Auto merge of #29434 - servo:dependabot/cargo/tempfile-3.4.0, r=jdm

Bump tempfile from 3.3.0 to 3.4.0

Bumps [tempfile](https://github.com/Stebalien/tempfile) from 3.3.0 to 3.4.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/Stebalien/tempfile/blob/master/NEWS">tempfile's changelog</a>.</em></p>
<blockquote>
<h1>3.4.0</h1>
<p>SECURITY: Prior <code>tempfile</code> releases depended on <code>remove_dir_all</code> version 0.5.0 which was vulnerabiel to a <a href="https://github.com/XAMPPRocky/remove_dir_all/security/advisories/GHSA-mc8h-8q98-g5hr">TOCTOU race</a>. This same race is present in rust versions prior to 1.58.1.</p>
<p>Features:</p>
<ul>
<li>Generalized temporary files: <code>NamedTempFile</code> can now abstract over different kinds of files (e.g.,
unix domain sockets, pipes, etc.):
<ul>
<li>Add <code>Builder::make</code> and <code>Builder::make_in</code> for generalized temp file
creation.</li>
<li>Add <code>NamedTempFile::from_parts</code> to complement <code>NamedTempFile::into_parts</code>.</li>
<li>Add generic parameter to <code>NamedTempFile</code> to support wrapping non-File types.</li>
</ul>
</li>
</ul>
<p>Bug Fixes/Improvements:</p>
<ul>
<li>Don't try to create a temporary file multiple times if the file path has been fully specified by
the user (no random characters).</li>
<li><code>NamedTempFile::persist_noclobber</code> is now always atomic on linux when <code>renameat_with</code> is
supported. Previously, it would first link the new path, then unlink the previous path.</li>
<li>Fix compiler warnings on windows.</li>
</ul>
<p>Trivia:</p>
<ul>
<li>Switch from <code>libc</code> to <code>rustix</code> on wasi/unix. This now makes direct syscalls instead of calling
through libc.</li>
<li>Remove <code>remove_dir_all</code> dependency. The rust standard library has optimized their internal version
significantly.</li>
<li>Switch to official windows-sys windows bindings.</li>
</ul>
<p>Breaking:</p>
<ul>
<li>The minimum rust version is now <code>1.48.0</code>.</li>
<li>Mark most functions as <code>must_use</code>.</li>
<li>Uses direct syscalls on linux by default, instead of libc.</li>
<li>The new type parameter in <code>NamedTempFile</code> may lead to type inference issues in some cases.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/Stebalien/tempfile/commits">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tempfile&package-manager=cargo&previous-version=3.3.0&new-version=3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>
This commit is contained in:
bors-servo 2023-02-28 03:02:23 +01:00 committed by GitHub
commit 8decd02a06
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

69
Cargo.lock generated
View file

@ -1561,6 +1561,27 @@ dependencies = [
"termcolor",
]
[[package]]
name = "errno"
version = "0.2.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f639046355ee4f37944e44f60642c6f3a7efa3cf6b78c78a0d989a8ce6c396a1"
dependencies = [
"errno-dragonfly",
"libc",
"winapi",
]
[[package]]
name = "errno-dragonfly"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
dependencies = [
"cc",
"libc",
]
[[package]]
name = "euclid"
version = "0.22.7"
@ -2921,6 +2942,16 @@ dependencies = [
"web-sys",
]
[[package]]
name = "io-lifetimes"
version = "1.0.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1abeb7a0dd0f8181267ff8adc397075586500b81b28a73e8a0208b00fc170fb3"
dependencies = [
"libc",
"windows-sys 0.45.0",
]
[[package]]
name = "io-surface"
version = "0.15.1"
@ -3444,6 +3475,12 @@ dependencies = [
"linked-hash-map",
]
[[package]]
name = "linux-raw-sys"
version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f051f77a7c8e6957c0696eac88f26b0117e54f52d3fc682ab19397a8812846a4"
[[package]]
name = "lock_api"
version = "0.4.7"
@ -5111,15 +5148,6 @@ version = "0.6.28"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
[[package]]
name = "remove_dir_all"
version = "0.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4a83fa3702a688b9359eccba92d153ac33fd2e8462f9e0e3fdf155239ea7792e"
dependencies = [
"winapi",
]
[[package]]
name = "rle-decode-fast"
version = "1.0.3"
@ -5169,6 +5197,20 @@ dependencies = [
"semver",
]
[[package]]
name = "rustix"
version = "0.36.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f43abb88211988493c1abb44a70efa56ff0ce98f233b7b276146f1f3f7ba9644"
dependencies = [
"bitflags",
"errno",
"io-lifetimes",
"libc",
"linux-raw-sys",
"windows-sys 0.45.0",
]
[[package]]
name = "ryu"
version = "1.0.9"
@ -6402,16 +6444,15 @@ dependencies = [
[[package]]
name = "tempfile"
version = "3.3.0"
version = "3.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
checksum = "af18f7ae1acd354b992402e9ec5864359d693cd8a79dcbef59f76891701c1e95"
dependencies = [
"cfg-if 1.0.0",
"fastrand",
"libc",
"redox_syscall 0.2.13",
"remove_dir_all",
"winapi",
"rustix",
"windows-sys 0.42.0",
]
[[package]]