[renovate]

This PR contains the following updates:

Package	Type	Update	Change
cargo:cargo-nextest	tools	patch	0.9.149 → 0.9.150

---

Release Notes

nextest-rs/nextest (cargo:cargo-nextest)

v0.9.150: cargo-nextest 0.9.150

Compare Source

Security

• Fixed GHSA-vc25-qg58-w57c: with the experimental run recording feature enabled, cargo nextest run --rerun with a malicious portable recording could run arbitrary code during the build.

  Reruns inherit the original run's build scope (defined as the combination of package, target, and feature selection options). Nextest versions 0.9.125 through 0.9.149 recorded the build scope as raw Cargo arguments, and passed them to Cargo unchanged. A crafted recording could therefore add any Cargo option, such as a --config that sets build.rustc-wrapper. That code ran as the invoking user during the build, before any tests started, even with a warm build cache.

  Nextest now records the build scope as structured data, and passes each value to Cargo joined to its flag (for example, --package=<value>), so a recording can no longer add other Cargo options.

  To ensure that everyone working on your repository uses a fixed version, set the minimum required version in .config/nextest.toml:

  nextest-version = "0.9.150"

Added

• cargo nextest archive has a new --zstd-long option, which enables Zstandard long-distance matching with a 128 MiB window. For large archives, this can significantly improve the compression ratio at lower compression levels. Extracting these archives needs no extra options. (#​3664)

  Thanks nsextonTT for your first contribution!

Changed

• Run recording now uses store format 3.0. As part of the security fix above:

  • Recordings made by nextest 0.9.149 and earlier, including portable recordings, can no longer be replayed or rerun. Nextest still lists and prunes them, and recommends discarding them.
  • Once this version of nextest writes to a record store, nextest 0.9.149 and earlier can still read the store but can no longer write to it. These versions disable recording with a warning, and pruning fails.

  For more details, see recorded run versioning.

• If cargo nextest run --rerun can't read the parent run, the error now names the run (and the portable recording, if any), and suggests starting a new rerun chain.

Fixed

• Nextest now passes Cargo options to Cargo as single --flag=value arguments. Previously, an option value that started with -, such as --target-dir=-build, was passed as a separate argument and could be misinterpreted by Cargo as a flag.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.