Skip to content

deps: bump the rust-dependencies group across 1 directory with 35 updates - #1035

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-0fbb4b07b9
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/rust-dependencies-0fbb4b07b9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the rust-dependencies group with 35 updates in the / directory:

Package From To
serde_json 1.0.150 1.0.151
thiserror 2.0.18 2.0.20
serde 1.0.228 1.0.229
futures 0.3.32 0.3.34
tokio-stream 0.1.18 0.1.19
tokio 1.52.3 1.53.1
anyhow 1.0.103 1.0.104
tower-http 0.7.0 0.7.1
uuid 1.23.3 1.26.1
bytes 1.12.0 1.12.1
http-body-util 0.1.3 0.1.5
base64 0.22.1 0.23.1
indexmap 2.14.0 2.14.2
moka 0.12.15 0.12.16
bhttp 0.7.2 0.8.0
futures-util 0.3.32 0.3.34
tokio-util 0.7.18 0.7.19
axum-test 20.1.0 21.0.0
deadpool-postgres 0.14.1 0.14.2
ed25519-dalek 2.2.0 3.0.0
rand 0.10.1 0.10.2
async-trait 0.1.89 0.1.92
serial_test 3.5.0 4.0.1
rustls 0.23.41 0.23.44
aes-gcm 0.10.3 0.11.1
regex 1.12.4 1.13.1
futures-core 0.3.32 0.3.34
http 1.4.1 1.5.0
chacha20poly1305 0.10.1 0.11.0
flate2 1.1.9 1.1.10
getrandom 0.4.1 0.4.3
rmcp 1.8.0 3.3.0
jsonwebtoken 10.4.0 11.0.0
dcap-qvl 0.5.2 0.5.3
mockall 0.14.0 0.15.0

Updates serde_json from 1.0.150 to 1.0.151

Release notes

Sourced from serde_json's releases.

v1.0.151

Commits
  • de85007 Release 1.0.151
  • 3b2b3c5 Merge pull request #1331 from WonderLawrence/rawvalue-from-string-unchecked
  • 0406d96 Debug-assert well-formedness and no-whitespace in from_string_unchecked
  • cf16f75 Add RawValue::from_string_unchecked
  • 827a315 Update actions/upload-artifact@v6 -> v7
  • cea36a5 Update actions/checkout@v6 -> v7
  • See full diff in compare view

Updates thiserror from 2.0.18 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

  • Suppress redundant_field_names clippy lint in generated code (#454)

2.0.19

  • Update to syn 3
Commits
  • b1d5db5 Release 2.0.20
  • c4c3ebd Merge pull request #454 from dtolnay/clippy
  • 2266152 Suppress redundant_field_names clippy lint
  • 2901cfd Raise minimum tested compiler to rust 1.88
  • aa9d91f Update ui tests for version 2.0.19
  • e13a785 Release 2.0.19
  • 0a0e76c Update to syn 3
  • ec42ea7 Update actions/upload-artifact@v6 -> v7
  • 4178c4a Update actions/checkout@v6 -> v7
  • 7214e0e Ignore items_after_statements pedantic clippy lint in test
  • Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

  • Update to syn 3
Commits
  • 7fc3b4c Release 1.0.229
  • 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
  • 6dec3b7 Update to syn 3
  • cfe6692 Resolve mut_mut pedantic clippy lint
  • 1023d07 Update actions/upload-artifact@v6 -> v7
  • dd682c2 Update actions/checkout@v6 -> v7
  • 5f0f18b Update ui test suite to nightly-2026-06-01
  • 63a1498 Regenerate stderr with trybuild normalization fixes
  • fa7da4a Fix unused_features warning
  • 6b1a178 Unpin CI miri toolchain
  • Additional commits viewable in compare view

Updates futures from 0.3.32 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits

Updates tokio-stream from 0.1.18 to 0.1.19

Commits
  • bc0933c chore: prepare tokio-stream v0.1.19 (#8310)
  • e3786d0 readme: remove obsolete TokioConf notices (#8311)
  • f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
  • 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
  • ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
  • 75fef53 chore: prepare Tokio v1.53.1 (#8303)
  • ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
  • eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
  • 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
  • a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
  • Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

  • signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

  • time: fix alt timer cancellation and insertion race (#8252)

Documented

  • runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

  • fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
  • metrics: add task schedule latency metric (#7986)
  • net: add SocketAddr methods to Unix sockets (#8144)

Changed

  • io: add #[inline] to IO trait impls for in-memory types (#8242)
  • net: implement UCred::pid on FreeBSD (#8086)
  • net: support Nuttx target os (#8259)
  • signal: refactor global variables on Windows (#8231)
  • sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
  • taskdump: support taskdumps on s390x (#8192)
  • time: add #[track_caller] to timeout_at() (#8077)
  • time: consolidate mutex locks on spurious poll (#8124)
  • time: defer waker clone on spurious poll (#8107)
  • time: move lazy-registration state into Sleep (#8132)
  • tracing: remove unnecessary span clone (#8126)

Fixed

  • io: do not treat zero-length reads as EOF in Chain (#8251)
  • net: use getpeereid for QNX peer credentials (#8270)
  • runtime: avoid illegal state in FastRand (#8078)
  • sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
  • taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
  • time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

Updates anyhow from 1.0.103 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

  • Update syn dev-dependency to version 3
Commits

Updates tower-http from 0.7.0 to 0.7.1

Release notes

Sourced from tower-http's releases.

tower-http-0.7.1

Added

  • fs: add ServeDir::redirect_to_trailing_slash() to serve directory indexes directly instead of first redirecting to the trailing-slash path. The redirect remains the default (#728)
  • fs: add ignore_multi_range_requests() to ServeDir and ServeFile, serving the full representation when a request asks for multiple byte ranges. The existing 416 Range Not Satisfiable response remains the default (#727)
  • request-id: the constructors and accessors on the request-id layers, services, and RequestId are now const fn, so they can be used in const context (#716)

Changed

  • fs: the minimum http-range-header requirement is now 0.4.2 (#661)

Fixed

  • behavioral change: fs: make ServeDir::try_call propagate expected filesystem I/O errors when no fallback is configured, as documented, instead of converting them to 404 Not Found responses (#718)
  • decompression: don't end the body when a data frame with no remaining bytes arrives after the decompressor reports end-of-stream. Trailers following such a frame were dropped and could not be recovered (#722)
  • decompression: return a body error when a data frame with remaining bytes arrives after the decompressor reports end-of-stream, rather than silently truncating. This regressed in 0.7.0 (#712)
  • fs: multipart range requests are now rejected before range validation, so they consistently return 416 Range Not Satisfiable with a Cannot serve multipart range requests body instead of a generic unsatisfiable-range response (#661)
  • fs: range error responses no longer carry representation headers such as Content-Type and Content-Encoding (#727)
  • set-header: SetMultipleResponseHeadersLayer and SetMultipleResponseHeader are now Clone regardless of the response body type, matching the fix applied to the request-side types in 0.7.0 (#714)

#661: tower-rs/tower-http#661 #712: tower-rs/tower-http#712 #714: tower-rs/tower-http#714 #716: tower-rs/tower-http#716 #718: tower-rs/tower-http#718 #722: tower-rs/tower-http#722 #727: tower-rs/tower-http#727 #728: tower-rs/tower-http#728

All the changes

... (truncated)

Commits
  • c941451 chore(release): prepare 0.7.1 (#729)
  • 9697702 chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (#730)
  • e2582e2 Allow ignoring multi-range requests (#727)
  • 888f7fe feat(services): configure directory redirects (#728)
  • 5ad7654 chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (#726)
  • d154adb fix: reject multipart ranges before validation (#661)
  • d9e5c8a ci: Update to cargo-check-external-types 0.5.0 (#724)
  • 90c072b Propagate ServeDir::try_call I/O errors (#718)
  • 860922e fix(decompression): don't end the body on an empty data frame (#722)
  • 8532252 docs(example)/custom future with multiple bodies (#711)
  • Additional commits viewable in compare view

