Skip to content

chore(deps): bump the cargo group across 1 directory with 6 updates - #20

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/contracts-legacy/cargo-567a5dd039
Open

chore(deps): bump the cargo group across 1 directory with 6 updates#20
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/contracts-legacy/cargo-567a5dd039

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 17, 2026

Copy link
Copy Markdown

Bumps the cargo group with 6 updates in the /contracts-legacy directory:

Package From To
soroban-sdk 23.0.2 23.5.3
keccak 0.1.5 0.1.6
rand 0.8.5 0.8.8
serde_with 3.14.0 3.23.0
soroban-sdk-macros 23.0.2 23.5.3
time 0.3.41 0.3.55

Updates soroban-sdk from 23.0.2 to 23.5.3

Release notes

Sourced from soroban-sdk's releases.

23.5.3

What's Changed

Full Changelog: stellar/rs-soroban-sdk@v23.5.2...v23.5.3

23.5.2

What's Changed

Bugs Fixed

All Changes

Full Changelog: stellar/rs-soroban-sdk@v23.5.1...v23.5.2

23.5.1

What's Changed

Bug Fixes

All Changes

Full Changelog: stellar/rs-soroban-sdk@v23.5.0...v23.5.1

23.5.0

What's Changed

New Features

  • MuxedAddress String Parsing: Added MuxedAddress::from_str and from_string methods to parse Stellar strkey addresses (G.../M.../C...) directly in contracts using no-alloc strkey parsing for Wasm compatibility. (stellar/rs-soroban-sdk#1701 #1678)

All Changes

Full Changelog: stellar/rs-soroban-sdk@v23.4.1...v23.5.0

23.4.1

What's Changed

Full Changelog: stellar/rs-soroban-sdk@v23.4.0...v23.4.1

23.4.0

What's Changed

... (truncated)

Commits
  • d3e1ab2 Fix Fr scalar field to reduce modulo r on construction (#1758)
  • df56ce8 Bump version to 23.5.3
  • 347f711 Fix trait method call resolution in contractimpl (#1729)
  • 9ec7aed Bump version to 23.5.2
  • 59fcef4 Fix range bound overflow in Vec/Bytes slice and GenRange gen_range for u64 (#...
  • 7870f0d Bump version to 23.5.1
  • 09f6ccf update fuzz lock
  • be3dc16 Add MuxedAddress::from_str and from_string methods (#1678)
  • a55c37b Bump version to 23.5.0
  • e671b39 test: update new event tests for v23
  • Additional commits viewable in compare view

Updates keccak from 0.1.5 to 0.1.6

Commits

Updates rand from 0.8.5 to 0.8.8

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

  • Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

[0.8.7] - 2026-07-02

Fixes

  • Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

[0.8.6] - 2026-04-14

This release back-ports a fix from v0.10. See also #1763.

Changes

  • Deprecate feature log (#1772)

#1763: rust-random/rand#1763 #1772: rust-random/rand#1772

  • Drop the experimental simd_support feature.
Commits

Updates serde_with from 3.14.0 to 3.23.0

Release notes

Sourced from serde_with's releases.

serde_with v3.23.0

Changed

  • Update syn and darling dependencies to use syn v3 (#992)
  • Update dev-dependencies to newer versions (#993)
  • Update base64 to a newer version. This should not have any API change, but some error messages might change. (#993)
  • serde_as can now parse cfg_attr(true, ...) and cfg_attr(false, ...) (#995) true/false are new literals as of Rust 1.88 but need to be parsed explicitly with the syn types. This is used when emitting schemars annotations.

serde_with v3.22.0

Added

  • Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936) jiff::SignedDuration works with DurationSeconds and its variants. jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants. Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

  • Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections. The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged). Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

serde_with v3.21.0

Security

  • GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries Bad or attacker controlled values could cause a panic while allocating too large values. Fixed in #966 by setting a maximum allocation size during the creation of collections like Vec or sets.

