Skip to content

chore: bump the minor-and-patch group across 1 directory with 7 updates - #808

Closed
dependabot[bot] wants to merge 39 commits into
mainfrom
dependabot/cargo/fluid-server/minor-and-patch-36867b6b19
Closed

chore: bump the minor-and-patch group across 1 directory with 7 updates#808
dependabot[bot] wants to merge 39 commits into
mainfrom
dependabot/cargo/fluid-server/minor-and-patch-36867b6b19

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 6 updates in the /fluid-server directory:

Package From To
bytes 1.11.1 1.12.0
chrono 0.4.44 0.4.45
uuid 1.22.0 1.23.3
axum 0.8.8 0.8.9
serde_json 1.0.149 1.0.150
tokio 1.50.0 1.52.3

Updates bytes from 1.11.1 to 1.12.0

Release notes

Sourced from bytes's releases.

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)
Changelog

Sourced from bytes's changelog.

1.12.0 (June 18th, 2026)

Added

  • Add BytesMut::extend_from_within() (#818)
  • Add BytesMut::try_unsplit() (#746)

Fixed

  • Fix panic in get_int if nbytes is zero (#806)

Changed

  • Pass vtable data by value (#826)
  • Exclude development scripts from published package (#810)

Documented

  • Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)
Commits

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

Commits
  • 1703382 Prepare 0.4.45 release
  • 881f9ab tz_data: fix tzdata locations on Android
  • f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
  • c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
  • 120686c Bump codecov/codecov-action from 5 to 6
  • See full diff in compare view

Updates js-sys from 0.3.91 to 0.3.92

Commits

Updates uuid from 1.22.0 to 1.23.3

Release notes

Sourced from uuid's releases.

v1.23.3

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.2...v1.23.3

v1.23.2

What's Changed

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

v1.23.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.0...v1.23.1

v1.23.0

What's Changed

New Contributors

Special thanks

@​meng-xu-cs raised a series of bugs against the timestamp logic in uuid using automated tooling. The issues themselves were reasonably and responsibly presented and the end result is a better uuid library for everyone. Thanks!

Deprecations

This release includes the following deprecations:

  • Context: Renamed to ContextV1
  • Timestamp::from_gregorian: Renamed to Timestamp::from_gregorian_time

... (truncated)

Commits
  • 20da78b Merge pull request #887 from uuid-rs/cargo/v1.23.3
  • 62232ca prepare for 1.23.3 release
  • 2320c6a Merge pull request #886 from uuid-rs/fix/parser-panics
  • 2d034d4 fix some invalid indexers on error reporting
  • a8b9f14 update fuzz infra and run in CI
  • d119657 Merge pull request #883 from uuid-rs/cargo/v1.23.2
  • 0651cfc prepare for 1.23.2 release
  • e8dea0c Merge pull request #882 from uuid-rs/fix/error-msgs
  • bdc429a fix up serde messages
  • d4342e4 make indexes 0 based and fix up more error messages
  • Additional commits viewable in compare view

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

  • added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
  • changed: Update minimum rust version to 1.80 (#3620)
  • fixed: Set connect endpoint on correct field in MethodRouter (#3656)
  • fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

Commits
  • a1ae73a Release 1.0.150
  • 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
  • 2037b63 Reject non-string enum object keys
  • 5d30df6 Resolve manual_assert_eq pedantic clippy lint
  • dc8003a Raise required compiler for preserve_order feature to 1.85
  • a42fa98 Unpin CI miri toolchain
  • 684a60e Pin CI miri to nightly-2026-02-11
  • 7c7da33 Raise required compiler to Rust 1.71
  • acf4850 Simplify Number::is_f64
  • 6b8ceab Resolve unnecessary_map_or clippy lint
  • Additional commits viewable in compare view

Updates tokio from 1.50.0 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

  • sync: fix underflow in mpsc channel len() (#8062)
  • sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
  • sync: require that an RwLock has max_readers != 0 (#8076)
  • sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Tokio v1.52.1

1.52.1 (April 16th, 2026)

