7352)
  • time: add a missing panic scenario of time::advance (#7394)

#7290: tokio-rs/tokio#7290 #7307: tokio-rs/tokio#7307

... (truncated)

Commits
  • ab3ff69 chore: prepare to release v1.46.1 (#7444)
  • a0d5b8a runtime(unstable): fix task hook spawn locations for tokio::spawn (#7440)
  • a1ee3ef chore: fix some minor typos in the comments (#7442)
  • 171cd14 changelog: fix typo in pipe::OpenOptions for 1.46.0 (#7439)
  • 3f1f268 chore: prepare Tokio v1.46.0 (#7437)
  • 3e890cc rt(unstable): add spawn Location to TaskMeta (#7417)
  • 69290a6 net: derive Clone for net::unix::SocketAddr (#7422)
  • e2b1758 fuzz: cfg fuzz tests under cfg(test) (#7428)
  • b7a75b5 net: update AsRawFd doc link to current Rust stdlib location (#7429)
  • 6b705b3 net: allow pipe::OpenOptions::read_write on Android (#7426)
  • Additional commits viewable in compare view

Updates bytes from 1.10.1 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

  • Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

  • Bump MSRV to 1.57 (#788)

Fixed

  • fix: BytesMut only reuse if src has remaining (#803)
  • Specialize BytesMut::put::<Bytes> (#793)
  • Reserve capacity in BytesMut::put (#794)
  • Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

  • Guarantee address in slice() for empty slices. (#780)
  • Rename Vtable::to_* -> Vtable::into_* (#776)
  • Fix latest clippy warnings (#787)
  • Ignore BytesMut::freeze doctest on wasm (#790)
  • Move drop_fn of from_owner into vtable (#801)
Commits

Updates keccak from 0.1.5 to 0.1.6

Commits

Updates ring from 0.17.8 to 0.17.14

Changelog

Sourced from ring's changelog.

Version 0.17.14 (2025-03-11)

Fixed a performance bug in the AVX2-based AES-GCM implementation added in ring 0.17.13. This will be another notable performance improvement for most newish x86-64 systems. The performance issue impacted not just AES-GCM.

Compatibility with GNU binutils 2.29 (used on Amazon Linux 2), and probably even earlier versions, was restored. It is expected that ring 0.17.14 will build on all the systems that 0.17.12 would build on.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

  • Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

  • Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

Commits

Updates rsa from 0.9.8 to 0.9.10

Changelog

Sourced from rsa's changelog.

0.9.10 (2026-01-06)

Fixed

  • do not panic on a prime being 1 when loading a secret key (#624)

#624: RustCrypto/RSA#624

0.9.9 (2025-11-13)

Fixed

  • Support for cryptographic operations with larger keys (#594)

#594: RustCrypto/RSA#594

Commits

Updates ruint from 1.17.0 to 1.17.2

Release notes

Sourced from ruint's releases.

v1.17.2

What's Changed

Full...

Description has been truncated

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Feb 20, 2026
@dependabot dependabot bot mentioned this pull request Feb 20, 2026
Closed
@dependabot dependabot bot force-pushed the dependabot/cargo/cargo-36a76951a8 branch from 8439af8 to 27d5cd5 Compare March 11, 2026 14:58
@dependabot
chore(deps): bump the cargo group across 4 directories with 9 updates
d0f1ab7 
Bumps the cargo group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aws-sdk-kms](https://github.com/awslabs/aws-sdk-rust) | `1.59.0` | `1.85.0` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.5` | `0.1.6` |
| [rsa](https://github.com/RustCrypto/RSA) | `0.9.8` | `0.9.10` |
| [ruint](https://github.com/recmo/uint) | `1.17.0` | `1.17.2` |
| [zip](https://github.com/zip-rs/zip2) | `2.2.2` | `2.4.2` |

Bumps the cargo group with 7 updates in the /build/risczero/hana directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.43.0` | `1.46.1` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.10.1` | `1.11.1` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.5` | `0.1.6` |
| [ring](https://github.com/briansmith/ring) | `0.17.8` | `0.17.14` |
| [rsa](https://github.com/RustCrypto/RSA) | `0.9.8` | `0.9.10` |
| [ruint](https://github.com/recmo/uint) | `1.17.0` | `1.17.2` |
| [time](https://github.com/time-rs/time) | `0.3.37` | `0.3.47` |

Bumps the cargo group with 7 updates in the /build/risczero/hokulea directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.43.0` | `1.46.1` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.10.1` | `1.11.1` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.5` | `0.1.6` |
| [ring](https://github.com/briansmith/ring) | `0.17.8` | `0.17.14` |
| [rsa](https://github.com/RustCrypto/RSA) | `0.9.8` | `0.9.10` |
| [ruint](https://github.com/recmo/uint) | `1.17.0` | `1.17.2` |
| [time](https://github.com/time-rs/time) | `0.3.37` | `0.3.47` |

