deps(deps): bump the rust-runtime group across 1 directory with 12 updates

[dependabot]

Bumps the rust-runtime group with 12 updates in the /rustytime directory:

Package	From	To
diesel	2.3.7	2.3.9
diesel_migrations	2.3.1	2.3.2
tokio	1.52.1	1.52.3
tower-http	0.6.8	0.6.11
uuid	1.23.1	1.23.2
serde_json	1.0.149	1.0.150
reqwest	0.13.2	0.13.4
pyroscope	2.0.0	2.0.6
apalis-postgres	1.0.0-rc.7	1.0.0-rc.8
apalis-cron	1.0.0-rc.7	1.0.0-rc.8
serde_qs	1.1.1	1.1.2
axum-test	20.0.0	20.1.0

Updates diesel from 2.3.7 to 2.3.9

Changelog

Sourced from diesel's changelog.

[2.3.9] 2026-04-30

• Removed a dbg! statement from the Mysql backend that caused unwanted output
• Fix a regression in #[derive(AsChangeset)] introduced in 2.3.8 where structs with a type or const generic parameter referenced in a field type failed to compile with error[E0425]: cannot find type 'T' in this scope. The diagnostic helper functions added to improve AsChangeset error messages now forward all generic parameters of the input struct, not only lifetimes.

[2.3.8] 2026-04-24

• Added support for libsqlite3-sys 0.37.0
• Raise a compile-time error when mixing aggregate and non-aggregate expressions in an ORDER BY clause without a GROUP BY clause
• Calling .count() or .select(aggregate_expr) on a query that already has a non-aggregate .order_by() clause now raises a compile-time error instead of generating invalid SQL that would be rejected by the database at runtime (fixes #3815)
• Added documentation for migration transaction behaviour at the crate root
• Improved compile time error messages for #[derive(AsChangeset)]
• Allow to use generic types in infix_operator!()
• Fixes for several instances of unsound, unspecified or otherwise dangerous behaviour:
  • Unsound string construction in SqliteValue::read_text/FromSql<Text, Sqlite> for String
  • Invalid alignment for over aligned data in SqliteConnection::register_function for aggregate functions
  • Potential memory leaks in SqliteConnection::register_function
  • Access to padding bytes while serializing Date/time types in the Mysql backend
  • SQL Option Injection in PostgreSQL COPY FROM/TO
  • Unspecified pointer cast in Debug/Display implementation of batch INSERT statements for SQLite
  • Invalid call order of SQLite API functions in SqliteValue::read_text/FromSql<Text, Sqlite> for String/SqliteValue::read_blob()/FromSql<Binary, Sqlite> for Vec<u8>
  • Potential unsound pointer access for FromSql<Binary, _> for Vec<u8> and FromSql<Text, _> for String for third party backends (requires changes to the third party backend as well)

Commits

• 2e7eb35 Also bump derives version
• b3a16a3 Merge pull request #5046 from apastrana6/ap/fix-derive-as-changeset
• 9f0a6c1 Prepare a 2.3.9 release
• adcc896 Enable some clippy lints to prevent having dbg in a release again
• 66760df Remove MySQL time serializer debug output
• 58820dc Merge pull request #5036 from weiznich/prepare_2.3.8
• 895b5ba Prepare a 2.3.8 release
• ea008d3 Fix several UB instances
• 64003c6 Merge pull request #5034 from ayarotsky/fix-reject-aggregate-select-with-non-...
• 49b936e Merge pull request #5012 from ayarotsky/fix-aggregate-expressions-and-order-by
• Additional commits viewable in compare view

Updates diesel_migrations from 2.3.1 to 2.3.2

Release notes

Sourced from diesel_migrations's releases.

Diesel 2.3.2

Fixed

• Fixed an incompatibility with libmariadb versions shipped by debian
• Fixed docs.rs builds
• Fixed applying patch file schema.rs file with formatting
• Allow to compare DatabaseErrorKind values

(Diesel 2.3.1 did not contain any changes beside the version bump to retrigger the docs.rs build)

Full Changelog: diesel-rs/diesel@v2.3.0...v2.3.2

You can support the development of Diesel by:

• Contributing Code, Documentation or Guides. Checkout the planing for Diesel 2.4 for open tasks.
• Providing knowledge and help to maintain the MySQL/MariaDB backend. This is currently the only in-tree backend that is not used by any maintainers, so having someone around that actually uses this backend would be very helpful for the Diesel project.
• Answering questions in our discussion forum
• Reporting bugs in our issue tracker
• Helping triaging issues in our issue tracker
• Sponsoring the maintainers.

Changelog

Sourced from diesel_migrations's changelog.

[2.3.2] 2025-09-19

Fixed

• Fixed an incompatibility with libmariadb versions shipped by debian
• Fixed docs.rs builds
• Fixed applying patch file schema.rs file with formatting
• Allow to compare DatabaseErrorKind values

Commits

• See full diff in compare view

Updates tokio from 1.52.1 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• sync: require that an RwLock has max_readers != 0 (#8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Tokio v1.52.2

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#7431), due to [its performance impact]#8065. (#8100)

#7431: tokio-rs/tokio#7431 #8065: tokio-rs/tokio#8065 #8100: tokio-rs/tokio#8100

Commits

• d875691 chore: prepare Tokio v1.52.3 (#8130)
• e1aebb0 Merge 'tokio-1.51.3' into 'tokio-1.52.x' (#8129)
• fd63094 chore: prepare Tokio v1.51.3 (#8127)
• 8c600d0 Merge 'tokio-1.47.5' into 'tokio-1.51.x' (#8123)
• 11bfc13 chore: prepare Tokio v1.47.5 (#8122)
• f085b62 sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• 30d25cc sync: require that an RwLock has max_readers != 0 (#8076)
• 9fccf53 sync: return Empty from try_recv() when mpsc is closed with outstanding p...
• ebf61b4 sync: fix underflow in mpsc channel len() (#8062)
• 4abe9d7 chore: prepare Tokio v1.52.2 (#8115)
• Additional commits viewable in compare view

Updates tower-http from 0.6.8 to 0.6.11

Release notes

Sourced from tower-http's releases.

tower-http-0.6.11

Added

• set-header: add SetMultipleResponseHeadersLayer and SetMultipleResponseHeader for setting multiple response headers at once. Supports overriding, appending, and if_not_present modes. Header values can be fixed or computed dynamically via closures (#672)

  use http::{Response, header::{self, HeaderValue}};
  use http_body::Body as _;
  use tower_http::set_header::response::SetMultipleResponseHeadersLayer;
  let layer = SetMultipleResponseHeadersLayer::overriding(vec![
  (header::X_FRAME_OPTIONS, HeaderValue::from_static("DENY")).into(),
  (header::CONTENT_LENGTH, |res: &Response<MyBody>| {
  res.body().size_hint().exact()
  .map(|size| HeaderValue::from_str(&size.to_string()).unwrap())
  }).into(),
  ]);

• set-header: add SetMultipleRequestHeadersLayer and SetMultipleRequestHeaders for setting multiple request headers at once, mirroring the response-side API (#677)

• classify: add From<i32> and From<NonZeroI32> impls for GrpcCode. Unrecognized status codes map to GrpcCode::Unknown (#506)

Changed

• compression: compress application/grpc-web responses. Previously all application/grpc* content types were excluded from compression; now only application/grpc (non-web) is excluded (#408)

Fixed

• fs: fix ServeDir returning 500 instead of 405 for non-GET/HEAD requests when call_fallback_on_method_not_allowed is enabled but no fallback service is configured (#587)
• fs: remove duplicate cfg attribute on is_reserved_dos_name (#675)

#408: tower-rs/tower-http#408 #506: tower-rs/tower-http#506 #587: tower-rs/tower-http#587 #672: tower-rs/tower-http#672 #675: tower-rs/tower-http#675 #677: tower-rs/tower-http#677

All PRs

• ci: fix flaky encoding test, add nightly stress test job by @​jlizen in tower-rs/tower-http#670

... (truncated)

Commits

• 1d082ef v0.6.11
• 9c3117d feat: set multiple request header (#677)
• 667e7c7 Remove duplicate cfg attribute for is_reserved_dos_name (#675)
• 7551a9b feat(set_header): refactor and improve multiple header middleware (#672)
• 991e9ee add From<i32> impl for GrpcCode (#506)
• 3962dba Do compress grpc-web responses (#408)
• f0b3bb6 Fix serve_dir method not allowed handling when no fallback is configured (#587)
• d1a571b ci: use static timeout in stress-test workflow (#671)
• 309555a ci: fix flaky encoding test, add nightly stress test job (#670)
• 4532fc2 v0.6.10
• Additional commits viewable in compare view

