chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #2348 · DataDog/saluki

renovate · 2026-08-17T02:50:37Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
anyhow	workspace.dependencies	patch	`1.0.103` → `1.0.104`
anymap3	workspace.dependencies	minor	`1.0.1` → `1.1.0`
arc-swap	workspace.dependencies	patch	`1.9.1` → `1.9.2`
async-compression	workspace.dependencies	patch	`0.4.42` → `0.4.43`
async-trait	workspace.dependencies	patch	`0.1.89` → `0.1.92`
aws-lc-rs	workspace.dependencies	minor	`1.17.1` → `1.18.0`
bytes	workspace.dependencies	patch	`1.12.0` → `1.12.1`
bytesize	workspace.dependencies	minor	`2.4.0` → `2.7.0`
clap	workspace.dependencies	patch	`4.6.1` → `4.6.6`
crossbeam-queue (source)	workspace.dependencies	patch	`0.3.12` → `0.3.13`
futures (source)	workspace.dependencies	patch	`0.3.32` → `0.3.33`	`0.3.34`
http	workspace.dependencies	minor	`1.4.2` → `1.5.0`
http-body	workspace.dependencies	minor	`1.0.1` → `1.1.0`
http-body-util	workspace.dependencies	patch	`0.1.3` → `0.1.4`	`0.1.5`
hyper (source)	workspace.dependencies	minor	`1.10.1` → `1.11.0`
kube	workspace.dependencies	minor	`4.0.0` → `4.2.0`
libc	workspace.dependencies	patch	`0.2.186` → `0.2.189`
memchr	workspace.dependencies	patch	`2.8.2` → `2.8.3`
opentelemetry-semantic-conventions (source)	workspace.dependencies	patch	`0.32.0` → `0.32.1`
proc-macro2	workspace.dependencies	patch	`1.0.106` → `1.0.107`
quote	workspace.dependencies	patch	`1.0.45` → `1.0.47`
rand (source)	workspace.dependencies	patch	`0.10.1` → `0.10.2`
regex	workspace.dependencies	minor	`1.12.4` → `1.13.1`
rustls	workspace.dependencies	patch	`0.23.41` → `0.23.43`
rustls-pki-types	workspace.dependencies	minor	`1.14.1` → `1.15.1`
serde (source)	workspace.dependencies	patch	`1.0.228` → `1.0.229`
serde_json	workspace.dependencies	patch	`1.0.150` → `1.0.151`
serde_with	workspace.dependencies	minor	`3.21.0` → `3.22.0`
snafu	workspace.dependencies	patch	`0.9.1` → `0.9.2`
socket2	workspace.dependencies	patch	`0.6.4` → `0.6.5`
tokio (source)	workspace.dependencies	minor	`1.52.3` → `1.53.1`
tokio-util (source)	workspace.dependencies	patch	`0.7.18` → `0.7.19`
triomphe	workspace.dependencies	patch	`0.1.15` → `0.1.16`
trybuild	workspace.dependencies	patch	`1.0.117` → `1.0.120`
twox-hash	workspace.dependencies	patch	`2.1.2` → `2.1.3`
uuid	workspace.dependencies	minor	`1.23.3` → `1.24.0`	`1.24.1`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

dtolnay/anyhow (anyhow)

`v1.0.104`

Compare Source

Update syn dev-dependency to version 3

reivilibre/anymap3 (anymap3)

`v1.1.0`

Compare Source

Removals and Deprecations

Increase Minimum Supported Rust Version (MSRV) to 1.56 (October 2021). (#7)

Features

Support the AnyDebug trait from the anymore crate. Enable with anymore crate feature. Contributed by @DJMcNab — thank you. (#5)

Internal Changes

Add CI for tests and linting. (#6)
Fix our tests to work with new Rust versions, which changed the internal representation of TypeId. Runtime behaviour was unaffected. (#7)

vorner/arc-swap (arc-swap)

`v1.9.2`

Document RefCnt must not panic (#208).

