[dependabot]

Bumps candid from 0.10.34 to 0.10.39.

Changelog

Sourced from candid's changelog.

Candid 0.10.39

• Bug fixes:
  • A failed step of a subtype check now withdraws every assumption made since it, not only its own. The opt rule probes t <: t' and falls back to the special rule when the probe fails; pairs proved inside the probe could rely on the pair that failed, and previously stayed in Gamma, so a later comparison in the same check was answered from them. subtype, subtype_with_config and subtype_check_all could therefore accept a type that is not a subtype — service_compatible and didc check accepted a breaking upgrade when a sibling opt field triggered the probe first — and a failed check could leave such pairs in a Gamma the caller reuses, as the decoder does across one message. Checks that do not reach a failed probe are unchanged.
  • subtype_check_all (and so service_compatibility_report and didc check) no longer re-explores a pair of types it has already found incompatible. When a recursive type was reachable along many paths, every path re-checked it from scratch, so a small interface could take exponential time and memory, and the report repeated the same error once per path. Each later path now gets one entry pointing back to the first report.
  • A subtype check now remembers the pairs it has refuted, so the opt rule's probes no longer re-explore them. A recursive type with several opt fields pointing to the next level, compared against an incompatible one, took exponential time in subtype, subtype_with_config and subtype_check_all (and so in service_compatible, didc check and the subtype check for func and service references when decoding). Hitting the recursion limit now fails the whole check at once: nothing derived from it is remembered, since it depends on the stack rather than the types, and an opt probe that hits it no longer falls back to the special opt rule and accepts with a warning.

2026-10-09

Candid 0.10.38

• Bug fixes:
  • nat and int values decoded into u128 and i128 are now bounded by the width of the target type at every byte of the LEB128 body. A value that needs more than 128 bits returns a nat overflow or int overflow error, and an overlong encoding of a value that fits (zero or sign padding past bit 127) decodes to that value, so the fixed-width decoders agree with Nat::decode and Int::decode on every input.
  • A failed type-variable lookup inside subtype, subtype_check_all and equal is now reported as an error rather than unwrapped.

2026-09-25

Candid 0.10.37

• Bug fixes:
  • Bound the byte length of the type-table header, 64 KiB by default and configurable with DecoderConfig::set_max_header_len. Headers over the bound, far above any realistic interface, are now rejected; the value section is unaffected, and set_max_type_len still separately bounds the number of type-table entries.
  • Bound the size of a type named in a decoder diagnostic. What it costs to render a type follows that type's own width and depth, and a type reaching the decoder is chosen by the sender, so a diagnostic now elides one whose rendering would exceed a fixed budget instead of rendering it in full. This holds for every diagnostic that names a type, including the subtyping messages and the verbose form that set_full_error_message(true) selects; ordinary mismatches are unchanged and still name both types.

2026-09-22

Candid 0.10.36

• Bug fixes:
  • Scope the decode fast paths of a map to their own half of an entry, so a map entry's key and value each decode under their own declared type. deserialize_map derives a big-integer fast path from the map's value type and a text fast path from its key type; each previously stayed active for the whole entry. The big-integer path is now cleared for the duration of the key and restored for the value, the text path is cleared for the duration of the value, and the value's expected and wire types are re-established on every entry. Each half of an entry therefore goes through its own type's entry point, keeping its own encoding (SLEB128 for int, LEB128 for nat) and its own subtype check, for every combination of key and value type — including a value whose type shares an encoding with the key's, such as blob against text. The wire format is unchanged, and entries whose key and value types agree decode identically.
  • Share the undecoded argument queue behind a reference count. The option/backtracking path snapshots the deserializer to restore on a subtype mismatch, which previously copied the whole queue of remaining arguments on every present opt. The queue is only mutated at the top level, so it is now shared rather than copied and the snapshot is a refcount bump. Skipping many present optional arguments is no longer superlinear in the argument count; the decode result is unchanged.

2026-08-14

candid_parser 0.4.1

• Bug fixes:
  • Escape the method names of a service type in the Rust binding. A Candid method name is an arbitrary text value, but pp_ty_service emitted it raw between the quotes of a Rust string literal inside candid::define_service!. A name containing " therefore closed the literal and the macro invocation, and the rest of the name was compiled as Rust — a .did file could inject arbitrary items into the bindings generated from it, and from there into the consumer's binary. Names are now escaped with escape_debug, as pp_function and the #[serde(rename)] attributes already were. The value seen by define_service! is unchanged, and names that are ordinary identifiers generate byte-identical output.

2026-08-11

Candid 0.10.35

• Bug fixes:
  • Bound the allocation when reading a length-prefixed byte field in the type-table header. A byte vector (a future type's payload, or a service method's name) previously reserved its full declared length up front, so a length larger than the remaining input requested a correspondingly large allocation instead of failing on the short read. These fields now grow their buffer incrementally, so an out-of-range or truncated length surfaces as an ordinary parse error. The wire format is unchanged and valid messages decode identically.

2026-07-27

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)