[dependabot]

Bumps the minor-patch group with 6 updates in the / directory:

Package	From	To
serde_json	1.0.151	1.0.154
toml	1.1.6+spec-1.1.0	1.1.8+spec-1.1.0
sha2	0.11.0	0.11.1
ureq	3.4.2	3.5.0
yara-x	1.21.0	1.22.0
rsa	0.9.10	0.10.0-rc.19

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates ureq from 3.4.2 to 3.5.0

Changelog

Sourced from ureq's changelog.

3.5.0

• Prepare 3.5.0 and fix dependency advisories and warnings - #1217
• Add Agent::shutdown() to interrupt requests in flight and close all connections #1211
• Preserve validated request header casing with RequestBuilder::header_raw #1214
• Decode proxy URL credentials once; literal percent signs must be escaped as %25 #1215
• Encode ProxyBuilder credentials and preserve colons in proxy passwords #1215
• Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #1209
• Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #1209
• Clarify timeout budgets, phase boundaries, and proxy DNS #1213
• Bound TLS handshake I/O by the remaining connect/global timeout #1208
• Retry socket reads interrupted by EINTR when timeout (technically breaking) #1205
• Fix native-tls-no-default enabling dependencies without enabling the TLS connector
• Add timeout_per_read and timeout_per_write independently of total phase budgets

3.4.3

• Update TLS dependencies for security fixes #1218

Commits

• 1bd534e Fix changelog
• fee0ad2 Prepare 3.5.0 and fix dependency advisories and warnings
• 7de0ab7 Remove realtime dependencies from tests
• 3f18f90 Add Agent::shutdown() for active and pooled connections
• 04572f2 Expose validated request header casing
• 6b1c275 Fix proxy credential encoding and decoding
• 6a609b4 Apply the connect timeout to the SOCKS handshake and check NO_PROXY first
• 3c818f4 Clarify timeout budgets and phase boundaries
• af3e959 Bound TLS handshake I/O by remaining timeout budgets
• 0ebb046 Retry socket reads interrupted by a signal when a timeout applies (#1205)
• Additional commits viewable in compare view

Updates yara-x from 1.21.0 to 1.22.0

Release notes

Sourced from yara-x's releases.

v1.22.0

• Add int64, int64be, uint64, and uint64be built-in functions, and support for unsigned 64-bit integers and integer literals greater than i64::MAX (#806).
• Add pe.offset_to_rva function to pe module to convert file offsets to RVAs (07f7a94).
• Keep the width and signedness of protobuf integer fields (#806).
• Implement constant folding for integer division and modulus operations (#806).
• Raise warnings on implicit sign conversions that change constant values and unary operations on unsigned integers (#806).
• Allow the yr dump command to show information from the zip module (3bbe876).
• Link compiler errors and warnings to their documentation pages (d34819c).
• Expose xor_key for matching patterns in the C and Go APIs (#814).
• Performance and memory consumption improvements (#808, #810, 9c2b3c7).
• Improve Language Server with Workspace Symbols support, better Code Completion documentation, auto-importing modules on non-top-level symbol completion, and --help/--version CLI flags (#788, #792, #795, #797, #798).
• Improve documentation for math.entropy function (#783).
• BUGFIX: Limit the size of emitted WASM functions and return error when a rule condition is too large (#813).
• BUGFIX: Don't force yara-x default features in yara-x-capi (#802).
• BUGFIX: Avoid WASM trap when dividing i64::MIN by -1 (7d16c1f).
• BUGFIX: Ensure quantifiers computed at runtime that are out of range are never satisfied (af690da).
• BUGFIX: Dix the number of iterations in loops over ranges when bounds overflow (697e36e).
• BUGFIX: Don't truncate 64-bit offsets and indexes on 32-bit platforms (9e00369).
• BUGFIX: Improve robustness of deserialized rule data validation (9d6a1d8).
• BUGFIX: Enhance C API robustness with comprehensive null checks and detailed error reporting (0ed7485).
• BUGFIX: Correct output line termination when progress bar is active in yr scan (029e9c9).

Contributors: @​agreene0, @​CfirTsabari, @​chojuninengu, @​prosperritty

Commits

• e27597f tests: run test_teddy_scan_timeout only on platforms that support Teddy.
• 1fe41aa tests: fix flaky test_teddy_scan_timeout (#774).
• 4156104 docs: clarify that xint64xx functions were introduced in v1.22.0.
• fa84ca1 chore: bump version to 1.22.0.
• 3bcebfe chore: upgrade dependencies.
• 63aa201 chore: update generated protobufs.
• f2a0b20 feat: expose xor_key in C and Go APIs. (#814)
• 20c7949 fix: limit the size of emitted WASM functions and return error when a rule co...
• 1706b5d Project import generated by Copybara. (#812)
• 649cd3b chore: enable automatic Gemini reviews on new pull requests.
• Additional commits viewable in compare view

Updates rsa from 0.9.10 to 0.10.0-rc.19

Commits

• db10300 v0.10.0-rc.19 (#713)
• 29c31c4 Bump pkcs1 to v0.8.0-rc.5 release (#712)
• 7e5331c refactor: use *Ref (or *Owned) der types from RustCrypto/formats (#706)
• 4a6006f Add RSADoS note to RsaPublicKey::MAX_PUB_EXPONENT (#696)
• 99f8088 Bump signature dependency to v3 (#693)
• 4da5150 Add regression test for CVE-2026-21895 (per @​tarcieri's note in #690) (#692)
• e31a020 v0.10.0-rc.18 (#689)
• 113a5e9 Bump pkcs8 depenency to v0.11 (#688)
• ecd32e3 Use pkcs8::KeyError (#687)
• 6ca073e Bump spki crate dependency to v0.8 (#684)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​yara-x@​1.21.0 ⏵ 1.22.0
	cargo/​ureq@​3.4.2 ⏵ 3.5.0
	cargo/​serde_json@​1.0.151 ⏵ 1.0.154
	cargo/​sha2@​0.11.0 ⏵ 0.11.1
	cargo/​toml@​1.1.6%2Bspec-1.1.0 ⏵ 1.1.8+spec-1.1.0

View full report