Nullus157/async-compression (async-compression)

`v0.4.43`

Compare Source

Other

Fix hang when decoding a corrupt subsequent zstd frame (#470)

dtolnay/async-trait (async-trait)

`v0.1.92`

Compare Source

Resolve double_must_use clippy lint in generated code (#303)

`v0.1.91`

Compare Source

`v0.1.90`

Compare Source

Update to syn 3

aws/aws-lc-rs (aws-lc-rs)

`v1.18.0`: aws-lc-rs v1.18.0

Compare Source

AWS-LC-FIPS module updated to 4.x

This release switches aws-lc-fips-sys (used via the fips feature) from the AWS-LC-FIPS 3.x branch to AWS-LC-FIPS 4.0.

If your project requires FIPS compliance, please consult your local FIPS compliance experts before upgrading. The FIPS v3 module shipped in aws-lc-rs v1.17.x is FIPS 140-3 validated (Certificate #5314 static, Certificate #5298 dynamic). The 4.x module has completed validation testing by an accredited lab and has been submitted to NIST for certification. Refer to the CMVP Modules In Progress List for its current status, and to FIPS.md for security policies and supported operating environments.
Consumers who need to remain on the FIPS 3.x module should pin aws-lc-rs to <1.18.0. See the Cargo Book on Specifying Dependencies.

AWS-LC-FIPS module	aws-lc-rs
2.0.x	<1.12.0
3.0.x	<1.18.0
4.x	latest

What's Changed

Switch aws-lc-fips-sys to AWS-LC's "FIPS 4.0" branch by @justsmth in #1185
- aws-lc-fips-sys v0.13.16 -> v0.14.0. Please see the call-out above.
The ML-DSA signature APIs are now stable 🎉 by @justsmth in #1188 and #1189
- PqdsaKeyPair, PqdsaPublicKey, PqdsaPrivateKey, PqdsaSigningAlgorithm, PqdsaVerificationAlgorithm, and the ML_DSA_44 / ML_DSA_65 / ML_DSA_87 algorithms (and their _SIGNING counterparts) now live in aws_lc_rs::signature. ML-DSA no longer requires the unstable feature, and is now available under fips -- the FIPS 4.0 module provides ML-DSA, which is what had kept these APIs unstable. See our updated API documentation.
- Please migrate any use of aws_lc_rs::unstable::signature to aws_lc_rs::signature. The unstable::signature module remains as deprecated aliases and will be removed in a future release.
- PqdsaKeyPair::to_pkcs8 has been renamed to to_pkcs8v1, since elsewhere in the module an unqualified to_pkcs8 means PKCS#8 v2. A deprecated to_pkcs8 alias remains available under the unstable feature.
- Existing unstable consumers continue to compile, with deprecation warnings. Two cases need a source change: builds using #![deny(warnings)], and code that glob-imports both signature::* and unstable::signature::*, which now needs an explicit import to disambiguate.
- Behavior change: PqdsaVerificationAlgorithm::parsed_verify_digest_sig now always returns Unspecified. Digest-then-verify is not an operation defined by FIPS 204 -- pure ML-DSA signs the message itself, and the pre-hash variant (HashML-DSA) uses a distinct domain separator that this API does not implement.
Add out-of-place AEAD sealing by @iainmcgin in #1183
- Adds seal_separate_out_of_place to LessSafeKey and TlsRecordSealingKey. Every sealing entry point was previously in-place, so a caller whose plaintext was borrowed or shared had to copy it into a scratch buffer purely to make it mutable. This mirrors the existing open_separate_gather, so the sealing and opening directions now match.
Add rsa::KeyPair::from_components for constructing RSA key pairs from raw components by @justsmth in #1175
- Adds rsa::KeyPairComponents and rsa::KeyPair::from_components, matching ring 0.17, so a signing key can be built from formats such as JWK without first encoding the components as DER. Unlike ring, d and the CRT parameters are validated at construction using RSA_check_key, so keys with inconsistent or placeholder values that ring accepts may be rejected. Unnecessary generic bounds were also removed from PublicKeyComponents.
Automatically optimize aws-lc for size when opt-level is "s" or "z" by @justsmth in #1159
- The builder now enables AWS-LC's size-optimized configuration (OPENSSL_SMALL, and no AVX-512 assembly on x86_64) whenever Cargo is already building for size. In CI, a small binary exercising SHA-256, AES-256-GCM, and ECDSA P-256 is 36-50% smaller at opt-level=z than at opt-level=3: 50% on x86_64 Linux, 48% on aarch64 macOS, 39% on x86_64 Windows, 36% on aarch64 Linux. Your own savings depend on how much of AWS-LC your binary retains.
- No algorithms are removed and outputs are unchanged; the trade-off is slower elliptic-curve performance. Set AWS_LC_SYS_SMALL=1/=0 to force it on or off independently of opt-level.
- FIPS builds do not opt in automatically: aws-lc-fips-sys requires an explicit AWS_LC_FIPS_SYS_SMALL=1, and warns when it is set.
- Partially addresses #745; the default size under opt-level=3 footprint is unchanged.
Export native library build metadata from the -sys crates by @justsmth in #1187, including original commits from @glebpom in #1184
- Downstream build scripts compiling C code against AWS-LC can now locate our artifacts via DEP_AWS_LC_* / DEP_AWS_LC_FIPS_* (libdir, libcrypto_path, link_kind, and libssl_path with ssl), consistently across the CC, CMake, and system-library build paths. Existing linker directives are unchanged. On Windows, the *_path values are the link-time artifact (import library), not the runtime DLL.
Key wrap hardening by @justsmth in #1190 and #1191
- KeyEncryptionKey::unwrap no longer underflows on ciphertexts shorter than 8 bytes. Since the ciphertext is untrusted input, builds with overflow-checks = true would panic instead of returning the documented Err(Unspecified); default release builds were unaffected.
- KeyEncryptionKey now zeroizes its key material on drop, consistent with the other key types in this crate.
docs(signature): correct outdated note about signing a separate digest by @WesleyRosenblum in #1186

