chore(deps): weekly safe cargo updates · 6 packages

[mendral-app]

Packages bumped

Crate	Old	New	Published
http	1.4.0	1.4.2	2026-06-08
jsonwebtoken	10.3.0	10.4.0	2026-05-11
serde_json	1.0.149	1.0.150	2026-05-21
tokio	1.49.0	1.52.3	2026-05-08
tracing-subscriber	0.3.22	0.3.23	2026-03-13
uuid	1.21.0	1.23.3	2026-06-09

Per-package changelog & impact

http 1.4.0 → 1.4.2

• Fixed PathAndQuery::from_static() and from_shared() to reject inputs that don't start with /
• Fixed Extend for HeaderMap to prevent overflow by clamping max size hint
• Fixed header::IntoIter potential use-after-free if generic value type panics on drop
• Impact: We don't construct PathAndQuery directly or iterate HeaderMap with extend. Bug fixes only; no API changes.

jsonwebtoken 10.3.0 → 10.4.0

• Minor additive release
• Impact: We use jsonwebtoken for GitHub App JWT signing (encode/decode). No breaking changes.

serde_json 1.0.149 → 1.0.150

• Reject non-string enum object keys during deserialization
• Impact: We deserialize webhook payloads with known string keys. No behavioral change for our usage.

tokio 1.49.0 → 1.52.3

• Fixed underflow in mpsc channel len()
• Reverted LIFO slot stealing change from v1.51.0 (performance regression)
• Reverted regression that caused spawn_blocking to hang
• Added AioSource::register_borrowed for I/O safety support
• Impact: We use tokio as async runtime with macros/rt-multi-thread/signal. Bug fixes are beneficial; no API changes affect us.

tracing-subscriber 0.3.22 → 0.3.23

• Allow ANSI sanitization to be disabled
• Impact: We use tracing-subscriber with env-filter for logging. Additive feature; no behavioral change.

uuid 1.21.0 → 1.23.3

• Fixed parser panic on empty input
• Various internal improvements
• Impact: We use uuid with v4 feature for generating random UUIDs. Parser fix is positive; no API changes.

Files modified

• Cargo.toml
• Cargo.lock

Skipped this ecosystem

Crate	Current	Latest	Reason
octocrab	0.49.5	0.53.1	Open PR #28
askama_escape	0.15.4	0.16.0	Open PR #24
axum	0.8.8	0.8.9	Open PR #26
chrono	0.4.44	0.4.45	Open PR #26
rand	0.10.0	0.10.1	Open PR #26
reqwest	0.13.2	0.13.4	Open PR #26
rustls	0.23.37	0.23.40	Open PR #26
hmac	0.12.1	0.13.0-rc.6	Pre-release only; no stable update
sha2	0.10.9	0.11.0-rc.5	Pre-release only; no stable update
mockall	0.14.0	0.15.0	Cooldown (published 2026-06-28)
uuid	1.23.3	1.23.4	Cooldown (published 2026-06-24)

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session

[cloudflare-workers-and-pages]

Deploying pratrol with    Cloudflare Pages

Latest commit:	5999bbc
Status:	✅  Deploy successful!
Preview URL:	https://54959897.pratrol.pages.dev
Branch Preview URL:	https://mendral-deps-weekly-safe-car-j26t.pratrol.pages.dev

View logs