build(deps): bump the dependencies group with 6 updates #777

dependabot · 2025-11-01T18:31:02Z

Bumps the dependencies group with 6 updates:

Package	From	To
axum-extra	`0.10.3`	`0.12.0`
aws-config	`1.8.8`	`1.8.10`
aws-sdk-s3	`1.109.0`	`1.110.0`
aws-smithy-types	`1.3.3`	`1.3.4`
clap	`4.5.50`	`4.5.51`
matchit	`0.8.4`	`0.9.0`

Updates axum-extra from 0.10.3 to 0.12.0

Release notes

Sourced from axum-extra's releases.

axum-extra v0.12.0

breaking: Remove unused async-stream feature, which was accidentally introduced as an implicit feature through an optional dependency which was no longer being used (#3298)

breaking: option_layer now maps the Response body type to axum::body::Body (#3469)

breaking: Some new features are added which need to be opted in (#3485).

Cached extractor requires cached feature.

The handler utilities require handler feature.

The middleware utilities require middleware feature.

OptionalPath extractor requires optional-path feature.

The routing utilities require routing feature.

WithRejection extractor requires with-rejection feature.

breaking: Upgraded prost dependency to v0.14. (#3517)

#3298: tokio-rs/axum#3298 #3469: tokio-rs/axum#3469 #3485: tokio-rs/axum#3485 #3517: tokio-rs/axum#3517

axum-extra v0.11.0

Yanked from crates.io due to unforeseen breaking change, see #3190 for details

breaking: Remove unused async-stream feature, which was accidentally introduced as an implicit feature through an optional dependency which was no longer being used (#3145)

fixed: Fix a broken link in the documentation of ErasedJson (#3186)

changed: Make the status function of rejections a const function, such as FormRejection, QueryRejection and MultipartRejection (#3168)

#3145: tokio-rs/axum#3145 #3168: tokio-rs/axum#3168 #3186: tokio-rs/axum#3186

Commits

914a35a Release axum-extra 0.12.0
e20e90d Upgrade axum-extra to prost v0.14 (#3517)
a77c2cf fix(axum-extra): don't require S generic param when using `FileStream::from...
0c2e4a2 axum-extra: gate rejection test behind feature (#3493)
82ce9d6 axum-extra: Add link definition for pull request to changelog (#3492)
2175c8d axum-extra: Make rustversion and serde_core optional dependency (#3487)
9e6be95 axum-extra: Remove unused tower dependency (#3486)
929512f axum-extra: Make axum optional dependency (#3485)
6970347 axum-extra: make option_layer guarantee that the output body is `axum::body...
8d00a14 axum-extra: Remove unused feature
See full diff in compare view

Updates aws-config from 1.8.8 to 1.8.10

Commits

See full diff in compare view

Updates aws-sdk-s3 from 1.109.0 to 1.110.0

Commits

See full diff in compare view

Updates aws-smithy-types from 1.3.3 to 1.3.4

Commits

See full diff in compare view

Updates clap from 4.5.50 to 4.5.51

Release notes

Sourced from clap's releases.

v4.5.51

[4.5.51] - 2025-10-29

Fixes

(help) Correctly calculate padding for short flags that take a value

(help) Don't panic on short flags using ArgAction::Count

Changelog

Sourced from clap's changelog.

[4.5.51] - 2025-10-29

Fixes

(help) Correctly calculate padding for short flags that take a value

(help) Don't panic on short flags using ArgAction::Count

Commits

b49dae2 chore: Release
d37b0b5 docs: Update changelog
3398b6a Merge pull request #6009 from gtema/complete_try_generate
21fc9e4 feat(clap-complete): Introduce fallible generator
bd01bdc Merge pull request #6012 from epage/sub
ed0c63d docs(derive): Specify arg_required_else_help is set for users
e2188d9 chore(deps): Update Rust Stable to v1.87 (#6004)
e01f2b7 docs: Cleanup unused links
6b12a81 chore: Release
8dd92a7 docs: Update changelog
Additional commits viewable in compare view

Updates matchit from 0.8.4 to 0.9.0

Release notes

Sourced from matchit's releases.

0.9.0

Fixed a bug that caused empty routes to be ignored on insert (ibraheemdev/matchit#76).

