chore(deps): bump the cargo group across 2 directories with 6 updates

[dependabot]

Bumps the cargo group with 5 updates in the /codex-rs directory:

Package	From	To
jsonwebtoken	9.3.1	10.3.0
rand	0.9.2	0.9.3
actix-http	3.11.2	3.12.1
quinn-proto	0.11.13	0.11.14
rustls-webpki	0.103.10	0.103.13

Bumps the cargo group with 1 update in the /tools/argument-comment-lint directory: tar.

Updates jsonwebtoken from 9.3.1 to 10.3.0

Changelog

Sourced from jsonwebtoken's changelog.

10.3.0 (2026-01-27)

• Export everything needed to define your own CryptoProvider
• Fix type confusion with exp/nbf when not required

10.2.0 (2025-11-06)

• Remove Clone bound from decode functions

10.1.0 (2025-10-18)

• add dangerous::insecure_decode
• Implement TryFrom &Jwk for DecodingKey

10.0.0 (2025-09-29)

• BREAKING: now using traits for crypto backends, you have to choose between aws_lc_rs and rust_crypto
• Add Clone bound to decode
• Support decoding byte slices
• Support JWS

Commits

• abbc307 Fix type confusion
• e99740d fix: bump minimal version requirements (#481)
• 50d15e0 Use try_sign to avoid panics (#479)
• 245858f Bump some dep
• 122c2ed Bump action number in CI
• 72e0c7f Expose cryptography backends via CryptoProvider (#452)
• 53a3fc2 Do not fail for clippy
• 3226cfc Prepare for release
• dfe58f9 Remove unnecessary Clone bounds from decode functions (#458)
• 9b3e19c Fix function names in README (#457)
• Additional commits viewable in compare view

Updates rand from 0.9.2 to 0.9.3

Changelog

Sourced from rand's changelog.

[0.9.3] — 2026-02-11

This release back-ports a fix from v0.10. See also #1763.

Changes

• Deprecate feature log (#1764)
• Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

Commits

• 1aeee9f Prepare v0.9.3: deprecate feature log (#1764)
• 98473ee Prepare rand 0.9.2 (#1648)
• 031a1f5 examples/print-next.rs (#1647)
• 6cb75ee Make UniformUsize serializable (#1646)
• 0c955c5 Add some tests for BlockRng, BlockRng64 and Xoshiro RNGs (#1639)
• 204084a Fix: Remove accidental editor swap file (#1636)
• 86262ac Deprecate rand::rngs::mock module and StepRng (#1634)
• a6e217f Update statrs link (#1630)
• db993ec Prepare rand v0.9.1 (#1629)
• 3057641 Remove zerocopy from rand (#1579)
• Additional commits viewable in compare view

Updates actix-http from 3.11.2 to 3.12.1

Release notes

Sourced from actix-http's releases.

actix-http: v3.12.1

Notice: This release contains a security fix. Users are encouraged to update to this version ASAP.

• SECURITY: Reject HTTP/1 requests with ambiguous request framing from Content-Length and Transfer-Encoding headers to prevent request smuggling.
• Encode the HTTP/1 Connection: Upgrade header in Camel-Case when camel-case header formatting is enabled.#3953
• Fix HeaderMap iterators' len() and size_hint() implementations for multi-value headers.
• Update rand dependency to 0.10.
• Update sha1 dependency to 0.11.

#3953: actix/actix-web#3953

actix-http: v3.12.0

• Minimum supported Rust version (MSRV) is now 1.88.
• Increase default HTTP/2 flow control window sizes. #3638
• Expose configuration methods to improve upload throughput. #3638
• Fix truncated body ending without error when connection closed abnormally. #3067
• Add config/method for TCP_NODELAY. #3918
• Do not compress 206 Partial Content responses. #3191
• Fix lingering sockets and client stalls when responding early to dropped chunked request payloads. #2972

#3638: actix/actix-web#3638 #3067: actix/actix-web#3067 #3918: actix/actix-web#3918 #3191: actix/actix-web#3191 #2972: actix/actix-web#2972

Commits

• 0fb8945 chore(http): prepare v3.12.1 (#4029)
• 3c056bd Merge commit from fork
• e6d0991 chore(multipart,derive): prepare 0.8.0 (#4027)
• 4434a49 fix(multipart): count ignored fields towards MultipartFormConfig li… (#4026)
• be62050 fix(multipart): set cap for parser buffering (#4025)
• be4566d fix(multipart): do not parse with fixed index not to panic (#4024)
• 6d2c2f4 chore(http): upgrade sha1 to 0.11 (#4022)
• 253cd4f chore: address new advisories (#4023)
• e766ca6 chore: upgrade rand to 0.10.1 (#4021)
• d747959 build(deps): bump EmbarkStudios/cargo-deny-action from 2.0.15 to 2.0.16 (#4018)
• Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.14

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.14

@​jxs reported a denial of service issue in quinn-proto 5 days ago:

• GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

• Fix over-permissive proto dependency edge by @​Ralith in quinn-rs/quinn#2385
• 0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @​djc in quinn-rs/quinn#2559

Commits

• 2c315aa proto: bump version to 0.11.14
• 8ad47f4 Use newer rustls-pki-types PEM parser API
• c81c028 ci: fix workflow syntax
• 0050172 ci: pin wasm-bindgen-cli version
• 8a6f82c Take semver-compatible dependency updates
• e52db4a Apply suggestions from clippy 1.91
• 6df7275 chore: Fix unnecessary_unwrap clippy
• c8eefa0 proto: avoid unwrapping varint decoding during parameters parsing
• 9723a97 fuzz: add fuzzing target for parsing transport parameters
• eaf0ef3 Fix over-permissive proto dependency edge (#2385)
• Additional commits viewable in compare view

Updates rustls-webpki from 0.103.10 to 0.103.13

Release notes

Sourced from rustls-webpki's releases.

0.103.13

• Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
• For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

• Actually fail closed for URI matching against excluded subtrees by @​djc in rustls/webpki#473
• Prepare 0.103.13 by @​ctz in rustls/webpki#474

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

• GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
• GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

• Prepare 0.103.12 by @​djc in rustls/webpki#470

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

• Backport parsing trust anchors with unknown critical extensions to 0.103 by @​djc in rustls/webpki#466

Commits

• 2879b2c Prepare 0.103.13
• 2c49773 Improve tests for padding of BitStringFlags
• 4e3c0b3 Correct validation of BIT STRING constraints
• 39c91d2 Actually fail closed for URI matching against excluded subtrees
• 27131d4 Bump version to 0.103.12
• 6ecb876 Clean up stuttery enum variant names
• 318b3e6 Ignore wildcard labels when matching name constraints
• 1219622 Rewrite constraint matching to avoid permissive catch-all branch
• 57bc62c Bump version to 0.103.11
• d0fa01e Allow parsing trust anchors with unknown criticial extensions
• See full diff in compare view

Updates tar from 0.4.44 to 0.4.45

Commits

• 096e3d1 Bump to 0.4.45 (#443)
• 17b1fd8 archive: Prevent symlink-directory collision chmod attack (#442)
• de1a587 archive: Unconditionally honor PAX size (#441)
• 6071cbe ci: Consolidate workflows (#439)
• ad1fde9 build-sys: Promote unused_code to an error
• c8cb250 tests: Squash a warning
• 638c495 ci: Add xtask infra + reverse dependency testing (#435)
• 32a9bbb tests: Add RandomReader to exercise partial-read resilience (#436)
• 9c5df0b Fix GNU long-name extension stream corruption on validation error (#434)
• 88b1e3b Fix docs typo in header.rs (#431)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
codex	Error		Apr 22, 2026 2:58pm

[dependabot]

Superseded by #132.