Bump the global group across 1 directory with 6 updates by dependabot[bot] · Pull Request #123 · Chia-Network/offer-codes

dependabot · 2026-10-28T16:38:39Z

Bumps the global group with 6 updates in the / directory:

Package	From	To
anyhow	`1.0.97`	`1.0.104`
axum	`0.8.1`	`0.8.9`
chia	`0.20.0`	`0.22.0`
serde	`1.0.228`	`1.0.229`
sqlx	`0.8.3`	`0.9.0`
tracing	`0.1.41`	`0.1.44`

Updates anyhow from 1.0.97 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

Update syn dev-dependency to version 3

1.0.103

Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

1.0.102

Remove backtrace dependency (#438, #439, #440, #441, #442)

1.0.101

Add #[inline] to anyhow::Ok helper (#437, thanks @Ibitier)

1.0.100

Teach clippy to lint formatting arguments in bail!, ensure!, anyhow! (#426)

1.0.99

Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#420)

1.0.98

Add self.into_boxed_dyn_error() and self.reallocate_into_boxed_dyn_error_without_backtrace() methods for anyhow::Error (#415)

Commits

1dbe186 Release 1.0.104
f6479f8 Update to syn 3
5bdb0e2 Release 1.0.103
e621bd3 Merge pull request #452 from dtolnay/downcast
6e8c000 Eliminate pointer->reference->pointer during downcast
67c4abd Add regression test for issue 451
917a169 Update actions/upload-artifact@v6 -> v7
d9dc3fa Update actions/checkout@v6 -> v7
841522b Raise minimum tested compiler to rust 1.85
5c657b3 Release 1.0.102
Additional commits viewable in compare view

Updates axum from 0.8.1 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)

changed: Update minimum rust version to 1.80 (#3620)

fixed: Set connect endpoint on correct field in MethodRouter (#3656)

fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

axum v0.8.8

Clarify documentation for Router::route_layer (#3567)

#3567: tokio-rs/axum#3567

axum v0.8.7

Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#3555)

Make it easier to visually scan for default features (#3550)

Fix some documentation typos

#3550: tokio-rs/axum#3550 #3555: tokio-rs/axum#3555

axum v0.8.5

fixed: Reject JSON request bodies with trailing characters after the JSON document (#3453)

added: Implement OptionalFromRequest for Multipart (#3220)

added: Getter methods Location::{status_code, location}

added: Support for writing arbitrary binary data into server-sent events (#3425)]

added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#3469)

added: impl FusedStream for WebSocket (#3443)

changed: The sse module and Sse type no longer depend on the tokio feature (#3154)

changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#3377)

changed: Update minimum rust version to 1.78 (#3412)

#3154: tokio-rs/axum#3154 #3220: tokio-rs/axum#3220 #3377: tokio-rs/axum#3377 #3412: tokio-rs/axum#3412 #3425: tokio-rs/axum#3425 #3443: tokio-rs/axum#3443 #3453: tokio-rs/axum#3453 #3469: tokio-rs/axum#3469

axum v0.8.4

added: Router::reset_fallback (#3320)

added: WebSocketUpgrade::selected_protocol (#3248)

fixed: Panic location for overlapping method routes (#3319)

fixed: Don't leak a tokio task when using serve without graceful shutdown (#3129)

... (truncated)

Commits

See full diff in compare view

Updates chia from 0.20.0 to 0.22.0

Release notes

Sourced from chia's releases.

0.22.0

What's Changed

update pyo3 to 0.24.1 by @altendky in Chia-Network/chia_rs#1010

update openssl 0.10.72 by @altendky in Chia-Network/chia_rs#1013

remove soft-fork6 since it's activated by @arvidn in Chia-Network/chia_rs#1018

Bump crossbeam-channel from 0.5.13 to 0.5.15 by @dependabot in Chia-Network/chia_rs#1020

bump version to 0.22.0 by @arvidn in Chia-Network/chia_rs#1028

Full Changelog: Chia-Network/chia_rs@0.21.2...0.22.0

0.21.2

What's Changed

Bump ring from 0.17.8 to 0.17.13 by @dependabot in Chia-Network/chia_rs#986

Bump prettier from 3.5.2 to 3.5.3 by @dependabot in Chia-Network/chia_rs#980

Bump quote from 1.0.38 to 1.0.40 by @dependabot in Chia-Network/chia_rs#998

Bump anyhow from 1.0.96 to 1.0.97 by @dependabot in Chia-Network/chia_rs#997

Bump tokio from 1.43.0 to 1.44.0 by @dependabot in Chia-Network/chia_rs#996

Bump time from 0.3.37 to 0.3.39 by @dependabot in Chia-Network/chia_rs#994

Bump serde from 1.0.218 to 1.0.219 by @dependabot in Chia-Network/chia_rs#993

Bump clap from 4.5.31 to 4.5.32 by @dependabot in Chia-Network/chia_rs#991

Bump syn from 2.0.98 to 2.0.100 by @dependabot in Chia-Network/chia_rs#989

Bump indoc from 2.0.5 to 2.0.6 by @dependabot in Chia-Network/chia_rs#990

Bump serde_json from 1.0.139 to 1.0.140 by @dependabot in Chia-Network/chia_rs#992

Bump proc-macro2 from 1.0.93 to 1.0.94 by @dependabot in Chia-Network/chia_rs#995

Remove chia-blockchain dependency for most of chia_rs by @matt-o-how in Chia-Network/chia_rs#887

bump clvmr dependency to 0.12.1 by @arvidn in Chia-Network/chia_rs#1004

bump version to 0.21.2 by @arvidn in Chia-Network/chia_rs#1006

Full Changelog: Chia-Network/chia_rs@0.21.1...0.21.2

0.21.1

What's Changed

use image for benchmark runner by @altendky in Chia-Network/chia_rs#976

create_coin_announcement is not eligible for FF by @arvidn in Chia-Network/chia_rs#978

bump version to 0.21.1 by @arvidn in Chia-Network/chia_rs#982

Full Changelog: Chia-Network/chia_rs@0.21.0...0.21.1

0.21.0

What's Changed

Bump clap from 4.5.27 to 4.5.30 by @dependabot in Chia-Network/chia_rs#935

Bump openssl from 0.10.70 to 0.10.71 by @dependabot in Chia-Network/chia_rs#933

Bump serde_json from 1.0.137 to 1.0.138 by @dependabot in Chia-Network/chia_rs#914

Bump syn from 2.0.96 to 2.0.98 by @dependabot in Chia-Network/chia_rs#920

Bump libfuzzer-sys from 0.4.7 to 0.4.9 by @dependabot in Chia-Network/chia_rs#913

Bump anyhow from 1.0.95 to 1.0.96 by @dependabot in Chia-Network/chia_rs#945

Bump zstd from 0.13.2 to 0.13.3 by @dependabot in Chia-Network/chia_rs#948

... (truncated)

Commits

4eb3cf0 bump version to 0.22.0 (#1028)
57b1bb3 Merge pull request #1020 from Chia-Network/dependabot/cargo/crossbeam-channel...
1607c33 remove soft-fork6 since it's activated. Bump clvm_rs to the latest version wh...
2fd300b Bump crossbeam-channel from 0.5.13 to 0.5.15
d5b1a20 update openssl 0.10.72 (#1013)
add6c76 update pyo3 to 0.24.1 (#1010)
d3b8a0a bump version to 0.21.2 (#1006)
6a1836a bump clvmr dependency to 0.12.1 (#1004)
22838b0 Remove chia-blockchain dependency for most of chia_rs (#887)
6b8ad75 Merge pull request #995 from Chia-Network/dependabot/cargo/proc-macro2-1.0.94
Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

