devel/cargo-nextest 0.9.145 NetBSD

Security cargo nextest self update no longer trusts the eMudhra intermediate certificate authorities whose private keys were disclosed on 2026-10-20. Previously, an attacker able to intercept network traffic could have used these keys to make cargo nextest self update download and install a malicious binary. Nextest's self-updater uses a bundled set of root certificates, so operating system and browser updates do not protect it. This release updates webpki-roots to 1.0.10 and rustls-webpki to 0.103.16, both of which distrust the compromised certificates. Running tests does not involve network access and is not affected. Builds without the self-update feature, including most distribution packages, are also not affected. …

0.9.148 Changed For setup scripts, slow-timeout no longer accepts on-timeout = "pass", and nextest now reports a configuration error if it is specified. A setup script that times out always fails the run. Previously, this setting was accepted but handled inconsistently: the timed-out script was counted as a failure, but the run was not cancelled. Internal dependency updates: guppy updated to 0.19.1, and target-spec updated to 3.7.0, updating built-in targets to Rust 1.98. Fixed Stress runs now exit with a non-zero code if any iteration failed. Previously, with fail-fast disabled, the exit code reflected only the last iteration, so a stress run with failures in earlier iterations exited with code 0 if the last iteration passed. …

0.9.146 Updated chacha20 and der to non-yanked versions.

(leaf pkg) Changed Configuration diagnostics now name the file each setting came from. For example, cargo nextest show-config version shows which file specified the nextest-version requirement, and cargo nextest show-config test-groups shows which file each override was defined in. For now, this is most useful when tool-specific config files are in play, but upcoming work to support local configuration files also benefits from this. (#3580, #3584) …

0.9.144 Changed Failures while setting up run recording (for example, a store directory that cannot be created) are now always reported as warnings, and the test run continues without recording. Previously, only a store format version mismatch was treated as a warning, and other setup failures aborted the run. This makes setup consistent with recording finalization, which already never fails a run. The "continue rerunning" hint printed when a rerun has outstanding tests is now only shown when the rerun was itself recorded, since cargo nextest run -R latest can only continue the chain in that case. Fixed …