chore(deps): Bump http-body-util from 0.1.3 to 0.1.4

[dependabot]

Bumps http-body-util from 0.1.3 to 0.1.4.

Release notes

Sourced from http-body-util's releases.

http-body-util-v0.1.4

What's Changed

• Add Fused body combinator that always returns None once completed.
• Add BodyExt::into_stream() to convert a body into a Stream.
• Add Full::into_inner() to get the full Buf.
• Add InspectFrame and InspectErr combinators.

Commits

• 7685047 http-body-util v0.1.4
• 3396328 http-body v1.1.0
• 2fb78de chore: bump license year (#170)
• b16554b chore(ci): bump checkout to v7
• c0c53ca chore(ci): use msrv aware update for msrv job
• 5ed15d2 tests: fix clippy::double_parens
• c8cb37f Derive Copy trait to SizeHint struct (#164)
• 915d6d5 feat(util): add InspectErr, InspectFrame combinators (#161)
• 0fc0a94 docs: fix broken intradoc links (#162)
• 5a849d4 chore: add FUNDING.yml
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​http-body-util@​0.1.4

View full report

[msalvatti]

@dependabot rebase

[msalvatti]

Status: blocked on the supply-chain policy, not on anything wrong with this bump.

cargo deny and cargo audit pass here — no known advisory, no license or ban issue. The only failing step is cargo vet, and it is failing because the new version has no audit yet from any source this repository imports.

#117 has landed and separates the two causes that were tangled together. It refreshed supply-chain/imports.lock, which was five dependencies behind and was making every PR fail for reasons that had nothing to do with the PR, and it pinned CI to cargo vet --locked so the gate answers from what the repository recorded rather than from whatever upstream published that minute. What is left here is genuinely this bump:

$ cargo vet          # with the imports refreshed
Vetting Failed!

(the exact crate is listed in the job log)

Three ways forward, and the right one is a call for the maintainer rather than something to route around:

1. Wait. This is what just happened for anyhow, serde_json, syn and thiserror: Mozilla, Bytecode Alliance and Google published audits between 18 and 22 July, and the versions became vetted with no decision from us. There is no advisory here, so waiting costs nothing.
2. Audit the diff with cargo vet diff, and record it with cargo vet certify. Honest, and real work — the redis 1.3 → 1.5 diff alone is 2377 insertions.
3. Exempt it — record that we accept the version without auditing it. Fastest, and the only one that puts a trust claim in the repository that nobody earned.

Leaving this open rather than forcing it through: a gate that gets bypassed whenever it is inconvenient is not a gate.