Bumps the cargo group with 7 updates in the /build/risczero/kona directory:

| Package | From | To |
| --- | --- | --- |
| [tokio](https://github.com/tokio-rs/tokio) | `1.43.0` | `1.46.1` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.10.1` | `1.11.1` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.5` | `0.1.6` |
| [ring](https://github.com/briansmith/ring) | `0.17.8` | `0.17.14` |
| [rsa](https://github.com/RustCrypto/RSA) | `0.9.8` | `0.9.10` |
| [ruint](https://github.com/recmo/uint) | `1.17.0` | `1.17.2` |
| [time](https://github.com/time-rs/time) | `0.3.37` | `0.3.47` |



Updates `aws-sdk-kms` from 1.59.0 to 1.85.0
- [Release notes](https://github.com/awslabs/aws-sdk-rust/releases)
- [Commits](https://github.com/awslabs/aws-sdk-rust/commits)

Updates `keccak` from 0.1.5 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6)

Updates `rsa` from 0.9.8 to 0.9.10
- [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md)
- [Commits](RustCrypto/RSA@v0.9.8...v0.9.10)

Updates `ruint` from 1.17.0 to 1.17.2
- [Release notes](https://github.com/recmo/uint/releases)
- [Changelog](https://github.com/recmo/uint/blob/main/CHANGELOG.md)
- [Commits](recmo/uint@v1.17.0...v1.17.2)

Updates `zip` from 2.2.2 to 2.4.2
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v2.2.2...v2.4.2)

Updates `tokio` from 1.43.0 to 1.46.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.43.0...tokio-1.46.1)

Updates `bytes` from 1.10.1 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.10.1...v1.11.1)

Updates `keccak` from 0.1.5 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6)

Updates `ring` from 0.17.8 to 0.17.14
- [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md)
- [Commits](https://github.com/briansmith/ring/commits)

Updates `rsa` from 0.9.8 to 0.9.10
- [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md)
- [Commits](RustCrypto/RSA@v0.9.8...v0.9.10)

Updates `ruint` from 1.17.0 to 1.17.2
- [Release notes](https://github.com/recmo/uint/releases)
- [Changelog](https://github.com/recmo/uint/blob/main/CHANGELOG.md)
- [Commits](recmo/uint@v1.17.0...v1.17.2)

Updates `time` from 0.3.37 to 0.3.47
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.37...v0.3.47)

Updates `tokio` from 1.43.0 to 1.46.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.43.0...tokio-1.46.1)

Updates `bytes` from 1.10.1 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.10.1...v1.11.1)

Updates `keccak` from 0.1.5 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6)

Updates `ring` from 0.17.8 to 0.17.14
- [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md)
- [Commits](https://github.com/briansmith/ring/commits)

Updates `rsa` from 0.9.8 to 0.9.10
- [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md)
- [Commits](RustCrypto/RSA@v0.9.8...v0.9.10)

Updates `ruint` from 1.17.0 to 1.17.2
- [Release notes](https://github.com/recmo/uint/releases)
- [Changelog](https://github.com/recmo/uint/blob/main/CHANGELOG.md)
- [Commits](recmo/uint@v1.17.0...v1.17.2)

Updates `time` from 0.3.37 to 0.3.47
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.37...v0.3.47)

Updates `tokio` from 1.43.0 to 1.46.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.43.0...tokio-1.46.1)

Updates `bytes` from 1.10.1 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.10.1...v1.11.1)

Updates `keccak` from 0.1.5 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6)

Updates `ring` from 0.17.8 to 0.17.14
- [Changelog](https://github.com/briansmith/ring/blob/main/RELEASES.md)
- [Commits](https://github.com/briansmith/ring/commits)

Updates `rsa` from 0.9.8 to 0.9.10
- [Changelog](https://github.com/RustCrypto/RSA/blob/v0.9.10/CHANGELOG.md)
- [Commits](RustCrypto/RSA@v0.9.8...v0.9.10)

Updates `ruint` from 1.17.0 to 1.17.2
- [Release notes](https://github.com/recmo/uint/releases)
- [Changelog](https://github.com/recmo/uint/blob/main/CHANGELOG.md)
- [Commits](recmo/uint@v1.17.0...v1.17.2)

Updates `time` from 0.3.37 to 0.3.47
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.37...v0.3.47)

---
updated-dependencies:
- dependency-name: aws-sdk-kms
  dependency-version: 1.85.0
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rsa
  dependency-version: 0.9.10
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ruint
  dependency-version: 1.17.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: zip
  dependency-version: 2.4.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.46.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ring
  dependency-version: 0.17.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rsa
  dependency-version: 0.9.10
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ruint
  dependency-version: 1.17.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.47
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.46.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ring
  dependency-version: 0.17.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rsa
  dependency-version: 0.9.10
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ruint
  dependency-version: 1.17.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.47
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: tokio
  dependency-version: 1.46.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ring
  dependency-version: 0.17.14
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rsa
  dependency-version: 0.9.10
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: ruint
  dependency-version: 1.17.2
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.47
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/cargo/cargo-36a76951a8 branch from 27d5cd5 to d0f1ab7 Compare March 13, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants