[breaking] chore: update rust dependencies #259

Merged

Wuast94 merged 1 commit from updatarr/rust-dependencies-17605dfeaf into main 2026-09-02 15:29:49 +02:00

Conversation 0 Commits 1 Files changed 1 +1 -1

Wuast94 commented 2026-08-31 23:11:17 +02:00

Owner

• Copy link
• Copy Markdown

Updates rust dependencies.

Breaking change detected. Review the release notes before merging.

Automerge: Disabled because breaking change release notes were detected

Changed files:

• Cargo.toml:33 0.7.0 -> 0.7.1

Release notes

tower-http-0.7.0: tower-http: tower-http-0.7.0

Breaking change detected.

Compare source

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  
  // Rejects cross-origin state-changing requests using `Sec-Fetch-Site`,
  // an `Origin` allow-list, and an `Origin`/`Host` fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);
  

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
      .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
      .service_fn(handler);
  

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  
  // `MyBackend` implements `tower_http::services::fs::Backend`.
  // The default `ServeDir::new()` continues to use `TokioBackend` (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());
  

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

• breaking: compression: the middleware now handles the * wildcard and identity;q=0 in Accept-Encoding per RFC 9110 §12.5.3. Requests that previously fell back to identity (e.g. *;q=0 or identity;q=0 with no other acceptable encoding) now receive a 406 Not Acceptable response. Clients that explicitly reject all encodings without listing an alternative will see different behavior. (#693)

• breaking: compression: upgrade the SizeAbove predicate threshold from u16 to u64, allowing minimum sizes above 64 KiB (#704)

• breaking: remove the implicit no-op tokio and async-compression features. These were kept as no-op features in 0.6.x for backwards compatibility after the switch to dep: syntax in #642. Downstream crates that activate tower-http/tokio or tower http/async-compression should remove those feature entries; the underlying dependencies are still pulled in transitively by the features that need them (e.g. compression-gzip, fs, timeout). (#628)

• breaking: trace/classify: include the gRPC error message in tracing output. GrpcCode and GrpcFailureClass are now #[non_exhaustive], and GrpcStatus is exported from the classify module (#422)

• breaking: follow-redirect: FollowRedirect now forwards request Extensions to redirected requests instead of dropping them. The Standard policy drops extensions on cross-origin redirections (same-origin keeps them). Opt out with FollowRedirectLayer::preserve_extensions(false); keep specific types with FilterCredentials::allow_extension::<T>() or all of them with keep_all_extensions(). (#706)

  use tower_http::follow_redirect::FollowRedirectLayer;
  
  // 0.7.0 forwards request `Extensions` across redirects by default.
  // Restore the previous behavior (drop all extensions) with:
  let layer = FollowRedirectLayer::new().preserve_extensions(false);
  

• breaking: follow-redirect: header and extension filtering is now cumulative. A value a policy drops on one hop is no longer replayed on later hops, so FilterCredentials no longer re-sends Cookie/Authorization to a same-origin target reached after cross-origin hop. Custom Policy::on_request impls now see the previous hop's filtered request, not the original. (#706)

• trace: DefaultOnRequest, DefaultOnResponse, DefaultOnFailure, and DefaultOnEos now explicitly parent their tracing events to the request span rather than relying on the ambient span context. This fixes intermittent cases where events could appear without their request span attached (#690)

• cors: relax the Vary header defaults (#674)

• MSRV bumped from 1.64 to 1.65 (#684)

Fixed

• fs: ServeDir and ServeFile now emit a Vary: Accept-Encoding response
  header when precompressed serving is configured, ensuring caches correctly
  distinguish between compressed and uncompressed variants (#692)
• breaking: services: reject a trailing slash for file paths. File requests with a trailing slash now return 404 Not Found instead of serving the file (#678)
• fs: fix ServeDir stripping the file extension when serving with identity encoding (#686)
• compression: forward trailers from the inner body after compression finishes, fixing dropped gRPC status trailers (#685)
• trace: fire on_eos when the inner body reports is_end_stream with a precise content-length (#687)
• on-early-drop: suppress the early-drop guard when is_end_stream is reported after a data frame (#687)
• set-header: make SetMultipleRequestHeaders and SetMultipleResponseHeaders Clone for non-Clone HTTP bodies (#703)

Thanks

• @jlizen
• @seun-ja
• @Oliboy50

New Contributors

• @muhamadazmy made their first contribution in https://github.com/tower-rs/tower-http/pull/679
• @Isvane made their first contribution in https://github.com/tower-rs/tower-http/pull/678
• @xiaoyawei made their first contribution in https://github.com/tower-rs/tower-http/pull/422
• @dependabot[bot] made their first contribution in https://github.com/tower-rs/tower-http/pull/696
• @its-the-shrimp made their first contribution in https://github.com/tower-rs/tower-http/pull/519
• @yawn made their first contribution in https://github.com/tower-rs/tower-http/pull/699
• @Jesse-Bakker made their first contribution in https://github.com/tower-rs/tower-http/pull/703
• @junghwan16 made their first contribution in https://github.com/tower-rs/tower-http/pull/705
• @claraphyll made their first contribution in https://github.com/tower-rs/tower-http/pull/486

Updates `rust dependencies`. **Breaking change detected.** Review the release notes before merging. Automerge: Disabled because breaking change release notes were detected Changed files: - `Cargo.toml:33` `0.7.0` -> `0.7.1` <details> <summary>Release notes</summary> ### [`tower-http-0.7.0`](https://github.com/tower-rs/tower-http/releases/tag/tower-http-0.7.0): tower-http: tower-http-0.7.0 **Breaking change detected.** [Compare source](https://github.com/tower-rs/tower-http/compare/0.7.0...tower-http-0.7.0) [Changes since 0.6.11](https://github.com/tower-rs/tower-http/compare/tower-http-0.6.11...tower-http-0.7.0) ## Added - `csrf`: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 ([#699]) ```rust use tower::ServiceBuilder; use tower_http::csrf::CsrfLayer; // Rejects cross-origin state-changing requests using `Sec-Fetch-Site`, // an `Origin` allow-list, and an `Origin`/`Host` fallback. No per-request // token state required. let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?; let service = ServiceBuilder::new().layer(layer).service_fn(handler); ``` - `timeout`: add `DeadlineBody` for non-resetting body timeouts, applied via the new `RequestBodyDeadlineLayer` and `ResponseBodyDeadlineLayer` ([#688]) Unlike `TimeoutBody`, which resets its deadline on every frame, `DeadlineBody` caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline. ```rust use std::time::Duration; use tower::ServiceBuilder; use tower_http::timeout::RequestBodyDeadlineLayer; // Abort the request body transfer after 30s total, regardless of how // frequently data arrives. let service = ServiceBuilder::new() .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30))) .service_fn(handler); ``` - `fs`: add strong `ETag` support to `ServeDir`, including `If-Match` and `If-None-Match` precondition handling per RFC 9110. `304 Not Modified` responses now carry the `ETag` and `Last-Modified` validators ([#691]) - `fs`: add a `Backend` trait to make `ServeDir` work with non-filesystem sources (e.g. embedded assets or object storage). The default `TokioBackend` preserves existing behavior. Use `ServeDir::with_backend()` to plug in custom implementations ([#684]) ```rust use tower_http::services::fs::ServeDir; // `MyBackend` implements `tower_http::services::fs::Backend`. // The default `ServeDir::new()` continues to use `TokioBackend` (local FS). let service = ServeDir::with_backend("assets", MyBackend::new()); ``` - `fs`: add `html_as_default_extension` option to `ServeDir`, appending `.html` when the request path has no extension ([#519]) - `fs`: add `redirect_path_prefix` option to `ServeDir`, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path ([#486]) - `validate-request`: add `ValidateRequestHeaderLayer::has_header_value()` to reject requests when a header does not have an expected value ([#360]) - `body`: `UnsyncBoxBody::new()` constructor and `From<ServeFileSystemResponseBody>` conversion to avoid double-boxing when combining `ServeDir` responses with other body types ([#537]) - `limit`: implement `Default` for `limit::ResponseBody` when the wrapped body also implements `Default` ([#679]) ## Changed - **breaking:** `compression`: the middleware now handles the `*` wildcard and `identity;q=0` in Accept-Encoding per RFC 9110 §12.5.3. Requests that previously fell back to identity (e.g. `*;q=0` or `identity;q=0` with no other acceptable encoding) now receive a 406 Not Acceptable response. Clients that explicitly reject all encodings without listing an alternative will see different behavior. ([#693]) - **breaking:** `compression`: upgrade the `SizeAbove` predicate threshold from `u16` to `u64`, allowing minimum sizes above 64 KiB ([#704]) - **breaking:** remove the implicit no-op `tokio` and `async-compression` features. These were kept as no-op features in 0.6.x for backwards compatibility after the switch to `dep:` syntax in [#642]. Downstream crates that activate `tower-http/tokio` or `tower http/async-compression` should remove those feature entries; the underlying dependencies are still pulled in transitively by the features that need them (e.g. `compression-gzip`, `fs`, `timeout`). ([#628]) - **breaking:** `trace`/`classify`: include the gRPC error message in tracing output. `GrpcCode` and `GrpcFailureClass` are now `#[non_exhaustive]`, and `GrpcStatus` is exported from the `classify` module ([#422]) - **breaking:** `follow-redirect`: `FollowRedirect` now forwards request `Extensions` to redirected requests instead of dropping them. The `Standard` policy drops extensions on cross-origin redirections (same-origin keeps them). Opt out with `FollowRedirectLayer::preserve_extensions(false)`; keep specific types with `FilterCredentials::allow_extension::<T>()` or all of them with `keep_all_extensions()`. ([#706]) ```rust use tower_http::follow_redirect::FollowRedirectLayer; // 0.7.0 forwards request `Extensions` across redirects by default. // Restore the previous behavior (drop all extensions) with: let layer = FollowRedirectLayer::new().preserve_extensions(false); ``` - **breaking:** `follow-redirect`: header and extension filtering is now cumulative. A value a policy drops on one hop is no longer replayed on later hops, so `FilterCredentials` no longer re-sends `Cookie`/`Authorization` to a same-origin target reached after cross-origin hop. Custom `Policy::on_request` impls now see the previous hop's filtered request, not the original. ([#706]) - `trace`: `DefaultOnRequest`, `DefaultOnResponse`, `DefaultOnFailure`, and `DefaultOnEos` now explicitly parent their tracing events to the request span rather than relying on the ambient span context. This fixes intermittent cases where events could appear without their request span attached ([#690]) - `cors`: relax the `Vary` header defaults ([#674]) - MSRV bumped from 1.64 to 1.65 ([#684]) ## Fixed - `fs`: `ServeDir` and `ServeFile` now emit a `Vary: Accept-Encoding` response header when precompressed serving is configured, ensuring caches correctly distinguish between compressed and uncompressed variants ([#692]) - **breaking:** `services`: reject a trailing slash for file paths. File requests with a trailing slash now return `404 Not Found` instead of serving the file ([#678]) - `fs`: fix `ServeDir` stripping the file extension when serving with identity encoding ([#686]) - `compression`: forward trailers from the inner body after compression finishes, fixing dropped gRPC status trailers ([#685]) - `trace`: fire `on_eos` when the inner body reports `is_end_stream` with a precise content-length ([#687]) - `on-early-drop`: suppress the early-drop guard when `is_end_stream` is reported after a data frame ([#687]) - `set-header`: make `SetMultipleRequestHeaders` and `SetMultipleResponseHeaders` `Clone` for non-`Clone` HTTP bodies ([#703]) [#360]: https://github.com/tower-rs/tower-http/pull/360 [#422]: https://github.com/tower-rs/tower-http/pull/422 [#486]: https://github.com/tower-rs/tower-http/pull/486 [#519]: https://github.com/tower-rs/tower-http/pull/519 [#537]: https://github.com/tower-rs/tower-http/pull/537 [#628]: https://github.com/tower-rs/tower-http/pull/628 [#642]: https://github.com/tower-rs/tower-http/pull/642 [#674]: https://github.com/tower-rs/tower-http/pull/674 [#678]: https://github.com/tower-rs/tower-http/pull/678 [#679]: https://github.com/tower-rs/tower-http/pull/679 [#684]: https://github.com/tower-rs/tower-http/pull/684 [#685]: https://github.com/tower-rs/tower-http/pull/685 [#686]: https://github.com/tower-rs/tower-http/pull/686 [#687]: https://github.com/tower-rs/tower-http/pull/687 [#688]: https://github.com/tower-rs/tower-http/pull/688 [#690]: https://github.com/tower-rs/tower-http/pull/690 [#691]: https://github.com/tower-rs/tower-http/pull/691 [#692]: https://github.com/tower-rs/tower-http/pull/692 [#693]: https://github.com/tower-rs/tower-http/pull/693 [#699]: https://github.com/tower-rs/tower-http/pull/699 [#703]: https://github.com/tower-rs/tower-http/pull/703 [#704]: https://github.com/tower-rs/tower-http/pull/704 [#706]: https://github.com/tower-rs/tower-http/pull/706 ## Thanks * @jlizen * @seun-ja * @Oliboy50 ### New Contributors * @muhamadazmy made their first contribution in https://github.com/tower-rs/tower-http/pull/679 * @Isvane made their first contribution in https://github.com/tower-rs/tower-http/pull/678 * @xiaoyawei made their first contribution in https://github.com/tower-rs/tower-http/pull/422 * @dependabot[bot] made their first contribution in https://github.com/tower-rs/tower-http/pull/696 * @its-the-shrimp made their first contribution in https://github.com/tower-rs/tower-http/pull/519 * @yawn made their first contribution in https://github.com/tower-rs/tower-http/pull/699 * @Jesse-Bakker made their first contribution in https://github.com/tower-rs/tower-http/pull/703 * @junghwan16 made their first contribution in https://github.com/tower-rs/tower-http/pull/705 * @claraphyll made their first contribution in https://github.com/tower-rs/tower-http/pull/486 </details>

Wuast94 added 1 commit 2026-08-31 23:11:17 +02:00

[breaking] chore: update rust dependencies 20aada8366

Wuast94 force-pushed updatarr/rust-dependencies-17605dfeaf from 20aada8366 to d1c89fc195 2026-09-01 22:45:20 +02:00 Compare

Wuast94 merged commit 48ffed11f2 into main 2026-09-02 15:29:49 +02:00

Wuast94 deleted branch updatarr/rust-dependencies-17605dfeaf 2026-09-02 15:29:51 +02:00

Wuast94 referenced this pull request from a commit 2026-09-02 15:29:51 +02:00

Merge pull request '[breaking] chore: update rust dependencies' (#259) from updatarr/rust-dependencies-17605dfeaf into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

vault/vrds!259

No description provided.