What the developer wrote
Authored by Roman Zeyde
Update `prometheus` to 0.14.0 (#1225)
What changed, and why it matters
This commit simply bumps the optional `prometheus` metrics library from version 0.13 to 0.14.0 in the project's dependency files. It is a routine maintenance update with no visible code changes to electrs itself. There is no indication in the commit that this fixes or introduces a security problem.
No immediate action is required. Treat as routine maintenance. If security relevance is later claimed, verify against the upstream prometheus 0.14.0 release notes and any associated CVEs.
Security signals we found
Dependency version bump for optional metrics library
No source-code changes in the commit
No security-related language in commit title or message
Evidence from the diff
The diff only changes Cargo.toml to require prometheus = { version = "0.14", optional = true } and updates Cargo.lock accordingly, pulling in transitive updates for procfs, protobuf, and thiserror. No electrs source code is modified. The commit title and message describe a dependency update, not a security fix.
Changed components
Cargo.toml dependency declarationCargo.lock transitive dependenciesOptional prometheus metrics featureInspect captured patch +46 / −13
diff --git a/Cargo.lock b/Cargo.lock
index eb2400a..349e25b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -753,22 +753,21 @@ dependencies = [
[[package]]
name = "procfs"
-version = "0.16.0"
+version = "0.17.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "731e0d9356b0c25f16f33b5be79b1c57b562f141ebfcdb0ad8ac2c13a24293b4"
+checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
dependencies = [
"bitflags",
"hex",
- "lazy_static",
"procfs-core",
"rustix 0.38.44",
]
[[package]]
name = "procfs-core"
-version = "0.16.0"
+version = "0.17.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d3554923a69f4ce04c4a754260c338f505ce22642d3830e049a399fc2059a29"
+checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
dependencies = [
"bitflags",
"hex",
@@ -776,9 +775,9 @@ dependencies = [
[[package]]
name = "prometheus"
-version = "0.13.4"
+version = "0.14.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d33c28a30771f7f96db69893f78b857f7450d7e0237e9c8fc6427a81bae7ed1"
+checksum = "3ca5326d8d0b950a9acd87e6a3f94745394f62e4dae1b1ee22b2bc0c394af43a"
dependencies = [
"cfg-if",
"fnv",
@@ -788,14 +787,28 @@ dependencies = [
"parking_lot",
"procfs",
"protobuf",
- "thiserror",
+ "thiserror 2.0.16",
]
[[package]]
name = "protobuf"
-version = "2.28.0"
+version = "3.7.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
+checksum = "d65a1d4ddae7d8b5de68153b48f6aa3bba8cb002b243dbdbc55a5afbc98f99f4"
+dependencies = [
+ "once_cell",
+ "protobuf-support",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "protobuf-support"
+version = "3.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e36c2f31e0a47f9280fb347ef5e461ffcd2c52dd520d8e216b52f93b0b0d7d6"
+dependencies = [
+ "thiserror 1.0.69",
+]
[[package]]
name = "quote"
@@ -879,7 +892,7 @@ checksum = "ba009ff324d1fc1b900bd1fdb31564febe58a8ccc8a6fdbb93b543d33b13ca43"
dependencies = [
"getrandom 0.2.16",
"libredox",
- "thiserror",
+ "thiserror 1.0.69",
]
[[package]]
@@ -1114,7 +1127,16 @@ version = "1.0.69"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
dependencies = [
- "thiserror-impl",
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3467d614147380f2e4e374161426ff399c91084acd2363eaf549172b3d5e60c0"
+dependencies = [
+ "thiserror-impl 2.0.16",
]
[[package]]
@@ -1128,6 +1150,17 @@ dependencies = [
"syn",
]
+[[package]]
+name = "thiserror-impl"
+version = "2.0.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c5e1be1c48b9172ee610da68fd9cd2770e7a4056cb3fc98710ee6906f0c7960"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
[[package]]
name = "tiny_http"
version = "0.12.0"
diff --git a/Cargo.toml b/Cargo.toml
index 004a4e8..19b0393 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,7 +32,7 @@ dirs-next = "2.0"
env_logger = "0.10"
log = "0.4"
parking_lot = "0.12"
-prometheus = { version = "0.13", optional = true }
+prometheus = { version = "0.14", optional = true }
rayon = "1.11"
serde = "1.0.184"
serde_derive = "1.0.184"
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.