Bump the hyper group across 1 directory with 2 updates by dependabot[bot] · Pull Request #272 · arminha/covet

dependabot · 2026-04-06T03:53:24Z

Bumps the hyper group with 2 updates in the / directory: hyper and reqwest.

Updates hyper from 1.8.1 to 1.9.0

Release notes

v1.9.0

Features

client:

expose HTTP/2 current max stream count (#4026) (d51cb715)

add HTTP/2 max_local_error_reset_streams option (#4021) (57787459)

error: add 'Error::is_parse_version_h2' method (393c77c7)

http1: add UpgradeableConnection::into_parts (e21205cf)

Bug Fixes

ffi: validate null pointers before dereferencing in request/response functions (#4038 (28e73ccd)

http1:

allow keep-alive for chunked requests with trailers (#4043) (7211ec25, closes #4044)

use case-insensitive matching for trailer fields (#4011) (3b344cac, closes #4010)

use httparse config for Servers (#4002) (bcb8ec57, closes #3923)

http2:

cancel sending client request body on response future drop (#4042) (5b17a69e, closes #4040)

non-utf8 char in Connection header may cause panic when calling to_str (#4019) (c36ca8a5)

Refactors and chores

docs(error): add more information about is_incomplete_message by @seanmonstar in hyperium/hyper#3978

Run cargo-audit in CI to check for known vulnerabilities in dependencies. by @f0rki in hyperium/hyper#3246

refactor(http1): simplify match of Token parse error by @seanmonstar in hyperium/hyper#3981

refactor(http1): use saturating_sub instead of manual impl by @seanmonstar in hyperium/hyper#3983

refactor(http1): replace many args of Chunked::step with struct by @seanmonstar in hyperium/hyper#3982

docs: fix comment in put_slice() by @coryan in hyperium/hyper#3986

test(lib): fix unused warnings due to feature gating test imports by @seanmonstar in hyperium/hyper#3997

docs: improve Read trait and ReadBufCursor documentation by @majiayu000 in hyperium/hyper#4000

fix: use h1 parser config when parsing server req by @0xPoe in hyperium/hyper#4002

test(server): fix flaky disable_keep_alive_mid_request by @seanmonstar in hyperium/hyper#4009

chore(ci): update to actions/checkout@v6 by @tottoto in hyperium/hyper#4005

chore(ci): update to cargo-check-external-types 0.4.0 by @tottoto in hyperium/hyper#4006

update copyright year to 2026 by @jasmyhigh in hyperium/hyper#4007

refactor: avoid unwrap examples by @0xPoe in hyperium/hyper#4001

fix(http1): use case-insensitive matching for trailer fields by @HueCodes in hyperium/hyper#4011

chore: convert bug report template to GitHub form by @njg7194 in hyperium/hyper#4015

chore(ci): force toml mode in yq selecting msrv by @seanmonstar in hyperium/hyper#4020

fix: non-utf8 char may cause panic when calling to_str by @cuiweixie in hyperium/hyper#4019

feat(http2/client): add max_local_error_reset_streams option by @ffuugoo in hyperium/hyper#4021

chore: drop pin-utils dependency by @tottoto in hyperium/hyper#4023

[minor] doc: Fix HTTP/2 max concurrent stream link by @dentiny in hyperium/hyper#4037

fix(ffi): validate null pointers before dereferencing in request/resp… by @DhruvaD1 in hyperium/hyper#4038

h2: expose current max stream count by @howardjohn in hyperium/hyper#4026

fix(http1): allow keep-alive for chunked requests with trailers by @wi-adam in hyperium/hyper#4043

fix(http2): cancel pipe_task and send RST_STREAM on response future drop by @mmishra100 in hyperium/hyper#4042

Add APIs to allow switching an HTTP1 connection to HTTP2 if H2 preface is seen by @pborzenkov in hyperium/hyper#3996

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.9.0 (2026-03-31)

Bug Fixes

ffi: validate null pointers before dereferencing in request/response functions (#4038 (28e73ccd)

http1:

allow keep-alive for chunked requests with trailers (#4043) (7211ec25, closes #4044)

use case-insensitive matching for trailer fields (#4011) (3b344cac, closes #4010)

use httparse config for Servers (#4002) (bcb8ec57, closes #3923)

http2:

cancel sending client request body on response future drop (#4042) (5b17a69e, closes #4040)

non-utf8 char in Connection header may cause panic when calling to_str (#4019) (c36ca8a5)

Features

client:

expose HTTP/2 current max stream count (#4026) (d51cb715)

add HTTP/2 max_local_error_reset_streams option (#4021) (57787459)

error: add 'Error::is_parse_version_h2' method (393c77c7)

http1: add UpgradeableConnection::into_parts (e21205cf)

Commits

0d6c7d5 v1.9.0
e21205c feat(http1): add UpgradeableConnection::into_parts
393c77c feat(error): add 'Error::is_parse_version_h2' method
5b17a69 fix(http2): cancel sending client request body on response future drop (#4042)
7211ec2 fix(http1): allow keep-alive for chunked requests with trailers (#4043)
d51cb71 feat(client): expose HTTP/2 current max stream count (#4026)
28e73cc fix(ffi): validate null pointers before dereferencing in request/response fun...
e13e783 docs(client): fix HTTP/2 max concurrent stream link to spec (#4037)
8ba9008 chore(dependencies): drop pin-utils dependency (#4023)
5778745 feat(client): add HTTP/2 max_local_error_reset_streams option (#4021)
Additional commits viewable in compare view

