From 5d10725dc6f929cc309efd03f36455582d0a79f6 Mon Sep 17 00:00:00 2001 From: Nic-dorman Date: Fri, 23 Oct 2026 19:16:30 +0100 Subject: [PATCH] fix(deps): bump tokio to 1.53.3 for RUSTSEC-2026-0386 tokio 1.53.1 -> 1.53.3 resolves RUSTSEC-2026-0386 (unsound tokio::io::unix::AsyncFd; patched in >=1.51.6,<1.52.0 and >=1.53.3). Lockfile-only: Cargo.toml keeps `tokio = "1.35"`, which already admits 1.53.3. `cargo update -p tokio --precise 1.53.3` with cargo 1.97 also rewrote unrelated windows-sys 0.61 -> 0.52 and socket2 0.6 -> 0.5 edges, so the tokio version and checksum were edited by hand and the diff is limited to those two lines. No dependency edges changed. Closes V2-1736 Co-Authored-By: Claude Opus 5.5 --- Cargo.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index cfc436d7..248d9970 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6235,9 +6235,9 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" [[package]] name = "tokio" -version = "1.53.1" +version = "1.53.3" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed" +checksum = "ce3335fa71841cda333a58d7615b03901380ecf09d59b3296d21f8bbac0dde4e" dependencies = [ "bytes", "libc",