Skip to content

chore(deps): bump rustls-webpki from 0.103.7 to 0.103.10 in the cargo group across 1 directory#13

Closed
dependabot[bot] wants to merge 47 commits intomainfrom
dependabot/cargo/cargo-64b2a50fd2
Closed

chore(deps): bump rustls-webpki from 0.103.7 to 0.103.10 in the cargo group across 1 directory#13
dependabot[bot] wants to merge 47 commits intomainfrom
dependabot/cargo/cargo-64b2a50fd2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 25, 2026

Bumps the cargo group with 1 update in the / directory: rustls-webpki.

Updates rustls-webpki from 0.103.7 to 0.103.10

Release notes

Sourced from rustls-webpki's releases.

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correctly provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @​1seal for the report.

What's Changed

Full Changelog: rustls/webpki@v/0.103.9...v/0.103.10

0.103.9

What's Changed

0.103.8

What's Changed

Full Changelog: rustls/webpki@v/0.103.7...v/0.103.8

Commits
  • 348ce01 Prepare 0.103.10
  • dbde592 crl: fix authoritative_for() support for multiple URIs
  • 9c4838e avoid std::prelude imports
  • 009ef66 fix rust 1.94 ambiguous panic macro warnings
  • c41360d build(deps): bump taiki-e/cache-cargo-install-action from 2 to 3
  • e401d00 generate.py: reformat for black 2026.1.0
  • 06cedec Take semver-compatible deps
  • 6bc9931 Bump version to 0.103.9
  • 92dbfc6 Tie lifetime of valid_dns_names/valid_uri_names to struct lifetime
  • 2c46166 ci: sync cargo-check-external-types nightly
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

kjwsl-flab and others added 30 commits October 9, 2025 01:38
feat: add yt_transcript_fetcher
Bumps the cargo group with 1 update in the / directory: [bytes](https://github.com/tokio-rs/bytes).


Updates `bytes` from 1.10.1 to 1.11.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.10.1...v1.11.1)

---
updated-dependencies:
- dependency-name: bytes
  dependency-version: 1.11.1
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
- Replaced redundant `Vec` allocations and `.join(" ")` calls with an iterator-based approach.
- Used `String::with_capacity(srt.len())` to pre-allocate memory for the transcript.
- Added a benchmark and correctness test to `lib.rs`.

Measured improvement: ~42% reduction in execution time for `parse_srt`.
Baseline: 254.14ms for 1000 iterations (1000 blocks each).
Optimized: 147.58ms for 1000 iterations (1000 blocks each).

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
…006237618

⚡ Optimize SRT parsing to reduce allocations
- Refactored `get_content_from_pdf` and `get_content_from_epub` to be async functions.
- Replaced standard `fs::read` and `fs::read_to_string` with `tokio::fs` variants to avoid blocking the async executor.
- Wrapped synchronous, CPU-bound parsing operations (`pdf_extract` and `EpubDoc`) in `tokio::task::spawn_blocking` to ensure the async executor remains responsive during large file parsing.
- Updated calls to `get_content_from_file` in `commands.rs` to `.await`.

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
- Avoid intermediate Vec allocations and `.join()` inside loop (already present)
- Pre-allocate string capacity via `srt.len()` (already present)
- Avoid allocating a new String at the end of the function by changing `trim().to_string()` to an in-place `ends_with` check and `pop()`

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Refactored `clean_subtitle_text` to use a globally cached `AhoCorasick` automaton instead of chaining 15 separate `.replace()` calls.

This avoids 15 separate string allocations and multiple passes over the input text, greatly improving performance of subtitle cleaning.

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
- Modified `get_content_from_file`, `get_content_from_epub`, and `get_content_from_pdf` to return `Result<String, Box<dyn std::error::Error + Send + Sync>>`.
- Changed `extract_text_from_vtt` to also return `Send + Sync` error type for type compatibility in `match` arms.
- Simplified `tokio::task::spawn_blocking` error handling to correctly utilize `await??` without an intermediate `map_err`.
- Handled backwards-compatibility downcasting back to `Box<dyn std::error::Error>` inside `commands.rs`.

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
Copilot AI and others added 17 commits March 6, 2026 17:50
… bridge

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
…5063441335

⚡ Optimize file extraction to be non-blocking in async context
Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
…-level imports

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
refactor(youtube): apply PR review feedback on AhoCorasick optimization
fix: Replace invalid `as` cast with proper coercion for boxed errors in async file extraction
…n-5872338781751368452

⚡ Optimize string replacements in subtitle text cleaning
Fix async error types to be `Send + Sync` throughout the extraction pipeline
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…364042732

⚡ perf: optimize SRT parsing by avoiding intermediate and final string reallocations
chore(deps): bump bytes from 1.10.1 to 1.11.1 in the cargo group across 1 directory
* Initial plan

* Add GitHub Actions CI workflow

Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kjwsl <33772093+kjwsl@users.noreply.github.com>
Bumps the cargo group with 1 update in the / directory: [rustls-webpki](https://github.com/rustls/webpki).


Updates `rustls-webpki` from 0.103.7 to 0.103.10
- [Release notes](https://github.com/rustls/webpki/releases)
- [Commits](rustls/webpki@v/0.103.7...v/0.103.10)

---
updated-dependencies:
- dependency-name: rustls-webpki
  dependency-version: 0.103.10
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Mar 25, 2026
@larpios larpios closed this Mar 28, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Mar 28, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot Bot deleted the dependabot/cargo/cargo-64b2a50fd2 branch March 28, 2026 01:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants