chore(deps): bump the rust-dependencies group across 1 directory with 6 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the rust-dependencies group with 6 updates in the / directory:

Package	From	To
zeroize	1.9.0	1.9.1
russh	0.63.3	0.64.1
napi	3.14.0	3.14.2
signal-hook	0.4.4	0.4.5
syn	3.0.6	3.0.7
toml	1.1.6+spec-1.1.0	1.1.8+spec-1.1.0

Updates zeroize from 1.9.0 to 1.9.1

Commits

• 34a6ebc zeroize v1.9.1 (#1553)
• e68c684 zeroize: test under cargo miri in CI (#1552)
• 4a53d7d Update Cargo.lock (#1545)
• a2b1713 zeroize: fix fallback code used by optimization_barrier (#1551)
• 3c5aa70 ctutils v0.4.3 (#1550)
• 6f4e70f ctutils: use cast_(un)signed; MSRV 1.87 (#1548)
• 29391e4 ctutils: make Choice::{to_bool, to_u8} into const fn; MSRV 1.86 (#1547)
• f09945d ci: allow triggering workflows manually (#1543)
• 53493df dit v0.0.1-alpha (#1540)
• c89949d Rename aarch64-dit to dit (#1539)
• Additional commits viewable in compare view

Updates russh from 0.63.3 to 0.64.1

Release notes

Sourced from russh's releases.

v0.64.1

Security fixes

GHSA-4wc5-f2rc-q74m - Unbounded memory allocation in agent protocol server via crafted constraint records

A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message.

v0.64.0

Breaking changes

• 5d9d2b8: drop the legacy ed25519 key parser
  • Dropped the legacy-ed25519-pkcs8-parser feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error.

Security fixes

GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm

Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1

Features

• efa9a03: Add support hostkeys-prove-00@openssh.com support (#767) (@​inureyes) #767

  • Adds client::Handle::hostkeys_prove to ask the server to prove ownership of the host keys it announced via hostkeys-00@openssh.com.

• a0ded76: Support sending custom global requests from the client (#759) (@​ChrisJr404) #759

  • Adds client::Handle::send_global_request(name, data, want_reply)

Fixes

• e8b2fd3: Fix enforce rekey read and time limits (#766) (@​inureyes) #766
• bf05d50: honor want_reply = false on server-side global requests
• dddf72c: bug: Fix partial_success clobber (#773) (@​markovejnovic) #773
• 26487fb: fix: auth-agent-req@openssh.com replies on channel (#774) (#775) (@​markovejnovic) #775
• 36fa1bc: fix(pageant): trim username padding and handle empty principals (#779) (@​t8y2) #779

New Contributors

• @​markovejnovic made their first contribution in Eugeny/russh#773
• @​t8y2 made their first contribution in Eugeny/russh#779
• @​ChrisJr404 made their first contribution in Eugeny/russh#759

Full Changelog: Eugeny/russh@v0.63.3...v0.64.0

Commits

• e5d80a0 v0.64.1
• 4c30503 handle lifetime constraints correctly
• c0fe3b1 bump pageant
• 4973149 v0.64.0
• bf05d50 cleanup
• a0ded76 Support sending custom global requests from the client (#759)
• e8b2fd3 Fix enforce rekey read and time limits (#766)
• efa9a03 Add support hostkeys-prove-00@openssh.com (#767)
• 36fa1bc fix(pageant): trim username padding and handle empty principals (#779)
• d27ff7e add t8y2 as a contributor for code (#780)
• Additional commits viewable in compare view

Updates napi from 3.14.0 to 3.14.2

Release notes

Sourced from napi's releases.

napi-v3.14.2

Fixed

• (napi) register the wasm cleanup through the env cleanup hook (#3571)
• (napi) own NativeBorrowScope storage via NonNull to fix aliasing violation (#3573)
• (napi) bound serde_json::Value conversion depth at 128 levels (#3568)

napi-v3.14.1

Fixed

• (napi) create objects with napi_define_properties on every Node version (#3560)

Commits

• 8bab46e chore: release (#3567)
• 9c49b6c chore(release): publish
• e73367c feat: recognize the aarch64-unknown-freebsd target (#3574)
• 44e7911 chore(deps): update dependency @​oxc-node/core to v0.1.3 (#3564)
• 962e4b5 fix(cli): keep WASI-managed root entry that differs from package main (#3572)
• 469b861 chore(deps): update dependency webdriverio to v10 (#3566)
• 9ca1bab fix(napi): register the wasm cleanup through the env cleanup hook (#3571)
• 8047dbb fix(napi): own NativeBorrowScope storage via NonNull to fix aliasing violatio...
• 125e472 fix(napi): bound serde_json::Value conversion depth at 128 levels (#3568)
• a713fcb chore(deps): update dependency oxc-parser to ^0.153.0 (#3569)
• Additional commits viewable in compare view

Updates signal-hook from 0.4.4 to 0.4.5

Changelog

Sourced from signal-hook's changelog.

0.4.5

• pipe::register_raw now really sets close-on-exec (FD_CLOEXEC) on the file descriptor, for both pipes and sockets (#206).
• Removed the 32-bit Android sigemptyset/sigaddset fallback, which panicked in emulate_default_handler (#207). Android below API 21 is no longer supported.

Commits

• 1ee5faa Release 0.4.5
• 2003e57 CI: Check only mio 1.x support on the BSDs
• 5eaf084 signal-hook-mio: Drop redundant mio 0.7 dev-dependency
• f7ceb8a Use square brackets for vec! in tests
• 4c1f6f1 CI: Leave out mio 0.6 from BSD checks and doc link check
• e52500e CI: Make the registry manifest parseable by old cargo
• d3f9239 Allow deprecated std::isize in the registry
• 5e09118 Drop hand-rolled sigset fallback on 32-bit Android
• d12e7d9 Set close-on-exec correctly
• See full diff in compare view

Updates syn from 3.0.6 to 3.0.7

Release notes

Sourced from syn's releases.

3.0.7

• Fix parsing absolute path expr in labeled break (#2085, thanks @​A4-Tacks)

Commits

• ec4c2da Release 3.0.7
• f947cf7 Merge pull request #2085 from A4-Tacks/break-label-abs-path
• 9cb6556 Update test suite to nightly-2026-10-08
• 0cce166 Fix parse abs path expr in labeled break
• 295f964 Update test suite to nightly-2026-09-29
• 9ce6a79 Update test suite to nightly-2026-09-24
• 3de8494 Update test suite to nightly-2026-09-22
• 2ebf5f9 Update test suite to nightly-2026-09-17
• See full diff in compare view

Updates toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	bb31501	Commit Preview URL Branch Preview URL	Oct 13 2026, 10:24 AM

[chaliy]

Superseded by #2720, now merged, which carries this exact group bump plus the supply-chain delta audits it needed.

Every rust job here was green; only Audit failed, with cargo vet --locked reporting ten crates unvetted. Refreshing the imported audits covered serde_spanned and the four toml crates; the other five — russh, napi, zeroize, syn, signal-hook — got hand-written delta audits after a read of each published package diff. None adds a dependency, a build script or any host access, and each is a narrowing; russh 0.64 in particular fixes a server-side signature-algorithm confusion (RFC 8332 §3) and drops the yasna dependency.

Against current main this branch is now a no-op on Cargo.toml and would only downgrade turso 0.8.3 → 0.8.2, since its base predates #2717. So closing rather than rebasing.

---

Generated by Claude Code

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml