chore(deps): bump the http-serialization-utils group in /core with 6 updates by dependabot[bot] · Pull Request #7693 · apache/opendal

dependabot · 2026-06-05T09:17:13Z

Bumps the http-serialization-utils group in /core with 6 updates:

Package	From	To
reqwest	`0.13.3`	`0.13.4`
http	`1.4.0`	`1.4.1`
quick-xml	`0.39.3`	`0.40.1`
serde_json	`1.0.149`	`1.0.150`
uuid	`1.23.1`	`1.23.2`
rustls-native-certs	`0.8.3`	`0.8.4`

Updates reqwest from 0.13.3 to 0.13.4

Release notes

Sourced from reqwest's releases.

v0.13.4

tl;dr

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

What's Changed

fix(tls): improve rustls-no-provider panic message and add module docs by @smythg4 in seanmonstar/reqwest#3021

fix: do not lose the url in error when decoding json by @Dushistov in seanmonstar/reqwest#3026

Add tls_sslkeylogfile builder method by @passcod in seanmonstar/reqwest#2923

fix(redirect): strip sensitive headers on scheme change across redirects by @SAY-5 in seanmonstar/reqwest#3034

chore: upgrade MSRV to 1.85 by @seanmonstar in seanmonstar/reqwest#3038

chore: clean up minimal-versions CI job by @seanmonstar in seanmonstar/reqwest#3039

fix(http3): use happy eyeballs for h3 connect by @lyuzichong in seanmonstar/reqwest#3030

fix: update hickory-resolver to 0.26 and adjust code accordingly by @seanmonstar in seanmonstar/reqwest#3040

fix: remove unwrap in hickory initialization by @mat813 in seanmonstar/reqwest#3041

feat(https): support TLS 1.3 as min version under native-tls 🎉 by @AverageHelper in seanmonstar/reqwest#2975

Expose keep alive configurations in blocking client by @aeb-dev in seanmonstar/reqwest#3043

Prepare v0.13.4 by @seanmonstar in seanmonstar/reqwest#3046

New Contributors

@smythg4 made their first contribution in seanmonstar/reqwest#3021

@Dushistov made their first contribution in seanmonstar/reqwest#3026

@SAY-5 made their first contribution in seanmonstar/reqwest#3034

@mat813 made their first contribution in seanmonstar/reqwest#3041

@AverageHelper made their first contribution in seanmonstar/reqwest#2975

@aeb-dev made their first contribution in seanmonstar/reqwest#3043

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

Changelog

Sourced from reqwest's changelog.

v0.13.4

Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.

Add ClientBuilder::http2_keep_alive_* options for the blocking client.

Add TLS 1.3 support when using native-tls backend.

Fix redirect handling to strip sensitive headers when the scheme changes.

Fix HTTP/3 happy-eyeball connection creation.

Upgrade hickory-resolver to 0.26.

Commits

11489b3 v0.13.4
d31ffbb feat: Expose HTTP2 keep alive configurations in blocking client (#3043)
79ed0d7 feat: support TLS 1.3 as min version under native-tls 🎉 (#2975)
fb7bf6a fix: remove unwrap in hickory initialization (#3041)
3da616f fix: update hickory-resolver to 0.26 and adjust code accordingly (#3040)
c77e7b2 fix(http3): use happy eyeballs for h3 connect (#3030)
9cbb65b chore: clean up minimal-versions CI job (#3039)
17a7dc5 chore: upgrade MSRV to 1.85 (#3038)
03db63a fix(redirect): strip sensitive headers on scheme change across redirects (#3034)
4b813a8 feat: add tls_sslkeylogfile builder method (#2923)
Additional commits viewable in compare view

Updates http from 1.4.0 to 1.4.1

Release notes

Sourced from http's releases.

v1.4.1

tl;dr

Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.

Fix Extend for HeaderMap to clamp max size hint and not overflow.

Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.

Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

What's Changed

chore(header): fix clippy::assign_op_pattern by @rxc-amzn in hyperium/http#806

ci: pin itoa in msrv job by @seanmonstar in hyperium/http#813

Remove unnecessary explicit lifetimes by @jplatte in hyperium/http#815

chore(ci): update to actions/checkout@v6 by @tottoto in hyperium/http#819

tests: update to rand 0.10 by @tottoto in hyperium/http#818

refactor: Remove usage of float instruction by @AurelienFT in hyperium/http#823

refactor(uri): consolidate PathAndQuery::from_shared and from_static by @seanmonstar in hyperium/http#825

fix(uri): reject Path::from_shared/from_static if doesn't start with slash by @seanmonstar in hyperium/http#826

Rephrase comment by @daalfox in hyperium/http#827

Fix typo in request builder docs by @vleksis in hyperium/http#831

fix: clamp Extend size hint so HeaderMap reserve cannot overflow by @SAY-5 in hyperium/http#833

fix(headers): fix stacked borrows for IterMut/ValuesIterMut by @seanmonstar in hyperium/http#837

fix(header): use a set_len guard in IntoIter drop by @seanmonstar in hyperium/http#838

New Contributors

@rxc-amzn made their first contribution in hyperium/http#806

@AurelienFT made their first contribution in hyperium/http#823

@daalfox made their first contribution in hyperium/http#827

@vleksis made their first contribution in hyperium/http#831

@SAY-5 made their first contribution in hyperium/http#833

Full Changelog: hyperium/http@v1.4.0...v1.4.1

Changelog

Sourced from http's changelog.

1.4.1 (May 25, 2026)

Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.

Fix Extend for HeaderMap to clamp max size hint and not overflow.

Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.

Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

Commits

a24c968 v1.4.1
bc3b044 fix(header): use a set_len guard in IntoIter drop (#838)
1b968dc fix(header): fix stacked borrows for IterMut/ValuesIterMut (#837)
6e2dd42 fix: clamp Extend size hint so HeaderMap reserve cannot overflow (#833)
68e0abb docs: fix typo in request builder docs (#831)
29dd307 docs(extensions): rephrase internal comment (#827)
ae48fb5 fix(uri): reject Path::from_shared/from_static if doesn't start with slash (#...
1ad200e refactor(uri): consolidate PathAndQuery::from_shared and from_static (#825)
d59d939 refactor: Remove usage of float instruction (#823)
ed680c4 tests: update to rand 0.10 (#818)
Additional commits viewable in compare view

Updates quick-xml from 0.39.3 to 0.40.1

Release notes

Sourced from quick-xml's releases.

v0.40.1 - Fix rarely possible serde deserialization panic

What's Changed

#964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE declaration appears between two text runs inside an element (e.g. <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's consecutive-text merge, so two DeEvent::Text events reached read_text and tripped its "Cannot be two consequent Text events" invariant. DOCTYPE is now treated as transparent during text drain — it still goes through the entity resolver, but the surrounding text is merged into one run. Discovered via libFuzzer on a real-world SAML deserializer harness.

#964: tafia/quick-xml#964

New Contributors

@williamareynolds made their first contribution in tafia/quick-xml#964

Full Changelog: tafia/quick-xml@v0.40.0...v0.40.1

v0.40.0 - UTF-16 and ISO-2022-JP encodings supported

What's Changed

MSRV bumped to 1.79.

Now quick-xml supports the UTF-16 and ISO-2022-JP encoded documents. See the new DecodingReader type.

New Features

#956: Add DecodingReader, a BufRead adapter that auto-detects encoding from BOM or XML declaration and transcodes to UTF-8. Enabled by the encoding feature.

#938: Add new enumeration XmlVersion and typified getter BytesDecl::xml_version().

#938: Add new error variant IllFormedError::UnknownVersion.

#371: Add new error variant EscapeError::TooManyNestedEntities.

#371: Improved compliance with the XML attribute value normalization process by adding

Attribute::normalized_value()

Attribute::normalized_value_with()

Attribute::decoded_and_normalized_value()

Attribute::decoded_and_normalized_value_with()

which ought to be used in place of deprecated

Attribute::unescape_value()

Attribute::unescape_value_with()

Attribute::decode_and_unescape_value()

Attribute::decode_and_unescape_value_with()

Deprecated functions now behaves the same as newly added.

Bug Fixes

#938: Use correct rules for EOL normalization in Deserializer when parse XML 1.0 documents. Previously XML 1.1. rules was applied.

Misc Changes

#914: Remove deprecated .prefixes(), .resolve(), .resolve_attribute(), and .resolve_element() of NsReader. Use .resolver().<...> methods instead.

#938: Now BytesText::xml_content, BytesCData::xml_content and BytesRef::xml_content accepts XmlVersion parameter to apply correct EOL normalization rules.

#944: read_text() now returns BytesText which allows you to get the content with properly normalized EOLs. To get the previous behavior use .read_text().decode()?.

#956: Bumped MSRV from 1.59 (Feb 2022) to 1.79 (June 2024)

... (truncated)

Changelog

Sourced from quick-xml's changelog.

0.40.1 -- 2026-05-15

Bug Fixes

#964: Fix unreachable!() panic in the serde deserializer when a DOCTYPE declaration appears between two text runs inside an element (e.g. <a>x<!DOCTYPE y>z</a>). The DOCTYPE used to break drain_text's consecutive-text merge, so two DeEvent::Text events reached read_text and tripped its "Cannot be two consequent Text events" invariant. DOCTYPE is now treated as transparent during text drain — it still goes through the entity resolver, but the surrounding text is merged into one run. Discovered via libFuzzer on a real-world SAML deserializer harness.

#964: tafia/quick-xml#964

Misc Changes

0.40.0 -- 2026-05-11

MSRV bumped to 1.79.

Now quick-xml supports the UTF-16 encoded documents. See the new DecodingReader type.

New Features

#956: Add DecodingReader, a BufRead adapter that auto-detects encoding from BOM or XML declaration and transcodes to UTF-8. Enabled by the encoding feature.

#938: Add new enumeration XmlVersion and typified getter BytesDecl::xml_version().

#938: Add new error variant IllFormedError::UnknownVersion.

#371: Add new error variant EscapeError::TooManyNestedEntities.

#371: Improved compliance with the XML attribute value normalization process by adding

Attribute::normalized_value()

Attribute::normalized_value_with()

Attribute::decoded_and_normalized_value()

Attribute::decoded_and_normalized_value_with()

which ought to be used in place of deprecated

Attribute::unescape_value()

Attribute::unescape_value_with()

Attribute::decode_and_unescape_value()

Attribute::decode_and_unescape_value_with()

Deprecated functions now behaves the same as newly added.

Bug Fixes

#938: Use correct rules for EOL normalization in Deserializer when parse XML 1.0 documents. Previously XML 1.1. rules was applied.

... (truncated)

Commits

9aaea92 Release 0.40.1
ce488bc Merge pull request #964 from williamareynolds/fix/de-doctype-in-text-unreachable
e00ae5c Fix unreachable!() panic when DOCTYPE appears between text runs in element co...
2778564 Release 0.40.0
393db03 Merge pull request #962 from Mingun/prepare-0.40
a27709a Fix misprint in code example
0c0c914 Make some functions const and enable clippy::missing_const_for_fn lint
bf4ffe5 Fix clippy warning: use .first() instead of .get(0)
d69baad Fix clippy warning: remove unnecessary after 241f01e20ff679e9248f2ae424c9ba82...
8e0ae4f Fix clippy warning: use strip_prefix instead of manual stripping
Additional commits viewable in compare view

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

Reject non-string enum object keys (#1324, thanks @puneetdixit200)

Commits

a1ae73a Release 1.0.150
1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
2037b63 Reject non-string enum object keys
5d30df6 Resolve manual_assert_eq pedantic clippy lint
dc8003a Raise required compiler for preserve_order feature to 1.85
a42fa98 Unpin CI miri toolchain
684a60e Pin CI miri to nightly-2026-02-11
7c7da33 Raise required compiler to Rust 1.71
acf4850 Simplify Number::is_f64
6b8ceab Resolve unnecessary_map_or clippy lint
Additional commits viewable in compare view

Updates uuid from 1.23.1 to 1.23.2

Release notes

Sourced from uuid's releases.

v1.23.2

What's Changed

Improve error messages for ambiguous formats by @KodrAus in uuid-rs/uuid#882

Prepare for 1.23.2 release by @KodrAus in uuid-rs/uuid#883

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

Commits

d119657 Merge pull request #883 from uuid-rs/cargo/v1.23.2
0651cfc prepare for 1.23.2 release
e8dea0c Merge pull request #882 from uuid-rs/fix/error-msgs
bdc429a fix up serde messages
d4342e4 make indexes 0 based and fix up more error messages
4ad479f work on more accurate parser errors
See full diff in compare view

Updates rustls-native-certs from 0.8.3 to 0.8.4

Release notes

Sourced from rustls-native-certs's releases.