Tightened the rules around overlapping parameter prefixes and suffixes, where ambiguous routes were inadvertently allowed (ibraheemdev/matchit#67). See the new conflict rules for details.

0.8.6

Added support for parameter suffixes, e.g. /{name}.png (ibraheemdev/matchit#17).

Performance improvements.

0.8.5

Added Params::{default, new} (ibraheemdev/matchit#63).

Added Router::merge to combine two routers (ibraheemdev/matchit#62).

Fixed a bug where empty route parameters were accepted (ibraheemdev/matchit#60).

Commits

31ccf25 silence new clippy warnings
c3ca0df release 0.9.0
034d89f error on prefix-suffix conflicts
83da717 set MSRV to 1.66.0
15b8aa0 fix clippy lints
551c892 revmap CI workflows
8fef456 fix empty route being ignored on insert
d720199 update copyright year
654813a update to wayfind 0.8
8853c24 remove unnecessary async block in hyper example
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

CLAassistant · 2025-11-01T18:31:11Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

github-actions · 2025-11-01T18:31:17Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

cargo/aws-config

1.8.10

Unknown

cargo/aws-runtime

1.5.13

Unknown

cargo/aws-sdk-s3

1.110.0

Unknown

cargo/aws-sdk-sso

1.88.0

Unknown

cargo/aws-sdk-ssooidc

1.90.0

Unknown

cargo/aws-sdk-sts

1.90.0

Unknown

cargo/aws-sigv4

1.3.6

Unknown

cargo/aws-smithy-checksums

0.63.10

Unknown

cargo/aws-smithy-eventstream

0.60.13

Unknown

cargo/aws-smithy-http

0.62.5

Unknown

cargo/aws-smithy-http-client

1.1.4

Unknown

cargo/aws-smithy-json

0.61.7

Unknown

cargo/aws-smithy-runtime

1.9.4

Unknown

cargo/aws-smithy-runtime-api

1.9.2

Unknown

cargo/aws-smithy-types

1.3.4

Unknown

cargo/aws-smithy-xml

0.60.12

Unknown

cargo/aws-types

1.3.10

Unknown

cargo/axum-extra

0.12.0

🟢 5.4

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 9	Found 20/21 approved changesets -- score normalized to 9
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/clap

4.5.51

🟢 4.9

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 2/15 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	⚠️ 0	12 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/clap_builder

4.5.51

🟢 4.9

Details

Check	Score	Reason
Code-Review	⚠️ 1	Found 2/15 approved changesets -- score normalized to 1
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	⚠️ 0	security policy file not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Vulnerabilities	⚠️ 0	12 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/matchit

0.9.0

🟢 5.8

Details

Check	Score	Reason
Code-Review	🟢 3	Found 10/29 approved changesets -- score normalized to 3
Maintained	🟢 6	7 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 6
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	🟢 10	project is fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

cargo/rust-embed

8.9.0

Unknown

cargo/rust-embed-impl

8.9.0

Unknown

cargo/rust-embed-utils

8.9.0

Unknown

cargo/tokio-util

0.7.17

🟢 7.1

Details

Check	Score	Reason
Code-Review	🟢 9	Found 19/21 approved changesets -- score normalized to 9
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Maintained	🟢 10	30 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

Cargo.lock

dependabot bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Nov 1, 2025

upgrade crates version

7299d74

houseme approved these changes Nov 2, 2025

View reviewed changes

houseme merged commit a9d5fba into main Nov 2, 2025
15 of 16 checks passed

houseme deleted the dependabot/cargo/dependencies-7c8269a12d branch November 2, 2025 16:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the dependencies group with 6 updates #777

build(deps): bump the dependencies group with 6 updates #777

Uh oh!

dependabot bot commented on behalf of github Nov 1, 2025

Uh oh!

CLAassistant commented Nov 1, 2025

Uh oh!

github-actions bot commented Nov 1, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

build(deps): bump the dependencies group with 6 updates #777

build(deps): bump the dependencies group with 6 updates #777

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 1, 2025

axum-extra v0.12.0

axum-extra v0.11.0

v4.5.51

[4.5.51] - 2025-10-29

Fixes

[4.5.51] - 2025-10-29

Fixes

0.9.0

0.8.6

0.8.5

Uh oh!

CLAassistant commented Nov 1, 2025

Uh oh!

github-actions bot commented Nov 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Nov 1, 2025 •

edited

Loading