Update tower-sessions requirement from 0.11.1 to 0.12.0

[dependabot]

Updates the requirements on tower-sessions to permit the latest version.

Release notes

Sourced from tower-sessions's releases.

v0.12.0

What's Changed

Important Security Update

• Id collision mitigation. #181

This release introduces a new method, create, to the SessionStore trait to distinguish between creating a new session and updating an existing one. This distinction is crucial for mitigating the potential for session ID collisions.

Although the probability of session ID collisions is statistically low, given that IDs are composed of securely-random i128 values, such collisions pose a significant security risk. A store that does not differentiate between session creation and updates could inadvertently allow an existing session to be accessed, leading to potential session takeovers.

Session store authors are strongly encouraged to update and implement create such that potential ID collisions are handled, either by generating a new ID or returning an error.

As a transitional measure, we have provided a default implementation of create that wraps the existing save method. However, this default is not immune to the original issue. Therefore, it is imperative that stores override the create method with an implementation that adheres to the required uniqueness semantics, thereby effectively mitigating the risk of session ID collisions.

Thanks to @​wt for discovering this issue and working through our design to address! 🙇

Full Changelog: maxcountryman/tower-sessions@v0.11.1...v0.12.0

Changelog

Sourced from tower-sessions's changelog.

0.12.0

Important Security Update

• Id collision mitigation. #181

This release introduces a new method, create, to the SessionStore trait to distinguish between creating a new session and updating an existing one. This distinction is crucial for mitigating the potential for session ID collisions.

Although the probability of session ID collisions is statistically low, given that IDs are composed of securely-random i128 values, such collisions pose a significant security risk. A store that does not differentiate between session creation and updates could inadvertently allow an existing session to be accessed, leading to potential session takeovers.

Session store authors are strongly encouraged to update and implement create such that potential ID collisions are handled, either by generating a new ID or returning an error.

As a transitional measure, we have provided a default implementation of create that wraps the existing save method. However, this default is not immune to the original issue. Therefore, it is imperative that stores override the create method with an implementation that adheres to the required uniqueness semantics, thereby effectively mitigating the risk of session ID collisions.

0.11.1

• Ensure session.set_expiry updates record. #175
• Provide signed and private features, enabling signing and encryption respectively. #157

0.11.0

• Uses slices when encoding and decoding Id. #159

Breaking Changes

• Removes IdError type in favor of using base64::DecodeSliceError. #159
• Provides the same changes as 0.10.4, without breaking SemVer.
• Updates base64 to 0.22.0.

0.10.4 Yanked: SemVer breaking

• Revert introduction of lifetime parameter; use static lifetime directly

This ensures that the changes introduced in 0.10.3 do not break SemVer.

Please note that 0.10.3 has been yanked in accordance with cargo guidelines.

0.10.3 Yanked: SemVer breaking

• Improve session config allocation footprint #158

0.10.2

• Ensure "Path" and "Domain" are set on removal cookie #154

0.10.1

• Ensure Expires: Session #149

0.10.0

... (truncated)

Commits

• 6ad8933 mark 0.12.0
• 95798cd Id collision mitigation (#181)
• bc0d0f9 use mapped mutex guard (#177)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like tower-sessions is up-to-date now, so this is no longer needed.