Fixed

  • runtime: revert #7757 to fix [a regression]#8056 that causes spawn_blocking to hang (#8057)

#7757: tokio-rs/tokio#7757 #8056: tokio-rs/tokio#8056 #8057: tokio-rs/tokio#8057

Tokio v1.52.0

1.52.0 (April 14th, 2026)

Added

  • io: AioSource::register_borrowed for I/O safety support (#7992)
  • net: add try_io function to unix::pipe sender and receiver types (#8030)

Added (unstable)

  • runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#8010)
  • taskdump: add trace_with() for customized task dumps (#8025)
  • taskdump: allow impl FnMut() in trace_with instead of just fn() (#8040)
  • fs: support io_uring in AsyncRead for File (#7907)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

0xVida and others added 30 commits May 31, 2026 16:07
Add fuzzing, parity checks, audit log filters, and SSE log streaming
feat: theme toggle, api-key usage charts, settings panel, leaderboard…
feat: implement web worker fallback testing in client sdk (#734)
feat: implement simulated contract call failure demos (#733)
feat: implement memory leak profiling under 24-hour load (#737)
…#722, #728, #731)

Implement precise rate-limit window boundary tests, a congestion fee simulator
with Node/Rust parity checks, Playwright cross-browser E2E for the admin
dashboard, and cargo-fuzz targets for the XDR parser.
…zing-718-722-728-731

test: add verification, fuzzing, and cross-browser E2E coverage
feat: implement sandbox transaction builder interface (#741)
…locust

feat: implement load testing bypass configuration, scripts, and docum…
#715, #717, #723)

Add nightly sandbox data purge worker, unit tests for webhook exponential
backoff, and Envoy/NGINX gateway configs to offload API key checks and
rate limiting from the application process.
…sandbox-webhook-gateway

feat: sandbox cleanup, webhook backoff tests, and Envoy gateway config
feat: cache soroban contracts, decouple notifications, tenant isolation, read replica
…cal-mock-horizon-api-server, extract-congestion-fee-calculator-module

- #709: Add W3C traceparent distributed tracing in fluid-server (tracing.rs)
  - SpanContext with trace/span ID generation and propagation
  - Extract/inject helpers for HTTP headers
  - traceparent header on fee-bump responses

- #711: Partition AuditLog table by month in server
  - SQL migration (20260601000000_partition_audit_logs_by_month)
  - AuditLogPartitionManager service with ensurePartitions/listPartitions/pruneOldPartitions
  - Full unit test coverage

- #712: Extract congestion fee calculator module in fluid-server (fee_calculator.rs)
  - Pure calculate_fee() function decoupled from API server
  - FeeCalculator struct with configurable base_fee and multiplier
  - CongestionLevel classification (low/medium/high)

- #720: Local mock Horizon API server in fluid-server (mock_horizon.rs)
  - Simulates success, 429, 500, 502, 503, 504, connection reset
  - Horizon tx error extras (tx_bad_seq, tx_insufficient_fee, tx_failed)
  - Latency injection, per-path scenario overrides, request capture
  - fail_count auto-reset for transient failure simulation

Also fix pre-existing compile errors: xdr.rs borrow, archive.rs ByteStream,
memory_leak_profiling.rs import, load_testing_integration.rs String type,
main.rs duplicate serde import.
Bind admin sessions to the originating IP, sanitize fee-bump error responses, and route Prisma adapters from the configured database URL.

Closes #698

Closes #670

Closes #673

Closes #672
Harden admin sessions, fee-bump errors, and DB adapters
feat: distributed tracing, audit log partitioning, mock Horizon, fee calculator (#709 #711 #712 #720)
feat: security-limits-congestion-graph-wcag-audit-and-alert-cooldowns
Add CI matrix workflow for cargo-audit and npm audit on fluid-server,
with JSON report artifacts and failure on high/critical advisories.

Closes #674

Co-authored-by: Cursor <cursoragent@cursor.com>
Validate inner transaction signature weight against the source account
med_threshold via Horizon before fee-bumping, with unit and integration tests.

