Skip to content

chore(deps): update rust crate hickory-resolver to 0.26#328

Merged
l50 merged 3 commits into
mainfrom
renovate/hickory-dns-monorepo
May 17, 2026
Merged

chore(deps): update rust crate hickory-resolver to 0.26#328
l50 merged 3 commits into
mainfrom
renovate/hickory-dns-monorepo

Conversation

@dreadnode-renovate-bot
Copy link
Copy Markdown
Contributor

@dreadnode-renovate-bot dreadnode-renovate-bot Bot commented May 17, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
hickory-resolver (source) workspace.dependencies minor 0.24 → 0.26

Release Notes

hickory-dns/hickory-dns (hickory-resolver)

v0.26.1

Compare Source

This point release for the 0.26 release series brings in several bug fixes, and no user-facing changes. Two security reports are addressed:
RUSTSEC-2026-0120 and RUSTSEC-2026-0119.

What's Changed

Full Changelog: hickory-dns/hickory-dns@v0.26.0...v0.26.1

v0.26.0: 0.26.0

Compare Source

13 months after the release of 0.25.0, we finally have a bigger feature release of Hickory DNS, the suite of DNS libraries and authoritative/recursive name servers written in pure Rust. A lot of work has gone into this release, so we wanted to take a moment to release this before we continue work on deploying the Hickory DNS recursive resolver at Let's Encrypt (and did you see that Hickory is being used in some of Google's Pixel devices?). Because of the ongoing work, we expect that 0.27.0 might happen quite a bit sooner than in 13 months from now.

These release notes describe a number of high-level improvements as well as API changes that are likely to break a larger fraction of our downstream users. Feedback (both on these notes and the release itself) is always welcome in our issue tracker or via our Discord server.

Most of the following notes are broken up by specific components: the server binary and our library crates. However, for this release we've made several changes to the structure of our crates itself:

  • Network protocol support has moved out of the hickory-proto crate, into a new hickory-net crate (#​3394); this allows the hickory-proto crate to cleanly focus on message encoding and decoding.
  • The hickory-client crate has been subsumed into hickory-net, in the client module (#​3366). No future releases of the hickory-client crate are expected.
  • The hickory-recursor crate has been merged into hickory-resolver (#​3370), guarded by a recursor feature which must be enabled explicitly. The recursor implementation was already tightly coupled to the resolver internals, so keeping it separate didn't really make sense.

Additionally, substantial cross-crate changes have been made to improve our error handling:

hickory-dns (the server binary)

hickory-server (the library API)

hickory-resolver

We made many improvements to improve correctness and efficiency of both the recursive resolver and the "stub" resolver. In addition, we want to highlight the following changes:

hickory-net

We made substantial improvements to DNSSEC validation and our handling of potentially spoofing messages.

hickory-proto

Details

For more details, review the detailed release notes for our pre-releases:

and these final PRs merged after beta 4:

Thanks

Finally, we want to thank everyone who contributed to this release: @​bryanlarsen, @​billf, @​hargut, @​ibigbug, @​xi0, @​steffengy, @​james7132, @​Thomasdezeeuw, @​Kriskras99, @​mispp, @​conradludgate, @​nabijaczleweli, @​musicinmybrain, @​msrd0, @​jmwample, @​LAGonauta, @​tisonkun, @​provokateurin, @​lemon-sh, @​thomas-zahner, @​jpds, @​lpraneis, @​zachsmith1, @​jackboykin, @​ZnqbuZ, @​Jeidnx, @​kn0sys, @​matheus23, @​benesch, @​roblabla and of course our maintainers @​cpu, @​divergentdave, @​marcus0x62 and @​djc.

v0.25.2: 0.25.2

Compare Source

What's Changed

v0.25.1: 0.25.1

Compare Source

This is a small patch release to address errors that prevented publication of version 0.25.0 of some crates.

What's Changed

Full Changelog: hickory-dns/hickory-dns@v0.25.0...v0.25.1

v0.25.0: 0.25.0

Compare Source

0.25.0 represents a large release for the Hickory DNS project. Over 14 months since 0.24.0, we've added two new maintainers, divergentdave and marcus0x62, and have addressed many limitations. A team from Ferrous Systems shored up our support for DNSSEC, and we addressed a number of findings from our first security audit.

Breaking changes

This is not an exhaustive list of changes, but here are some of the most impactful breaking changes in this release:

  • Configuration for the Hickory DNS server crate has been reworked substantially to be more robust and secure. Most of the code related to the server binary has been moved out of the hickory-server library and into the hickory-dns binary crate.
  • Support for TLS using native-tls or OpenSSL has been removed. We now only provide first-party support for rustls (0.23, for DNS over TLS, HTTP/2, QUIC and HTTP/3). We support ring or aws-lc-rs for cryptographic operations both for DNSSEC and TLS. The dns-over-rustls,dns-over-native-tls, dns-over-openssl, dns-over-https-rustls, dns-over-https, dns-over-quic and dns-over-h3 features have been removed in favor of a set of {tls,https,quic,h3}-{aws-lc-rs,ring} features across our library crates.
  • The synchronous API in the resolver and client crates, which previously provided a thin partial wrapper over the asynchronous API, has been removed. Downstream users will have to migrate to the asynchronous API.
  • Support for the async-std runtime has been removed following the deprecation of the async-std crate by upstream (see their README). The async-std-resolver crate will no longer be updated.
  • The DNSSEC API was reworked to extend coverage to the recursor, add support for NSEC3, and make the API more ergonomic and harder to misuse.
  • Moved the RuntimeProvider API into the proto crate and use it consistently across the project.
  • Name values are now rooted by default in many places, and more consistently maintain their fqdn status.
  • Error types are now exposed directly in the crate roots.
  • Top-level TLS configuration in the resolver crate has moved to the ResolverOpts type. Specific NameServerConfigs should implicitly set up the ALPN protocol appropriate for the DNS protocol.
  • The ResolverOptions fields authentic_data and shuffle_dns_servers were removed. The former field didn't do anything; and should be covered by new DNSSEC API. shuffle_dns_servers functionality has been subsumed into the server_ordering_strategy field.
  • The use of rustls-native-certs via the native-certs feature was replaced with rustls-platform-verifier.
  • The tokio-runtime feature was renamed to tokio.
  • The serde-config feature was renamed to serde.
  • Serializations (and what the new release can deserialize) has changed; data serialized by 0.24 may not deserialize correctly on 0.25, and vice versa.

Please don't hesitate to file an issue or ask on our Discord server if you have issues upgrading.

Detailed changes since alpha.5

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@dreadnode-renovate-bot
chore(deps): update rust crate hickory-resolver to 0.26
ecf00ec 
| datasource | package          | from   | to     |
| ---------- | ---------------- | ------ | ------ |
| crate      | hickory-resolver | 0.24.4 | 0.26.1 |
@dreadnode-renovate-bot dreadnode-renovate-bot Bot requested a review from l50 as a code owner May 17, 2026 00:31
@dreadnode-renovate-bot
Copy link
Copy Markdown
Contributor Author

dreadnode-renovate-bot Bot commented May 17, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock
Command failed: cargo update --config net.git-fetch-with-cli=true --manifest-path Cargo.toml --workspace
    Updating crates.io index
error: failed to select a version for `hickory-resolver`.
    ... required by package `ares-cli v0.2.0 (/tmp/renovate/repos/github/dreadnode/ares/ares-cli)`
versions that meet the requirements `^0.26` are: 0.26.1, 0.26.0

package `ares-cli` depends on `hickory-resolver` with feature `tokio-runtime` but `hickory-resolver` does not have that feature.
 available features: __dnssec, __h3, __https, __quic, __tls, default, dnssec-aws-lc-rs, dnssec-ring, h3-aws-lc-rs, h3-ring, https-aws-lc-rs, https-ring, metrics, quic-aws-lc-rs, quic-ring, recursor, rustls-platform-verifier, serde, system-config, tls-aws-lc-rs, tls-ring, tokio, toml, webpki-roots


failed to select a version for `hickory-resolver` which could resolve this conflict

@l50
Copy link
Copy Markdown
Contributor

l50 commented May 17, 2026

@dreadnode-renovate-bot rebase!

l50 added 2 commits May 16, 2026 21:05
@l50
Merge branch 'main' into renovate/hickory-dns-monorepo
f80a903
@l50
refactor: update DNS resolver usage and dependencies for hickory 0.26
a817b32 
**Changed:**

- Switched DNS resolver implementation from `TokioAsyncResolver` to `TokioResolver`
  in the domain probe logic to match hickory-resolver 0.26 API updates
- Updated error handling to use new error types (`DnsError`, `NetError`) and methods
  consistent with hickory 0.26
- Adjusted code to build the resolver with the new builder pattern and runtime provider
- Modified feature flags in Cargo.toml for hickory-resolver to use `tokio` instead of
  `tokio-runtime` in accordance with upstream changes
- Updated Cargo.lock to:
  - Remove deprecated/unused dependencies (enum-as-inner, lru-cache, linked-hash-map)
  - Add new transitive dependencies (moka, crossbeam-channel, prefix-trie, etc.)
  - Consolidate and update hickory-resolver, hickory-proto, and hickory-net to 0.26.x
  - Standardize on `thiserror` 2.x and remove explicit version qualifiers from dependencies
  - Add new system-configuration dependencies required by hickory-resolver

**Removed:**

- Removed legacy resolver construction patterns and error kinds no longer present in
  hickory 0.26 from the DNS SRV probe implementation
- Eliminated references to now-removed dependency versions in Cargo.lock (e.g.,
  "thiserror 1.0.69") to align with the updated dependency graph
@codecov
Copy link
Copy Markdown

codecov Bot commented May 17, 2026

Codecov Report

❌ Patch coverage is 0% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.85%. Comparing base (9b262a7) to head (a817b32).
⚠️ Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
...cli/src/orchestrator/state/domain_probe/dns_srv.rs 0.00% 9 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #328      +/-   ##
==========================================
- Coverage   78.85%   78.85%   -0.01%     
==========================================
  Files         438      438              
  Lines      125609   125614       +5     
==========================================
  Hits        99050    99050              
- Misses      26559    26564       +5
Files with missing lines Coverage Δ
...cli/src/orchestrator/state/domain_probe/dns_srv.rs 0.00% <0.00%> (ø)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@l50 l50 merged commit bedcd99 into main May 17, 2026
12 checks passed
@l50 l50 deleted the renovate/hickory-dns-monorepo branch May 17, 2026 15:37
@dreadnode-renovate-bot
Copy link
Copy Markdown
Contributor Author

dreadnode-renovate-bot Bot commented May 17, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@l50 l50 Awaiting requested review from l50 l50 is a code owner

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@l50