Update to syn 3

Commits

7fc3b4c Release 1.0.229
6d6e9a1 Merge pull request #3085 from dtolnay/syn3
6dec3b7 Update to syn 3
cfe6692 Resolve mut_mut pedantic clippy lint
1023d07 Update actions/upload-artifact@v6 -> v7
dd682c2 Update actions/checkout@v6 -> v7
5f0f18b Update ui test suite to nightly-2026-06-01
63a1498 Regenerate stderr with trybuild normalization fixes
fa7da4a Fix unused_features warning
6b1a178 Unpin CI miri toolchain
Additional commits viewable in compare view

Updates sqlx from 0.8.3 to 0.9.0

Changelog

Sourced from sqlx's changelog.

0.9.0 - 2026-05-06

Important Announcements

New Github Organization

Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization: https://github.com/transact-rs/

This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been informally transferred to the collective ownership of its principal authors. Moving the repository to a new organization makes this change more clear, and also allows for potentially inviting outside collaborators.

Cargo.lock Removed from Tracking

The Cargo.lock has been removed from tracking in Git. CI should now always test with the latest versions of all dependencies by default, alongside our pass that checks with cargo generate-lockfile -Z minimal-versions.

This should eliminate the need for any PRs that update dependencies to also update Cargo.lock or contend with an endless stream of merge conflicts against it.

N.B. cargo install --locked sqlx-cli will no longer work. However, cargo install sqlx-cli has always used the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran cargo update sporadically, so relying on SQLx's lockfile offered few guarantees anyway.

See [the manual page for cargo install][man-cargo-install] for details.

Breaking

As per our MSRV policy, the supported Rust version for this release cycle is 1.94.0.

[#3383]: feat: create sqlx.toml format [[@abonander]]

SQLx and sqlx-cli now support per-crate configuration files (sqlx.toml)

New functionality includes, but is not limited to:

Rename DATABASE_URL for a crate (for multi-database workspaces)

Set global type overrides for the macros (supporting custom types)

Rename or relocate the _sqlx_migrations table (for multiple crates using the same database)

Set characters to ignore when hashing migrations (e.g. ignore whitespace)

More to be implemented in future releases.

Enable feature sqlx-toml to use.

sqlx-cli has it enabled by default, but sqlx does not.

Default features of library crates can be hard to completely turn off because of [feature unification], so it's better to keep the default feature set as limited as possible. [This is something we learned the hard way.][preferred-crates]

Guide: see sqlx::_config module in documentation.

Reference: [Link]

Examples (written for Postgres but can be adapted to other databases; PRs welcome!):

Multiple databases using DATABASE_URL renaming and global type overrides: [Link]

Multi-tenant database using _sqlx_migrations renaming and multiple schemas: [Link]

Force use of chrono when time is enabled (e.g. when using tower-sessions-sqlx-store): [[Link][preferred-crates]]

Forcing bigdecimal when rust_decimal is enabled is also shown, but problems with chrono/time are more common.

... (truncated)

Commits

75bc048 Release 0.9.0 (#4256)
6956cef Prefer to give real data to .bind() in README.md (#4257)
45ba990 Add the possibility to skip migrations (#3846)
66533fa Ensure Deterministic Migration Order (#4136)
db47fe3 ci: check direct minimal versions (#4173)
9ecb76d Unescape PostgreSQL passfile password (#3993)
c0a3218 breaking(any+mysql): correctly convert text and blob types to AnyTypeInfo (...
d82b781 test(sqlite): add regression test for ORDER BY + LIMIT nullability (#4223)
b77ba16 chore: update to axum 0.8 (#4253)
c0ec9c0 fix(tls): potential deadlock in StdSocket::poll_ready() (#4251)
Additional commits viewable in compare view

Updates tracing from 0.1.41 to 0.1.44

Release notes

Sourced from tracing's releases.

tracing 0.1.44

Fixed

Fix record_all panic (#3432)

Changed

tracing-core: updated to 0.1.36 (#3440)

#3432: tokio-rs/tracing#3432 #3440: tokio-rs/tracing#3440

tracing 0.1.43

Important

The previous release [0.1.42] was yanked because #3382 was a breaking change. See further details in #3424. This release contains all the changes from that version, plus a revert for the problematic part of the breaking PR.

Fixed

Revert "make valueset macro sanitary" (#3425)

#3382: tokio-rs/tracing#3382 #3424: tokio-rs/tracing#3424 #3425: tokio-rs/tracing#3425 [0.1.42]: https://github.com/tokio-rs/tracing/releases/tag/tracing-0.1.42

tracing 0.1.42

Important

The [Span::record_all] method has been removed from the documented API. It was always unsuable via the documented API as it requried a ValueSet which has no publically documented constructors. The method remains, but should not be used outside of tracing macros.

Added

attributes: Support constant expressions as instrument field names (#3158)

Add record_all! macro for recording multiple values in one call (#3227)

core: Improve code generation at trace points significantly (#3398)

Changed

tracing-core: updated to 0.1.35 (#3414)

tracing-attributes: updated to 0.1.31 (#3417)

Fixed

Fix "name / parent" variant of event! (#2983)

... (truncated)

Commits

2d55f6f chore: prepare tracing 0.1.44 (#3439)
10a9e83 chore: prepare tracing-core 0.1.36 (#3440)
ee82cf9 tracing: fix record_all panic (#3432)
9978c36 chore: prepare tracing-mock 0.1.0-beta.3 (#3429)
cc44064 chore: prepare tracing-subscriber 0.3.22 (#3428)
64e1c8d chore: prepare tracing 0.1.43 (#3427)
7c44f7b tracing: revert "make valueset macro sanitary" (#3425)
cdaf661 chore: prepare tracing-mock 0.1.0-beta.2 (#3422)
a164fd3 chore: prepare tracing-journald 0.3.2 (#3421)
405397b chore: prepare tracing-appender 0.2.4 (#3420)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Note

Medium Risk
Deploys must have MySQL/MariaDB TLS working and may need MYSQL_SSL_CA; the sqlx 0.9 + rustls switch is a broad dependency change that can break connections in misconfigured environments.

Overview
Upgrades sqlx to 0.9.0 and switches the MySQL TLS stack from tls-native-tls to tls-rustls, with a large Cargo.lock refresh from that migration (OpenSSL/native-tls paths drop out of the sqlx dependency tree).

Database startup no longer uses a plain DATABASE_URL connect: it builds MySqlConnectOptions via new connect_options, connects with MySqlPoolOptions::connect_with, and always requires TLS unless the URL already requests verify_ca / verify_identity. URLs with ssl-mode=disabled or preferred are upgraded to Required. Optional MYSQL_SSL_CA turns on VerifyIdentity with that CA file. Setup docs in README.md and example.env describe the TLS requirement.

Unit tests lock in the ssl-mode behavior and assert sqlx does not enable mysql-rsa. The checked-in sqlx query metadata for the offers lookup query is regenerated for sqlx 0.9.

^{Reviewed by Cursor Bugbot for commit 10cad06. Bugbot is set up for automated code reviews on this repo. Configure here.}

Bumps the global group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.97` | `1.0.104` | | [axum](https://github.com/tokio-rs/axum) | `0.8.1` | `0.8.9` | | [chia](https://github.com/Chia-Network/chia_rs) | `0.20.0` | `0.22.0` | | [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` | | [sqlx](https://github.com/launchbadge/sqlx) | `0.8.3` | `0.9.0` | | [tracing](https://github.com/tokio-rs/tracing) | `0.1.41` | `0.1.44` | Updates `anyhow` from 1.0.97 to 1.0.104 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](dtolnay/anyhow@1.0.97...1.0.104) Updates `axum` from 0.8.1 to 0.8.9 - [Release notes](https://github.com/tokio-rs/axum/releases) - [Changelog](https://github.com/tokio-rs/axum/blob/main/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/axum/commits/axum-v0.8.9) Updates `chia` from 0.20.0 to 0.22.0 - [Release notes](https://github.com/Chia-Network/chia_rs/releases) - [Commits](Chia-Network/chia_rs@0.20.0...0.22.0) Updates `serde` from 1.0.228 to 1.0.229 - [Release notes](https://github.com/serde-rs/serde/releases) - [Commits](serde-rs/serde@v1.0.228...v1.0.229) Updates `sqlx` from 0.8.3 to 0.9.0 - [Changelog](https://github.com/transact-rs/sqlx/blob/main/CHANGELOG.md) - [Commits](transact-rs/sqlx@v0.8.3...v0.9.0) Updates `tracing` from 0.1.41 to 0.1.44 - [Release notes](https://github.com/tokio-rs/tracing/releases) - [Commits](tokio-rs/tracing@tracing-0.1.41...tracing-0.1.44) --- updated-dependencies: - dependency-name: anyhow dependency-version: 1.0.104 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: global - dependency-name: axum dependency-version: 0.8.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: global - dependency-name: chia dependency-version: 0.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: global - dependency-name: serde dependency-version: 1.0.229 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: global - dependency-name: sqlx dependency-version: 0.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: global - dependency-name: tracing dependency-version: 0.1.44 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: global ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-28T16:38:44Z

Labels

The following labels could not be found: Changed. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

socket-security · 2026-10-28T16:39:06Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/anyhow@1.0.97 ⏵ 1.0.104	⁺¹
	cargo/serde@1.0.228 ⏵ 1.0.229
	cargo/axum@0.8.1 ⏵ 0.8.9
	cargo/tracing@0.1.41 ⏵ 0.1.44
	cargo/sqlx@0.8.3 ⏵ 0.9.0	⁺¹

View full report

socket-security · 2026-10-28T16:39:08Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. It is recommended to resolve "Warn" alerts too. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	License policy violation: cargo `webpki-roots` under CDLA-Permissive-2.0 License: CDLA-Permissive-2.0 - The applicable license policy does not permit this license (5) (webpki-roots-1.0.11/Cargo.toml) License: CDLA-Permissive-2.0 - The applicable license policy does not permit this license (5) (webpki-roots-1.0.11/LICENSE) From: Cargo.lock → `cargo/sqlx@0.9.0` → `cargo/webpki-roots@1.0.11` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/webpki-roots@1.0.11`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Install-time scripts: cargo `rustls` Install script: Package overview Source: `undefined` From: Cargo.lock → `cargo/sqlx@0.9.0` → `cargo/rustls@0.23.28` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/rustls@0.23.28`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Install-time scripts: cargo `zmij` Install script: Package overview Source: `undefined` From: Cargo.lock → `cargo/axum@0.8.9` → `cargo/sqlx@0.9.0` → `cargo/chia-wallet-sdk@0.22.1` → `cargo/zmij@1.0.23` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/zmij@1.0.23`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Block
	Native binaries present: cargo `rustls` Location: Package overview From: Cargo.lock → `cargo/sqlx@0.9.0` → `cargo/rustls@0.23.28` ℹ Read more on: This package \| This alert \| Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/rustls@0.23.28`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Native binaries present: cargo `zmij` Location: Package overview From: Cargo.lock → `cargo/axum@0.8.9` → `cargo/sqlx@0.9.0` → `cargo/chia-wallet-sdk@0.22.1` → `cargo/zmij@1.0.23` ℹ Read more on: This package \| This alert \| Why is native code a concern? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Verify that the inclusion of native code is expected and necessary for this package's functionality. If it is unnecessary or unexpected, consider using alternative packages without native code to mitigate potential risks. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore cargo/zmij@1.0.23`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1ff3f0a. Configure here.}

Keep chia aligned with chia-wallet-sdk, enable the sqlx 0.9 MySQL RSA backend for non-TLS caching_sha2_password logins, and regenerate .sqlx offline query data with sqlx-cli 0.9. Add a test covering the mysql-rsa feature.

hoffmang9 · 2026-10-28T17:23:21Z

The failing Lint/Test and build-image jobs had two causes. chia was bumped to 0.22.0 while chia-wallet-sdk 0.22.1 still depends on the 0.20 chia crates, so two incompatible SpendBundle types were in the build; chia is set back to 0.20.0. The .sqlx offline query data predates sqlx 0.9 and lacks the column collation field; it has been regenerated with sqlx-cli 0.9.0. Fixed in c607233.

Switch sqlx to the rustls backend, always connect to MySQL with TLS (verify identity when MYSQL_SSL_CA is set), document the setting, and replace the feature test with tests covering the manifest and the TLS mode. This avoids the rsa dependency from sqlx.

When MYSQL_SSL_CA is unset, a verify_ca or verify_identity ssl-mode in DATABASE_URL was replaced with required, which drops certificate verification. Keep those modes; disabled, preferred and unset still become required.

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 28, 2026

This was referenced Oct 28, 2026

Bump chia from 0.20.0 to 0.22.0 #16

Closed

Bump tracing from 0.1.41 to 0.1.44 #81

Closed

Bump sqlx from 0.8.3 to 0.9.0 #115

Closed

dependabot Bot mentioned this pull request Oct 28, 2026

Bump serde from 1.0.228 to 1.0.229 #116

Closed

This was referenced Oct 28, 2026

Bump anyhow from 1.0.97 to 1.0.104 #118

Closed

Bump axum from 0.8.1 to 0.8.9 #119

Closed

cursor Bot reviewed Oct 28, 2026

View reviewed changes

Comment thread Cargo.toml Resolved

Pin chia to 0.20.0, enable sqlx mysql-rsa, regenerate sqlx data

c607233

Keep chia aligned with chia-wallet-sdk, enable the sqlx 0.9 MySQL RSA backend for non-TLS caching_sha2_password logins, and regenerate .sqlx offline query data with sqlx-cli 0.9. Add a test covering the mysql-rsa feature.

hoffmang9 added 2 commits October 28, 2026 10:55

Keep verify_ca and verify_identity from DATABASE_URL

10cad06

When MYSQL_SSL_CA is unset, a verify_ca or verify_identity ssl-mode in DATABASE_URL was replaced with required, which drops certificate verification. Keep those modes; disabled, preferred and unset still become required.

Navigation Menu

Repository navigation

Bump the global group across 1 directory with 6 updates - #123

Bump the global group across 1 directory with 6 updates#123
dependabot[bot] wants to merge 4 commits into
mainfrom
dependabot/cargo/global-7572847407

dependabot Bot commented on behalf of github Oct 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

socket-security Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

hoffmang9 commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.0.104

1.0.103

1.0.102

1.0.101

1.0.100

1.0.99

1.0.98

axum-v0.8.9

axum v0.8.8

axum v0.8.7

axum v0.8.5

axum v0.8.4

0.22.0

What's Changed

0.21.2

What's Changed

0.21.1

What's Changed

0.21.0

What's Changed

v1.0.229

0.9.0 - 2026-05-06

Important Announcements

New Github Organization

Cargo.lock Removed from Tracking

Breaking

tracing 0.1.44

Fixed

Changed

tracing 0.1.43

Important

Fixed

tracing 0.1.42

Important

Added

Changed

Fixed

Uh oh!

dependabot Bot commented on behalf of github Oct 28, 2026

Labels

Uh oh!

socket-security Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hoffmang9 commented Oct 28, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Oct 28, 2026 •

edited

Loading

`Cargo.lock` Removed from Tracking

socket-security Bot commented Oct 28, 2026 •

edited

Loading

socket-security Bot commented Oct 28, 2026 •

edited

Loading