chore(deps): bump the major group with 2 updates

[dependabot]

Bumps the major group with 2 updates: tower-http and rmcp.

Updates tower-http from 0.6.11 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Updates rmcp from 1.8.0 to 2.2.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v2.2.0

Added

• [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

• fill missing fully qualified syntax in prompt_handler macros (#866)

Other

• align README examples with v2 model API (#928)

rmcp-v2.2.0

Added

• reject auth servers lacking S256 PKCE support (#955)

Fixed

• pass client conformance suite (#960)
• don't respond to cancelled requests (#957)
• fail orphaned streamable HTTP responses on reinit (#914)
• address 2025-11-25 conformance audit findings (#951)

rmcp-macros-v2.1.0

Added

• [breaking] align model types with MCP 2025-11-25 spec (#927)

Fixed

• fill missing fully qualified syntax in prompt_handler macros (#866)

Other

• align README examples with v2 model API (#928)

rmcp-v2.1.0

Added

• add SEP-414 trace context meta accessors (#910)
• add SEP-2575 meta helpers (#942)

Fixed

• (transport) make AsyncRwTransport::receive cancel-safe (#941) (#947)
• (auth) preserve refresh_token when refresh response omits it (#949)
• block redirect header leaks (#936)
• don't respond to unparsable messages (#940)

... (truncated)

Commits

• 5195776 chore: release v2.2.0 (#953)
• 6dd7b85 chore(deps): update p256 requirement from 0.13 to 0.14 (#959)
• a037935 fix: pass client conformance suite (#960)
• dbda50c fix: don't respond to cancelled requests (#957)
• 45f2f72 fix: fail orphaned streamable HTTP responses on reinit (#914)
• 95490fa feat: reject auth servers lacking S256 PKCE support (#955)
• bdf0c32 fix: address 2025-11-25 conformance audit findings (#951)
• 8e44af4 chore: release v2.1.0 (#950)
• 4833ec7 fix(transport): make AsyncRwTransport::receive cancel-safe (#941) (#947)
• 5837e22 fix(auth): preserve refresh_token when refresh response omits it (#949)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: deps. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.