Upstream AWS-LC (v5.5.0)

aws-lc-sys v0.44.0 aligns with AWS-LC v5.5.0 (previously v5.2.0). See also the release notes for v5.3.0 and v5.4.0.

Build Improvements

Fix bindings copy from read-only prebuilt AWS-LC install by @justsmth in #1194
- Copies into OUT_DIR now remove any stale destination first and leave the fresh copy writable, so building against a read-only prebuilt install (e.g. the Nix store) no longer fails with Permission denied on a build-script rerun. An OUT_DIR already poisoned by an earlier build now recovers without a cargo clean.

Issues Being Closed

ML-DSA stabilization? -- #964
Expose out-of-place AEAD sealing -- #1182
Construct an RSA Key pair from raw private components -- #791
aws-lc-sys build script fails to copy bindings from read only prebuild aws-lc on repeat runs -- #1193

Other Merged PRs

ci: fix mdbook test failure and run docs checks on PRs by @justsmth in #1181
Publish script fixes: cargo clean failure, and verify aws-lc-rs against minimum published sys crates by @justsmth in #1179
Prepare aws-lc-sys v0.44.0 by @justsmth in #1199
Prepare aws-lc-rs v1.18.0 by @justsmth in #1200

New Contributors

@iainmcgin made their first contribution in #1183
@glebpom made their first contribution in #1184 (landed via #1187)

Full Changelog: aws/aws-lc-rs@v1.17.3...v1.18.0

`v1.17.3`: aws-lc-rs v1.17.3

Compare Source

What's Changed

Add public API to check AWS-LC and FIPS versions by @prasden in #1167
- awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
Clarify representations of PqdsaKeyPair in serialized forms by @Mark-Simulacrum in #1174
- Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

Fix TARGET_* env leakage into host builds by @justsmth in #1171
- Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
Restore cc default flags in memcmp probe; only fail build on confirmed bug by @justsmth in #1173
- Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

