Skip to content

chore(deps): bump the prod group with 5 updates - #185

Merged
yordis merged 1 commit into
mainfrom
dependabot/cargo/prod-d228ed4eb0
Sep 14, 2026
Merged

chore(deps): bump the prod group with 5 updates#185
yordis merged 1 commit into
mainfrom
dependabot/cargo/prod-d228ed4eb0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the prod group with 5 updates:

Package From To
toml 1.1.5+spec-1.1.0 1.1.6+spec-1.1.0
reqwest 0.13.4 0.13.5
libc 0.2.185 0.2.189
rmcp 3.2.0 3.3.0
open 5.4.3 5.4.4

Updates toml from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits
  • 572c005 chore: Release
  • 66d0c53 docs: Update changelog
  • 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
  • 0ff90db perf(display): Write encoded strings directly
  • efb2536 perf(display): Move generated representation strings
  • 075c444 refactor(display): Consolidate key-path encoding
  • b48f338 perf(display): Borrow table keys during document output
  • c6c1de3 perf(parser): Move completed table header keys
  • ec90463 perf(parser): Borrow input when creating editable documents
  • d76a48a test: Benchmark rendering generated keys and values
  • Additional commits viewable in compare view

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

New Contributors

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

  • Add Error::is_dns() to identify errors caused by DNS resolution failures.
  • Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
  • Add TLS version to TlsInfo extension.
  • Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
  • Fix sending wrong proxy-auth if multiple proxies intercept a given URL.
Commits
  • de55373 v0.13.5
  • 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
  • 9f06fd2 docs: improve description of JSON method (#3082)
  • 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
  • ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
  • 4e9a3c7 chore: add pull request template for human-written content
  • 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
  • 221abe9 chore: Remove unnecessary clones and a cast (#3071)
  • 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
  • fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
  • Additional commits viewable in compare view

Updates libc from 0.2.185 to 0.2.189

Release notes

Sourced from libc's releases.

0.2.189

Added

  • Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
  • Linux SPARC: Enable the clone3 syscall (#4980)
  • Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

  • Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

  • Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
  • NuttX: Fix wchar_t definition under Arm (#5245)
  • Windows: Add back link names for time-related symbols (#5300)

0.2.188

Changed

These were removed in 0.2.187 because libc does not actually make Send and Sync guarantees about DIR (or other extern types), but this caused some crates to break. The traits are added back for now to allow time to migrate, but will be removed again in the future; please make sure your crates are not relying on libc::DIR: Send or libc::DIR: Sync.

0.2.187

This release contains a number of improvements related to 64-bit time_t configuration. Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

  • The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits

  • uClibc now supports a similar configuration option:

    RUSTFLAGS='--cfg=libc_unstable_uclibc_time64'

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.189 - 2026-07-21

Added

  • Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
  • Linux SPARC: Enable the clone3 syscall (#4980)
  • Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

  • Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

  • Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
  • NuttX: Fix wchar_t definition under Arm (#5245)
  • Windows: Add back link names for time-related symbols (#5300)

0.2.188 - 2026-07-21

Changed

These were removed in 0.2.187 because libc does not actually make Send and Sync guarantees about DIR (or other extern types), but this caused some crates to break. The traits are added back for now to allow time to migrate, but will be removed again in the future; please make sure your crates are not relying on libc::DIR: Send or libc::DIR: Sync.

0.2.187 - 2026-07-20

This release contains a number of improvements related to 64-bit time_t configuration. Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

  • The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits
  • uClibc now supports a similar configuration option:

... (truncated)

Commits
  • ef0906e libc: Release 0.2.189
  • 5a79f76 riscv32-musl: Rename padding fields to avoid a conflict
  • 3e51062 psp: Fix overflowing_literals warnings
  • e352fdd emscripten: add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessa...
  • 63221b3 macros: Require safe in safe_f! invocations
  • 707ab52 macros: Require unsafe in f! invocations
  • 8e40c94 Enable clone3() syscall on sparc-linux and sparc64-linux
  • 8427909 windows: Add back link names for time-related symbols
  • b4863fa nuttx: fix wchar_t definition under arm
  • 41c683d nuttx: mirror type definitions
  • Additional commits viewable in compare view

Updates rmcp from 3.2.0 to 3.3.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.3.0

Added

  • (macros) reject empty tool_router (#1233)

rmcp-v3.3.0

Added

  • add ServerHandler::negotiate_initialize (#1247)
  • (macros) reject empty tool_router (#1233)
  • (auth) add enterprise refresh-token and ID-JAG exchanges (#1234)

Fixed

  • (sse) saturate exponential reconnect backoff to avoid overflow panic (#1231)
  • resolve clippy warnings across workspace (#1195)
  • (auth) unify refresh checks and error handling (#1236)

Other

  • (deps) update process-wrap requirement from 9.0 to 10.0 (#1229)
Commits
  • 3e636ca chore: release v3.3.0 (#1252)
  • b2c90b1 ci: pin commitlint dependencies (#1217)
  • 46db531 fix(sse): saturate exponential reconnect backoff to avoid overflow panic (#1231)
  • 744b9f9 chore(deps): bump crate-ci/typos (#1249)
  • e8a0d70 chore(deps): bump taiki-e/install-action from 2.86.7 to 2.87.6 (#1250)
  • 6fa4053 fix: resolve clippy warnings across workspace (#1195)
  • f9a68bf feat: add ServerHandler::negotiate_initialize (#1247)
  • 7d14f3a feat(macros): reject empty tool_router (#1233)
  • 04c2f3f fix(auth): unify refresh checks and error handling (#1236)
  • add9cbe ci: bump codeql-action to 4.37.9 and group updates (#1240)
  • Additional commits viewable in compare view

Updates open from 5.4.3 to 5.4.4

Release notes

Sourced from open's releases.

v5.4.4

Bug Fixes

  • open Windows paths without wildcard expansion

    Opening a child of a bracket-named directory fails because Start-Process resolves parent directories as PowerShell wildcard patterns. The isolated Windows regression test reproduced WildcardPatternException for a copied executable under "【Tiny Asa】 [77P7V-712MB]\child" before this change.

    Use Test-Path and Invoke-Item with LiteralPath for existing items, retaining Start-Process for URLs and application names. These cmdlets also work under PowerShell Constrained Language Mode. Share the embedded script between Windows and WSL, keep targets in environment data, and stop on launch errors to report a nonzero exit status. Preserve the security boundary established in fd29861: cmd /c start remains opt-in through the insecure feature. No previously removed launcher options are restored.

    The integration test launches only a copy of its own test binary, which records its executable path and exits. It checks absolute and relative paths with invalid and valid bracket patterns, Unicode, backticks, quotes, shell metacharacters, and leading dashes in normal and constrained PowerShell sessions, plus failure for a missing executable. It requires neither Explorer nor registered document or URL handlers. Adjust the existing fallback assertion to also allow the opt-in cmd launcher after Explorer with all features enabled.

    Validated locally on Windows with PowerShell 5.1.26100.33438 and rustc 1.97.1: cargo test and cargo test --all-features each passed all 19 tests, including the behavioral regression. git diff --check passed, and cargo package --list includes the embedded script. Test-Path returned false without errors for representative https, mailto, and file URLs. Actual GUI folder, document, URL handling and WSL interop were not exercised locally.

Commit Statistics

  • 2 commits contributed to the release.
  • 8 days passed between releases.
  • 1 commit was understood as conventional.
  • 1 unique issue was worked on: #132

Commit Details

  • #132
    • Open Windows paths without wildcard expansion (ad95c40)
  • Uncategorized

... (truncated)

Changelog

Sourced from open's changelog.

5.4.4 (2026-09-10)

Bug Fixes

  • open Windows paths without wildcard expansion

    Opening a child of a bracket-named directory fails because Start-Process resolves parent directories as PowerShell wildcard patterns. The isolated Windows regression test reproduced WildcardPatternException for a copied executable under "【Tiny Asa】 [77P7V-712MB]\child" before this change.

    Use Test-Path and Invoke-Item with LiteralPath for existing items, retaining Start-Process for URLs and application names. These cmdlets also work under PowerShell Constrained Language Mode. Share the embedded script between Windows and WSL, keep targets in environment data, and stop on launch errors to report a nonzero exit status. Preserve the security boundary established in fd29861: cmd /c start remains opt-in through the insecure feature. No previously removed launcher options are restored.

    The integration test launches only a copy of its own test binary, which records its executable path and exits. It checks absolute and relative paths with invalid and valid bracket patterns, Unicode, backticks, quotes, shell metacharacters, and leading dashes in normal and constrained PowerShell sessions, plus failure for a missing executable. It requires neither Explorer nor registered document or URL handlers. Adjust the existing fallback assertion to also allow the opt-in cmd launcher after Explorer with all features enabled.

    Validated locally on Windows with PowerShell 5.1.26100.33438 and rustc 1.97.1: cargo test and cargo test --all-features each passed all 19 tests, including the behavioral regression. git diff --check passed, and cargo package --list includes the embedded script. Test-Path returned false without errors for representative https, mailto, and file URLs. Actual GUI folder, document, URL handling and WSL interop were not exercised locally.

Commit Statistics

  • 2 commits contributed to the release.
  • 8 days passed between releases.
  • 1 commit was understood as conventional.
  • 1 unique issue was worked on: #132

Commit Details

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the prod group with 5 updates
00c9dd2 
Bumps the prod group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [toml](https://github.com/toml-rs/toml) | `1.1.5+spec-1.1.0` | `1.1.6+spec-1.1.0` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` |
| [libc](https://github.com/rust-lang/libc) | `0.2.185` | `0.2.189` |
| [rmcp](https://github.com/modelcontextprotocol/rust-sdk) | `3.2.0` | `3.3.0` |
| [open](https://github.com/Byron/open-rs) | `5.4.3` | `5.4.4` |


Updates `toml` from 1.1.5+spec-1.1.0 to 1.1.6+spec-1.1.0
- [Commits](toml-rs/toml@toml-v1.1.5...toml-v1.1.6)

Updates `reqwest` from 0.13.4 to 0.13.5
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5)

Updates `libc` from 0.2.185 to 0.2.189
- [Release notes](https://github.com/rust-lang/libc/releases)
- [Changelog](https://github.com/rust-lang/libc/blob/0.2.189/CHANGELOG.md)
- [Commits](rust-lang/libc@0.2.185...0.2.189)

Updates `rmcp` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/modelcontextprotocol/rust-sdk/releases)
- [Changelog](https://github.com/modelcontextprotocol/rust-sdk/blob/main/release-plz.toml)
- [Commits](modelcontextprotocol/rust-sdk@rmcp-v3.2.0...rmcp-v3.3.0)

Updates `open` from 5.4.3 to 5.4.4
- [Release notes](https://github.com/Byron/open-rs/releases)
- [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md)
- [Commits](Byron/open-rs@v5.4.3...v5.4.4)

---
updated-dependencies:
- dependency-name: toml
  dependency-version: 1.1.6+spec-1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: reqwest
  dependency-version: 0.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: libc
  dependency-version: 0.2.189
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
- dependency-name: rmcp
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod
- dependency-name: open
  dependency-version: 5.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 14, 2026
@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: d50fe048-85b9-4ef3-8a8f-f803b513fdb2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cursor

cursor Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

PR Summary

Medium Risk
Patch bumps to reqwest and rmcp affect outbound HTTP and MCP/auth behavior without local code changes; regression risk is mostly in integration paths rather than app logic.

Overview
This PR only updates Cargo.lock—no application source changes—as part of a grouped production dependency bump.

rmcp / rmcp-macros 3.2.0 → 3.3.0 refreshes the MCP stack (used in crates/trg), including auth refresh handling, SSE reconnect backoff safety, optional ServerHandler::negotiate_initialize, and macro rejection of empty tool_router.

reqwest 0.13.4 → 0.13.5 bumps the workspace HTTP client with DNS/proxy-auth/timeout fixes and a transitive base64 0.23 upgrade.

toml 1.1.5 → 1.1.6 is a patch release focused on parse/display performance.

open 5.4.3 → 5.4.4 fixes opening paths on Windows when directory names contain bracket/wildcard characters.

libc 0.2.185 → 0.2.189 updates low-level OS bindings pulled in transitively (including via open).

Reviewed by Cursor Bugbot for commit 00c9dd2. Bugbot is set up for automated code reviews on this repo. Configure here.

@yordis
yordis merged commit 58226bd into main Sep 14, 2026
11 checks passed
@yordis
yordis deleted the dependabot/cargo/prod-d228ed4eb0 branch September 14, 2026 20:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yordis yordis yordis approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yordis