fix(deps): update all dependencies #1568
No reviewers
Labels
No labels
blocked
bug
duplicate
enhancement
epic
help wanted
invalid
maintainer-only
performance
question
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
project-neon/neonfs!1568
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/all"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v5→v6v6→v70.10→0.11trixie-20260610→13trixie-20260610→131.20.1→1.20.229.0.2→29.0.3v2.46.3→v2.47.03.1.8→3.1.9v2.2.0→v2.2.10.6.2→0.6.3~> 0.5→~> 0.61.96.0→1.97.11.0.228→1.0.2291.3.0→1.4.01.3.0→1.4.02.0.18→2.0.19Release Notes
actions/cache (actions/cache)
v6.1.0Compare Source
What's Changed
Full Changelog: https://github.com/actions/cache/compare/v6...v6.1.0
v6.0.0Compare Source
What's Changed
Full Changelog: https://github.com/actions/cache/compare/v5...v6.0.0
v6Compare Source
actions/checkout (actions/checkout)
v7.0.0Compare Source
v7Compare Source
RustCrypto/AEADs (aes-gcm)
v0.11.0Compare Source
elixir-lang/elixir (elixir)
v1.20.2Compare Source
1. Enhancements
Elixir
profile: :time2. Bug fixes
Elixir
:uniqor:intoare usedquotewithunquoteis used inside a pattern or guardKernel.put_elem/3to emit:erlang.setelement/3__info__(:struct)to include the:requiredkeyMix
erlang/otp (erlang)
v29.0.3: OTP 29.0.3Compare Source
Check out the git tag OTP-29.0.3, and build a full OTP system including documentation. Apply one or more applications from this build as patches to your installation using the 'otp_patch_apply' tool. For information on install requirements, see descriptions for each application version below.
common_test-1.31.1
The common_test-1.31.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a crash in ct_netconfc that occurred when the remote server closed the SSH connection during NETCONF subsystem negotiation.
Own Id: OTP-20191
Related Id(s): ERIERL-1333, PR-11230
compiler-10.0.2
The compiler-10.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.
Own Id: OTP-20222
Related Id(s): PR-11219
crypto-5.9.1
The crypto-5.9.1 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
crypto:compute_key/4foreddhandcrypto:generate_key/2,3foreddh/eddsanow raise anerror:{notsup, Info, Description}exception instead of returning the atomnotsupwhen the underlying cryptolib lacks support.Own Id: OTP-20215
Related Id(s): PR-11302
dialyzer-6.0.2
The dialyzer-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fix a bug with native record sets in
erl_types.erlOwn Id: OTP-20201
erts-17.0.3
The erts-17.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed an undefined behavior in the internal
erts_qsort()function, which could have been the cause of a beam crash seen when updating large maps.Own Id: OTP-20185
Related Id(s): PR-11215
Calculating
bxorof the largest supported positive integer (erlang:system_info(max_integer)) and-1would return[]instead of a raising asystem_limitexception.Own Id: OTP-20208
Related Id(s): PR-11269
Fix possible race between
ets:delete/1and terminating process with a fixation on the same table.Own Id: OTP-20217
Related Id(s): PR-11283
A few code generation issues for the JIT on AArch64 (ARM64) have been fixed.
For all platforms, the loader will reject some invalid BEAM files earlier.
Own Id: OTP-20226
Related Id(s): PR-11299
On 32-bit computers, the
md5BIFs would return an incorrect MD5 checksum for data of size 4GiB or more.Own Id: OTP-20227
Related Id(s): PR-11289
kernel-11.0.3
The kernel-11.0.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
inet:info/1 could crash when calling for a closing (port) socket.
Own Id: OTP-20173
Handling of the truncation bit in
inet_reshas been fixed so it properly falls back to querying over TCP after a truncated UDP reply.This fixes a bug introduced in OTP-28.4.2 - kernel-10.6.2 making a truncated UDP answer fail to parse and never execute the fallback, instead the name resolve operation fails.
Own Id: OTP-20199
Related Id(s): PR-11247
public_key-1.21.3
The public_key-1.21.3 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Hardened OCSP response verification by using constant-time hash comparisons and rejecting responses exceeding 100 KB before ASN.1 decoding.
Own Id: OTP-20197
Related Id(s): PR-11239
ssh-6.0.2
The ssh-6.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Fixed a path-existence oracle in the SFTP server where
SSH_FXP_REALPATHrequests with..components could bypass the configured root directory isolation, allowing an authenticated client to determine whether arbitrary paths exist on the host filesystem.Own Id: OTP-20183
Related Id(s): GH-SA-h9pw-h5w4-h976, PR-11294, CVE-2026-53422
Fixed an infinite loop in the SFTP server triggered when receiving
SSH_MSG_CHANNEL_EXTENDED_DATAon an SFTP channel, which caused the channel process to spin indefinitely on CPU without consuming its message queue.Own Id: OTP-20186
Related Id(s): GH-SA-7wp4-pc27-2vj9, PR-11295, CVE-2026-54886
Fixed mlkem768x25519 hybrid key exchange failing intermittently with "incorrect signature" when the X25519 shared secret had a leading zero byte. The shared secret is now encoded as a fixed-width 32-byte string per the specification.