Updates uuid from 1.23.1 to 1.23.2

Release notes

Sourced from uuid's releases.

v1.23.2

What's Changed

• Improve error messages for ambiguous formats by @​KodrAus in uuid-rs/uuid#882
• Prepare for 1.23.2 release by @​KodrAus in uuid-rs/uuid#883

Full Changelog: uuid-rs/uuid@v1.23.1...v1.23.2

Commits

• d119657 Merge pull request #883 from uuid-rs/cargo/v1.23.2
• 0651cfc prepare for 1.23.2 release
• e8dea0c Merge pull request #882 from uuid-rs/fix/error-msgs
• bdc429a fix up serde messages
• d4342e4 make indexes 0 based and fix up more error messages
• 4ad479f work on more accurate parser errors
• See full diff in compare view

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• dc8003a Raise required compiler for preserve_order feature to 1.85
• a42fa98 Unpin CI miri toolchain
• 684a60e Pin CI miri to nightly-2026-02-11
• 7c7da33 Raise required compiler to Rust 1.71
• acf4850 Simplify Number::is_f64
• 6b8ceab Resolve unnecessary_map_or clippy lint
• Additional commits viewable in compare view

Updates reqwest from 0.13.2 to 0.13.4

Release notes

Sourced from reqwest's releases.

v0.13.4

tl;dr

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

What's Changed

• fix(tls): improve rustls-no-provider panic message and add module docs by @​smythg4 in seanmonstar/reqwest#3021
• fix: do not lose the url in error when decoding json by @​Dushistov in seanmonstar/reqwest#3026
• Add tls_sslkeylogfile builder method by @​passcod in seanmonstar/reqwest#2923
• fix(redirect): strip sensitive headers on scheme change across redirects by @​SAY-5 in seanmonstar/reqwest#3034
• chore: upgrade MSRV to 1.85 by @​seanmonstar in seanmonstar/reqwest#3038
• chore: clean up minimal-versions CI job by @​seanmonstar in seanmonstar/reqwest#3039
• fix(http3): use happy eyeballs for h3 connect by @​lyuzichong in seanmonstar/reqwest#3030
• fix: update hickory-resolver to 0.26 and adjust code accordingly by @​seanmonstar in seanmonstar/reqwest#3040
• fix: remove unwrap in hickory initialization by @​mat813 in seanmonstar/reqwest#3041
• feat(https): support TLS 1.3 as min version under native-tls 🎉 by @​AverageHelper in seanmonstar/reqwest#2975
• Expose keep alive configurations in blocking client by @​aeb-dev in seanmonstar/reqwest#3043
• Prepare v0.13.4 by @​seanmonstar in seanmonstar/reqwest#3046

New Contributors

• @​smythg4 made their first contribution in seanmonstar/reqwest#3021
• @​Dushistov made their first contribution in seanmonstar/reqwest#3026
• @​SAY-5 made their first contribution in seanmonstar/reqwest#3034
• @​mat813 made their first contribution in seanmonstar/reqwest#3041
• @​AverageHelper made their first contribution in seanmonstar/reqwest#2975
• @​aeb-dev made their first contribution in seanmonstar/reqwest#3043

Full Changelog: seanmonstar/reqwest@v0.13.3...v0.13.4

v0.13.3

tl;dr

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

What's Changed

• Update docs.rs Features by @​JamesWiresmith in seanmonstar/reqwest#2961
• fix: fallback to hickory_resolver's default config if reading /etc/resolv.conf fails by @​monosans in seanmonstar/reqwest#2797
• fix: remove timeout con by @​cuiweixie in seanmonstar/reqwest#2967
• http3: handle stop_sending without error by @​anuraaga in seanmonstar/reqwest#2978

... (truncated)

Changelog

Sourced from reqwest's changelog.

v0.13.4

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

v0.13.3

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

Commits

• 11489b3 v0.13.4
• d31ffbb feat: Expose HTTP2 keep alive configurations in blocking client (#3043)
• 79ed0d7 feat: support TLS 1.3 as min version under native-tls 🎉 (#2975)
• fb7bf6a fix: remove unwrap in hickory initialization (#3041)
• 3da616f fix: update hickory-resolver to 0.26 and adjust code accordingly (#3040)
• c77e7b2 fix(http3): use happy eyeballs for h3 connect (#3030)
• 9cbb65b chore: clean up minimal-versions CI job (#3039)
• 17a7dc5 chore: upgrade MSRV to 1.85 (#3038)
• 03db63a fix(redirect): strip sensitive headers on scheme change across redirects (#3034)
• 4b813a8 feat: add tls_sslkeylogfile builder method (#2923)
• Additional commits viewable in compare view

Updates pyroscope from 2.0.0 to 2.0.6

Release notes

Sourced from pyroscope's releases.

lib: v2.0.6

2.0.6 (2026-05-28)

Miscellaneous Chores

• deps: vendor pprofrs (#552) (6684026)

Continuous Integration

• remove pr-title-check workflow (#549) (e4739e4)

lib: v2.0.5

2.0.5 (2026-05-27)

Miscellaneous Chores

• deps: Remove unnecessary framehop dep (#550) (d9c0e02)

lib: v2.0.4

2.0.4 (2026-05-20)

Bug Fixes

• do not recreate profiling guard, just reset the data (#518) (b1fe114)
• remove kindasafe CI leftovers (#521) (f8bc0f3)

Miscellaneous Chores

• deps: bump openssl from 0.10.79 to 0.10.80 (#548) (f3ed911)
• deps: lock file maintenance (#535) (9554564)
• deps: lock file maintenance (#541) (3abc7b6)
• deps: lock file maintenance (#547) (cd30ebf)
• deps: pin rust docker tag to a9cfb75 (#544) (ea14091)
• deps: remove names crate dependency (#527) (5893aac)
• deps: update rust crate libc to v0.2.186 (#533) (a7468c1)
• deps: update rust crate reqwest to v0.13.3 (#539) (b8c6fbb)
• deps: update rust:trixie docker digest to a9cfb75 (#538) (bff1d5d)
• renovate: vulnerabilities-only with profiling deps allowlist (#540) (4aa8e56)

Continuous Integration

• add ARM cross-compilation test job (#536) (54bb03f)
• auto-publish to crates.io after release-please PR merge (#529) (a4f76b6)
• Potential fix for code scanning alert no. 14: Workflow does not contain permissions (#542) (51ac4b7)

... (truncated)

Changelog

Sourced from pyroscope's changelog.

2.0.6 (2026-05-28)

Miscellaneous Chores

• deps: vendor pprofrs (#552) (6684026)

Continuous Integration

• remove pr-title-check workflow (#549) (e4739e4)

2.0.5 (2026-05-27)

Miscellaneous Chores

• deps: Remove unnecessary framehop dep (#550) (d9c0e02)

2.0.4 (2026-05-20)

Bug Fixes

• do not recreate profiling guard, just reset the data (#518) (b1fe114)
• remove kindasafe CI leftovers (#521) (f8bc0f3)

Miscellaneous Chores

• deps: bump openssl from 0.10.79 to 0.10.80 (#548) (f3ed911)
• deps: lock file maintenance (#535) (9554564)
• deps: lock file maintenance (#541) (3abc7b6)
• deps: lock file maintenance (#547) (cd30ebf)
• deps: pin rust docker tag to a9cfb75 (#544) (ea14091)
• deps: remove names crate dependency (#527) (5893aac)
• deps: update rust crate libc to v0.2.186 (#533) (a7468c1)
• deps: update rust crate reqwest to v0.13.3 (#539) (b8c6fbb)
• deps: update rust:trixie docker digest to a9cfb75 (#538) (bff1d5d)
• renovate: vulnerabilities-only with profiling deps allowlist (#540) (4aa8e56)

Continuous Integration

• add ARM cross-compilation test job (#536) (54bb03f)
• auto-publish to crates.io after release-please PR merge (#529) (a4f76b6)
• Potential fix for code scanning alert no. 14: Workflow does not contain permissions (#542) (51ac4b7)

2.0.3 (2026-04-26)

... (truncated)

Commits

• ac41deb chore(main): release lib 2.0.6 (#553)
• 6684026 chore(deps): vendor pprofrs (#552)
• e4739e4 ci: remove pr-title-check workflow (#549)
• ec753fb chore(main): release lib 2.0.5 (#551)
• d9c0e02 chore(deps): Remove unnecessary framehop dep (#550)
• f9c9514 chore(main): release lib 2.0.4 (#534)
• f3ed911 chore(deps): bump openssl from 0.10.79 to 0.10.80 (#548)
• a4f76b6 ci: auto-publish to crates.io after release-please PR merge (#529)
• 5893aac chore(deps): remove names crate dependency (#527)
• 51ac4b7 ci: Potential fix for code scanning alert no. 14: Workflow does not contain p...
• Additional commits viewable in compare view

Updates apalis-postgres from 1.0.0-rc.7 to 1.0.0-rc.8

Release notes

Sourced from apalis-postgres's releases.

v1.0.0-rc.8

What's Changed

• ci(deps): bump cargo-bins/cargo-binstall from 1.17.7 to 1.17.9 by @​dependabot[bot] in apalis-dev/apalis-postgres#69
• ci(deps): bump codecov/codecov-action from 5 to 6 by @​dependabot[bot] in apalis-dev/apalis-postgres#70
• chore: Make JsonCodec publicly accessible by @​paomian in apalis-dev/apalis-postgres#79
• feat: idempotency for tasks by @​geofmureithi in apalis-dev/apalis-postgres#81
• ci(deps): bump pozil/auto-assign-issue from 2 to 3 by @​dependabot[bot] in apalis-dev/apalis-postgres#77
• ci(deps): bump cargo-bins/cargo-binstall from 1.17.9 to 1.19.1 by @​dependabot[bot] in apalis-dev/apalis-postgres#80
• bump: to v1.0.0-rc.8 by @​geofmureithi in apalis-dev/apalis-postgres#82

New Contributors

• @​paomian made their first contribution in apalis-dev/apalis-postgres#79

Full Changelog: apalis-dev/apalis-postgres@v1.0.0-rc.7...v1.0.0-rc.8

Changelog

Sourced from apalis-postgres's changelog.

[1.0.0-rc.8] - 2026-05-08

• feat: idempotency for tasks (#81)
• chore: make JsonCodec publicly accessible (#79)

Commits

• 5a93021 bump: to v1.0.0-rc.8 (#82)
• a4b03cb ci(deps): bump cargo-bins/cargo-binstall from 1.17.9 to 1.19.1 (#80)
• 810b71c ci(deps): bump pozil/auto-assign-issue from 2 to 3 (#77)
• 605adfb feat: idempotency for tasks (#81)
• 4a8d035 chore: Make JsonCodec publicly accessible (#79)
• 33f8f3b ci(deps): bump codecov/codecov-action from 5 to 6 (#70)
• 7f8f113 ci(deps): bump cargo-bins/cargo-binstall from 1.17.7 to 1.17.9 (#69)
• See full diff in compare view

Updates apalis-cron from 1.0.0-rc.7 to 1.0.0-rc.8

Release notes

Sourced from apalis-cron's releases.

v1.0.0-rc.8

What's Changed

• ci(deps): bump pozil/auto-assign-issue from 2 to 3 by @​dependabot[bot] in apalis-dev/apalis-cron#49
• bump: to v1.0.0-rc.8 by @​geofmureithi in apalis-dev/apalis-cron#51

Full Changelog: apalis-dev/apalis-cron@v1.0.0-rc.7...v1.0.0-rc.8

Changelog

Sourced from apalis-cron's changelog.

[1.0.0-rc.8] - 2026-05-08

• bump: to v1.0.0-rc.8 (#51)

Commits

• 47566e9 bump: to v1.0.0-rc.8 (#51)
• 648caec ci(deps): bump pozil/auto-assign-issue from 2 to 3 (#49)
• See full diff in compare view

Updates serde_qs from 1.1.1 to 1.1.2

Release notes

Sourced from serde_qs's releases.

v1.1.2

Fixed

• do not strict-validate ignored compound fields (#168)

Changelog

Sourced from serde_qs's changelog.

1.1.2 - 2026-05-15

Fixed

• do not strict-validate ignored compound fields (#168)

Commits

• ba6b6f7 chore: release v1.1.2 (#169)
• f220b13 fix: do not strict-validate ignored compound fields (#168)
• See full diff in compare view

Updates axum-test from 20.0.0 to 20.1.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.