chore(deps): weekly safe cargo updates · 2 packages

[mendral-app]

Packages bumped

Crate	Old	New	Published
ammonia	4.1.2	4.1.4	2026-07-22
tokio	1.49.0	1.53.1	2026-07-20

Per-package detail

ammonia 4.1.2 → 4.1.4

• 4.1.3: Intermediate release (no details).
• 4.1.4: Security fix — SVG animation and set elements can cause XSS because attributeName is not checked (reported by Younghun Ko, koyokr).
• Impact: We use ammonia in src/sanitize/text.rs for HTML sanitization. This patch hardens SVG element handling against XSS — directly relevant to our use case of sanitizing untrusted HTML content from PR descriptions.

tokio 1.49.0 → 1.53.1

• 1.50–1.53.0: See PR #40 for full changelog (adds runtime introspection APIs, spawn_blocking improvements, etc.).
• 1.53.1: Restores MSRV by removing OnceLock::wait from Windows signal handler; fixes alt timer cancellation race (unstable feature only).
• Impact: We use macros, rt-multi-thread, signal on Linux. The MSRV restoration is a correctness fix; the timer race fix is in unstable code we don't use. No code changes needed.

Files modified

• Cargo.toml
• Cargo.lock

Skipped this ecosystem

Crate	Current	Latest eligible	Reason
askama_escape	0.15.4	0.16.0	Open PR #24
async-trait	0.1.89	0.1.91	Open PR #40
axum	0.8.8	0.8.9	Open PR #31
chrono	0.4.44	0.4.45	Open PR #31
hex	0.4.3	0.4.3	Already latest
hmac	0.12.1	0.13.0	Open PR #33
http	1.4.0	1.5.0	1.5.0 published 2026-07-29, within cooldown; 1.4.2 covered by PR #29
http-body-util	0.1.3	0.1.4	Open PR #37
jsonwebtoken	10.3.0	11.0.0	Major bump — separate PR
mockall	0.14.0	0.15.0	Open PR #35
octocrab	0.49.5	0.54.1	Open PR #28 at 0.53.1; pre-1.0 breaking bumps
rand	0.10.0	0.10.2	Open PR #37
reqwest	0.13.2	0.13.4	Open PR #31
rustls	0.23.37	0.23.42	Open PR #37
serde	1.0.228	1.0.229	Open PR #40
serde_json	1.0.149	1.0.151	Open PR #40
sha2	0.10.9	0.11.0	Open PR #33
thiserror	2.0.18	2.0.19	Open PR #40
tower	0.5.3	0.5.3	Already latest
tracing	0.1.44	0.1.44	Already latest
tracing-subscriber	0.3.22	0.3.23	Open PR #29
uuid	1.21.0	1.24.0	Open PR #37

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session

[cloudflare-workers-and-pages]

Deploying pratrol with    Cloudflare Pages

Latest commit:	c3514bb
Status:	✅  Deploy successful!
Preview URL:	https://69a9a578.pratrol.pages.dev
Branch Preview URL:	https://mendral-deps-weekly-safe-car-9cpr.pratrol.pages.dev

View logs