Public API for FIPS status -- #1166
memcmp probe fails under RPM hardened build flags -- #1168
Cross-compilation failure: TARGET_CFLAGS applied to host builds -- #1169

Other Merged PRs

ci: Stop installing winehq-stable in cross windows-gnu pre-build by @justsmth in #1172
ci: only run push-triggered workflows on main by @justsmth in #1163
Prepare aws-lc-sys v0.43.0 by @justsmth in #1176
Prepare aws-lc-rs v1.17.2 by @justsmth in #1178
Prepare aws-lc-fips-sys v0.13.16 by @justsmth in #1180
build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #1177

New Contributors

@Mark-Simulacrum made their first contribution in #1174
@prasden made their first contribution in #1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE]
aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

`v1.17.2`

Compare Source

tokio-rs/bytes (bytes)

`v1.12.1`

Compare Source

Fixed

Properly handle when Box::new panics (#837)

bytesize-rs/bytesize (bytesize)

`v2.7.0`

Compare Source

Remove no-alloc support because it removed ByteSize::display() when default features were disabled.

`v2.6.0`

Compare Source

Add display styles for IEC and SI bit units.

`v2.5.0`

Compare Source

Honor precision when a width is set with formatting args.
Add #[no_alloc] support.

`v2.4.2`

Compare Source

Improve accuracy of parsing large non-decimal byte count strings.

`v2.4.1`

Compare Source

Fix rounding error near power-of-unit boundaries.

clap-rs/clap (clap)

`v4.6.6`

Compare Source

Features

Add Command::get_overridden_usage

`v4.6.5`

Compare Source

`v4.6.4`

Compare Source

Internal

Update to syn v3

`v4.6.3`

Compare Source

Fixes

(derive) Allow "literal".function() as attribute values

`v4.6.2`

Compare Source

Fixes

(help) Say alias when there is only one

crossbeam-rs/crossbeam (crossbeam-queue)

`v0.3.13`: crossbeam-queue 0.3.13

Compare Source

Add push_mut and pop_mut to ArrayQueue and SegQueue. (#1191)

rust-lang/futures-rs (futures)

`v0.3.33`

Compare Source

Fix ReadLine's soundness issue regarding to exception safety. (#3020)
Fix unsound Send impl for IterPinRef and Iter. (#3003)
Fix stacked borrows violation in compat01as03 implementation. (#3012)
Fix memory leak in FuturesUnordered::IntoIter. (#3005)
Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
Re-export alloc::task::Wake. (#3010)
Update spin to 0.12. (#3014)

hyperium/http (http)

`v1.5.0`

Compare Source

Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
Fix uri::PathAndQuery parsing to enforce URI max length.

hyperium/http-body (http-body)

`v1.1.0`

Compare Source

tl;dr

Implement Add for SizeHint.
Implement Copy for SizeHint.

hyperium/hyper (hyper)

`v1.11.0`

Compare Source

Bug Fixes

http1:
- discard content-length header when received before transfer-encoding (#4124) (540fff91, closes #4123)
- use append for repeat trailer values in encoder (#4118) (de1483d7)
- allow up to max_headers trailers (#4108) (f584091a)
- use append for repeat trailers (#4107) (876effe1)
- flush buffered data before shutdown (#4018) (72046cc7, closes #4022)
- more strictly enforce max_buf_size when parsing (#4093) (90ede307, closes #4081)
http2: avoid buffering Upgraded writes without send capacity (#4102) (aecf5abf)

Features

rt: add ReadBufCursor::initialized_unfilled() method (#4115) (ccc1e850)

v1.10.1 (2026-05-29)

Bug Fixes

http1: fix busy loop when peer half-closes and open body (#4086) (c6cb906f, closes #4085)

kube-rs/kube (kube)

`v4.2.0`

Compare Source

===================

see kube-rs/kube@4.0.0...main

rust-lang/libc (libc)

`v0.2.189`

Compare Source

Added

Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
Linux SPARC: Enable the clone3 syscall (#4980)
Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
NuttX: Fix wchar_t definition under Arm (#5245)
Windows: Add back link names for time-related symbols (#5300)

`v0.2.188`

Compare Source

Changed

Restore Send and Sync for DIR (35b062263401)

These were removed in 0.2.187 because libc does not actually make Send and Sync
guarantees about DIR (or other extern types), but this caused some crates to break.
The traits are added back for now to allow time to migrate, but will be removed again
in the future; please make sure your crates are not relying on libc::DIR: Send or
libc::DIR: Sync.

`v0.2.187`

Compare Source

This release contains a number of improvements related to 64-bit time_t configuration.
Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced
with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to
specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits
uClibc now supports a similar configuration option:
```
RUSTFLAGS='--cfg=libc_unstable_uclibc_time64'
```

As a reminder, these options are under active development and may change in the future
(hence the "unstable" in the name). It likely that we will harmonize everything under a
single configuration option before considering them stable.

Support

Add support for aarch64-unknown-linux-pauthtest (#5065)
Add support for new QNX targets (#5241)
Better document breaking change policy and recommended usage (#5179)

Added

Android: Add POSIX_SPAWN_* constants (#5104)
Android: Add getpwent, setpwent, and endpwent (#5160)
Android: Add preadv2 and pwritev2 (#5157)
Android: Add seccomp_notif* structures (#5224)
Android: Add timer_[create, delete, getoverrun, gettime, settime] (#5108)
Apple: Add PROC_PIDT_SHORTBSDINFO and proc_bsdshortinfo (#5110)
Apple: Add SIOC* constants from sockio.h (#5263)
Apple: Add _IOR, _IOW, _IOWR (#5264)
Apple: Add bpf_program and bpf_insn (#5235)
Apple: Add additional kqueue constants (#5077)
Apple: Update vm_statistics64 with recently added fields (#5253)
Apple: add IN6_IFF_* and SIOCGIFAFLAG_IN6 (#5239)
Dragonfly: Add O_*, POSIX_FADV_*, NI*, and a few other missing constants (#5116)
Dragonfly: add fdatasync, dlvsym, reallocarray, qsort_r, pthread_*affinity_np, ftok, extattr_*, and dup3 (#5116)
Emscripten: Add in6_pktinfo (#5256)
FreeBSD: Add SOL_LOCAL (#5185)
FreeBSD: Add DLT_* constants (#5235)
FreeBSD: Add PROC_LOGSIGEXIT_* and PPROT_* (#4657)
FreeBSD: Add SO_RERROR (#5260)
FreeBSD: add IN6_IFF_*, in6_ifreq, and SIOCGIFAFLAG_IN6 (#5239)
FreeBSD: add _IO* helpers from sys/ioccom.h (#5239)
Glibc: Add PTHREAD_*_MUTEX_INITIALIZER_NP for riscv64 (#5094)
Glibc: Add new fields to struct tcp_info (#5215)
Linux: Add OPEN_TREE_NAMESPACE (#5145)
Linux: Add SECCOMP_IOCTL_* constants (#5224)
Linux: Add SO_DETACH_REUSEPORT_BPF (#5081)
Linux: Add futex_waitv (#5125)
Linux: Add constants for fsopen, fsconfig, fsmount, and fspick (#5145)
Linux: Add fields to statx present since 6.16 (#4621)
Linux: Add network entry API (#5049)
Linux: add ifaddrmsg and rtattr (#5234)
Linux: add sockaddr_iucv (#5041)
MacOS: Add ENOTCAPABLE (#4925)
Musl: Add renameat2 (#5113)
NuttX: Add F_SETFD (#5258)
NuttX: Add POLLRD* and POLLWR* constants (#5258)
NuttX: Add SO_KEEPALIVE and TCP keepalive constants (#5111)
NuttX: Add TCP_MAXSEG (#5258)
NuttX: Add eventfd and EFD_* constants (#5258)
NuttX: Add pipe2 (#5258)
NuttX: Add strerror_r (#5258)
NuttX: Add netinet structs and constants (#5258)
NuttX: Add socket structs, functions and constants (#5258)
QuRT: Add POSIX timer functions (#5091)
QuRT: Add missing pthread functions from QuRT SDK headers (#5091)
QuRT: Add missing unistd process and file functions (#5091)
QuRT: Add mqueue subsystem (message queues, select/pselect) (#5091)
Redox: Add *at and dirent functions (#5117)
Solarish: Add IP TTL and IPv6 Hop Limit consts (#5089)
Solarish: Add port_alert and PORT_ALERT* constants (#5203)
Solarish: add AI_CANONNAME (#5085)
aarch64: Add SYS_sendfile and SYS_fadvise64 constants (#5133)

Deprecated

Dragonfly: Deprecate compatibility aliases CPUCTL_RSMSR and UTX_DB_LASTLOG (#5116)

Fixed

breaking NetBSD: Correct ts from *const timespec to *mut timespec in _lwp_park` (#5169)
breaking Linux GNU: Change overflowing PTRACE_*ET_SYSCALL_USER_DISPATCH_CONFIG constants from u8 to c_uint (#4936)
Fix the soundness bug in the representation of extern types (#5021)
Cygwin: fix cpuset_t typo in CPU_ZERO (#5098)
Dragonfly: ABI fixes including regex offsets, ifaddrs, pthread barriers, process sizing fields, and mcontext alignment (#5116)
Dragonfly: Correct values of CPUCTL_CPUID*, EV_HUP, and EV_SYSFLAGS (#5116)
Emscripten: fix pthread type sizes for wasm64 (MEMORY64) (#5156)
Horizon: Fix the value of POLLOUT (#5090)
Linux: Correct the value of EPIOC[GS]PARAMS with nonstandard _IOC (#5188)
Make VxWorks shims unsafe (#3727)
NetBSD: Correct getmntinfo to link __getmntinfo13 (#5251)
QNX: Fix the value of PTHREAD_MUTEX_INITIALIZER (#5241)
QuRT: fix type and definition inaccuracies against SDK headers (#5091)
Windows: Correctly link to 32-bit time routines on 32-bit platforms (#5059)
uClibc: Fix constants accidentally removed (#5141)
uclibc: Fix build issues (#5046)
uclibc: Fix type of PRIO_PROCESS and friends (#5046)

Changed

AIX, TeeOS: Drop unneeded -> c_void (#5240)
Apple: Change AIO_LISTIO_MAX to account for changes in macOS 27 (#5253)
Glibc: Update the value of MS_NOUSER (#5215)
L4Re: Update definitions and test infra (#5275)
Linux: Update the value of SW_MAX and SW_CNT (#5215)
MacOS: Add swapped_count to vm_statistics64 (#4926)
Windows: Windows-GNU now respects libc_unstable_gnu_time_bits for 64-bit time_t config (#5062)

Removed

Dragonfly: Remove FreeBSD-only Elf32_Lword, ip_mreq_source, and IP_ constants (#5116)
Dragonfly: Remove private VM type bindings (#5116)
Linux: Remove KERN_REALROOTDEV and VM_LAPTOP_MODE (#5177)
VxWorks: Remove non-user-facing (kernel) API (#5129)

Other

Print config information if LIBC_BUILD_VERBOSE is set (#5272)
Annotate *LAST constants as potentially changing (#5120)
Annotate *MAX constants as potentially changing (#5122)
BSD: Annotate ELAST constants as potentially changing (#5118)
FreeBSD: Annotate RAND_MAX as potentially changing (#5119)
Linux, L4re: Annotate *NUM constants as potentially changing (#5123)
QNX: Restructure to support new platforms (#4984)
Unix: Annotate *COUNT constants as potentially changing (#5121)
uClibc: Add unstable support of 64-bit time_t (#5046)
(internal) FreeBSD: Replace unstable env to set version with an unstable cfg (#5201)
(internal) Glibc: Remove public configuration for file offset bits (#5268)
(internal) Linux: Delete config via RUST_LIBC_UNSTABLE_LINUX_TIME_BITS64 (#5197)
(internal) Replace RUST_LIBC_UNSTABLE env with libc_unstable* cfg (#4977)