Updates uuid from 1.23.3 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

v1.24.0

What's Changed

New Contributors

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

... (truncated)

Commits
  • 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
  • d4df8f0 prepare for 1.26.1 release
  • 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
  • fda00eb don't panic in overflowing Timestamp to SystemTime conversion
  • c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
  • ac065a6 Align the counter diagram
  • 34ec102 Seat the v7 counter below the version nibble
  • cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
  • 34e4f49 don't test macros under miri
  • d9e7242 update nightly used for miri
  • Additional commits viewable in compare view

Updates bytes from 1.12.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

  • Properly handle when Box::new panics (#837)
Commits

Updates http-body-util from 0.1.3 to 0.1.5

Release notes

Sourced from http-body-util's releases.

http-body-util-v0.1.4

What's Changed

  • Add Fused body combinator that always returns None once completed.
  • Add BodyExt::into_stream() to convert a body into a Stream.
  • Add Full::into_inner() to get the full Buf.
  • Add InspectFrame and InspectErr combinators.
Commits

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

  • Make the tests build again on non-SIMD architectures

0.23.0

  • Added more consts for preconfigured configs and engines
  • Make DecodeError::InvalidLastSymbol more clear by including the decoded value
  • Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
  • Update MSRV to 1.71.0
  • Add support for custom padding symbols
Commits
  • 069bf70 v0.23.1
  • 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
  • 7cffce6 Fix testing on architectures without unsafe SIMD support
  • e34f9a0 Merge pull request #308 from atouchet/com
  • e9240c9 Remove outdated comment
  • 9e9220a v0.23.0
  • 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
  • fbec5f1 Document no trailing trailing bits
  • 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
  • f10b7e2 Update deps & edition
  • Additional commits viewable in compare view

Updates indexmap from 2.14.0 to 2.14.2

Changelog

Sourced from indexmap's changelog.

2.14.2 (2026-09-04)

  • Fix item hygiene in map and set macros. Previously, an internal const CAP could shadow the same name in the caller's namespace.
  • Allow const initialization of empty indexmap_with_default! and indexset_with_default!. The hasher may also be omitted if it's inferrable.

2.14.1 (2026-08-28)

  • Simplify comparisons where Equivalent isn't needed (Q = K).
  • Unify index assertions for bounds checks.
  • Fix (or expect) clippy lints.
Commits
  • 41a8708 Merge pull request #450 from cuviper/macros
  • 0fb7b5c Release 2.14.2
  • 55e6b28 Improve the empty macro cases
  • c067355 Fix item hygiene in user macros
  • fdf7e17 Merge pull request #449 from cuviper/release-2.14.1
  • ada540e Release 2.14.1
  • af93b43 expect clippy::redundant_slicing in tests
  • c95da18 fix clippy::derivable_impls
  • 2196365 fix clippy::useless_vec (and more) in tests
  • 1c2be7b use inherent usize::MAX
  • Additional commits viewable in compare view

Updates moka from 0.12.15 to 0.12.16

Release notes

Sourced from moka's releases.

v0.12.16

Version 0.12.16

Fixed

  • Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592gh-pull-0592 by @​kim-jhyeon, reported in #590gh-issue-0590):
    • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
    • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
    • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

Changed

  • Worked around a ThreadSanitizer false positive (#602gh-pull-0602):
    • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
    • std::sync::Arc has a similar workaround.
  • Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603gh-pull-0603):
    • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
    • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.
Changelog

Sourced from moka's changelog.

Version 0.12.16

Fixed

  • Fixed a bug where cache eviction could stall permanently when the cache was configured with the non-default LRU eviction policy (EvictionPolicy::lru()) by a race between insert and remove operations on the same key (#592[gh-pull-0592] by [@​kim-jhyeon][gh-kim-jhyeon], reported in #590[gh-issue-0590]):
    • This bug was introduced in v0.12.0 and affected sync::Cache, sync::SegmentedCache and future::Cache.
    • A race between applying a write recording for an entry and concurrently removing that entry from the internal concurrent hash table could leave an orphaned node at the front of the LRU queue. Once present, no entry was ever evicted again and the cache grew unboundedly past max_capacity.
    • The same race also affected the default TinyLFU eviction policy, but with a milder symptom: each occurrence permanently leaked one phantom entry slot, causing entry_count and weighted_size to over-report and the usable capacity to shrink by one entry per occurrence. Fixed by the same change.

Changed

  • Worked around a ThreadSanitizer false positive (#602[gh-pull-0602]):
    • Replaced the standalone fence(Acquire) in the internal MiniArc's drop path with an Acquire load of the reference count, so that downstream projects can now run ThreadSanitizer on code using Moka without hitting this false positive.
    • std::sync::Arc has a similar workaround.
  • Raised the minimum version of the crossbeam-epoch crate from v0.9.18 to v0.9.20 to avoid the following advisory (#603[gh-pull-0603]):
    • [RUSTSEC-2026-0204] crossbeam-epoch: invalid pointer dereference in fmt::Pointer for Atomic and Shared
    • Moka is not affected by this advisory because it never formats these pointer types. However, raising the minimum version prevents downstream lockfiles from resolving to an affected crossbeam-epoch version via Moka.
Commits
  • a616ec1 Merge pull request #604 from moka-rs/chore/bump-v0.12.16
  • 3b140a6 Bump the version to v0.12.16
  • 51b802d Merge pull request #603 from moka-rs/bump-crossbeam-epoch-floor
  • 4f90716 Raise the minimum crossbeam-epoch version to 0.9.20
  • 08d0e04 Merge pull request #602 from moka-rs/gh600-tsan-workaround
  • 14447a7 Restructure the v0.12.16 TSan workaround CHANGELOG entry
  • 7b14c37 Avoid a TSan false positive by replacing the fence in MiniArc::drop
  • 05b37c6 Merge pull request #599 from moka-rs/gh590-deterministic-tests
  • fc31858 Replace private doc references in gh590 test comments
  • 5743592 Improve the v0.12.16 CHANGELOG entry
  • Additional commits viewable in compare view

Updates bhttp from 0.7.2 to 0.8.0

Commits
  • 84f59d0 Update version to 0.8.0
  • e18790c Merge pull request #90 from martinthomson/hpke-update
  • 7ad4f7b Fix MSRV in CI
  • e9c0c0c Add X-Wing support to that batch of changes
  • a767165 Take some of rozbb's updates
  • ab10b68 Reformat debug check
  • b97e089 Minor fixes
  • 9a988f3 Merge pull request #95 from m-kus/feat/p-256-kem
  • 4eb64ff Add support for DHKEM(P-256, HKDF-SHA256)
  • 600931b Automatically work out what the MSRV is for pre-commit
  • Additional commits viewable in compare view

Updates futures-util from 0.3.32 to 0.3.34

Release notes

Sourced from futures-util's releases.

0.3.34

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Changelog

Sourced from futures-util's changelog.

0.3.34 - 2026-08-11

  • Preserve cloned waker identity. (#3032)
  • Updato syn to 3. (#3028)

0.3.33 - 2026-07-18

  • Fix ReadLine's soundness issue regarding to exception safety. (#3020)
  • Fix unsound Send impl for IterPinRef and Iter. (#3003)
  • Fix stacked borrows violation in compat01as03 implementation. (#3012)
  • Fix memory leak in FuturesUnordered::IntoIter. (#3005)
  • Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
  • Re-export alloc::task::Wake. (#3010)
  • Update spin to 0.12. (#3014)
Commits
  • 705e6b5 Release 0.3.34
  • 616dac7 compat: Inline RawWaker clone function
  • 4176369 Inline remaining RawWaker clone functions
  • f17a895 Fix cloned FuturesUnordered waker identity
  • Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Sep 9, 2026
@dependabot
dependabot Bot had a problem deploying to Cloud API test env September 9, 2026 19:14 Failure
@ironloopai

ironloopai Bot commented Sep 9, 2026

Copy link
Copy Markdown

Review · Status

🟩 Completed

IronLoop completed the review and posted it to GitHub.

