mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
651 stars 43 forks source link

Bump tracing from 0.1.35 to 0.1.40 #567

Open dependabot[bot] opened 10 months ago

dependabot[bot] commented 10 months ago

Bumps tracing from 0.1.35 to 0.1.40.

Release notes

Sourced from tracing's releases.

tracing 0.1.40

This release fixes a potential stack use-after-free in the Instrument::into_inner method. Only uses of this method are affected by this bug.

Fixed

  • Use mem::ManuallyDrop instead of mem::forget in Instrument::into_inner (#2765)

#2765: tokio-rs/tracing#2765

Thanks to @​cramertj and @​manishearth for finding and fixing this issue!

tracing 0.1.39

This release adds several additional features to the tracing macros. In addition, it updates the tracing-core dependency to [v0.1.32][core-0.1.32] and the tracing-attributes dependency to [v0.1.27][attrs-0.1.27].

Added

  • Allow constant field names in macros (#2617)
  • Allow setting event names in macros (#2699)
  • core: Allow ValueSets of any length (#2508)

Changed

  • tracing-attributes: updated to [0.1.27][attrs-0.1.27]
  • tracing-core: updated to [0.1.32][core-0.1.32]
  • attributes: Bump minimum version of proc-macro2 to 1.0.60 (#2732)
  • attributes: Generate less dead code for async block return type hint (#2709)

Fixed

  • Use fully qualified names in macros for items exported from std prelude (#2621, #2757)
  • attributes: Allow [clippy::let_with_type_underscore] in macro-generated code (#2609)
  • attributes: Allow unknown_lints in macro-generated code (#2626)
  • attributes: Fix a compilation error in #[instrument] when the "log" feature is enabled (#2599)

Documented

  • Add axum-insights to relevant crates. (#2713)
  • Fix link to RAI pattern crate documentation (#2612)
  • Fix docs typos and warnings (#2581)
  • Add clippy-tracing to related crates (#2628)
  • Add tracing-cloudwatch to related crates (#2667)
  • Fix deadlink to tracing-etw repo (#2602)

... (truncated)

Commits
  • 15600a3 tracing: prepare to release v0.1.40
  • 20a1762 tracing: use ManuallyDrop instead of mem::forget (#2765)
  • 4b99457 chore: prepare tracing 0.1.39 (#2755)
  • b2a5e11 tracing: update core to v0.1.31 and attributes to v0.1.27
  • 3825a50 tracing: use full path when calling format_args! (#2757)
  • c4b2a56 chore: prepare tracing-core 0.1.32 (#2754)
  • 2502f19 chore: prepare tracing-attributes 0.1.27 (#2756)
  • 9048762 Revert "log: update to env_logger 0.10 to fix GHSA-g98v-hv3f-hcfr (#2740)" (#...
  • 6ba5af2 docs: remove mention of Registration on v0.1.x (#2753)
  • 11aac9a log: deprecate env_logger in favor of tracing_subscriber::fmt::Subscriber...
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)