← Watch feed
Merge rust-bitcoin/rust-bitcoin#6947: build(deps): bump cargo-bins/cargo-binstall from 1.21.0 to 1.21.1
Public commit record
96/100 · Strong
What the developer wrote
Authored by Andrew Poelstra
Merge rust-bitcoin/rust-bitcoin#6947: build(deps): bump cargo-bins/cargo-binstall from 1.21.0 to 1.21.1
7d6cf2c9098e233bc50be845641a7bf8127a6a75 build(deps): bump cargo-bins/cargo-binstall from 1.21.0 to 1.21.1 (dependabot[bot])
Pull request description:
Bumps [cargo-bins/cargo-binstall](https://github.com/cargo-bins/cargo-binstall) from 1.21.0 to 1.21.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cargo-bins/cargo-binstall/releases">cargo-bins/cargo-binstall's releases</a>.</em></p>
<blockquote>
<h2>v1.21.1</h2>
<p><em>Binstall is a tool to fetch and install Rust-based executables as binaries. It aims to be a drop-in replacement for <code>cargo install</code> in most cases. Install it today with <code>cargo install cargo-binstall</code>, from the binaries below, or if you already have it, upgrade with <code>cargo binstall cargo-binstall</code>.</em></p>
<h4>In this release:</h4>
<ul>
<li>Upgrade dependencies</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/e00d2c94cc0067b77737821097a62d91c0301baa"><code>e00d2c9</code></a> release: cargo-binstall v1.21.1 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2616">#2616</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/dfefec18f56be1fb7ec8d1f4cfde42c305f29298"><code>dfefec1</code></a> chore: release (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2611">#2611</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/0bb9e27411a681176032498b17e01c0be66d8efd"><code>0bb9e27</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2614">#2614</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/57726869e28f4038a847ec56e5fdd9142fded110"><code>5772686</code></a> build(deps): bump the deps group across 1 directory with 2 updates (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2612">#2612</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/bfa50c12a896b5e070cc1aa726ad86875d1e5726"><code>bfa50c1</code></a> dep: Upgrade transitive dependencies (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2609">#2609</a>)</li>
<li><a href="https://github.com/cargo-bins/cargo-binstall/commit/579c9db795e670961c988fe26c4c1bbe94de414b"><code>579c9db</code></a> build(deps): bump cargo-bins/release-pr from 2.1.3 to 2.1.4 (<a href="https://redirect.github.com/cargo-bins/cargo-binstall/issues/2608">#2608</a>)</li>
<li>See full diff in <a href="https://github.com/cargo-bins/cargo-binstall/compare/ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4...e00d2c94cc0067b77737821097a62d91c0301baa">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
</details>
ACKs for top commit:
satsfy:
ACK 7d6cf2c9098e233bc50be845641a7bf8127a6a75
apoelstra:
ACK 7d6cf2c9098e233bc50be845641a7bf8127a6a75; successfully ran local tests
Tree-SHA512: 918d12d43e504777939248d514e8fa98122d3be9756081bf4774a3d2a6192ee80022898b4f0e0b5537ae69867a074f44646a193ad3d21d1e62f0a503ad485007
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
What changed, and why it matters
This commit updates the version of a helper tool (cargo-binstall) used only inside GitHub Actions automation. It is a routine dependency bump by Dependabot and does not change any code that ships to users. There is no indication of a security fix or vulnerability.
Recommended action
No security action needed. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit bumps the pinned GitHub Action reference for cargo-bins/cargo-binstall from v1.21.0 to v1.21.1 in two workflow files (cron-daily-audit.yml and semver-checks.yml). The change is a SHA-only update of a CI dependency. The upstream release notes say only ‘Upgrade dependencies.’ No security advisory, CVE, or bug fix is mentioned by the vendor or in the commit materials.
Changed components
.github/workflows/cron-daily-audit.yml.github/workflows/semver-checks.ymlInspect captured patch +2 / −2
### .github/workflows/cron-daily-audit.yml
@@ -22,7 +22,7 @@ jobs:
with:
toolchain: stable
- name: "Install cargo-binstall"
- uses: cargo-bins/cargo-binstall@ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4 # v1.21.0
+ uses: cargo-bins/cargo-binstall@e00d2c94cc0067b77737821097a62d91c0301baa # v1.21.1
- name: "Binstall cargo-audit"
run: cargo binstall cargo-audit --no-confirm
- name: "Audit every lockfile"
### .github/workflows/semver-checks.yml
@@ -30,7 +30,7 @@ jobs:
run: |
rustup default $(cargo metadata --format-version 1 | jq -r '.metadata.rbmt.toolchains.stable')
- name: "Install cargo-binstall"
- uses: cargo-bins/cargo-binstall@ead08b90bd7b2e6d81963fb9cf0b7239f66d5db4 # v1.21.0
+ uses: cargo-bins/cargo-binstall@e00d2c94cc0067b77737821097a62d91c0301baa # v1.21.1
- name: "Binstall pinned cargo-semver-checks"
run: cargo binstall cargo-semver-checks@$(cat ./.github/workflows/cargo-semver-checks-version) --no-confirm
- name: "Run semver checks"Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.