Update tower-sessions-core requirement from 0.12.1 to 0.13.0

[dependabot]

Updates the requirements on tower-sessions-core to permit the latest version.

Release notes

Sourced from tower-sessions-core's releases.

v0.13.0

What's Changed

• Add option to always save session by @​0rzech in maxcountryman/tower-sessions#216

New Contributors

• @​0rzech made their first contribution in maxcountryman/tower-sessions#216

Full Changelog: maxcountryman/tower-sessions@v0.12.3...v0.13.0

Changelog

Sourced from tower-sessions-core's changelog.

0.13.0

• Add option to always save session. #216

0.12.3

• Ensure continuously_delete_expired waits for initial run. #208

0.12.2

• Ensure set_expiry mutates Max-Age. #191

This addresses a bug where using set_expiry on a session with no initial expiry time would not add the Max-age attribute to the cookie leading to an inconsitency between the cookie and the database.

0.12.1

Important Security Update

• Ensure ID cycling invokes create. #188

Because cycling the session ID involves creating a new ID, this must follow the same semantics as normal session creation. Therefore prior to this fix session ID collision could occur through this vector.

0.12.0

Important Security Update

• Id collision mitigation. #181

This release introduces a new method, create, to the SessionStore trait to distinguish between creating a new session and updating an existing one. This distinction is crucial for mitigating the potential for session ID collisions.

Although the probability of session ID collisions is statistically low, given that IDs are composed of securely-random i128 values, such collisions pose a significant security risk. A store that does not differentiate between session creation and updates could inadvertently allow an existing session to be accessed, leading to potential session takeovers.

Session store authors are strongly encouraged to update and implement create such that potential ID collisions are handled, either by generating a new ID or returning an error.

As a transitional measure, we have provided a default implementation of create that wraps the existing save method. However, this default is not immune to the original issue. Therefore, it is imperative that stores override the create method with an implementation that adheres to the required uniqueness semantics, thereby effectively mitigating the risk of session ID collisions.

0.11.1

• Ensure session.set_expiry updates record. #175
• Provide signed and private features, enabling signing and encryption respectively. #157

0.11.0

• Uses slices when encoding and decoding Id. #159

Breaking Changes

• Removes IdError type in favor of using base64::DecodeSliceError. #159
• Provides the same changes as 0.10.4, without breaking SemVer.
• Updates base64 to 0.22.0.

... (truncated)

Commits

• 66983f5 mark 0.13.0
• fe33b77 Add option to always save session (#216)
• 02e4c55 bump tower (#214)
• c6ee4e1 mark 0.12.3
• 31ea841 fix(tower-sessions-core): continuously_delete_expired ran delete_expired twic...
• 05517aa Update mockall requirement from 0.12.1 to 0.13.0 (#205)
• a07bb7a bump reqwest
• 5f77b7a mark 0.12.2
• ea29bbc ensure session.set_expiry adds or removes the Max-Age attribute to or from ...
• d7b7e13 move session state into inner struct (#189)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like tower-sessions-core is up-to-date now, so this is no longer needed.