Skip to content

build(deps): bump the http group across 1 directory with 8 updates#1785

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/http-39dd14dc31
Closed

build(deps): bump the http group across 1 directory with 8 updates#1785
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/http-39dd14dc31

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026 •
edited
Loading

Bumps the http group with 8 updates in the / directory:

Package From To
hyper 0.14.32 1.9.0
tower-http 0.5.2 0.6.8
tower 0.3.1 0.5.3
tokio-tungstenite 0.26.2 0.29.0
axum-extra 0.10.3 0.12.6
rustls-cng 0.5.3 0.7.0
openssl-probe 0.1.6 0.2.1
openssl 0.10.79 0.10.80

Updates hyper from 0.14.32 to 1.9.0

Release notes

Sourced from hyper's releases.

v1.9.0

Features

  • client:
  • error: add 'Error::is_parse_version_h2' method (393c77c7)
  • http1: add UpgradeableConnection::into_parts (e21205cf)

Bug Fixes

  • ffi: validate null pointers before dereferencing in request/response functions (#4038 (28e73ccd)
  • http1:
  • http2:
    • cancel sending client request body on response future drop (#4042) (5b17a69e, closes #4040)
    • non-utf8 char in Connection header may cause panic when calling to_str (#4019) (c36ca8a5)

Refactors and chores

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.9.0 (2026-03-31)

Bug Fixes

  • ffi: validate null pointers before dereferencing in request/response functions (#4038 (28e73ccd)
  • http1:
  • http2:
    • cancel sending client request body on response future drop (#4042) (5b17a69e, closes #4040)
    • non-utf8 char in Connection header may cause panic when calling to_str (#4019) (c36ca8a5)

Features

  • client:
  • error: add 'Error::is_parse_version_h2' method (393c77c7)
  • http1: add UpgradeableConnection::into_parts (e21205cf)

v1.8.1 (2025-11-13)

Bug Fixes

  • http1: fix consuming extra CPU from previous change (#3977) (4492f31e)

v1.8.0 (2025-11-11)

Bug Fixes

Features

  • rt: add Timer::now() method to allow overriding the instant returned (#3965) (5509ebe6)

Breaking Changes

  • The HTTP/2 client connection no longer allows an executor that can not spawn itself.

... (truncated)

Commits
  • 0d6c7d5 v1.9.0
  • e21205c feat(http1): add UpgradeableConnection::into_parts
  • 393c77c feat(error): add 'Error::is_parse_version_h2' method
  • 5b17a69 fix(http2): cancel sending client request body on response future drop (#4042)
  • 7211ec2 fix(http1): allow keep-alive for chunked requests with trailers (#4043)
  • d51cb71 feat(client): expose HTTP/2 current max stream count (#4026)
  • 28e73cc fix(ffi): validate null pointers before dereferencing in request/response fun...
  • e13e783 docs(client): fix HTTP/2 max concurrent stream link to spec (#4037)
  • 8ba9008 chore(dependencies): drop pin-utils dependency (#4023)
  • 5778745 feat(client): add HTTP/2 max_local_error_reset_streams option (#4021)
  • Additional commits viewable in compare view

Updates tower-http from 0.5.2 to 0.6.8

Release notes

Sourced from tower-http's releases.

tower-http-0.6.8

Fixed

  • Disable multiple_members in Gzip decoder, since HTTP context only uses one member. (#621)

#621: tower-rs/tower-http#621

What's Changed

New Contributors

Full Changelog: tower-rs/tower-http@tower-http-0.6.7...tower-http-0.6.8

tower-http-0.6.7

Added

  • TimeoutLayer::with_status_code(status) to define the status code returned when timeout is reached. (#599)

Deprecated

  • auth::require_authorization is too basic for real-world. (#591)
  • TimeoutLayer::new() should be replaced with TimeoutLayer::with_status_code(). (Previously was StatusCode::REQUEST_TIMEOUT) (#599)

Fixed

  • on_eos is now called even for successful responses. (#580)
  • ServeDir: call fallback when filename is invalid (#586)
  • decompression will not fail when body is empty (#618)

#580: tower-rs/tower-http#580 #586: tower-rs/tower-http#586 #591: tower-rs/tower-http#591 #599: tower-rs/tower-http#599 #618: tower-rs/tower-http#618

New Contributors

... (truncated)

Commits
  • 33166c8 v0.6.8
  • 6680160 Fix deprecated lints (#608)
  • 81b8231 ci: Switch cargo-public-api-crates to cargo-check-external-types (#613)
  • 1fb0144 ci: pin tracing in msrv job (#622)
  • 1fe4c09 fix(decompression): disable multiple_members option for gzip decoder (#621)
  • 3bf1ba7 v0.6.7
  • 723ca9a fix(decompression): Suppress EOF errors caused by decompressing empty body (#...
  • 8ab9f82 chore(ci): use newer cargo-public-api-crates job (#619)
  • 7cfdf76 doc: Replace doc_auto_cfg with doc_cfg (#609)
  • 50beeaf Add support for custom status code in TimeoutLayer (#599)
  • Additional commits viewable in compare view

Updates tower from 0.3.1 to 0.5.3

Release notes

Sourced from tower's releases.

tower 0.5.3

Added

  • builder: Add ServiceBuilder::boxed_clone_sync() helper (#804)

Fixed

  • retry: Check that supplied jitter is not NaN (#843)

#804: tower-rs/tower#804 #843: tower-rs/tower#843

tower 0.5.2

Added

  • util: Add BoxCloneSyncService which is a Clone + Send + Sync boxed Service (#777)
  • util: Add BoxCloneSyncServiceLayer which is a Clone + Send + Sync boxed Layer (#802)

tower 0.5.1

  • Fix minimum version of tower-layer dependency (#787)

#787: tower-rs/tower#787

tower 0.5.0

Fixed

  • util: BoxService is now Sync (#702)

Changed

  • util: Removed deprecated ServiceExt::ready_and method and ReadyAnd future (#652)
  • retry: Breaking Change retry::Policy::retry now accepts &mut Req and &mut Res instead of the previous mutable versions. This increases the flexibility of the retry policy. To update, update your method signature to include mut for both parameters. (#584)
  • retry: Breaking Change Change Policy to accept &mut self (#681)
  • retry: Add generic backoff utilities (#685)
  • retry: Add Budget trait. This allows end-users to implement their own budget and bucket implementations. (#703)
  • reconnect: Breaking Change Remove unused generic parameter from Reconnect::new (#755)
  • ready-cache: Allow iteration over ready services (#700)
  • discover: Implement Clone for Change (#701)
  • util: Add a BoxCloneServiceLayer (#708)
  • rng: use a simpler random 2-sampler (#716)
  • filter: Derive Clone for AsyncFilterLayer (#731)
  • general: Update IndexMap (#741)
  • MSRV: Increase MSRV to 1.63.0 (#741)

#702: tower-rs/tower#702 #652: tower-rs/tower#652 #584: tower-rs/tower#584 #681: tower-rs/tower#681

... (truncated)

Commits

Updates tokio-tungstenite from 0.26.2 to 0.29.0

Changelog

Sourced from tokio-tungstenite's changelog.

0.29.0

0.28.0

0.27.0

Commits

Updates axum-extra from 0.10.3 to 0.12.6

Release notes

Sourced from axum-extra's releases.

axum-extra-v0.12.6

  • fixed: Escape backslashes and double quotes in Content-Disposition filenames to prevent header parameter injection in Attachment and FileStream (#3664)
  • vpath! macro now stops the compilation if your path is using deprecated path variables in the old 107 format, such as :var and *var. the only allowed way now is {var}. (#3618)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3664: tokio-rs/axum#3664 #3618: tokio-rs/axum#3618 #3611: tokio-rs/axum#3611

axum-extra v0.12.3

  • changed: Make the typed-routing feature enable the routing feature (#3514)
  • changed: Add trailing newline to ErasedJson::pretty response bodies (#3526)
  • fixed: Fix integer underflow in FileStream::try_range_response for empty files (#3566)

#3514: tokio-rs/axum#3514 #3526: tokio-rs/axum#3526 #3566: tokio-rs/axum#3566

axum-extra v0.12.2

  • Make it easier to visually scan for default features (#3550)

#3550: tokio-rs/axum#3550

axum-extra v0.12.0

  • breaking: Remove unused async-stream feature, which was accidentally introduced as an implicit feature through an optional dependency which was no longer being used (#3298)
  • breaking: option_layer now maps the Response body type to axum::body::Body (#3469)
  • breaking: Some new features are added which need to be opted in (#3485).
    • Cached extractor requires cached feature.
    • The handler utilities require handler feature.
    • The middleware utilities require middleware feature.
    • OptionalPath extractor requires optional-path feature.
    • The routing utilities require routing feature.
    • WithRejection extractor requires with-rejection feature.
  • breaking: Upgraded prost dependency to v0.14. (#3517)

#3298: tokio-rs/axum#3298 #3469: tokio-rs/axum#3469 #3485: tokio-rs/axum#3485 #3517: tokio-rs/axum#3517

axum-extra v0.11.0

Yanked from crates.io due to unforeseen breaking change, see #3190 for details

  • breaking: Remove unused async-stream feature, which was accidentally introduced as an implicit feature through an optional dependency which was no

... (truncated)

Commits

Updates rustls-cng from 0.5.3 to 0.7.0

Commits
  • 06fe2c0 Added Pkcs12Flags to control how to import chains from the PKCS#12
  • 69b7699 CertContext: method to retrieve time when added to store
  • 351916a Fixed compilation with Rust 1.84
  • fa39ce2 Fixed clippy 1.88 warnings
  • 46a3091 cargo fmt
  • 1e6e64b Clippy fixes
  • c96b7fa Removed unused early-data feature
  • 0ae70b2 Added support for silent flag
  • c377b43 address comments
  • 5c3a9fb cargo fmt change
  • Additional commits viewable in compare view

Updates openssl-probe from 0.1.6 to 0.2.1

Release notes

Sourced from openssl-probe's releases.

0.2.1

  • Support for OpenHarmony.
  • Corrections to crate metadata.

What's Changed

0.2.0 is the first release after openssl-probe maintenance has been handed over to the rustls team. Thanks to @​alexcrichton for creating and maintaining it for the past 9 years. We're happy to address any feedback you have for this crate.

Breaking changes

  • ProbeResult::cert_dir is now a Vec<PathBuf> rather than an Option<PathBuf>, allowing the library to yield multiple suggestions for directories which may contain certificate files.
  • Rather than using a single list of locations for certificate files and certificate directories, openssl-probe now uses much shorter per-platform lists. This should make the API faster and make it less likely to accidentally pick up locations that are unidiomatic for the platform.
  • Removed deprecated API

What's Changed

Commits
  • 9181752 Prepare 0.2.1
  • 2a23322 docs: clarify lib description, update README
  • 5e18d53 feat: add openharmony platform preset certs folder
  • df769f4 Update repo URL in Cargo metadata
  • cc52ac7 ci: check cargo-deny (and fix up SPDX metadata)
  • 4cfa095 ci: check semver compatibility
  • 04e7058 ci: check clippy
  • fbce324 ci: check code formatting
  • 11fba1b ci: setup duplicate workflow cancellation
  • a44b6f1 ci: restrict workflow permissions
  • Additional commits viewable in compare view

Updates openssl from 0.10.79 to 0.10.80

Release notes

Sourced from openssl's releases.

openssl-v0.10.80

What's Changed

Full Changelog: rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80

Commits
  • 35be7ae Release openssl 0.10.80 and openssl-sys 0.9.116 (#2639)
  • 19eceb2 Fix output buffer overflow in cipher_update_inplace for AES key-wrap-with-pad...
  • b460eb3 Prefer Homebrew openssl@4 and stop looking for openssl@1.1 (#2633)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the http group across 1 directory with 8 updates
8a28bd0 
Bumps the http group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [hyper](https://github.com/hyperium/hyper) | `0.14.32` | `1.9.0` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.5.2` | `0.6.8` |
| [tower](https://github.com/tower-rs/tower) | `0.3.1` | `0.5.3` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.26.2` | `0.29.0` |
| [axum-extra](https://github.com/tokio-rs/axum) | `0.10.3` | `0.12.6` |
| [rustls-cng](https://github.com/rustls/rustls-cng) | `0.5.3` | `0.7.0` |
| [openssl-probe](https://github.com/rustls/openssl-probe) | `0.1.6` | `0.2.1` |
| [openssl](https://github.com/rust-openssl/rust-openssl) | `0.10.79` | `0.10.80` |



Updates `hyper` from 0.14.32 to 1.9.0
- [Release notes](https://github.com/hyperium/hyper/releases)
- [Changelog](https://github.com/hyperium/hyper/blob/master/CHANGELOG.md)
- [Commits](hyperium/hyper@v0.14.32...v1.9.0)

Updates `tower-http` from 0.5.2 to 0.6.8
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.5.2...tower-http-0.6.8)

Updates `tower` from 0.3.1 to 0.5.3
- [Release notes](https://github.com/tower-rs/tower/releases)
- [Commits](tower-rs/tower@tower-0.3.1...tower-0.5.3)

Updates `tokio-tungstenite` from 0.26.2 to 0.29.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.26.2...v0.29.0)

Updates `axum-extra` from 0.10.3 to 0.12.6
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-extra-v0.10.3...axum-extra-v0.12.6)

Updates `rustls-cng` from 0.5.3 to 0.7.0
- [Commits](rustls/rustls-cng@v0.5.3...v0.7.0)

Updates `openssl-probe` from 0.1.6 to 0.2.1
- [Release notes](https://github.com/rustls/openssl-probe/releases)
- [Commits](rustls/openssl-probe@0.1.6...0.2.1)

Updates `openssl` from 0.10.79 to 0.10.80
- [Release notes](https://github.com/rust-openssl/rust-openssl/releases)
- [Commits](rust-openssl/rust-openssl@openssl-v0.10.79...openssl-v0.10.80)

---
updated-dependencies:
- dependency-name: hyper
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: http
- dependency-name: tower-http
  dependency-version: 0.6.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http
- dependency-name: tower
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http
- dependency-name: tokio-tungstenite
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http
- dependency-name: axum-extra
  dependency-version: 0.12.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http
- dependency-name: rustls-cng
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http
- dependency-name: openssl-probe
  dependency-version: 0.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http
- dependency-name: openssl
  dependency-version: 0.10.80
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: http
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels May 19, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 20, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this May 20, 2026
@dependabot dependabot Bot deleted the dependabot/cargo/http-39dd14dc31 branch May 20, 2026 17:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@CBenoit Benoît Cortier (CBenoit)

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update Rust code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@CBenoit