0.8.4

What's Changed

Exclude development script by @weiznich in rustls/rustls-native-certs#216

Update README.md with CertificateResult by @jleffell in rustls/rustls-native-certs#225

chore(docsrs): make docs.rs build work by @joshuachp in rustls/rustls-native-certs#222

Ignore empty entries in SSL_CERT_DIR by @sliekens in rustls/rustls-native-certs#242

Commits

9d1f11e Bump version to 0.8.4
a008aa1 Take semver-compatible dependency versions
26d43e3 Ignore empty entries in SSL_CERT_DIR
4d4f4de build(deps): bump serial_test from 3.4.0 to 3.5.0 in the crates-io group
8707835 Take semver-compatible dependency updates
f89af49 Apply suggestions from nightly clippy
4ea7b7b build(deps): bump rustls from 0.23.38 to 0.23.39 in the crates-io group
fa48b0a Take semver-compatible dependency updates
559fd3d build(deps): bump the crates-io group with 2 updates
0346ae5 Take semver-compatible dependency updates
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the http-serialization-utils group in /core with 6 updates: | Package | From | To | | --- | --- | --- | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.3` | `0.13.4` | | [http](https://github.com/hyperium/http) | `1.4.0` | `1.4.1` | | [quick-xml](https://github.com/tafia/quick-xml) | `0.39.3` | `0.40.1` | | [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.150` | | [uuid](https://github.com/uuid-rs/uuid) | `1.23.1` | `1.23.2` | | [rustls-native-certs](https://github.com/rustls/rustls-native-certs) | `0.8.3` | `0.8.4` | Updates `reqwest` from 0.13.3 to 0.13.4 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.3...v0.13.4) Updates `http` from 1.4.0 to 1.4.1 - [Release notes](https://github.com/hyperium/http/releases) - [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md) - [Commits](hyperium/http@v1.4.0...v1.4.1) Updates `quick-xml` from 0.39.3 to 0.40.1 - [Release notes](https://github.com/tafia/quick-xml/releases) - [Changelog](https://github.com/tafia/quick-xml/blob/master/Changelog.md) - [Commits](tafia/quick-xml@v0.39.3...v0.40.1) Updates `serde_json` from 1.0.149 to 1.0.150 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.149...v1.0.150) Updates `uuid` from 1.23.1 to 1.23.2 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.23.1...v1.23.2) Updates `rustls-native-certs` from 0.8.3 to 0.8.4 - [Release notes](https://github.com/rustls/rustls-native-certs/releases) - [Commits](rustls/rustls-native-certs@v/0.8.3...v/0.8.4) --- updated-dependencies: - dependency-name: reqwest dependency-version: 0.13.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: http-serialization-utils - dependency-name: http dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: http-serialization-utils - dependency-name: quick-xml dependency-version: 0.40.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: http-serialization-utils - dependency-name: serde_json dependency-version: 1.0.150 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: http-serialization-utils - dependency-name: uuid dependency-version: 1.23.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: http-serialization-utils - dependency-name: rustls-native-certs dependency-version: 0.8.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: http-serialization-utils ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Jun 5, 2026

dependabot Bot requested a review from Xuanwo as a code owner June 5, 2026 09:17

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update Rust code labels Jun 5, 2026

dosubot Bot added size:S This PR changes 10-29 lines, ignoring generated files. releases-note/chore The PR has a title that begins with "chore" or changes other small things that hard to tell labels Jun 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the http-serialization-utils group in /core with 6 updates#7693

chore(deps): bump the http-serialization-utils group in /core with 6 updates#7693
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/core/http-serialization-utils-da820cc14f

dependabot Bot commented on behalf of github Jun 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 5, 2026

v0.13.4

tl;dr

What's Changed

New Contributors

v0.13.4

v1.4.1

tl;dr

What's Changed

New Contributors

1.4.1 (May 25, 2026)

v0.40.1 - Fix rarely possible serde deserialization panic

What's Changed

New Contributors

v0.40.0 - UTF-16 and ISO-2022-JP encodings supported

What's Changed

New Features

Bug Fixes

Misc Changes

0.40.1 -- 2026-05-15

Bug Fixes

Misc Changes

0.40.0 -- 2026-05-11

New Features

Bug Fixes

v1.0.150

v1.23.2

What's Changed

0.8.4

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants