Swift: Bump the swift-dependencies group with 3 updates

[dependabot]

Bumps the swift-dependencies group with 3 updates: github.com/apple/swift-nio, github.com/vapor/vapor and github.com/vapor/console-kit.

Updates github.com/apple/swift-nio from 2.75.0 to 2.76.0

Release notes

Sourced from github.com/apple/swift-nio's releases.

SwiftNIO 2.76.0

What's Changed

SemVer Minor

• Drop support for Swift 5.8 by @​FranzBusch in apple/swift-nio#2924
• Fix EventLoopFuture and EventLoopPromise under strict concurrency checking by @​FranzBusch in apple/swift-nio#2654
• Provide APIs to read file into more data types by @​clintonpi in apple/swift-nio#2923

SemVer Patch

• Adopt NIOThrowingAsyncSequenceProducer 2nd try by @​rnro in apple/swift-nio#2917
• Add future wait benchmark to catch memory leaks by @​rnro in apple/swift-nio#2931
• Fix Windows build break. by @​jeffdav in apple/swift-nio#2935
• Fix withConnectedSocket in async mode by @​Lukasa in apple/swift-nio#2937
• Fix Windows build for NIOCore. by @​jeffdav in apple/swift-nio#2938
• NIOPosix on Darwin: inherit main thread QoS by @​weissi in apple/swift-nio#2944

Other Changes

• [CI] Migrate to Swift 6.0 and drop 5.8 by @​FranzBusch in apple/swift-nio#2920
• Disable semver label check locally by @​rnro in apple/swift-nio#2928
• [CI] Fix python lint by @​FranzBusch in apple/swift-nio#2925
• clean up 5.8 thresholds by @​rnro in apple/swift-nio#2932
• [CI] Add Windows matrix build by @​FranzBusch in apple/swift-nio#2929
• [CI] Small adjustments to the Windows actions by @​FranzBusch in apple/swift-nio#2939
• [CI] Enable benchmarks & cxx Windows CI by @​FranzBusch in apple/swift-nio#2940
• [CI] Fix the Windows 6.0 check name by @​FranzBusch in apple/swift-nio#2941

New Contributors

• @​jeffdav made their first contribution in apple/swift-nio#2935

Full Changelog: apple/swift-nio@2.75.0...2.76.0

Commits

• f6230d3 NIOPosix on Darwin: inherit main thread QoS (#2944)
• be823e6 [CI] Fix the Windows 6.0 check name (#2941)
• 6d24ab0 [CI] Enable benchmarks & cxx Windows CI (#2940)
• ecbb5ea [CI] Small adjustments to the Windows actions (#2939)
• ff6dea9 [CI] Add Windows matrix build (#2929)
• 8666af5 Fix Windows build for NIOCore. (#2938)
• 49cd78b Fix withConnectedSocket in async mode (#2937)
• cc1c57c Provide APIs to read file into more data types (#2923)
• 8b66b22 Fix Windows build break. (#2935)
• ff98c93 Fix EventLoopFuture and EventLoopPromise under strict concurrency checkin...
• Additional commits viewable in compare view

Updates github.com/vapor/vapor from 4.106.0 to 4.106.1

Release notes

Sourced from github.com/vapor/vapor's releases.

4.106.1 - Omit ACAO header instead of empty value

What's Changed

Omit ACAO header instead of empty value by @​grahamburgsma in #3243

For context, Vapor currently sends an empty Access-Control-Allow-Origin (ACAO) header when the origin does not match or is set to none.

We recently had a pentest done against our Vapor server and the tester reported the following regarding the empty ACAO header:

When the header is empty, browsers might reject the request without detailed error messages, making it harder for developers to debug or even realize there is a problem. This lack of transparency can lead to extended periods of vulnerability before the issue is discovered.

Looking at some other sources as well, an empty header doesn’t appear to be a valid value and so could result in unexpected behaviour.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#the_http_response_headers https://fetch.spec.whatwg.org/#http-access-control-allow-origin

This patch was released by @​0xTim

Full Changelog: vapor/vapor@4.106.0...4.106.1

Commits

• 4d3bc6c Omit ACAO header instead of empty value (#3243)
• 02e8b30 Fix flaky test (#3246)
• 1310c6f Test MUSL and iOS compilation (#3241)
• See full diff in compare view

Updates github.com/vapor/console-kit from 4.15.0 to 4.15.1

Commits

• 966d89a Fix Windows build break in Terminal. (#205)
• a44d671 Add Windows unit tests to CI workflow. (#206)
• 1490e7b Fix DocC Links (#204)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions