[renovate]

This PR contains the following updates:

Package	Type	Update	Change
finl_unicode (source)	dependencies	patch	1.5.0 → 1.5.1
flate2	dependencies	patch	1.1.10 → 1.1.11
minisign-verify	dev-dependencies	minor	0.2.5 → 0.3.0
pulldown-cmark	dependencies	patch	0.13.4 → 0.13.6
serde_json	dependencies	patch	1.0.151 → 1.0.154
sha2	dependencies	patch	0.11.0 → 0.11.1
ureq	dependencies	minor	3.4.2 → 3.5.1

---

Release Notes

dahosek/finl_unicode (finl_unicode)

v1.5.1

Compare Source

Fix grapheme clustering of emoji ZWJ sequences: Extend/SpacingMark/ZWJ after an emoji ZWJ now attach (GB9/GB9a), a SpacingMark no longer continues a GB11 sequence, and a virama after an emoji no longer blocks GB11. Deprecate CharacterCategories::is_control in favor of the standard library’s char::is_control (which c.is_control() already resolves to); it now delegates to it.

rust-lang/flate2-rs (flate2)

v1.1.11

Compare Source

Fixed

• fixup! Complete sync flushes across output buffer boundaries (#​581)
• Separate gzip header reads from compressed data
• Defer gzip input errors without losing read progress
• Preserve gzip header progress on input read errors (#​571)

Other

• Merge pull request #​582 from rust-lang/fix-lacking-buffer-drain
• Merge pull request #​574 from Sharadhi-v98/decompress-reset-window-bits
• Merge pull request #​577 from rust-lang/fix-loop
• Setup trusted publishing for the flate2 crate
• Complete sync flushes across output buffer boundaries (#​581)
• Fix "can by extended" typos in deflate and zlib write docs
• Merge pull request #​579 from NUAAwqy/docs/fix-double-space
• Fix double space in read module doc comment
• Add missing preposition in README description
• Cover decoder retries across the output buffer boundary
• Drain output before refilling the buffer
• Clarify partial-write buffering behavior
• Avoid shifting buffered output on partial writes
• Merge pull request #​567 from ndossche/more-asserts
• Merge pull request #​566 from HDauven/reject-incomplete-write-decoder-streams
• Fix encoder writes hanging after try_finish (#​576)
• Avoid panicking when dropping unfinished compressors
• Merge pull request #​565 from HDauven/zlib-rs-uninit-output
• still allow resetting incomplete write decoders
• Assert return result of reset calls
• Reject incomplete streams in write decoders
• Merge pull request #​573 from NUAAwqy/taiyi/fix-gzip-read-error-header
• review
• Reject incomplete streams when finishing write-side decoders
• Preserve window size and gzip mode across Decompress::reset
• preserve runtime detection in backend examples (#​570)
• Make miniz_oxide dictionary clearing explicit on reset
• Harden miniz_oxide decompressor reset
• Deduplicate zlib-rs flush conversions
• Use native zlib-rs uninitialized output

jedisct1/rust-minisign-verify (minisign-verify)

v0.3.0

Compare Source

raphlinus/pulldown-cmark (pulldown-cmark)

v0.13.6: Fix quadratic parsing of nested image wikilinks

Compare Source

This version backports #​1186 to fix quadratic parsing of nested image wikilinks.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.5...v0.13.6

v0.13.5: 0.13.5

Compare Source

This release fixes some security issues already fixed in main branch. More details in pulldown-cmark#1181.

Full Changelog: pulldown-cmark/pulldown-cmark@v0.13.4...v0.13.5

serde-rs/json (serde_json)

v1.0.154

Compare Source

• Support preserve_order in no_std builds (#​1333, thanks @​razmser)

v1.0.153

Compare Source

• Report invalid UTF-8 at the first bad byte (#​1345, thanks @​00200200)

v1.0.152

Compare Source

• Preserve sign of -0 in arbitrary_precision mode (#​1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#​1347, thanks @​yuxi-liu-wired)

RustCrypto/hashes (sha2)

v0.11.1

Compare Source

algesten/ureq (ureq)

v3.5.1

Compare Source

• Bump ureq-proto to 0.7.1 (fixes to connection reuse and transfer encoding) #​1224
  • Send only cookie names and values in request Cookie headers #​1222
  • Preserve readable responses after macOS rejects timeout changes on closed sockets #​1220

v3.5.0

Compare Source

• Prepare 3.5.0 and fix dependency advisories and warnings - #​1217
  • Add Agent::shutdown() to interrupt requests in flight and close all connections #​1211
  • Preserve validated request header casing with RequestBuilder::header_raw #​1214
  • Decode proxy URL credentials once; literal percent signs must be escaped as %25 #​1215
  • Encode ProxyBuilder credentials and preserve colons in proxy passwords #​1215
  • Apply remaining timeout budgets to SOCKS setup and drop the socks dependency #​1209
  • Check NO_PROXY before resolving a SOCKS proxy, so excluded hosts connect directly #​1209
  • Clarify timeout budgets, phase boundaries, and proxy DNS #​1213
  • Bound TLS handshake I/O by the remaining connect/global timeout #​1208
  • Retry socket reads interrupted by EINTR when timeout (technically breaking) #​1205
  • Fix native-tls-no-default enabling dependencies without enabling the TLS connector
  • Add timeout_per_read and timeout_per_write independently of total phase budgets

v3.4.3

Compare Source

• Update TLS dependencies for security fixes #​1218

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.