Update dependencies flagged by cargo audit (#2753)

Zelda Hessler · web-flow · commit 8c4d186487ee · 2023-06-12T17:09:29.000Z
Also, sort `Cargo.toml` dependencies if they were disordered.

----

_By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice._
diff --git a/.cargo-deny-config.toml b/.cargo-deny-config.toml
@@ -35,6 +35,20 @@ name = "ring"
 expression = "MIT AND ISC AND OpenSSL"
 license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]
 
+[[licenses.clarify]]
+name = "webpki"
+expression = "ISC"
+license-files = [
+    { path = "LICENSE", hash = 0x001c7e6c },
+]
+
+[[licenses.clarify]]
+name = "rustls-webpki"
+expression = "ISC"
+license-files = [
+    { path = "LICENSE", hash = 0x001c7e6c },
+]
+
 # This section is considered when running `cargo deny check bans`.
 # More documentation about the 'bans' section can be found here:
 # https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
diff --git a/aws/rust-runtime/aws-config/Cargo.toml b/aws/rust-runtime/aws-config/Cargo.toml
@@ -29,7 +29,7 @@ aws-smithy-http-tower = { path = "../../sdk/build/aws-sdk/sdk/aws-smithy-http-to
 aws-smithy-json = { path = "../../sdk/build/aws-sdk/sdk/aws-smithy-json" }
 aws-smithy-types = { path = "../../sdk/build/aws-sdk/sdk/aws-smithy-types" }
 aws-types = { path = "../../sdk/build/aws-sdk/sdk/aws-types" }
-hyper = { version = "0.14.25", default-features = false }
+hyper = { version = "0.14.26", default-features = false }
 time = { version = "0.3.4", features = ["parsing"] }
 tokio = { version = "1.13.1", features = ["sync"] }
 tracing = { version = "0.1" }
@@ -65,7 +65,7 @@ aws-credential-types = { path = "../../sdk/build/aws-sdk/sdk/aws-credential-type
 aws-smithy-client = { path = "../../sdk/build/aws-sdk/sdk/aws-smithy-client", features = ["test-util"] }
 
 # used for a usage example
-hyper-rustls = { version = "0.23.0", features = ["webpki-tokio", "http2", "http1"] }
+hyper-rustls = { version = "0.24", features = ["webpki-tokio", "http2", "http1"] }
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/aws/rust-runtime/aws-credential-types/Cargo.toml b/aws/rust-runtime/aws-credential-types/Cargo.toml
@@ -27,7 +27,7 @@ async-trait = "0.1.51"
 env_logger = "0.9.0"
 
 tokio = { version = "1.23.1", features = ["full", "test-util", "rt"] }
-tracing-test = "0.2.1"
+tracing-test = "0.2.4"
 # TODO(https://github.com/awslabs/smithy-rs/issues/2619): Remove this
 # workaround once the fixed is upstreamed.
 regex = { version = "1.0", features = ["unicode-case", "unicode-perl"] }
diff --git a/aws/rust-runtime/aws-http/Cargo.toml b/aws/rust-runtime/aws-http/Cargo.toml
@@ -29,8 +29,8 @@ aws-smithy-protocol-test = { path = "../../../rust-runtime/aws-smithy-protocol-t
 bytes-utils = "0.1.2"
 env_logger = "0.9"
 tokio = { version = "1.23.1", features = ["macros", "rt", "rt-multi-thread", "test-util", "time"] }
-tracing-subscriber = { version = "0.3.15", features = ["env-filter"] }
-proptest = "1"
+tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
+proptest = "1.2"
 serde = { version = "1", features = ["derive"]}
 serde_json = "1"
 
diff --git a/aws/rust-runtime/aws-inlineable/Cargo.toml b/aws/rust-runtime/aws-inlineable/Cargo.toml
@@ -43,8 +43,8 @@ aws-credential-types = { path = "../aws-credential-types", features = ["test-uti
 aws-smithy-client = { path = "../../../rust-runtime/aws-smithy-client", features = ["test-util"] }
 aws-smithy-http = { path = "../../../rust-runtime/aws-smithy-http", features = ["rt-tokio"] }
 aws-smithy-runtime = { path = "../../../rust-runtime/aws-smithy-runtime" }
-tempfile = "3.2.0"
-tracing-subscriber = { version = "0.3.15", features = ["env-filter"] }
+tempfile = "3.6.0"
+tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
 aws-smithy-async = { path = "../../../rust-runtime/aws-smithy-async", features = ["test-util"] }
 
 [package.metadata.docs.rs]
diff --git a/aws/rust-runtime/aws-runtime/Cargo.toml b/aws/rust-runtime/aws-runtime/Cargo.toml
@@ -33,10 +33,10 @@ aws-smithy-async = { path = "../../../rust-runtime/aws-smithy-async", features =
 aws-smithy-types = { path = "../../../rust-runtime/aws-smithy-types", features = ["test-util"] }
 aws-smithy-protocol-test = { path = "../../../rust-runtime/aws-smithy-protocol-test" }
 aws-smithy-runtime-api = { path = "../../../rust-runtime/aws-smithy-runtime-api", features = ["test-util"] }
-proptest = "1"
+proptest = "1.2"
 serde = { version = "1", features = ["derive"]}
 serde_json = "1"
-tracing-test = "0.2.1"
+tracing-test = "0.2.4"
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/aws/rust-runtime/aws-sig-auth/Cargo.toml b/aws/rust-runtime/aws-sig-auth/Cargo.toml
@@ -24,7 +24,7 @@ tracing = "0.1"
 aws-credential-types = { path = "../aws-credential-types", features = ["test-util"] }
 aws-endpoint = { path = "../aws-endpoint" }
 aws-smithy-types = { path = "../../../rust-runtime/aws-smithy-types" }
-tracing-test = "0.2.1"
+tracing-test = "0.2.4"
 aws-smithy-async = { path = "../../../rust-runtime/aws-smithy-async", features = ["test-util"] }
 
 [package.metadata.docs.rs]
diff --git a/aws/rust-runtime/aws-sigv4/Cargo.toml b/aws/rust-runtime/aws-sigv4/Cargo.toml
@@ -33,7 +33,7 @@ criterion = "0.4"
 bytes = "1"
 httparse = "1.5"
 pretty_assertions = "1.3"
-proptest = "1"
+proptest = "1.2"
 time = { version = "0.3.4", features = ["parsing"] }
 
 [target.'cfg(not(any(target_arch = "powerpc", target_arch = "powerpc64")))'.dev-dependencies]
diff --git a/aws/rust-runtime/aws-types/Cargo.toml b/aws/rust-runtime/aws-types/Cargo.toml
@@ -22,12 +22,12 @@ http = "0.2.6"
 # cargo does not support optional test dependencies, so to completely disable rustls
 # we need to add the webpki-roots feature here.
 # https://github.com/rust-lang/cargo/issues/1596
-hyper-rustls = { version = "0.23.0", optional = true, features = ["rustls-native-certs", "http2", "webpki-roots"] }
+hyper-rustls = { version = "0.24", optional = true, features = ["rustls-native-certs", "http2", "webpki-roots"] }
 
 [dev-dependencies]
 futures-util = { version = "0.3.16", default-features = false }
 http = "0.2.4"
-tracing-test = "0.2.1"
+tracing-test = "0.2.4"
 
 [build-dependencies]
 rustc_version = "0.4.0"
diff --git a/aws/sdk/integration-tests/s3/Cargo.toml b/aws/sdk/integration-tests/s3/Cargo.toml
@@ -30,7 +30,7 @@ futures-util = { version = "0.3.16", default-features = false }
 hdrhistogram = "7.5.2"
 http = "0.2.3"
 http-body = "0.4.5"
-hyper = "0.14.25"
+hyper = "0.14.26"
 pretty_assertions = "1.3"
 serde_json = "1"
 smol = "1.2"
diff --git a/codegen-core/src/main/kotlin/software/amazon/smithy/rust/codegen/core/rustlang/CargoDependency.kt b/codegen-core/src/main/kotlin/software/amazon/smithy/rust/codegen/core/rustlang/CargoDependency.kt
@@ -215,7 +215,7 @@ data class CargoDependency(
         val Hex: CargoDependency = CargoDependency("hex", CratesIo("0.4.3"))
         val Http: CargoDependency = CargoDependency("http", CratesIo("0.2.9"))
         val HttpBody: CargoDependency = CargoDependency("http-body", CratesIo("0.4.4"))
-        val Hyper: CargoDependency = CargoDependency("hyper", CratesIo("0.14.12"))
+        val Hyper: CargoDependency = CargoDependency("hyper", CratesIo("0.14.26"))
         val HyperWithStream: CargoDependency = Hyper.withFeature("stream")
         val LazyStatic: CargoDependency = CargoDependency("lazy_static", CratesIo("1.4.0"))
         val Md5: CargoDependency = CargoDependency("md-5", CratesIo("0.10.0"), rustName = "md5")
diff --git a/examples/pokemon-service-lambda/Cargo.toml b/examples/pokemon-service-lambda/Cargo.toml
@@ -9,7 +9,7 @@ description = "A smithy Rust service to retrieve information about Pokémon via
 [dependencies]
 async-stream = "0.3.4"
 clap = { version = "4.1.11", features = ["derive"] }
-hyper = {version = "0.14.25", features = ["server"] }
+hyper = {version = "0.14.26", features = ["server"] }
 tokio = "1.26.0"
 tracing = "0.1"
 
diff --git a/examples/pokemon-service-tls/Cargo.toml b/examples/pokemon-service-tls/Cargo.toml
@@ -8,12 +8,12 @@ description = "A smithy Rust service to retrieve information about Pokémon."
 
 [dependencies]
 clap = { version = "4.1.11", features = ["derive"] }
-hyper = { version = "0.14.25", features = ["server"] }
+hyper = { version = "0.14.26", features = ["server"] }
 tokio = "1.26.0"
 
 # These dependencies are only required for the `pokemon-service-tls` program.
-tls-listener = { version = "0.6.0", features = ["rustls", "hyper-h2"] }
-tokio-rustls = "0.23.4"
+tls-listener = { version = "0.7.0", features = ["rustls", "hyper-h2"] }
+tokio-rustls = "0.24.0"
 rustls-pemfile = "1.0.2"
 futures-util = { version = "0.3.27", default-features = false }
 
@@ -27,7 +27,7 @@ assert_cmd = "2.0"
 serial_test = "1.0.0"
 
 # This dependency is only required for testing the `pokemon-service-tls` program.
-hyper-rustls = { version = "0.23.2", features = ["http2"] }
+hyper-rustls = { version = "0.24", features = ["http2"] }
 
 # Local paths
 aws-smithy-client = { path = "../../rust-runtime/aws-smithy-client/", features = ["rustls"] }
diff --git a/examples/pokemon-service/Cargo.toml b/examples/pokemon-service/Cargo.toml
@@ -8,7 +8,7 @@ description = "A smithy Rust service to retrieve information about Pokémon."
 
 [dependencies]
 clap = { version = "4.1.11", features = ["derive"] }
-hyper = {version = "0.14.25", features = ["server"] }
+hyper = { version = "0.14.26", features = ["server"] }
 tokio = "1.26.0"
 tower = "0.4"
 tracing = "0.1"
@@ -25,10 +25,10 @@ rand = "0.8.5"
 serial_test = "1.0.0"
 
 # We use hyper client in tests
-hyper = {version = "0.14.25", features = ["server", "client"] }
+hyper = { version = "0.14.26", features = ["server", "client"] }
 
 # This dependency is only required for testing the `pokemon-service-tls` program.
-hyper-rustls = { version = "0.23.2", features = ["http2"] }
+hyper-rustls = { version = "0.24", features = ["http2"] }
 
 # Local paths
 aws-smithy-client = { path = "../../rust-runtime/aws-smithy-client/", features = ["rustls"] }
diff --git a/examples/python/pokemon-service-test/Cargo.toml b/examples/python/pokemon-service-test/Cargo.toml
@@ -14,7 +14,7 @@ tokio = { version = "1.20.1", features = ["full"] }
 serial_test = "2.0.0"
 rustls-pemfile = "1.0.1"
 tokio-rustls = "0.24.0"
-hyper-rustls = { version = "0.24.0", features = ["http2"] }
+hyper-rustls = { version = "0.24", features = ["http2"] }
 
 # Local paths
 aws-smithy-client  = { path = "../../../rust-runtime/aws-smithy-client/", features = ["rustls"] }
diff --git a/rust-runtime/aws-smithy-client/Cargo.toml b/rust-runtime/aws-smithy-client/Cargo.toml
@@ -26,13 +26,13 @@ bytes = "1"
 fastrand = "1.4.0"
 http = "0.2.3"
 http-body = "0.4.4"
-hyper = { version = "0.14.25", features = ["client", "http2", "http1", "tcp"], optional = true }
+hyper = { version = "0.14.26", features = ["client", "http2", "http1", "tcp"], optional = true }
 # cargo does not support optional test dependencies, so to completely disable rustls
 # we need to add the webpki-roots feature here.
 # https://github.com/rust-lang/cargo/issues/1596
-hyper-rustls = { version = "0.23.0", optional = true, features = ["rustls-native-certs", "http2"] }
+hyper-rustls = { version = "0.24", optional = true, features = ["rustls-native-certs", "http2"] }
 hyper-tls = { version = "0.5.0", optional = true }
-rustls = { version = "0.20", optional = true }
+rustls = { version = "0.21.1", optional = true }
 lazy_static = { version = "1", optional = true }
 pin-project-lite = "0.2.7"
 serde = { version = "1", features = ["derive"], optional = true }
diff --git a/rust-runtime/aws-smithy-eventstream/Cargo.toml b/rust-runtime/aws-smithy-eventstream/Cargo.toml
@@ -11,11 +11,11 @@ repository = "https://github.com/awslabs/smithy-rs"
 derive-arbitrary = ["arbitrary", "derive_arbitrary"]
 
 [dependencies]
-derive_arbitrary = { version = "=1.1.6", optional = true } # 1.2.0 requires Rust 1.63 to compile
 arbitrary = { version = "=1.1.3", optional = true } # 1.1.4 requires Rust 1.63 to compile
 aws-smithy-types = { path = "../aws-smithy-types" }
 bytes = "1"
 crc32fast = "1.3"
+derive_arbitrary = { version = "=1.1.6", optional = true } # 1.2.0 requires Rust 1.63 to compile
 
 [dev-dependencies]
 bytes-utils = "0.1"
diff --git a/rust-runtime/aws-smithy-eventstream/fuzz/Cargo.toml b/rust-runtime/aws-smithy-eventstream/fuzz/Cargo.toml
@@ -9,11 +9,11 @@ edition = "2021"
 cargo-fuzz = true
 
 [dependencies]
-derive_arbitrary = "=1.1.6" # 1.2.0 requires Rust 1.63 to compile
 arbitrary = "=1.1.3" # 1.1.4 requires Rust 1.63 to compile
 aws-smithy-types = { path = "../../aws-smithy-types" }
 bytes = "1"
 crc32fast = "1"
+derive_arbitrary = "=1.1.6" # 1.2.0 requires Rust 1.63 to compile
 libfuzzer-sys = "0.4"
 
 [dependencies.aws-smithy-eventstream]
diff --git a/rust-runtime/aws-smithy-http-server-python/Cargo.toml b/rust-runtime/aws-smithy-http-server-python/Cargo.toml
@@ -21,7 +21,7 @@ aws-smithy-xml = { path = "../aws-smithy-xml" }
 bytes = "1.2"
 futures = "0.3"
 http = "0.2"
-hyper = { version = "0.14.20", features = ["server", "http1", "http2", "tcp", "stream"] }
+hyper = { version = "0.14.26", features = ["server", "http1", "http2", "tcp", "stream"] }
 tls-listener = { version = "0.7.0", features = ["rustls", "hyper-h2"] }
 rustls-pemfile = "1.0.1"
 tokio-rustls = "0.24.0"
@@ -48,7 +48,7 @@ tower-test = "0.4"
 tokio-test = "0.4"
 pyo3-asyncio = { version = "0.18.0", features = ["testing", "attributes", "tokio-runtime", "unstable-streams"] }
 rcgen = "0.10.0"
-hyper-rustls = { version = "0.24.0", features = ["http2"] }
+hyper-rustls = { version = "0.24", features = ["http2"] }
 
 # PyO3 Asyncio tests cannot use Cargo's default testing harness because `asyncio`
 # wants to control the main thread. So we need to use testing harness provided by `pyo3_asyncio`
diff --git a/rust-runtime/aws-smithy-http-server/Cargo.toml b/rust-runtime/aws-smithy-http-server/Cargo.toml
@@ -18,28 +18,28 @@ unredacted-logging = []
 request-id = ["dep:uuid"]
 
 [dependencies]
+async-trait = "0.1"
 aws-smithy-http = { path = "../aws-smithy-http", features = ["rt-tokio"] }
-aws-smithy-types = { path = "../aws-smithy-types" }
 aws-smithy-json = { path = "../aws-smithy-json" }
+aws-smithy-types = { path = "../aws-smithy-types" }
 aws-smithy-xml = { path = "../aws-smithy-xml" }
-async-trait = "0.1"
 bytes = "1.1"
 futures-util = { version = "0.3.16", default-features = false }
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14.12", features = ["server", "http1", "http2", "tcp", "stream"] }
+hyper = { version = "0.14.26", features = ["server", "http1", "http2", "tcp", "stream"] }
 lambda_http = { version = "0.8.0", optional = true }
 mime = "0.3.4"
 nom = "7"
-pin-project-lite = "0.2"
 once_cell = "1.13"
+pin-project-lite = "0.2"
 regex = "1.5.5"
 serde_urlencoded = "0.7"
-thiserror = "1.0.0"
-tracing = "0.1.35"
+thiserror = "1.0.40"
 tokio = { version = "1.23.1", features = ["full"] }
 tower = { version = "0.4.11", features = ["util", "make"], default-features = false }
 tower-http = { version = "0.3", features = ["add-extension", "map-response-body"] }
+tracing = "0.1.35"
 uuid = { version = "1", features = ["v4", "fast-rng"], optional = true }
 
 [dev-dependencies]
diff --git a/rust-runtime/aws-smithy-http/Cargo.toml b/rust-runtime/aws-smithy-http/Cargo.toml
@@ -28,7 +28,7 @@ pin-utils = "0.1.0"
 tracing = "0.1"
 
 # We are using hyper for our streaming body implementation, but this is an internal detail.
-hyper = "0.14.25"
+hyper = "0.14.26"
 
 # ByteStream internals
 futures-core = "0.3.14"
@@ -38,7 +38,7 @@ tokio-util = { version = "0.7", optional = true }
 [dev-dependencies]
 async-stream = "0.3"
 futures-util = { version = "0.3.16", default-features = false }
-hyper = { version = "0.14.25", features = ["stream"] }
+hyper = { version = "0.14.26", features = ["stream"] }
 pretty_assertions = "1.3"
 proptest = "1"
 tokio = { version = "1.23.1", features = [
diff --git a/rust-runtime/aws-smithy-protocol-test/Cargo.toml b/rust-runtime/aws-smithy-protocol-test/Cargo.toml
@@ -8,15 +8,14 @@ license = "Apache-2.0"
 repository = "https://github.com/awslabs/smithy-rs"
 
 [dependencies]
-http = "0.2.1"
-thiserror = "1"
-serde_json = "1"
-regex = "1.5"
 # Not perfect for our needs, but good for now
 assert-json-diff = "1.1"
-
+http = "0.2.1"
 pretty_assertions = "1.3"
+regex = "1.5"
 roxmltree = "0.14.1"
+serde_json = "1"
+thiserror = "1.0.40"
 
 
 [package.metadata.docs.rs]
diff --git a/rust-runtime/aws-smithy-types/Cargo.toml b/rust-runtime/aws-smithy-types/Cargo.toml
@@ -16,21 +16,21 @@ serde-serialize = []
 serde-deserialize = []
 
 [dependencies]
+base64-simd = "0.8"
 itoa = "1.0.0"
 num-integer = "0.1.44"
 ryu = "1.0.5"
 time = { version = "0.3.4", features = ["parsing"] }
-base64-simd = "0.8"
 
 [dev-dependencies]
 base64 = "0.13.0"
+ciborium = { version = "0.2.1" }
+criterion = "0.4"
 lazy_static = "1.4"
 proptest = "1"
+rand = "0.8.4"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-criterion = "0.4"
-rand = "0.8.4"
-ciborium = { version = "0.2.1" }
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/tools/ci-build/publisher/Cargo.toml b/tools/ci-build/publisher/Cargo.toml
@@ -30,12 +30,12 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha256 = "1"
 smithy-rs-tool-common = { version = "0.1", path = "../smithy-rs-tool-common", features = ["async-shell"] }
+tempfile = "3.3.0"
 thiserror = "1.0"
 tokio = { version = "1.20.1", features = ["full"] }
 toml = { version = "0.5.8", features = ["preserve_order"] }
 tracing = "0.1.29"
 tracing-subscriber = { version = "0.3.15", features = ["env-filter"] }
-tempfile = "3.3.0"
 
 [dev-dependencies]
 pretty_assertions = "1.3"
diff --git a/tools/ci-build/sdk-lints/Cargo.toml b/tools/ci-build/sdk-lints/Cargo.toml
@@ -14,7 +14,7 @@ opt-level = 0
 anyhow = "1"
 cargo_toml = "0.10.1"
 clap = { version = "~3.1.18", features = ["derive"]}
-toml = "0.5.8"
-serde = { version = "1", features = ["derive"]}
 lazy_static = "1.4.0"
+serde = { version = "1", features = ["derive"]}
 smithy-rs-tool-common = { path = "../smithy-rs-tool-common" }
+toml = "0.5.8"
diff --git a/tools/ci-build/sdk-versioner/Cargo.toml b/tools/ci-build/sdk-versioner/Cargo.toml
@@ -15,8 +15,8 @@ opt-level = 0
 [dependencies]
 anyhow = "1.0"
 clap = { version = "~3.1.18", features = ["derive"] }
-toml_edit = { version = "0.19.6" }
 smithy-rs-tool-common = { version = "0.1", path = "../smithy-rs-tool-common" }
+toml_edit = { version = "0.19.6" }
 
 [dev-dependencies]
 pretty_assertions = "1.3"
diff --git a/tools/echo-server/Cargo.toml b/tools/echo-server/Cargo.toml