Updates reqwest from 0.12.28 to 0.13.2

Release notes

Sourced from reqwest's releases.

v0.13.2

tl;dr

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

What's Changed

chore(deps): bump actions/checkout from 5 to 6 by @dependabot[bot] in seanmonstar/reqwest#2921

Update readme for 0.13 by @VojtaStanek in seanmonstar/reqwest#2926

fix http2 feature is not enabled for "native-tls" by @fox0 in seanmonstar/reqwest#2927

chore(deps): remove unused webpki-roots and rustls-native-certs by @seanmonstar in seanmonstar/reqwest#2932

docs: native-tls-alpn has changed to native-tls-no-alpn by @seanmonstar in seanmonstar/reqwest#2940

Specify h3 alpn for http3 connector by @passcod in seanmonstar/reqwest#2929

update copyright year to 2026 by @taozui472 in seanmonstar/reqwest#2943

fix(json): custom content-type overidden by json method for wasm by @Narendran-KT in seanmonstar/reqwest#2908

chore: upgrade wasm-streams to v0.5 by @xangelix in seanmonstar/reqwest#2958

chore(ci): add windows and linux arm64 to ci by @dennisameling in seanmonstar/reqwest#2960

New Contributors

@VojtaStanek made their first contribution in seanmonstar/reqwest#2926

@fox0 made their first contribution in seanmonstar/reqwest#2927

@passcod made their first contribution in seanmonstar/reqwest#2929

@taozui472 made their first contribution in seanmonstar/reqwest#2943

@Narendran-KT made their first contribution in seanmonstar/reqwest#2908

@xangelix made their first contribution in seanmonstar/reqwest#2958

@dennisameling made their first contribution in seanmonstar/reqwest#2960

Full Changelog: seanmonstar/reqwest@v0.13.1...v0.13.2

v0.13.1

What's Changed

http3: depend on quinn/rustls-aws-lc-rs to avoid ring dependency by @djc in seanmonstar/reqwest#2917

fix rustls on android by @seanmonstar in seanmonstar/reqwest#2918

Full Changelog: seanmonstar/reqwest@v0.13.0...v0.13.1

v0.13.0

Breaking changes

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.2

Fix HTTP/2 and native-tls ALPN feature combinations.

Fix HTTP/3 to send h3 ALPN.

(wasm) fix RequestBuilder::json() from override previously set content-type.

v0.13.1

Fixes compiling with rustls on Android targets.

v0.13.0

Breaking changes:

rustls is now the default TLS backend, instead of native-tls.

rustls crypto provider defaults to aws-lc instead of ring. (rustls-no-provider exists if you want a different crypto provider)

rustls-tls has been renamed to rustls.

rustls roots features removed, rustls-platform-verifier is used by default.

To use different roots, call tls_certs_only(your_roots).

native-tls now includes ALPN. To disable, use native-tls-no-alpn.

query and form are now crate features, disabled by default.

Long-deprecated methods and crate features have been removed (such as trust-dns, which was renamed hickory-dns a while ago).

Many TLS-related methods renamed to improve autocompletion and discovery, but previous name left in place with a "soft" deprecation. (just documented, no warnings)

For example, prefer tls_backend_rustls() over use_rustls_tls().

Commits

ad83b63 v0.13.2
c25f3db chore: Add Windows and Linux arm64 to CI (#2960)
761b89e chore: upgrade wasm-streams to v0.5 (#2958)
fd2d507 fix(wasm): custom content-type overidden by json method for wasm (#2908)
10c31c2 fix(http3): specify h3 alpn for http3 connector (#2929)
8530ec3 docs: native-tls-alpn has changed to native-tls-no-alpn (#2940)
04a216f chore(deps): remove unused webpki-roots and rustls-native-certs (#2932)
406b59e fix http2 feature is not enabled for native-tls ALPN (#2927)
325a020 Update readme for 0.13 (#2926)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the hyper group with 2 updates in the / directory: [hyper](https://github.com/hyperium/hyper) and [reqwest](https://github.com/seanmonstar/reqwest). Updates `hyper` from 1.8.1 to 1.9.0 - [Release notes](https://github.com/hyperium/hyper/releases) - [Changelog](https://github.com/hyperium/hyper/blob/master/CHANGELOG.md) - [Commits](hyperium/hyper@v1.8.1...v1.9.0) Updates `reqwest` from 0.12.28 to 0.13.2 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.12.28...v0.13.2) --- updated-dependencies: - dependency-name: hyper dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: hyper - dependency-name: reqwest dependency-version: 0.13.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: hyper ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Apr 6, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the hyper group across 1 directory with 2 updates#272

Bump the hyper group across 1 directory with 2 updates#272
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/hyper-1e3f142a0e

dependabot Bot commented on behalf of github Apr 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.9.0

Features

Bug Fixes

Refactors and chores

v1.9.0 (2026-03-31)

Bug Fixes

Features

v0.13.2

tl;dr

What's Changed

New Contributors

v0.13.1

What's Changed

v0.13.0

Breaking changes

v0.13.2

v0.13.1

v0.13.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 6, 2026 •

edited

Loading