BurntSushi/memchr (memchr)

`v2.8.3`

Compare Source

open-telemetry/opentelemetry-rust (opentelemetry-semantic-conventions)

`v0.32.1`

Compare Source

Released 2026-Jun-26

Update to v1.42.0 of the semantic conventions.

dtolnay/proc-macro2 (proc-macro2)

`v1.0.107`

Compare Source

Documentation improvements

dtolnay/quote (quote)

`v1.0.47`

Compare Source

Documentation improvements

`v1.0.46`

Compare Source

Avoid repeated get_span in quote_spanned (#329, thanks @Noratrieb)

rust-random/rand (rand)

`v0.10.2`

Compare Source

Fixes

Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

rust-lang/regex (regex)

`v1.13.1`

Compare Source

===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#1364 for (many) more details.

Bug fixes:

#1354:
Fixes previously unsound reverse suffix and inner optimizations.

`v1.13.0`

Compare Source

===================
This release includes a new API, a regex! macro, for lazy compilation of
a regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:

use regex::regex;

fn is_match(line: &str) -> bool {
    // The regex will be compiled approximately once and reused automatically.
    // This avoids the footgun of using `Regex::new` here, which would
    // guarantee that it would be compiled every time this routine is called.
    // This would likely make this routine much slower than it needs to be.
    regex!(r"bar|baz").is_match(line)
}

let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";

let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

#709:
Add a new regex! macro for efficient and automatic reuse of a compiled regex.

serde-rs/serde (serde)

`v1.0.229`

Compare Source

Update to syn 3

serde-rs/json (serde_json)

`v1.0.151`

Compare Source

Add RawValue::from_string_unchecked (#1331, thanks @WonderLawrence)

jonasbb/serde_with (serde_with)

`v3.22.0`: serde_with v3.22.0

Compare Source

Added

Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#936)
jiff::SignedDuration works with DurationSeconds and its variants.
jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants.
Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections.
The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged).
Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

shepmaster/snafu (snafu)

`v0.9.2`

Compare Source

Fixed

The whatever macro no longer triggers the
semicolon_in_expressions_from_macros lint.

rust-lang/socket2 (socket2)

`v0.6.5`

Add support for Emscripten (wasm32)
(#660).
Add support for NuttX
(#663).
Enable Socket::(set_)tos_v4 on illumos
(#662).

tokio-rs/tokio (tokio)

`v1.53.1`: Tokio v1.53.1

Compare Source

1.53.1 (July 20th, 2026)

Fixed

signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

time: fix alt timer cancellation and insertion race (#8252)

Documented

runtime: remove dead link definition in Runtime::block_on (#8301)

`v1.53.0`: Tokio v1.53.0

Compare Source

1.53.0 (July 17th, 2026)

Added

fs: implement From<OwnedFd> and From<OwnedHandle> for File ([#8266])
metrics: add task schedule latency metric ([#7986])
net: add SocketAddr methods to Unix sockets ([#8144])

Changed

io: add #[inline] to IO trait impls for in-memory types ([#8242])
net: implement UCred::pid on FreeBSD ([#8086])
net: support Nuttx target os ([#8259])
signal: refactor global variables on Windows ([#8231])
sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders ([#8095])
taskdump: support taskdumps on s390x ([#8192])
time: add #[track_caller] to timeout_at() ([#8077])
time: consolidate mutex locks on spurious poll ([#8124])
time: defer waker clone on spurious poll ([#8107])
time: move lazy-registration state into Sleep ([#8132])
tracing: remove unnecessary span clone ([#8126])

Fixed

io: do not treat zero-length reads as EOF in Chain ([#8251])
net: use getpe

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

datadog-prod-us1-3

The Linux artifact published with a -fips tag would move from AWS-LC-FIPS 3.x’s validated module to 4.x, which the dependency release notes say is still awaiting NIST certification. Pin aws-lc-rs below 1.18 before shipping to customers that require validated cryptography.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 78e1a9e · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

datadog-prod-us1-3 · 2026-08-17T02:53:53Z

 [[package]]
 name = "aws-lc-fips-sys"
-version = "0.13.14"
+version = "0.14.1"


Keep the validated module in FIPS images

Customers using the advertised -fips image could deploy a cryptographic module without a current NIST certificate, violating their compliance requirements.