Closes #686

Co-authored-by: Cursor <cursoragent@cursor.com>
…ndency-scan-signer-weight

fluid-server: dependency scans (#674) and inner tx signer-weight preflight (#686)
Integrate HashiCorp Vault for Secure Fee Payer Secret Management
Dev-AdeTutu and others added 9 commits June 1, 2026 15:27
#688 - Short-lived hash cache to prevent replay attacks (server/)
- Add markTransactionHashProcessed() and isTransactionHashProcessed() to
  server/src/utils/redis.ts using atomic SET NX with 5-minute TTL
- Integrate replay check in processFeeBump() in feeBump.ts; returns 409
  DUPLICATE_TRANSACTION on repeated inner tx hash

#692 - Graceful shutdown in Rust server (fluid-server/)
- Add shutdown_signal() async fn that listens for SIGTERM and SIGINT
- Wire axum::serve().with_graceful_shutdown(shutdown_signal()) so
  in-flight fee-bump requests complete before the process exits

#691 - Log aggregator failure fallback (fluid-server/)
- flush_batch() now returns bool indicating remote export failure
- After 3 consecutive failures, export_worker() calls flush_batch_to_disk()
- flush_batch_to_disk() writes NDJSON lines to FLUID_LOG_FALLBACK_PATH
  (default: fluid-server-fallback.log) for later re-ingestion

#687 - Muxed account (M...) support in address validation (fluid-server/)
- inner_source_account_id() now delegates to muxed_account_to_account_id()
  which handles both Ed25519 and MuxedEd25519 variants
- blocklist.rs normalize_address() strips mux id so M... and G... addresses
  for the same key share a single blocklist entry
- Add muxed_account_resolves_to_base_account_id test
…ng-688-691-692-687

feat: resilience & error handling - issues #688, #691, #692, #687
Bumps the minor-and-patch group with 6 updates in the /fluid-server directory:

| Package | From | To |
| --- | --- | --- |
| [bytes](https://github.com/tokio-rs/bytes) | `1.11.1` | `1.12.0` |
| [chrono](https://github.com/chronotope/chrono) | `0.4.44` | `0.4.45` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.22.0` | `1.23.3` |
| [axum](https://github.com/tokio-rs/axum) | `0.8.8` | `0.8.9` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.150` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.50.0` | `1.52.3` |



Updates `bytes` from 1.11.1 to 1.12.0
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.11.1...v1.12.0)

Updates `chrono` from 0.4.44 to 0.4.45
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](chronotope/chrono@v0.4.44...v0.4.45)

Updates `js-sys` from 0.3.91 to 0.3.92
- [Release notes](https://github.com/wasm-bindgen/wasm-bindgen/releases)
- [Changelog](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/CHANGELOG.md)
- [Commits](https://github.com/wasm-bindgen/wasm-bindgen/commits)

Updates `uuid` from 1.22.0 to 1.23.3
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.22.0...v1.23.3)

Updates `axum` from 0.8.8 to 0.8.9
- [Release notes](https://github.com/tokio-rs/axum/releases)
- [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md)
- [Commits](tokio-rs/axum@axum-v0.8.8...axum-v0.8.9)

Updates `serde_json` from 1.0.149 to 1.0.150
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.149...v1.0.150)

Updates `tokio` from 1.50.0 to 1.52.3
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.50.0...tokio-1.52.3)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: chrono
  dependency-version: 0.4.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: js-sys
  dependency-version: 0.3.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: uuid
  dependency-version: 1.23.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: axum
  dependency-version: 0.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: serde_json
  dependency-version: 1.0.150
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tokio
  dependency-version: 1.52.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: cargo, dependabot, dependencies, fluid-server. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@0xVida
0xVida force-pushed the main branch 4 times, most recently from 573ca4c to 5b76891 Compare June 20, 2026 10:53
@dependabot @github

dependabot Bot commented on behalf of github Jun 20, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer a dependency, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 20, 2026
@dependabot
dependabot Bot deleted the dependabot/cargo/fluid-server/minor-and-patch-36867b6b19 branch June 20, 2026 11:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.