Sourced from tokio's releases.

Tokio v1.38.2

This release fixes a soundness issue in the broadcast channel. The channel accepts values that are Send but !Sync. Previously, the channel called clone() on these values without synchronizing. This release fixes the channel by synchronizing calls to .clone() (Thanks Austin Bonander for finding and reporting the issue).

Fixed

• sync: synchronize clone() call in broadcast channel (#7232)

#7232: tokio-rs/tokio#7232

Tokio v1.38.1

1.38.1 (July 16th, 2024)

This release fixes the bug identified as (#6682), which caused timers not to fire when they should.

Fixed

• time: update wake_up while holding all the locks of sharded time wheels (#6683)

#6682: tokio-rs/tokio#6682 #6683: tokio-rs/tokio#6683

Tokio v1.38.0

This release marks the beginning of stabilization for runtime metrics. It stabilizes RuntimeMetrics::worker_count. Future releases will continue to stabilize more metrics.

Added

• fs: add File::create_new (#6573)
• io: add copy_bidirectional_with_sizes (#6500)
• io: implement AsyncBufRead for Join (#6449)
• net: add Apple visionOS support (#6465)
• net: implement Clone for NamedPipeInfo (#6586)
• net: support QNX OS (#6421)
• sync: add Notify::notify_last (#6520)
• sync: add mpsc::Receiver::{capacity,max_capacity} (#6511)
• sync: add split method to the semaphore permit (#6472, #6478)
• task: add tokio::task::join_set::Builder::spawn_blocking (#6578)
• wasm: support rt-multi-thread with wasm32-wasi-preview1-threads (#6510)

Changed

• macros: make #[tokio::test] append #[test] at the end of the attribute list (#6497)
• metrics: fix blocking_threads count (#6551)
• metrics: stabilize RuntimeMetrics::worker_count (#6556)
• runtime: move task out of the lifo_slot in block_in_place (#6596)
• runtime: panic if global_queue_interval is zero (#6445)
• sync: always drop message in destructor for oneshot receiver (#6558)
• sync: instrument Semaphore for task dumps (#6499)

... (truncated)

• aa303bc chore: prepare Tokio v1.38.2 release
• 7b6ccb5 chore: backport CI fixes
• 4b174ce sync: fix cloning value when receiving from broadcast channel
• 9681ce2 chore: make 1.38 an LTS (#6706)
• 14b9f71 chore: release Tokio v1.38.1 (#6688)
• 24344df time: fix race condition leading to lost timers (#6683)
• 14c17fc chore: prepare Tokio v1.38.0 (#6601)
• 65cbf73 chore: prepare tokio-macros v2.3.0 (#6600)
• dbf93c7 sync: fix incorrect is_empty on mpsc block boundaries (#6603)
• 873cb8a runtime: move task out of the lifo_slot in block_in_place (#6596)
• Additional commits viewable in compare view

Sourced from crossbeam-channel's releases.

crossbeam-channel 0.5.15

• Fix regression introduced in 0.5.12 that can lead to a double free when dropping unbounded channel. (#1187)

crossbeam-channel 0.5.14

• Fix stack overflow when sending large value to unbounded channel. (#1146, #1147)
• Add Select::new_biased function. (#1150)
• Remove inefficient spinning. (#1154)
• Suppress buggy clippy::zero_repeat_side_effects lint in macro generated code. (#1123)

crossbeam-channel 0.5.13

• Add select_biased! macro. (#1040)

• d35ffde Prepare for the next release
• 6ec74ec crossbeam-channel: prevent double free on Drop (#1187)
• ccd83ac Prepare for the next release
• 54988eb Calculate layout in const context
• 761d0b6 Port #1146 & #1147 to deque::Injector and queue::SegQueue
• 8144fbb Remove optimistic spinning from Context::wait_until
• a92f6c4 Bump peter-evans/create-pull-request from 5 to 7 (#1153)
• 66d41a9 channel: Add new_biased constructor for biased channel selection (#1150)
• d0d0a80 CachePadded: Use 128-byte alignment on arm64ec
• f757eef Add comment about fixed rustc bug
• Additional commits viewable in compare view

Sourced from ring's changelog.

Version 0.17.14 (2025-03-11)

Fixed a performance bug in the AVX2-based AES-GCM implementation added in ring 0.17.13. This will be another notable performance improvement for most newish x86-64 systems. The performance issue impacted not just AES-GCM.

Compatibility with GNU binutils 2.29 (used on Amazon Linux 2), and probably even earlier versions, was restored. It is expected that ring 0.17.14 will build on all the systems that 0.17.12 would build on.

Version 0.17.13 (2025-03-06)

Increased MSRV to 1.66.0 to avoid bugs in earlier versions so that we can safely use core::arch::x86_64::__cpuid and core::arch::x86::__cpuid from Rust in future releases.

AVX2-based VAES-CLMUL implementation. This will be a notable performance improvement for most newish x86-64 systems. This will likely raise the minimum binutils version supported for very old Linux distros.

Version 0.17.12 (2025-03-05)

Bug fix: briansmith/ring#2447 for denial of service (DoS).

• Fixes a panic in ring::aead::quic::HeaderProtectionKey::new_mask() when integer overflow checking is enabled. In the QUIC protocol, an attacker can induce this panic by sending a specially-crafted packet. Even unintentionally it is likely to occur in 1 out of every 2**32 packets sent and/or received.

• Fixes a panic on 64-bit targets in ring::aead::{AES_128_GCM, AES_256_GCM} when overflow checking is enabled, when encrypting/decrypting approximately 68,719,476,700 bytes (about 64 gigabytes) of data in a single chunk. Protocols like TLS and SSH are not affected by this because those protocols break large amounts of data into small chunks. Similarly, most applications will not attempt to encrypt/decrypt 64GB of data in one chunk.

Overflow checking is not enabled in release mode by default, but RUSTFLAGS="-C overflow-checks" or overflow-checks = true in the Cargo.toml profile can override this. Overflow checking is usually enabled by default in debug mode.

• See full diff in compare view

• 3633152 Cargo: v0.21.11 -> v0.21.12
• 0baaeba proj: MSRV 1.61 -> 1.63
• 6fd691a tls13: fix clippy::unnecessary_lazy_evaluations finding
• 6da5337 Test for illegal IP address in server name extension
• 75f8857 Ignore server_name extension containing IP address
• 7b8d1db Prepare 0.21.11
• ebcb478 complete_io: bail out if progress is impossible
• 20f35df Regression test for complete_io infinite loop bug
• 2f2aae1 Don't specially handle unauthenticated close_notify alerts
• e163587 Don't deny warnings from nightly clippy
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.