Assertion details

Input: Any Linux agent-data-plane image built with the fips feature; release CI publishes both amd64 and arm64 variants with a -fips tag.

Expected: Constrain the workspace aws-lc-rs dependency to <1.18, then regenerate Cargo.lock so Linux FIPS artifacts retain the validated 3.x module until 4.x is certified and approved. This is a multi-file generated-lockfile fix, so no inline suggestion is safe.

Actual: Cargo.lock upgrades aws-lc-fips-sys from 0.13.14 to 0.14.1 through aws-lc-rs 1.18.0. The supplied upstream release notes state this switches from validated AWS-LC-FIPS 3.x to 4.x, which is awaiting NIST certification, and direct validation-required consumers to pin below 1.18. Existing tests only check approved algorithms and cannot detect certification status.

Was this helpful? React 👍 or 👎
_{🤖 Datadog Autotest · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

pr-commenter · 2026-08-17T02:59:53Z

Regression Detector (Agent Data Plane)

Optimization Goals: ⚠️ Report unavailable

The benchmark run did not produce a usable report: outputs/report.json is missing

Check the benchmark job logs for details.

chore(deps): update all non-major dependencies

78e1a9e

renovate Bot requested a review from a team as a code owner August 17, 2026 02:50

chore(deps): sync third-party license file

e79ec4f

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

datadog-prod-us1-3 Bot reviewed Aug 17, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore(deps): update all non-major dependencies - #2348

chore(deps): update all non-major dependencies#2348
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/all-minor-patch

renovate Bot commented Aug 17, 2026

Uh oh!

datadog-prod-us1-3 Bot left a comment

Uh oh!

datadog-prod-us1-3 Bot Aug 17, 2026

Uh oh!

pr-commenter Bot commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 17, 2026

Release Notes

Removals and Deprecations

Features

Internal Changes

Other

v1.18.0: aws-lc-rs v1.18.0

AWS-LC-FIPS module updated to 4.x

What's Changed

Upstream AWS-LC (v5.5.0)

Build Improvements

Issues Being Closed

Other Merged PRs

New Contributors

v1.17.3: aws-lc-rs v1.17.3

What's Changed

Build Improvements

Issues Being Closed

Other Merged PRs

New Contributors

Fixed

Features

Internal

Fixes

Fixes

v0.3.13: crossbeam-queue 0.3.13

tl;dr

Bug Fixes

Features

v1.10.1 (2026-05-29)

Bug Fixes

Added

Deprecated

Fixed

Changed

Support

Added

Deprecated

Fixed

Changed

Removed

Other

Fixes

Changes

v3.22.0: serde_with v3.22.0

Added

Fixed

Fixed

v1.53.1: Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

Fixed (unstable)

Documented

v1.53.0: Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

Changed

Fixed

Configuration

Uh oh!

datadog-prod-us1-3 Bot left a comment

Choose a reason for hiding this comment

Uh oh!

datadog-prod-us1-3 Bot Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

pr-commenter Bot commented Aug 17, 2026

Regression Detector (Agent Data Plane)

Optimization Goals: ⚠️ Report unavailable

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v1.18.0`: aws-lc-rs v1.18.0

`v1.17.3`: aws-lc-rs v1.17.3

`v0.3.13`: crossbeam-queue 0.3.13

`v3.22.0`: serde_with v3.22.0

`v1.53.1`: Tokio v1.53.1

`v1.53.0`: Tokio v1.53.0