Own Id: OTP-20196
Related Id(s): PR-11209
Fixed a race condition where SSH keepalive responses could be matched to unrelated pending requests due to incorrect request queue ordering. Requests are now matched in the order they were sent.
Own Id: OTP-20198
Related Id(s): PR-11244
The SFTP server now caps the read length in
SSH_FXP_READrequests to 255 KiB (matching OpenSSH'sSFTP_MAX_READ_LENGTH), preventing excessive memory allocation when clients request large reads.Own Id: OTP-20200
Related Id(s): PR-11259
Removed a server-side workaround (OTP-14827, introduced in OTP 20) that accepted SHA-1 user-auth signatures from clients identifying as OpenSSH 7.x when rsa-sha2-* was negotiated. The workaround addressed a distro-specific build issue in 2017 that no longer exists. Clients affected by this removal (extremely unlikely — requires a 10-year-old unpatched OpenSSH build) will see authentication failures and must upgrade.
Own Id: OTP-20206
Related Id(s): PR-11268
ssl-11.7.3
Note! The ssl-11.7.3 application cannot be applied independently of other applications on an arbitrary OTP 29 installation.
Fixed Bugs and Malfunctions
Correct small behavior bugs that occasionally could cause DTLS connection errors, unwanted behavior for legacy DHE_DSS, hiding of a distribution config error, and possible unorderly process tree shutdown.
Own Id: OTP-20190
Related Id(s): PR-11250
Initialize DTLS cookie to random value to avoid DoS attack with forged cookie during startup window.
Own Id: OTP-20194
Related Id(s): PR-11271, CVE-2026-54887
Guard TLS client for MITM injection of application data during "plain-text-window" during handshake.
Own Id: OTP-20207
Related Id(s): PR-11270, CVE-2026-54891
Improve error handling of TLS PSK sending ILLIGAL_PARMETER alert if binders and PSK-identities are not matched. Also mend recovery mechanism of ticket and session stores to be as resilient as possible to intermediate bugs.
Own Id: OTP-20216
Related Id(s): PR-11282, CVE-2026-55952
Fix race condition that could be used to DoS attack DTLS servers.
Own Id: OTP-20220
Related Id(s): PR-11306, CVE-2026-55950
A TLS-1.3 stateless session ticket with obfuscated_ticket_age set to zero was incorrectly accepted without checking the server-side ticket lifetime or the RFC 8446 Section 8.3 freshness window. The server now always validates ticket age using its own timestamp regardless of the client-reported age value.
Own Id: OTP-20230
Related Id(s): PR-11307
TLS-1.3 client rejects a second HelloRetryRequest as requiered in RFC 8446 Section 4.1.4
Own Id: OTP-20231
Related Id(s): PR-11309
A busy client node could self-trigger a ticket store crash if unlucky with scheduling if auto mode is used.
Own Id: OTP-20232
Related Id(s): PR-11311
Correct spec for CRL API
Own Id: OTP-20233
Related Id(s): PR-11281
stdlib-8.0.2
The stdlib-8.0.2 application can be applied independently of other applications on a full OTP 29 installation.
Fixed Bugs and Malfunctions
Several compiler bugs that could crash the compiler or generate incorrect code in rare circumstances have been fixed.
Own Id: OTP-20222
Related Id(s): PR-11219
Thanks to
Cole Christensen, Nick Krichevsky, Stefan Grundmann
goreleaser/nfpm (goreleaser/nfpm)
v2.47.0Compare Source
Changelog
New Features
5c2f7ca: feat: RiscV64 support (#1091) (@ahqsoftwares)64b788a: feat: add Requires(Post) for RPMS (#1085) (@teddelin)dc96073: feat: add fang support for styled CLI output (#1068) (@caarlos0)Security updates
060af04: sec(deps): update golang.org/x/crypto (@caarlos0)f769631: sec(deps): update golang.org/x/net (@caarlos0)Bug fixes
3118ec1: fix: tolerate empty overrides packager clause (#1080) (@dleske)Dependency updates
a2d9ce5: feat(deps): go1.26.4 (@caarlos0)9b16218: fix(deps): bump alpine from 3.23.3 to 3.23.4 (#1075) (@dependabot[bot])e3102b3: fix(deps): bump alpine from 3.23.3 to 3.23.4 in /testdata/acceptance (#1076) (@dependabot[bot])62c555e: fix(deps): bump alpine from 3.23.4 to 3.24.0 (#1098) (@dependabot[bot])071ae18: fix(deps): bump alpine from 3.23.4 to 3.24.0 in /testdata/acceptance (#1099) (@dependabot[bot])Build process updates
4c62d34: ci(deps): bump github/codeql-action in the actions group (#1083) (@dependabot[bot])38a05de: ci(deps): bump the actions group across 1 directory with 3 updates (#1096) (@dependabot[bot])6fe4da4: ci(deps): bump the actions group across 1 directory with 7 updates (#1095) (@dependabot[bot])cd95f9f: ci(deps): bump the actions group with 2 updates (#1078) (@dependabot[bot])8f9cbef: ci(deps): bump the actions group with 3 updates (#1090) (@dependabot[bot])9ff0e2f: ci(deps): bump the actions group with 4 updates (#1086) (@dependabot[bot])2ce1832: ci(deps): bump the actions group with 5 updates (#1074) (@dependabot[bot])1bd2fed: ci: fix docs build test (@caarlos0)4695cdc: ci: fix license check (@caarlos0)a40b461: ci: update build (@caarlos0)Other work
d16d75f: docs(deps): update hextra (@caarlos0)c6a6a27: docs: update cmd docs (@caarlos0)Full Changelog: https://github.com/goreleaser/nfpm/compare/v2.46.3...v2.47.0
Helping out
This release is only possible thanks to all the support of awesome people!
