fix(deps): update rust crate sqlx to 0.8.1 [security]

This PR contains the following updates:

Package	Type	Update	Change
sqlx	dependencies	minor	`0.7.4` -> `0.8.1`
sqlx	dev-dependencies	minor	`0.7.4` -> `0.8.1`

GitHub Vulnerability Alerts

GHSA-xmrp-424f-vfpx

The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:

SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
(Archive link for posterity.)

Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow, causing the server to interpret the rest of the string as binary protocol commands or other data.

It appears SQLx does perform truncating casts in a way that could be problematic, for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163

This code has existed essentially since the beginning, so it is reasonable to assume that all published versions <= 0.8.0 are affected.

Mitigation

As always, you should make sure your application is validating untrustworthy user input. Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB. Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.

Encode::size_hint() can be used for sanity checks, but do not assume that the size returned is accurate. For example, the Json<T> and Text<T> adapters have no reasonable way to predict or estimate the final encoded size, so they just return size_of::<T>() instead.

For web application backends, consider adding some middleware that limits the size of request bodies by default.

Resolution

Work has started on a branch to add #[deny] directives for the following Clippy lints:

and to manually audit the code that they flag.

A fix is expected to be included in the 0.8.1 release (still WIP as of writing).

Release Notes

launchbadge/sqlx (sqlx)

### [`v0.8.1`](https://togithub.com/launchbadge/sqlx/blob/HEAD/CHANGELOG.md#081---2024-08-23) [Compare Source](https://togithub.com/launchbadge/sqlx/compare/v0.8.0...v0.8.1) 16 pull requests were merged this release cycle. This release contains a fix for [RUSTSEC-2024-0363]. Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated: [#3440 (comment)](https://togithub.com/launchbadge/sqlx/issues/3440#issuecomment-2307956901) MySQL and SQLite do not *appear* to be exploitable, but upgrading is recommended nonetheless. ##### Added - \[[#3421]]: correct spelling of `MySqlConnectOptions::no_engine_substitution()` \[\[[@kolinfluence](https://togithub.com/kolinfluence)]] - Deprecates `MySqlConnectOptions::no_engine_subsitution()` (oops) in favor of the correctly spelled version. ##### Changed - \[[#3376]]: doc: hide `spec_error` module \[\[[@abonander](https://togithub.com/abonander)]] - This is a helper module for the macros and was not meant to be exposed. - It is not expected to receive any breaking changes for the 0.8.x release, but is not designed as a public API. Use at your own risk. - \[[#3382]]: feat: bumped to `libsqlite3-sys=0.30.1` to support sqlite 3.46 \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3385]]: chore(examples):Migrated the pg-chat example to ratatui \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3399]]: Upgrade to rustls 0.23 \[\[[@djc](https://togithub.com/djc)]] - RusTLS now has pluggable cryptography providers: `ring` (the existing implementation), and `aws-lc-rs` which has optional FIPS certification. - The existing features activating RusTLS (`runtime-tokio-rustls`, `runtime-async-std-rustls`, `tls-rustls`) enable the `ring` provider of RusTLS to match the existing behavior so this *should not* be a breaking change. - Switch to the `tls-rustls-aws-lc-rs` feature to use the `aws-lc-rs` provider. - If using `runtime-tokio-rustls` or `runtime-async-std-rustls`, this will necessitate switching to the appropriate non-legacy runtime feature: `runtime-tokio` or `runtime-async-std` - See the RusTLS README for more details: ##### Fixed - \[[#2786]]: fix(sqlx-cli): do not clean sqlx during prepare \[\[[@cycraig](https://togithub.com/cycraig)]] - \[[#3354]]: sqlite: fix inconsistent read-after-write \[\[[@ckampfe](https://togithub.com/ckampfe)]] - \[[#3371]]: Fix encoding and decoding of MySQL enums in `sqlx::Type` \[\[[@alu](https://togithub.com/alu)]] - \[[#3374]]: fix: usage of `node12` in `SQLx` action \[\[[@hamirmahal](https://togithub.com/hamirmahal)]] - \[[#3380]]: chore: replace structopt with clap in examples \[\[[@tottoto](https://togithub.com/tottoto)]] - \[[#3381]]: Fix CI after Rust 1.80, remove dead feature references \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3384]]: chore(tests): fixed deprecation warnings \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3386]]: fix(dependencys):bumped cargo_metadata to `v0.18.1` to avoid yanked `v0.14.3` \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3389]]: fix(cli): typo in error for required DB URL \[\[[@ods](https://togithub.com/ods)]] - \[[#3417]]: Update version to 0.8 in README \[\[[@soucosmo](https://togithub.com/soucosmo)]] - \[[#3441]]: fix: audit protocol handling \[\[[@abonander](https://togithub.com/abonander)]] - This addresses [RUSTSEC-2024-0363] and includes regression tests for MySQL, Postgres and SQLite. [#2786]: https://togithub.com/launchbadge/sqlx/pull/2786 [#3354]: https://togithub.com/launchbadge/sqlx/pull/3354 [#3371]: https://togithub.com/launchbadge/sqlx/pull/3371 [#3374]: https://togithub.com/launchbadge/sqlx/pull/3374 [#3376]: https://togithub.com/launchbadge/sqlx/pull/3376 [#3380]: https://togithub.com/launchbadge/sqlx/pull/3380 [#3381]: https://togithub.com/launchbadge/sqlx/pull/3381 [#3382]: https://togithub.com/launchbadge/sqlx/pull/3382 [#3384]: https://togithub.com/launchbadge/sqlx/pull/3384 [#3385]: https://togithub.com/launchbadge/sqlx/pull/3385 [#3386]: https://togithub.com/launchbadge/sqlx/pull/3386 [#3389]: https://togithub.com/launchbadge/sqlx/pull/3389 [#3399]: https://togithub.com/launchbadge/sqlx/pull/3399 [#3417]: https://togithub.com/launchbadge/sqlx/pull/3417 [#3421]: https://togithub.com/launchbadge/sqlx/pull/3421 [#3441]: https://togithub.com/launchbadge/sqlx/pull/3441 [RUSTSEC-2024-0363]: https://rustsec.org/advisories/RUSTSEC-2024-0363.html ### [`v0.8.0`](https://togithub.com/launchbadge/sqlx/blob/HEAD/CHANGELOG.md#080---2024-07-22) [Compare Source](https://togithub.com/launchbadge/sqlx/compare/v0.7.4...v0.8.0) 70 pull requests were merged this release cycle. [#2697] was merged the same day as release 0.7.4 and so was missed by the automatic CHANGELOG generation. ##### Breaking - \[[#2697]]: fix(macros): only enable chrono when time is disabled \[\[[@saiintbrisson](https://togithub.com/saiintbrisson)]] - \[[#2973]]: Generic Associated Types in Database, replacing HasValueRef, HasArguments, HasStatement \[\[[@nitn3lav](https://togithub.com/nitn3lav)]] - \[[#2482]]: chore: bump syn to 2.0 \[\[[@saiintbrisson](https://togithub.com/saiintbrisson)]] - Deprecated type ascription syntax in the query macros was removed. - \[[#2736]]: Fix describe on PostgreSQL views with rules \[\[[@tsing](https://togithub.com/tsing)]] - Potentially breaking: nullability inference changes for Postgres. - \[[#2869]]: Implement PgHasArrayType for all references \[\[[@tylerhawkes](https://togithub.com/tylerhawkes)]] - Conflicts with existing manual implementations. - \[[#2940]]: fix: Decode and Encode derives ([#1031](https://togithub.com/launchbadge/sqlx/issues/1031)) \[\[[@benluelo](https://togithub.com/benluelo)]] - Changes lifetime obligations for field types. - \[[#3064]]: Sqlite explain graph \[\[[@tyrelr](https://togithub.com/tyrelr)]] - Potentially breaking: nullability inference changes for SQLite. - \[[#3123]]: Reorder attrs in sqlx::test macro \[\[[@bobozaur](https://togithub.com/bobozaur)]] - Potentially breaking: attributes on `#[sqlx::test]` usages are applied in the correct order now. - \[[#3126]]: Make Encode return a result \[\[[@FSMaxB](https://togithub.com/FSMaxB)]] - \[[#3130]]: Add version information for failed cli migration ([#3129](https://togithub.com/launchbadge/sqlx/issues/3129)) \[\[[@FlakM](https://togithub.com/FlakM)]] - Breaking changes to `MigrateError`. - \[[#3181]]: feat: no tx migration \[\[[@cleverjam](https://togithub.com/cleverjam)]] - (Postgres only) migrations that should not run in a transaction can be flagged by adding `-- no-transaction` to the beginning. - Breaking change: added field to `Migration` - \[[#3184]]: \[BREAKING} fix(sqlite): always use `i64` as intermediate when decoding \[\[[@abonander](https://togithub.com/abonander)]] - integer decoding will now loudly error on overflow instead of silently truncating. - some usages of the query!() macros might change an i32 to an i64. - \[[#3252]]: fix `#[derive(sqlx::Type)]` in Postgres \[\[[@abonander](https://togithub.com/abonander)]] - Manual implementations of PgHasArrayType for enums will conflict with the generated one. Delete the manual impl or add `#[sqlx(no_pg_array)]` where conflicts occur. - Type equality for PgTypeInfo is now schema-aware. - \[[#3329]]: fix: correct handling of arrays of custom types in Postgres \[\[[@abonander](https://togithub.com/abonander)]] - Potential breaking change: `PgTypeInfo::with_name()` infers types that start with `_` to be arrays of the un-prefixed type. Wrap type names in quotes to bypass this behavior. - \[[#3356]]: breaking: fix name collision in `FromRow`, return `Error::ColumnDecode` for `TryFrom` errors \[\[[@abonander](https://togithub.com/abonander)]] - Breaking behavior change: errors with `#[sqlx(try_from = "T")]` now return `Error::ColumnDecode` instead of `Error::ColumnNotFound`. - Breaking because `#[sqlx(default)]` on an individual field or the struct itself would have previously suppressed the error. This doesn't seem like good behavior as it could result in some potentially very difficult bugs. - Instead, create a wrapper implementing `From` and apply the default explicitly. - \[[#3337]]: allow rename with rename_all (close [#2896](https://togithub.com/launchbadge/sqlx/issues/2896)) \[\[[@DirectorX](https://togithub.com/DirectorX)]] - Changes the precedence of `#[sqlx(rename)]` and `#[sqlx(rename_all)]` to match the expected behavior (`rename` wins). - \[[#3285]]: fix: use correct names for sslmode options \[\[[@lily-mosquitoes](https://togithub.com/lily-mosquitoes)]] - Changes the output of `ConnectOptions::to_url_lossy()` to match what parsing expects. ##### Added - \[[#2917]]: Add Debug impl for PgRow \[\[[@g-bartoszek](https://togithub.com/g-bartoszek)]] - \[[#3113]]: feat: new derive feature flag \[\[[@saiintbrisson](https://togithub.com/saiintbrisson)]] - \[[#3154]]: feat: add `MySqlTime`, audit `mysql::types` for panics \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3188]]: feat(cube): support postgres cube \[\[[@jayy-lmao](https://togithub.com/jayy-lmao)]] - \[[#3244]]: feat: support `NonZero*` scalar types \[\[[@AlphaKeks](https://togithub.com/AlphaKeks)]] - \[[#3260]]: feat: Add set_update_hook on SqliteConnection \[\[[@gridbox](https://togithub.com/gridbox)]] - \[[#3291]]: feat: support the Postgres Bool type for the Any driver \[\[[@etorreborre](https://togithub.com/etorreborre)]] - \[[#3293]]: Add LICENSE-\* files to crates \[\[[@LecrisUT](https://togithub.com/LecrisUT)]] - \[[#3303]]: add array support for NonZeroI\* in postgres \[\[[@JohannesIBK](https://togithub.com/JohannesIBK)]] - \[[#3311]]: Add example on how to use Transaction as Executor \[\[[@Lachstec](https://togithub.com/Lachstec)]] - \[[#3343]]: Add support for PostgreSQL HSTORE data type \[\[[@KobusEllis](https://togithub.com/KobusEllis)]] ##### Changed - \[[#2652]]: MySQL: Remove collation compatibility check for strings \[\[[@alu](https://togithub.com/alu)]] - \[[#2960]]: Removed `Send` trait bound from argument binding \[\[[@bobozaur](https://togithub.com/bobozaur)]] - \[[#2970]]: refactor: lift type mappings into driver crates \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3148]]: Bump libsqlite3-sys to v0.28 \[\[[@NfNitLoop](https://togithub.com/NfNitLoop)]] - Note: version bumps to `libsqlite3-sys` are not considered breaking changes as per our semver guarantees. - \[[#3265]]: perf: box `MySqlConnection` to reduce sizes of futures \[\[[@stepantubanov](https://togithub.com/stepantubanov)]] - \[[#3352]]: chore:added a testcase for `sqlx migrate add ...` \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3340]]: ci: Add job to check that sqlx builds with its declared minimum dependencies \[\[[@iamjpotts](https://togithub.com/iamjpotts)]] ##### Fixed - \[[#2702]]: Constrain cyclic associated types to themselves \[\[[@BadBastion](https://togithub.com/BadBastion)]] - \[[#2954]]: Fix several inter doc links \[\[[@ralpha](https://togithub.com/ralpha)]] - \[[#3073]]: feat(logging): Log slow acquires from connection pool \[\[[@iamjpotts](https://togithub.com/iamjpotts)]] - \[[#3137]]: SqliteConnectOptions::filename() memory fix ([#3136](https://togithub.com/launchbadge/sqlx/issues/3136)) \[\[[@hoxxep](https://togithub.com/hoxxep)]] - \[[#3138]]: PostgreSQL Bugfix: Ensure connection is usable after failed COPY inside a transaction \[\[[@feikesteenbergen](https://togithub.com/feikesteenbergen)]] - \[[#3146]]: fix(sqlite): delete unused `ConnectionHandleRaw` type \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3162]]: Drop urlencoding dependency \[\[[@paolobarbolini](https://togithub.com/paolobarbolini)]] - \[[#3165]]: Bump deps that do not need code changes \[\[[@GnomedDev](https://togithub.com/GnomedDev)]] - \[[#3167]]: fix(ci): use `docker compose` instead of `docker-compose` \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3172]]: fix: Option decoding in any driver \[\[[@pxp9](https://togithub.com/pxp9)]] - \[[#3173]]: fix(postgres) : int type conversion while decoding \[\[[@RaghavRox](https://togithub.com/RaghavRox)]] - \[[#3190]]: Update time to 0.3.36 \[\[[@BlackSoulHub](https://togithub.com/BlackSoulHub)]] - \[[#3191]]: Fix unclean TLS shutdown \[\[[@levkk](https://togithub.com/levkk)]] - \[[#3194]]: Fix leaking connections in fetch_optional ([#2647](https://togithub.com/launchbadge/sqlx/issues/2647)) \[\[[@danjpgriffin](https://togithub.com/danjpgriffin)]] - \[[#3216]]: security: bump rustls to 0.21.11 \[\[[@toxeus](https://togithub.com/toxeus)]] - \[[#3230]]: fix: sqlite pragma order for auto_vacuum \[\[[@jasonish](https://togithub.com/jasonish)]] - \[[#3233]]: fix: get_filename should not consume self \[\[[@jasonish](https://togithub.com/jasonish)]] - \[[#3234]]: fix(ci): pin Rust version, ditch unmaintained actions \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3236]]: fix: resolve `path` ownership problems when using `sqlx_macros_unstable` \[\[[@lily-mosquitoes](https://togithub.com/lily-mosquitoes)]] - \[[#3254]]: fix: hide `sqlx_postgres::any` \[\[[@Zarathustra2](https://togithub.com/Zarathustra2)]] - \[[#3266]]: ci: MariaDB - add back 11.4 and add 11.5 \[\[[@grooverdan](https://togithub.com/grooverdan)]] - \[[#3267]]: ci: syntax fix \[\[[@grooverdan](https://togithub.com/grooverdan)]] - \[[#3271]]: docs(sqlite): fix typo - unixtime() -> unixepoch() \[\[[@joelkoen](https://togithub.com/joelkoen)]] - \[[#3276]]: Invert boolean for `migrate` error message. ([#3275](https://togithub.com/launchbadge/sqlx/issues/3275)) \[\[[@nk9](https://togithub.com/nk9)]] - \[[#3279]]: fix Clippy errors \[\[[@abonander](https://togithub.com/abonander)]] - \[[#3288]]: fix: sqlite update_hook char types \[\[[@jasonish](https://togithub.com/jasonish)]] - \[[#3297]]: Pass the `persistent` query setting when preparing queries with the `Any` driver \[\[[@etorreborre](https://togithub.com/etorreborre)]] - \[[#3298]]: Track null arguments in order to provide the appropriate type when converting them. \[\[[@etorreborre](https://togithub.com/etorreborre)]] - \[[#3312]]: doc: Minor rust docs fixes \[\[[@SrGesus](https://togithub.com/SrGesus)]] - \[[#3327]]: chore: fixed one usage of `select_input_type!()` being unhygenic \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3328]]: fix(ci): comment not separated from other characters \[\[[@hamirmahal](https://togithub.com/hamirmahal)]] - \[[#3341]]: refactor: Resolve cargo check warnings in postgres examples \[\[[@iamjpotts](https://togithub.com/iamjpotts)]] - \[[#3346]]: fix(postgres): don't panic if `M` or `C` Notice fields are not UTF-8 \[\[[@YgorSouza](https://togithub.com/YgorSouza)]] - \[[#3350]]: fix:the `json`-feature should activate `sqlx-postgres?/json` as well \[\[[@CommanderStorm](https://togithub.com/CommanderStorm)]] - \[[#3353]]: fix: build script new line at eof \[\[[@Zarthus](https://togithub.com/Zarthus)]] - (no PR): activate `clock` and `std` features of `workspace.dependencies.chrono`. [#2482]: https://togithub.com/launchbadge/sqlx/pull/2482 [#2652]: https://togithub.com/launchbadge/sqlx/pull/2652 [#2697]: https://togithub.com/launchbadge/sqlx/pull/2697 [#2702]: https://togithub.com/launchbadge/sqlx/pull/2702 [#2736]: https://togithub.com/launchbadge/sqlx/pull/2736 [#2869]: https://togithub.com/launchbadge/sqlx/pull/2869 [#2917]: https://togithub.com/launchbadge/sqlx/pull/2917 [#2940]: https://togithub.com/launchbadge/sqlx/pull/2940 [#2954]: https://togithub.com/launchbadge/sqlx/pull/2954 [#2960]: https://togithub.com/launchbadge/sqlx/pull/2960 [#2970]: https://togithub.com/launchbadge/sqlx/pull/2970 [#2973]: https://togithub.com/launchbadge/sqlx/pull/2973 [#3064]: https://togithub.com/launchbadge/sqlx/pull/3064 [#3073]: https://togithub.com/launchbadge/sqlx/pull/3073 [#3113]: https://togithub.com/launchbadge/sqlx/pull/3113 [#3123]: https://togithub.com/launchbadge/sqlx/pull/3123 [#3126]: https://togithub.com/launchbadge/sqlx/pull/3126 [#3130]: https://togithub.com/launchbadge/sqlx/pull/3130 [#3137]: https://togithub.com/launchbadge/sqlx/pull/3137 [#3138]: https://togithub.com/launchbadge/sqlx/pull/3138 [#3146]: https://togithub.com/launchbadge/sqlx/pull/3146 [#3148]: https://togithub.com/launchbadge/sqlx/pull/3148 [#3154]: https://togithub.com/launchbadge/sqlx/pull/3154 [#3162]: https://togithub.com/launchbadge/sqlx/pull/3162 [#3165]: https://togithub.com/launchbadge/sqlx/pull/3165 [#3167]: https://togithub.com/launchbadge/sqlx/pull/3167 [#3172]: https://togithub.com/launchbadge/sqlx/pull/3172 [#3173]: https://togithub.com/launchbadge/sqlx/pull/3173 [#3181]: https://togithub.com/launchbadge/sqlx/pull/3181 [#3184]: https://togithub.com/launchbadge/sqlx/pull/3184 [#3188]: https://togithub.com/launchbadge/sqlx/pull/3188 [#3190]: https://togithub.com/launchbadge/sqlx/pull/3190 [#3191]: https://togithub.com/launchbadge/sqlx/pull/3191 [#3194]: https://togithub.com/launchbadge/sqlx/pull/3194 [#3216]: https://togithub.com/launchbadge/sqlx/pull/3216 [#3230]: https://togithub.com/launchbadge/sqlx/pull/3230 [#3233]: https://togithub.com/launchbadge/sqlx/pull/3233 [#3234]: https://togithub.com/launchbadge/sqlx/pull/3234 [#3236]: https://togithub.com/launchbadge/sqlx/pull/3236 [#3244]: https://togithub.com/launchbadge/sqlx/pull/3244 [#3252]: https://togithub.com/launchbadge/sqlx/pull/3252 [#3254]: https://togithub.com/launchbadge/sqlx/pull/3254 [#3260]: https://togithub.com/launchbadge/sqlx/pull/3260 [#3265]: https://togithub.com/launchbadge/sqlx/pull/3265 [#3266]: https://togithub.com/launchbadge/sqlx/pull/3266 [#3267]: https://togithub.com/launchbadge/sqlx/pull/3267 [#3271]: https://togithub.com/launchbadge/sqlx/pull/3271 [#3276]: https://togithub.com/launchbadge/sqlx/pull/3276 [#3279]: https://togithub.com/launchbadge/sqlx/pull/3279 [#3285]: https://togithub.com/launchbadge/sqlx/pull/3285 [#3288]: https://togithub.com/launchbadge/sqlx/pull/3288 [#3291]: https://togithub.com/launchbadge/sqlx/pull/3291 [#3293]: https://togithub.com/launchbadge/sqlx/pull/3293 [#3297]: https://togithub.com/launchbadge/sqlx/pull/3297 [#3298]: https://togithub.com/launchbadge/sqlx/pull/3298 [#3303]: https://togithub.com/launchbadge/sqlx/pull/3303 [#3311]: https://togithub.com/launchbadge/sqlx/pull/3311 [#3312]: https://togithub.com/launchbadge/sqlx/pull/3312 [#3327]: https://togithub.com/launchbadge/sqlx/pull/3327 [#3328]: https://togithub.com/launchbadge/sqlx/pull/3328 [#3329]: https://togithub.com/launchbadge/sqlx/pull/3329 [#3337]: https://togithub.com/launchbadge/sqlx/pull/3337 [#3340]: https://togithub.com/launchbadge/sqlx/pull/3340 [#3341]: https://togithub.com/launchbadge/sqlx/pull/3341 [#3343]: https://togithub.com/launchbadge/sqlx/pull/3343 [#3346]: https://togithub.com/launchbadge/sqlx/pull/3346 [#3350]: https://togithub.com/launchbadge/sqlx/pull/3350 [#3352]: https://togithub.com/launchbadge/sqlx/pull/3352 [#3353]: https://togithub.com/launchbadge/sqlx/pull/3353 [#3356]: https://togithub.com/launchbadge/sqlx/pull/3356

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

[ ] If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

geofmureithi / apalis