Changelog

jsr-io/jsr · · 1 commit

Security alert cleanup and major dependency refresh

Updated core Rust dependencies and lockfiles to clear all open Dependabot security alerts, including several API-version bumps.

piscisaureus

Dependency refresh to clear Dependabot alerts (piscisaureusa5dd8fe)

This commit upgrades a wide swath of Rust crates and regenerates both lockfiles to close all open Dependabot security alerts. It includes several notable version jumps and API changes around HTTP, OAuth, OpenTelemetry, JSON web tokens, and tree-sitter-related crates, so it’s a substantial maintenance and security update rather than a routine bump.

The diff also shows manifest changes to keep reqwest feature sets isolated, switch OTLP export to blocking HTTP, and pin newer versions of crates that needed code changes. That combination reduces security exposure while keeping the service’s storage, auth, tracing, and parsing stacks aligned with current releases.

Other misc changes

  • Lockfile refreshes across Cargo.lock and workers-rs/Cargo.lock
  • Multiple transitive dependency bumps and manifest pin updates
  • Internal code adjustments to compile against upgraded auth, tracing, and parser crates