Bump prost from 0.5.0 to 0.6.1

[dependabot]

Bumps prost from 0.5.0 to 0.6.1.

Release notes

Sourced from prost's releases.

v0.6.1

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

prost 0.6.1 fixes a bug in which decoding untrusted input could overflow the stack. The bug was reported by @​dbrgn in #267 (with an attached repro!), and fixed by @​danburkert. The fix extended the same recursion limits introduced in #186 by @​nrc (released in 0.6.0) to the logic which skips unknown fields during decoding, which became recursive when support was added for decoding groups (also released in 0.6.0). The 0.6.0 release of the prost crates has been yanked from crates.io.

Additionally, @​koushiro updated the private dependencies of all prost crates to the latest versions.

Many thanks to the generous contributors who have helped out since 0.6.0:

• Dan Burkert
• Danilo Bargen
• Qinxuan Chen

v0.6.0

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

prost 0.6.0 includes breaking changes:

• The minimum-supported Rust version (MSRV) is now 1.39.0.
• The bytes public dependency version is now 0.5.
• The prost-types Timestamp and Duration types now impl TryFrom for their std::time equivalents. The old inherent try_from methods have been removed.
• Deeply nested messages now fail decoding with an error, instead of potentially resulting in a stack overflow. The limit is set to a nesting depth of 100, and the limit can be disabled using a new no-recursion-limit Cargo feature.

As well as many new (non-breaking) features and improvements:

• @​hanya added support for protobuf Group types.
• @​danburkert improved the benchmark suite, including adding support for the full set of upstream message encoding and decoding benchmarks.
• @​nrc implemented a series of micro-optimizations which result in faster message encoding and decoding.
• @​dunmatt improved the method docs on generated types.
• @​lukaslueg removed the dependency on byteorder.
• @​parasyte added the ServiceGenerator::finalize_package, which is useful for advanced service generators.
• @​joelgallant improved the error message that occurs when attempting to compile .proto files without a package specifier.
• @​LucioFranco removed the direct dependency of generated types on the bytes crate, which means applications which use prost code generation are no longer required to declare a bytes dependency.
• @​ErichDonGubler and @​hobofan bumped the syn, quote, and proc-macro2 to stable versions.
• @​Timmmm improved prost-build so that it no longer writes .rs files when they are unchanged, which improves working with tools like cargo watch in codebases with prost code generation.
• @​Hirevo replaced usage of failure with anyhow.
• @​danburkert bumped the packaged protoc version to 3.11.2.

... (truncated)

Commits

• 9ec3614 release 0.6.1
• 04091d3 apply recursion limit when skipping fields
• 221ebbf Update outdated dependencies
• a8ed170 publish script bugfixes
• 4b1914f release 0.6.0
• 6cc4702 Add prepare-release.sh, publish-release.sh scripts
• 420e032 Reintroduce unsafe in encoding::string::merge
• 51ed67d remove deprecated error description methods
• 59c11ca Bump packaged Protobuf to 3.11.2 (#263)
• 7e0070f More fallible Try to TryFrom conversions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.