Want to be one of them?
You can sponsor or contribute with code.
Where to go next?
rabbitmq/ra (ra)
v3.1.9Compare Source
What's Changed
last_written/pendingstate after log truncation, and a snapshot-send regression by @kjnilsson in #644force_shrink_members_to_current_member/1typespec by @visciang in #640Full Changelog: https://github.com/rabbitmq/ra/compare/v3.1.8...v3.1.9
wojtekmach/req (req)
v0.6.3Compare Source
Req.Test]: Fix race conditionrust-lang/rust (rust)
v1.97.1Compare Source
==========================
This backports an LLVM submodule bump to include the LLVM-side fix and a
revert of the rustc change that is one known trigger for the bug. The rustc
side revert should not be strictly necessary but is done out of abundance of caution.
v1.97.0Compare Source
==========================
Language
Result<T, Uninhabited>andControlFlow<Uninhabited, T>to be equivalent toTfor must use lintdead_code_pub_in_binarylint for unused pub items in binary cratesdiv32,lam-bh,lamcas,ld-seq-saandscqtarget featurescfg(target_has_atomic_primitive_alignment)selfin imports in more casesPlatform Support
Refer to Rust's platform support page
for more information on Rust's tiered platform support.
Stabilized APIs
Default for RepeatNCopy for ffi::FromBytesUntilNulErrorSend for std::fs::Fileon UEFI<{integer}>::isolate_highest_one<{integer}>::isolate_lowest_one<{integer}>::highest_one<{integer}>::lowest_one<{integer}>::bit_widthNonZero<{integer}>::isolate_highest_oneNonZero<{integer}>::isolate_lowest_oneNonZero<{integer}>::highest_oneNonZero<{integer}>::lowest_oneNonZero<{integer}>::bit_widthThese previously stable APIs are now stable in const contexts:
char::is_controlCargo
build.warningsconfig. This controls how lint warnings from local packages are treated. Useful for enforcing a warning-free build in CI, replacing-Dwarnings. docsresolver.lockfile-pathconfig. This allows specifying the path to the lockfile to use when resolving dependencies. Useful when working with read-only source directories. docs--target-dirdoesn't look like a Cargo target directory. This prevents accidental deletion of non-target directories.-mshorthand for--manifest-pathcurldependency fromcrates-iocrateRustdoc
--emitflag--remap-path-prefixCompatibility Notes
f32: From<{float}>to constrain{float}pin!, in order to prevent unsoundness. The most likely case where this might impact users is: writingpin!(x)wherexhas type&mut Twill now always correctly produce a value of typePin<&mut &mut T>, instead of sometimes allowing a coercion that produces a value of typePin<&mut T>. This coercion was previously incorrectly allowed since Rust 1.88.0.std::charconstants and functionsf64methods which have been deprecated since 1.0varargs_without_patternlint in depslink_sectionspecifierenums have changed. This is not a breaking change, as it only applies toenums without layout guarantees, but is noted here as we've seen people impacted from having made assumptions about the layout algorithm.#[export_name = "..."]where the name is empty#[link_name = "..."]&#[link(name = "...")]parametersshutdownon a socket to shut down the write side, attempting to write to the socket will now produce aBrokenPipeerror rather thanOther. MapWSAESHUTDOWNtoio::ErrorKind::BrokenPipev1.96.1Compare Source
===========================
serde-rs/serde (serde)
v1.0.229Compare Source
whatyouhide/stream_data (stream_data)
v1.4.0Compare Source
StreamData.float/1when min and max are too far apart.StreamData.string/2.StreamData.one_of/1towards earlier elements first (instead of smaller values for later elements).dtolnay/thiserror (thiserror)
v2.0.19Compare Source
Configuration
📅 Schedule: (in timezone Pacific/Auckland)
* 0-3 * * 1)* 0-3 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.
⚠️ Artifact update problem
Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: neonfs_s3/mix.lock
File name: neonfs_client/mix.lock
File name: neonfs_core/mix.lock
File name: neonfs_fuse/mix.lock
File name: neonfs_iam/mix.lock
File name: neonfs_integration/mix.lock
File name: neonfs_nfs/mix.lock
File name: neonfs_webdav/mix.lock
File name: nfs_server/mix.lock
Fromfor aes-gcm 0.11Key/NonceconstructionEdited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️ Warning: custom changes will be lost.