Result

Open submitted review →

Run details
  • Run: a96e178f-4471-41de-92a9-f52116af7003
  • Base: main at 1c8057f
  • Head: dependabot/cargo/rust-dependencies-0fbb4b07b9 at 85adbb1
  • Created: 2026-09-09 19:19 UTC
  • Updated: 2026-09-09 19:44 UTC

Automatic trigger · attempt 1 of 3 · completed in 25m 9s

@ironloopai ironloopai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review · Summary

Dependency updates introduce four production compilation blockers and one pinned-toolchain test blocker.

Findings: 🔴 High 4 · 🟠 Medium 1

Code-specific findings are attached to the diff.

Validation
  • Services library compilation — The updated dependencies fail with the RMCP, AES-GCM, and Ed25519 compatibility errors described above.
  • Pinned-toolchain config test compilation — Rust 1.92.0 rejects serial_test 4.0.1 because it requires Rust 1.93.1.
Review details
  • Run: a96e178f-4471-41de-92a9-f52116af7003
  • Attempts: 1

Comment thread crates/services/Cargo.toml Outdated
tokio-stream = "0.1"
# MCP protocol
rmcp = { version = "1.5", features = [
rmcp = { version = "3.2", features = [

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Port the RMCP v3 upgrade before changing the dependency

RMCP 3.2 no longer exports model::Content; this service re-exports and implements helpers for that removed type. The services library therefore fails to compile before MCP connectors can be built. Keep the 1.x dependency or migrate these helpers to the v3 content API as part of this update.

dstack-sdk = "0.1.3"
dstack-sdk-types = "0.1.2"
ed25519-dalek = { version = "2.1", features = ["rand_core"] }
ed25519-dalek = { version = "3.0", features = ["rand_core"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Align the Ed25519 RNG integration with v3

ed25519-dalek 3.0 requires its SigningKey::generate RNG to implement the 0.10 rand_core traits, but this crate still passes its direct 0.6 rand_core::OsRng. Attestation key generation fails trait checking, preventing the services library from compiling. Upgrade/migrate the RNG integration along with this major-version bump.

aws-sdk-s3 = { version = "1.134", default-features = false, features = ["sigv4a", "http-1x", "default-https-client", "rt-tokio"] }
# Encryption for file storage
aes-gcm = "0.10"
aes-gcm = "0.11"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Migrate AES-GCM nonce generation for v0.11

AES-GCM 0.11 no longer re-exports aead::OsRng, while both service and database encryption modules import it from that path. This produces unresolved-import errors and prevents compilation of the encryption code. Update the RNG imports/API or retain the 0.10 dependency.

Comment thread Cargo.lock
[[package]]
name = "deadpool-postgres"
version = "0.14.1"
version = "0.14.2"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 High · Keep the database pool on one deadpool version

The lockfile moves deadpool-postgres to 0.14.2, which depends on deadpool 0.13.1, while the database crate remains directly tied to 0.12.3. Its pool configuration and status code then mix incompatible QueueMode/Status types, and the old instance no longer has Runtime::Tokio1 enabled. Align the direct dependency and imports with 0.13, or keep deadpool-postgres at 0.14.1.

Comment thread crates/config/Cargo.toml
[dev-dependencies]
tempfile = "3.27"
serial_test = "3.4"
serial_test = "4.0"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Medium · Do not select serial_test 4.0.1 with Rust 1.92

The repository pins Rust 1.92.0, but the updated lockfile resolves serial_test and serial_test_derive 4.0.1, both of which require Rust 1.93.1. Config test compilation stops before tests run. Pin a compatible release or raise the repository toolchain version.

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

🔍 OpenCodeReview found 1 issue(s) in this PR.

  • ✅ 0 posted as inline comment(s)
  • 📝 1 posted as summary

📊 Posting Statistics:

  • ✅ Successfully posted: 0 comment(s)
  • ❌ Failed to post: 1 comment(s)

⚠️ Inline comments shown in summary


📄 crates/services/Cargo.toml (L27-L27)

⚠️ GitHub could not post this as an inline comment: Unprocessable Entity: "Line could not be resolved" - https://docs.github.com/rest/pulls/reviews#create-a-review-for-a-pull-request

ed25519-dalek was bumped from 2.x to 3.0, which depends on rand_core 0.10.0 (confirmed in Cargo.lock line 2914). However, rand_core is still pinned at "0.6" (line 27). The source code in services/src/attestation/keys.rs uses use rand_core::OsRng (which resolves to rand_core 0.6) and passes it to SigningKey::generate(&mut csprng). In ed25519-dalek 3.0, SigningKey::generate requires a type implementing CryptoRngCore from rand_core 0.10, but rand_core 0.6's OsRng does not implement traits from rand_core 0.10 (they are separate, semver-incompatible crates). This will cause a compile error like: the trait bound rand_core 0.6::OsRng: rand_core 0.10::CryptoRngCore is not satisfied. The rand_core dependency should be bumped to "0.10" to match ed25519-dalek 3.0.

💡 Suggested Change

Before:

rand_core = { version = "0.6", features = ["getrandom"] }

After:

rand_core = "0.10"

…ates

Bumps the rust-dependencies group with 35 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.18` | `2.0.20` |
| [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` |
| [futures](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.34` |
| [tokio-stream](https://github.com/tokio-rs/tokio) | `0.1.18` | `0.1.19` |
| [tokio](https://github.com/tokio-rs/tokio) | `1.52.3` | `1.53.1` |
| [anyhow](https://github.com/dtolnay/anyhow) | `1.0.103` | `1.0.104` |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.7.0` | `0.7.1` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.3` | `1.26.1` |
| [bytes](https://github.com/tokio-rs/bytes) | `1.12.0` | `1.12.1` |
| [http-body-util](https://github.com/hyperium/http-body) | `0.1.3` | `0.1.5` |
| [base64](https://github.com/marshallpierce/rust-base64) | `0.22.1` | `0.23.1` |
| [indexmap](https://github.com/indexmap-rs/indexmap) | `2.14.0` | `2.14.2` |
| [moka](https://github.com/moka-rs/moka) | `0.12.15` | `0.12.16` |
| [bhttp](https://github.com/martinthomson/ohttp) | `0.7.2` | `0.8.0` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.34` |
| [tokio-util](https://github.com/tokio-rs/tokio) | `0.7.18` | `0.7.19` |
| [axum-test](https://github.com/JosephLenton/axum-test) | `20.1.0` | `21.0.0` |
| [deadpool-postgres](https://github.com/deadpool-rs/deadpool) | `0.14.1` | `0.14.2` |
| [ed25519-dalek](https://github.com/dalek-cryptography/curve25519-dalek) | `2.2.0` | `3.0.0` |
| [rand](https://github.com/rust-random/rand) | `0.10.1` | `0.10.2` |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` | `0.1.92` |
| [serial_test](https://github.com/palfrey/serial_test) | `3.5.0` | `4.0.1` |
| [rustls](https://github.com/rustls/rustls) | `0.23.41` | `0.23.44` |
| [aes-gcm](https://github.com/RustCrypto/AEADs) | `0.10.3` | `0.11.1` |
| [regex](https://github.com/rust-lang/regex) | `1.12.4` | `1.13.1` |
| [futures-core](https://github.com/rust-lang/futures-rs) | `0.3.32` | `0.3.34` |
| [http](https://github.com/hyperium/http) | `1.4.1` | `1.5.0` |
| [chacha20poly1305](https://github.com/RustCrypto/AEADs) | `0.10.1` | `0.11.0` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10` |
| [getrandom](https://github.com/rust-random/getrandom) | `0.4.1` | `0.4.3` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `1.8.0` | `3.3.0` |
| [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `10.4.0` | `11.0.0` |
| [dcap-qvl](https://github.com/Phala-Network/dcap-qvl) | `0.5.2` | `0.5.3` |
| [mockall](https://github.com/asomers/mockall) | `0.14.0` | `0.15.0` |



Updates `serde_json` from 1.0.150 to 1.0.151
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](serde-rs/json@v1.0.150...v1.0.151)

Updates `thiserror` from 2.0.18 to 2.0.20
- [Release notes](https://github.com/dtolnay/thiserror/releases)
- [Commits](dtolnay/thiserror@2.0.18...2.0.20)

Updates `serde` from 1.0.228 to 1.0.229
- [Release notes](https://github.com/serde-rs/serde/releases)
- [Commits](serde-rs/serde@v1.0.228...v1.0.229)

Updates `futures` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `tokio-stream` from 0.1.18 to 0.1.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-stream-0.1.18...tokio-stream-0.1.19)

Updates `tokio` from 1.52.3 to 1.53.1
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-1.52.3...tokio-1.53.1)

Updates `anyhow` from 1.0.103 to 1.0.104
- [Release notes](https://github.com/dtolnay/anyhow/releases)
- [Commits](dtolnay/anyhow@1.0.103...1.0.104)

Updates `tower-http` from 0.7.0 to 0.7.1
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.7.0...tower-http-0.7.1)

Updates `uuid` from 1.23.3 to 1.26.1
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](uuid-rs/uuid@v1.23.3...v1.26.1)

Updates `bytes` from 1.12.0 to 1.12.1
- [Release notes](https://github.com/tokio-rs/bytes/releases)
- [Changelog](https://github.com/tokio-rs/bytes/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/bytes@v1.12.0...v1.12.1)

Updates `http-body-util` from 0.1.3 to 0.1.5
- [Release notes](https://github.com/hyperium/http-body/releases)
- [Commits](hyperium/http-body@http-body-util-v0.1.3...http-body-util-v0.1.5)

Updates `base64` from 0.22.1 to 0.23.1
- [Changelog](https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md)
- [Commits](marshallpierce/rust-base64@v0.22.1...v0.23.1)

Updates `indexmap` from 2.14.0 to 2.14.2
- [Changelog](https://github.com/indexmap-rs/indexmap/blob/main/RELEASES.md)
- [Commits](indexmap-rs/indexmap@2.14.0...2.14.2)

Updates `moka` from 0.12.15 to 0.12.16
- [Release notes](https://github.com/moka-rs/moka/releases)
- [Changelog](https://github.com/moka-rs/moka/blob/main/CHANGELOG.md)
- [Commits](moka-rs/moka@v0.12.15...v0.12.16)

Updates `bhttp` from 0.7.2 to 0.8.0
- [Commits](martinthomson/ohttp@v0.7.2...v0.8.0)

Updates `futures-util` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `tokio-util` from 0.7.18 to 0.7.19
- [Release notes](https://github.com/tokio-rs/tokio/releases)
- [Commits](tokio-rs/tokio@tokio-util-0.7.18...tokio-util-0.7.19)

Updates `axum-test` from 20.1.0 to 21.0.0
- [Release notes](https://github.com/JosephLenton/axum-test/releases)
- [Commits](https://github.com/JosephLenton/axum-test/commits)

Updates `deadpool-postgres` from 0.14.1 to 0.14.2
- [Changelog](https://github.com/deadpool-rs/deadpool/blob/main/release.toml)
- [Commits](deadpool-rs/deadpool@deadpool-postgres-v0.14.1...deadpool-postgres-v0.14.2)

Updates `ed25519-dalek` from 2.2.0 to 3.0.0
- [Release notes](https://github.com/dalek-cryptography/curve25519-dalek/releases)
- [Changelog](https://github.com/dalek-cryptography/curve25519-dalek/blob/3.0.0/CHANGELOG.md)
- [Commits](dalek-cryptography/curve25519-dalek@ed25519-2.2.0...3.0.0)

Updates `rand` from 0.10.1 to 0.10.2
- [Release notes](https://github.com/rust-random/rand/releases)
- [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md)
- [Commits](rust-random/rand@0.10.1...0.10.2)

Updates `async-trait` from 0.1.89 to 0.1.92
- [Release notes](https://github.com/dtolnay/async-trait/releases)
- [Commits](dtolnay/async-trait@0.1.89...0.1.92)

Updates `serial_test` from 3.5.0 to 4.0.1
- [Release notes](https://github.com/palfrey/serial_test/releases)
- [Commits](palfrey/serial_test@v3.5.0...v4.0.1)

Updates `rustls` from 0.23.41 to 0.23.44
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.41...v/0.23.44)

Updates `aes-gcm` from 0.10.3 to 0.11.1
- [Commits](RustCrypto/AEADs@aes-gcm-v0.10.3...aes-gcm-v0.11.1)

Updates `regex` from 1.12.4 to 1.13.1
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](rust-lang/regex@1.12.4...1.13.1)

Updates `futures-core` from 0.3.32 to 0.3.34
- [Release notes](https://github.com/rust-lang/futures-rs/releases)
- [Changelog](https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md)
- [Commits](rust-lang/futures-rs@0.3.32...0.3.34)

Updates `http` from 1.4.1 to 1.5.0
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](hyperium/http@v1.4.1...v1.5.0)

Updates `chacha20poly1305` from 0.10.1 to 0.11.0
- [Commits](RustCrypto/AEADs@chacha20poly1305-v0.10.1...chacha20poly1305-v0.11.0)

Updates `flate2` from 1.1.9 to 1.1.10
- [Release notes](https://github.com/rust-lang/flate2-rs/releases)
- [Commits](rust-lang/flate2-rs@1.1.9...1.1.10)

Updates `getrandom` from 0.4.1 to 0.4.3
- [Changelog](https://github.com/rust-random/getrandom/blob/master/CHANGELOG.md)
- [Commits](rust-random/getrandom@v0.4.1...v0.4.3)

Updates `rmcp` from 1.8.0 to 3.3.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v1.8.0...rmcp-v3.3.0)

Updates `jsonwebtoken` from 10.4.0 to 11.0.0
- [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](Keats/jsonwebtoken@v10.4.0...v11.0.0)

Updates `dcap-qvl` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/Phala-Network/dcap-qvl/releases)
- [Commits](Phala-Network/dcap-qvl@v0.5.2...v0.5.3)

Updates `mockall` from 0.14.0 to 0.15.0
- [Changelog](https://github.com/asomers/mockall/blob/master/CHANGELOG.md)
- [Commits](asomers/mockall@v0.14.0...v0.15.0)

---
updated-dependencies:
- dependency-name: aes-gcm
  dependency-version: 0.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: anyhow
  dependency-version: 1.0.104
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: async-trait
  dependency-version: 0.1.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: axum-test
  dependency-version: 21.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: base64
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: bhttp
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: bytes
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: chacha20poly1305
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: dcap-qvl
  dependency-version: 0.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: deadpool-postgres
  dependency-version: 0.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: ed25519-dalek
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: flate2
  dependency-version: 1.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: futures
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: futures-core
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: futures-util
  dependency-version: 0.3.34
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: getrandom
  dependency-version: 0.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: http
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: http-body-util
  dependency-version: 0.1.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: indexmap
  dependency-version: 2.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: jsonwebtoken
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: mockall
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: moka
  dependency-version: 0.12.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: rand
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: regex
  dependency-version: 1.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: rmcp
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: rustls
  dependency-version: 0.23.43
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serde
  dependency-version: 1.0.229
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serde_json
  dependency-version: 1.0.151
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: serial_test
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: rust-dependencies
- dependency-name: thiserror
  dependency-version: 2.0.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tokio
  dependency-version: 1.53.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
- dependency-name: tokio-stream
  dependency-version: 0.1.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tokio-util
  dependency-version: 0.7.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: tower-http
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rust-dependencies
- dependency-name: uuid
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: rust-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/rust-dependencies-0fbb4b07b9 branch from 85adbb1 to 33e8afe Compare September 16, 2026 19:13
@dependabot
dependabot Bot had a problem deploying to Cloud API test env September 16, 2026 19:14 Failure
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants