Merge branch 'main' into atproto

rauthy-client/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## v0.5.0
+
+This version bumps internal dependencies and
+remediates [CVE-2024-12224](https://rustsec.org/advisories/RUSTSEC-2024-0421). The way the vulnerable `idna` crate has
+been used can not lead to any security issues though.
+
+The MSRV is also bumped to `1.71.1`.
+
 ## v0.4.0
 
 ### BREAKING

rauthy-client/Cargo.toml

@@ -1,10 +1,10 @@
 [package]
 name = "rauthy-client"
-version = "0.4.0"
+version = "0.5.0"
 edition = "2021"
 authors = ["Sebastian Dobe <[email protected]>"]
 license = "Apache-2.0"
-rust-version = "1.70.0"
+rust-version = "1.71.1"
 categories = ["web-programming"]
 keywords = ["rauthy", "rauthy-client", "oidc"]
 description = "rauthy-client - Client for the Rauthy OIDC IAM project"
@@ -31,18 +31,18 @@ userinfo = []
 # common
 base64 = "0.22.0"
 bincode = "1.3.3"
-cached = { version = "0.51", features = [] }
+cached = { version = "0.54", features = [] }
 chacha20poly1305 = { version = "0.10.1", features = ["std"] }
 chrono = { version = "0.4.31", default-features = false, features = ["clock", "serde", "std"] }
 jwt-simple = { version = "0.12.6", default-features = false, features = ["pure-rust"] }
 rand = "0.8.5"
-reqwest = { version = "0.12", default-features = false, features = [
+reqwest = { version = "0.12.9", default-features = false, features = [
     "brotli", "json", "rustls-tls", "rustls-tls-webpki-roots"
 ] }
 ring = "0.17.5"
 serde = { version = "1.0.180", features = ["derive"] }
 serde_json = "1.0.100"
-thiserror = { version = "1.0" }
+thiserror = { version = "2" }
 tokio = "1.34"
 tracing = "0.1.40"
 
@@ -60,6 +60,10 @@ qrcode = { version = "0.14.0", optional = true }
 # make minimal versions happy
 elliptic-curve = { version = "0.13.8", optional = true }
 
+# remediate idna cve https://rustsec.org/advisories/RUSTSEC-2024-0421
+# this is an indirect fix, as reqwest 0.12.9 uses url 2.5.0 as minimum which is vulnerable
+url = "2.5.4"
+
 [dev-dependencies]
 pretty_assertions = "1"
-rstest = "0.19"
+rstest = "0.23"