Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Bump `async-graphql` from 7.0.6 to 7.0.11 This additionally bumps the `async-graphql-axum` crate, missed by Dependabot. Patches [`CVE-2024-47614`](https://nvd.nist.gov/vuln/detail/CVE-2024-47614): async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10. * Bump `diesel` from 2.2.1 to 2.2.4 Fixes [`RUSTSEC-2024-0365`](https://rustsec.org/advisories/RUSTSEC-2024-0365): Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts * Bump `object_store` from 0.10.1 to 0.11.0 Fixes [`RUSTSEC-2024-0358`](https://rustsec.org/advisories/RUSTSEC-2024-0358): Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files * Bump `openssl` from 0.10.64 to 0.10.66 Fixes [`RUSTSEC-2024-0357`](https://rustsec.org/advisories/RUSTSEC-2024-0357): `MemBio::get_buf` has undefined behavior with empty buffers * Bump `quinn-proto` from 0.11.3 to 0.11.8 Fixes [`RUSTSEC-2024-0373`](https://rustsec.org/advisories/RUSTSEC-2024-0373): `Endpoint::retry()` calls can lead to panicking
- Loading branch information