    Thanks to @​7thParkk for reporting the issue.

Added

  • Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#486)

Changed

  • Re-enable link-to-definition on docs.rs (#964)

Fixed

  • Fix some doc links to point to the correct types (#963)
  • Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#962)

serde_with v3.20.0

... (truncated)

Commits
  • ea5dfdc Bump version to v3.23.0 (#1005)
  • e52e85b Bump version to v3.23.0
  • 39955b6 Bump rmp dev-dependency (#1004)
  • b51e5fb Bump rmp dev-dependency
  • ef598c6 Use setup-rust-toolchain v2 instead of v1 (#1003)
  • 9ea2658 Fix cargo lint about workspace lints being inherited in the test crate
  • e5ad81a Use setup-rust-toolchain v2 instead of v1
  • 8100141 Bump the github-actions group across 1 directory with 2 updates (#1002)
  • 940f4a6 Bump jsonschema from 0.49.8 to 0.52.0 (#1001)
  • 6f42b94 Bump the github-actions group across 1 directory with 2 updates
  • Additional commits viewable in compare view

Updates soroban-sdk-macros from 23.0.2 to 23.5.3

Release notes

Sourced from soroban-sdk-macros's releases.

23.5.3

What's Changed

Full Changelog: stellar/rs-soroban-sdk@v23.5.2...v23.5.3

23.5.2

What's Changed

Bugs Fixed

All Changes

Full Changelog: stellar/rs-soroban-sdk@v23.5.1...v23.5.2

23.5.1

What's Changed

Bug Fixes

All Changes

Full Changelog: stellar/rs-soroban-sdk@v23.5.0...v23.5.1

23.5.0

What's Changed

New Features

  • MuxedAddress String Parsing: Added MuxedAddress::from_str and from_string methods to parse Stellar strkey addresses (G.../M.../C...) directly in contracts using no-alloc strkey parsing for Wasm compatibility. (stellar/rs-soroban-sdk#1701 #1678)

All Changes

Full Changelog: stellar/rs-soroban-sdk@v23.4.1...v23.5.0

23.4.1

What's Changed

Full Changelog: stellar/rs-soroban-sdk@v23.4.0...v23.4.1

23.4.0

What's Changed

... (truncated)

Commits
  • d3e1ab2 Fix Fr scalar field to reduce modulo r on construction (#1758)
  • df56ce8 Bump version to 23.5.3
  • 347f711 Fix trait method call resolution in contractimpl (#1729)
  • 9ec7aed Bump version to 23.5.2
  • 59fcef4 Fix range bound overflow in Vec/Bytes slice and GenRange gen_range for u64 (#...
  • 7870f0d Bump version to 23.5.1
  • 09f6ccf update fuzz lock
  • be3dc16 Add MuxedAddress::from_str and from_string methods (#1678)
  • a55c37b Bump version to 23.5.0
  • e671b39 test: update new event tests for v23
  • Additional commits viewable in compare view

Updates time from 0.3.41 to 0.3.55

Release notes

Sourced from time's releases.

v0.3.55

See the changelog for details.

v0.3.54

See the changelog for details.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

v0.3.51

See the changelog for details.

v0.3.49

See the changelog for details.

v0.3.48

See the changelog for details.

v0.3.47

See the changelog for details.

v0.3.46

See the changelog for details.

v0.3.45

See the changelog for details.

v0.3.44

See the changelog for details.

v0.3.43

See the changelog for details.

v0.3.42

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.55 [2026-08-01]

Fixed

  • Avoid underflow in DateIter::nth, ensuring correct behavior.
  • Avoid overflow when deserializing timestamps.
  • Handle out-of-bounds data when deserializing.
  • Don't assume that the format being deserialized was generated by the serializer; this previously led to some valid values being parsed incorrectly and others being rejected.
  • No longer silence errors when deserializing UtcOffset.
  • OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.
  • OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None for all out-of-range values, rather than unexpectedly panicking in some situations.

0.3.54 [2026-07-20]

Added

  • PrimitiveDateTime has been renamed to PlainDateTime.
  • Duration has been renamed to SignedDuration.
  • Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for backwards compatibility. The new names should be preferred.

Changed

  • The associated metadata type (for powerfmt implementations) for various types has been changed to () and made public. This guarantees that no additional metadata will be present.

Performance

  • More gains when parsing RFC 2822.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

  • Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result

... (truncated)

Commits
  • 857d9c4 v0.3.55 release
  • 2b72fcd Precise feature gating for macro
  • c1089eb Run check-targets, miri in parallel
  • f377fad Avoid range-validated ordinal => year in cascade
  • 2eacb0a Report miscellaneous tasks, overall status
  • 29621ac Speed up CI
  • 08de7ba Fix nano-timestamp validation
  • 3c3f046 Fix copy-paste error
  • 3c0c81c Cascade errors when deserializing UtcOffset
  • c21acd5 Handle more deserializations of SignedDuration
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the cargo group across 1 directory with 6 updates
79314b7 
Bumps the cargo group with 6 updates in the /contracts-legacy directory:

| Package | From | To |
| --- | --- | --- |
| [soroban-sdk](https://github.com/stellar/rs-soroban-sdk) | `23.0.2` | `23.5.3` |
| [keccak](https://github.com/RustCrypto/sponges) | `0.1.5` | `0.1.6` |
| [rand](https://github.com/rust-random/rand) | `0.8.5` | `0.8.8` |
| [serde_with](https://github.com/jonasbb/serde_with) | `3.14.0` | `3.23.0` |
| [soroban-sdk-macros](https://github.com/stellar/rs-soroban-sdk) | `23.0.2` | `23.5.3` |
| [time](https://github.com/time-rs/time) | `0.3.41` | `0.3.55` |



Updates `soroban-sdk` from 23.0.2 to 23.5.3
- [Release notes](https://github.com/stellar/rs-soroban-sdk/releases)
- [Commits](stellar/rs-soroban-sdk@v23.0.2...v23.5.3)

Updates `keccak` from 0.1.5 to 0.1.6
- [Commits](RustCrypto/sponges@keccak-v0.1.5...keccak-v0.1.6)

Updates `rand` from 0.8.5 to 0.8.8
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/0.8.8/CHANGELOG.md)
- [Commits](rust-random/rand@0.8.5...0.8.8)

Updates `serde_with` from 3.14.0 to 3.23.0
- [Release notes](https://github.com/jonasbb/serde_with/releases)
- [Commits](jonasbb/serde_with@v3.14.0...v3.23.0)

Updates `soroban-sdk-macros` from 23.0.2 to 23.5.3
- [Release notes](https://github.com/stellar/rs-soroban-sdk/releases)
- [Commits](stellar/rs-soroban-sdk@v23.0.2...v23.5.3)

Updates `time` from 0.3.41 to 0.3.55
- [Release notes](https://github.com/time-rs/time/releases)
- [Changelog](https://github.com/time-rs/time/blob/main/CHANGELOG.md)
- [Commits](time-rs/time@v0.3.41...v0.3.55)

---
updated-dependencies:
- dependency-name: soroban-sdk
  dependency-version: 23.5.3
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: keccak
  dependency-version: 0.1.6
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: rand
  dependency-version: 0.8.8
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: serde_with
  dependency-version: 3.23.0
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: soroban-sdk-macros
  dependency-version: 23.5.3
  dependency-type: indirect
  dependency-group: cargo
- dependency-name: time
  dependency-version: 0.3.55
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 17, 2026
Copilot AI balanced review requested due to automatic review settings September 17, 2026 19:52
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 17, 2026
Copilot AI reviewed Sep 17, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@socket-security

socket-security Bot commented Sep 17, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedcargo/​serde@​1.0.2298110093100100
Updatedcargo/​soroban-sdk@​23.0.2 ⏵ 23.5.382100 +393100100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant