CVS commit: pkgsrc/devel/cargo-nextest

["pin" <pin%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   pin
Date:           Thu Oct 22 09:20:51 UTC 2026

Modified Files:
        pkgsrc/devel/cargo-nextest: Makefile cargo-depends.mk distinfo

Log Message:
devel/cargo-nextest: update to 0.9.149

Security

    cargo nextest self update no longer trusts the eMudhra intermediate certificate authorities whose private keys were disclosed on 2026-10-20. Previously, an attacker able to intercept network 
traffic could have used these keys to make cargo nextest self update download and install a malicious binary.

    Nextest's self-updater uses a bundled set of root certificates, so operating system and browser updates do not protect it. This release updates webpki-roots to 1.0.10 and rustls-webpki to 
0.103.16, both of which distrust the compromised certificates.

    Running tests does not involve network access and is not affected. Builds without the self-update feature, including most distribution packages, are also not affected.

    Updating from an earlier version with cargo nextest self update would go through the affected code one last time. If you're concerned about your network being compromised, use one of the other 
installation methods instead.

Fixed

    On riscv64 Linux, cargo nextest self update no longer panics. (#3649)


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/devel/cargo-nextest/Makefile
cvs rdiff -u -r1.26 -r1.27 pkgsrc/devel/cargo-nextest/cargo-depends.mk \
    pkgsrc/devel/cargo-nextest/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/cargo-nextest/Makefile
diff -u pkgsrc/devel/cargo-nextest/Makefile:1.30 pkgsrc/devel/cargo-nextest/Makefile:1.31
--- pkgsrc/devel/cargo-nextest/Makefile:1.30    Thu Oct  8 05:16:43 2026
+++ pkgsrc/devel/cargo-nextest/Makefile Thu Oct 22 09:20:51 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2026/10/08 05:16:43 adam Exp $
+# $NetBSD: Makefile,v 1.31 2026/10/22 09:20:51 pin Exp $
 
-DISTNAME=      cargo-nextest-0.9.148
+DISTNAME=      cargo-nextest-0.9.149
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=nextest-rs/}
 GITHUB_PROJECT=        nextest

Index: pkgsrc/devel/cargo-nextest/cargo-depends.mk
diff -u pkgsrc/devel/cargo-nextest/cargo-depends.mk:1.26 pkgsrc/devel/cargo-nextest/cargo-depends.mk:1.27
--- pkgsrc/devel/cargo-nextest/cargo-depends.mk:1.26    Thu Oct  8 05:16:43 2026
+++ pkgsrc/devel/cargo-nextest/cargo-depends.mk Thu Oct 22 09:20:51 2026
@@ -1,4 +1,4 @@
-# $NetBSD: cargo-depends.mk,v 1.26 2026/10/08 05:16:43 adam Exp $
+# $NetBSD: cargo-depends.mk,v 1.27 2026/10/22 09:20:51 pin Exp $
 
 CARGO_CRATE_DEPENDS+=  addr2line-0.24.2
 CARGO_CRATE_DEPENDS+=  adler2-2.0.1
@@ -279,7 +279,7 @@ CARGO_CRATE_DEPENDS+=       option-ext-0.2.0
 CARGO_CRATE_DEPENDS+=  ordered-float-4.6.0
 CARGO_CRATE_DEPENDS+=  os_pipe-1.2.2
 CARGO_CRATE_DEPENDS+=  outref-0.5.2
-CARGO_CRATE_DEPENDS+=  owo-colors-4.3.0
+CARGO_CRATE_DEPENDS+=  owo-colors-4.4.0
 CARGO_CRATE_DEPENDS+=  parking_lot-0.12.4
 CARGO_CRATE_DEPENDS+=  parking_lot_core-0.9.11
 CARGO_CRATE_DEPENDS+=  pathdiff-0.2.3
@@ -350,7 +350,7 @@ CARGO_CRATE_DEPENDS+=       rustls-native-cert
 CARGO_CRATE_DEPENDS+=  rustls-pki-types-1.12.0
 CARGO_CRATE_DEPENDS+=  rustls-platform-verifier-0.7.0
 CARGO_CRATE_DEPENDS+=  rustls-platform-verifier-android-0.1.1
-CARGO_CRATE_DEPENDS+=  rustls-webpki-0.103.15
+CARGO_CRATE_DEPENDS+=  rustls-webpki-0.103.16
 CARGO_CRATE_DEPENDS+=  rustversion-1.0.22
 CARGO_CRATE_DEPENDS+=  rusty-fork-0.3.0
 CARGO_CRATE_DEPENDS+=  same-file-1.0.6
@@ -517,7 +517,7 @@ CARGO_CRATE_DEPENDS+=       wasmparser-0.244.0
 CARGO_CRATE_DEPENDS+=  web-sys-0.3.91
 CARGO_CRATE_DEPENDS+=  web-time-1.1.0
 CARGO_CRATE_DEPENDS+=  webpki-root-certs-1.0.6
-CARGO_CRATE_DEPENDS+=  webpki-roots-1.0.0
+CARGO_CRATE_DEPENDS+=  webpki-roots-1.0.10
 CARGO_CRATE_DEPENDS+=  wezterm-bidi-0.2.3
 CARGO_CRATE_DEPENDS+=  wezterm-blob-leases-0.1.1
 CARGO_CRATE_DEPENDS+=  wezterm-color-types-0.3.0
Index: pkgsrc/devel/cargo-nextest/distinfo
diff -u pkgsrc/devel/cargo-nextest/distinfo:1.26 pkgsrc/devel/cargo-nextest/distinfo:1.27
--- pkgsrc/devel/cargo-nextest/distinfo:1.26    Thu Oct  8 05:16:43 2026
+++ pkgsrc/devel/cargo-nextest/distinfo Thu Oct 22 09:20:51 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.26 2026/10/08 05:16:43 adam Exp $
+$NetBSD: distinfo,v 1.27 2026/10/22 09:20:51 pin Exp $
 
 BLAKE2s (addr2line-0.24.2.crate) = 5bdb03ff8621c0993eda0ec3682c467ad3fc0015f48e46a70779bbd4bfbe8267
 SHA512 (addr2line-0.24.2.crate) = 39cbec3c920ffc0f37584afb55e1cfe4f182e4415319a4e9bfe842360f102f7b9315f6171c0cf71ba0337123903e604096cd573fe98698a26c8eebc2376d965b
@@ -144,9 +144,9 @@ Size (camino-tempfile-1.4.1.crate) = 265
 BLAKE2s (camino-tempfile-ext-0.3.3.crate) = a4c8ca92f3553889982795461fa1bd8a17151e7e8afcd6bce7227ccbbb6e40be
 SHA512 (camino-tempfile-ext-0.3.3.crate) = 1725f3f72ccd207e8d9ee6c7f28749f1b34734032e51bf11aa773be791509a80fdad1aa3c8cb70e3d2b8cea4c04997a615c3581fb16975242e66cb11655195fa
 Size (camino-tempfile-ext-0.3.3.crate) = 19167 bytes
-BLAKE2s (cargo-nextest-0.9.148.tar.gz) = 0a5a6862a80cc31a5db6c8c1d08052bcbcd37d062a127989d183af0b2383d0f9
-SHA512 (cargo-nextest-0.9.148.tar.gz) = def1cecc276512068dc88f427ffdf8daf706046e7ee8b34dc61e6babc3d7c6a14e9149a027c55757ea0a0b4a0bec1420b2499f171c248d3864e8d90447da68af
-Size (cargo-nextest-0.9.148.tar.gz) = 9119734 bytes
+BLAKE2s (cargo-nextest-0.9.149.tar.gz) = 7fd8987a780ceb7f67c7d89da80b6ce3fa00ea70f8b5ad55d70f666374017a06
+SHA512 (cargo-nextest-0.9.149.tar.gz) = e0b7764915637bd22bcced196eb048f5a846f11cbe476300286706da98a78198bb484416aab90df093e7f528826ec353aee2aee34b51df2a05a6b6055c30edcc
+Size (cargo-nextest-0.9.149.tar.gz) = 9121242 bytes
 BLAKE2s (cargo-platform-0.3.0.crate) = f1dc01d022f8890fc5e672e24809275d002c6063802735604161960fd465374c
 SHA512 (cargo-platform-0.3.0.crate) = 43800bb1f7d23c4b82b8ff67dda6463de93955201bf9add1da16d31e4efc3864e5bc506ad05d7b76e7d7eb3a1dc3623e25c5656d19433dc8ef545656aa5786e0
 Size (cargo-platform-0.3.0.crate) = 13252 bytes
@@ -840,9 +840,9 @@ Size (os_pipe-1.2.2.crate) = 10810 bytes
 BLAKE2s (outref-0.5.2.crate) = 73ed851a3f019a8f48f0a49bb5edcd37a6a29d64fd75fc039e544e5395621b68
 SHA512 (outref-0.5.2.crate) = a352eee5f77ca697300d46835deb88821dd9af8165918fee3f32de2f18e529e0fbca5c982454f0a9c9a4596a5e99671ee3e56bdcf3e036af232f013ee8260416
 Size (outref-0.5.2.crate) = 5621 bytes
-BLAKE2s (owo-colors-4.3.0.crate) = 015fd0db3e206995f7f75738edc7a58730cf48c0b1f7cf5e0085de1349534ed4
-SHA512 (owo-colors-4.3.0.crate) = 7a63f3c9e8dba768779163ad8f547ce64587c35e85c39dd9c57f24670e9ae49b8955c0f0a84ec79c110f907925f429ac33ec6580a4c979ffadfe7e3eee554661
-Size (owo-colors-4.3.0.crate) = 31273 bytes
+BLAKE2s (owo-colors-4.4.0.crate) = 61c964b3e17cbc79f50ccaca7d092f5873348ff4500b32c480f3ee123e79b72b
+SHA512 (owo-colors-4.4.0.crate) = 10cbdcca7b970c25a1d309de2b125a15cb7d904f41a8607882864d709c0d434769111e220870fa63da5c4eeedf7af5f5d413585fa257fbec3e974126e602b367
+Size (owo-colors-4.4.0.crate) = 30904 bytes
 BLAKE2s (parking_lot-0.12.4.crate) = 311ad021551f1fafeb610b7d06e40a1dd586ebea683ea602c4c00a5744bac8e8
 SHA512 (parking_lot-0.12.4.crate) = 0334bfd39e59f61eeb1bf182b1026825ea7ea50be7be44b1584c62facdb8e30fbb617e29ded4a35a05155b57c1574c980ba75f602044db75b985661305db0671
 Size (parking_lot-0.12.4.crate) = 46779 bytes
@@ -1053,9 +1053,9 @@ Size (rustls-platform-verifier-0.7.0.cra
 BLAKE2s (rustls-platform-verifier-android-0.1.1.crate) = c8d0240ebc3809d2fbfd7805badb53674ced7d89a17a1cd06880a158d2227cb6
 SHA512 (rustls-platform-verifier-android-0.1.1.crate) = f3f21b88b448f46e08da4303d225f10765d21f2397d4fbe44d5f9cf9da5ced84fa5adc5881f1db66a324cef818537e4a79bad2260b8027894029ba7e6ec16533
 Size (rustls-platform-verifier-android-0.1.1.crate) = 13919 bytes
-BLAKE2s (rustls-webpki-0.103.15.crate) = 7798c89cd466bfc2dcef2c2c7be614ae77cbb76e2772a9890bb5ecc1d1dd3185
-SHA512 (rustls-webpki-0.103.15.crate) = adeb7c379e9b691e044d497768959bab9c8f291c21f93e9f5373ab0639e9070258945e2bd0be4e8eb8fca98c3824e942033d6430d15134f8fe8ff3a1c4d98382
-Size (rustls-webpki-0.103.15.crate) = 87465 bytes
+BLAKE2s (rustls-webpki-0.103.16.crate) = 752cd6f7b2ea420c76d7891a38783c33fdb77471ea4286f27ce3fb0a78ab8087
+SHA512 (rustls-webpki-0.103.16.crate) = eee403a2e2a57b598ad01662995db2bd2fe79d2405e3e3ff98442fa37e6ff8f8a267a46476303fe74691c3399d618c41cc8ffa733ddebe4d8759fd466fc7ce6a
+Size (rustls-webpki-0.103.16.crate) = 89984 bytes
 BLAKE2s (rustversion-1.0.22.crate) = 94885d422b9c942ceab679e86d0a2b8e6f322f655091475a6a475f0b796f48b9
 SHA512 (rustversion-1.0.22.crate) = 7929352df3e5279ac88cebb26ca89bb13c755f46986d2d1f514d18a3239a63638bf64f8ff153920569d173185d988d692ee676335afba0bf72d47f71babe0e15
 Size (rustversion-1.0.22.crate) = 21096 bytes
@@ -1554,9 +1554,9 @@ Size (web-time-1.1.0.crate) = 18026 byte
 BLAKE2s (webpki-root-certs-1.0.6.crate) = 7bfa59791faced7a74eb3f103d57bd398ec08c176adeb0f46740bdd87bfdbd4b
 SHA512 (webpki-root-certs-1.0.6.crate) = 0cbdd87e0e814f5f0921eff0aa6769eaea200934c837cd4fc9cf61f92f5a96b7e95911332ba4ce3be9a699a7d126f89232f2261a718973b1972e2508c96ff1ba
 Size (webpki-root-certs-1.0.6.crate) = 165537 bytes
-BLAKE2s (webpki-roots-1.0.0.crate) = 7eb4b6599deacfc17b38755d002d38f8b0c53a36253f36386e3a84070625b4f1
-SHA512 (webpki-roots-1.0.0.crate) = fd0c2688ad1dffde4216da335e715b8b07231790e8693cf683e6e6a5a1e188e6fdfc558572ec99b0ca83ec469387b9bbf977ccc84408994ca571b4015f3c614c
-Size (webpki-roots-1.0.0.crate) = 248893 bytes
+BLAKE2s (webpki-roots-1.0.10.crate) = f337149f2878c45343438984d80bf67eab56ac8c9fca7af3ca3c138b65d0791d
+SHA512 (webpki-roots-1.0.10.crate) = aee28de146157169c036ef180bf83529303f83f90998021932f830334190cadc46afd53a9d91dba1520fb05152ac1146fce650ed164ea1138768cd7d286b4882
+Size (webpki-roots-1.0.10.crate) = 216631 bytes
 BLAKE2s (wezterm-bidi-0.2.3.crate) = 21cb5448b48f1368a3eed911fe3eb827ee237c32592d567aa61f613aadb6f9d9
 SHA512 (wezterm-bidi-0.2.3.crate) = 37950db06980a60ce7a5cf2a2ac55aafb3d16d02b650dbb938f28d60217f4c51e1fbfe21d53898078336f68538e97f8a061e7b6c7eb238427651ff8673d6c45f
 Size (wezterm-bidi-0.2.3.crate) = 73214 bytes