chore(deps): update salvo requirement from =0.96.0 to =1.0.1

[dependabot]

Updates the requirements on salvo to permit the latest version.

Release notes

Sourced from salvo's releases.

v1.0.1

What's Changed

• fix(examples): align OpenTelemetry examples with 0.33 by @​chrislearn in salvo-rs/salvo#1710
• Allow HTTP/1-only builds without h2 by @​chrislearn in salvo-rs/salvo#1713
• fix(quinn): finish QUIC handshakes on the connection task by @​reinerp in salvo-rs/salvo#1711

New Contributors

• @​reinerp made their first contribution in salvo-rs/salvo#1711

Full Changelog: salvo-rs/salvo@v1.0.0...v1.0.1

Changelog

Sourced from salvo's changelog.

[1.0.1] - 2026-10-05

Fixed

• A QUIC connection was dropped when a joined listener, such as the TCP side of a combined HTTP/1.1, HTTP/2 and HTTP/3 server, accepted a connection during its handshake. A client that never finished its handshake also stalled all new QUIC connections for up to tls_handshake_timeout.
• Honor the http1 and http2 feature flags when enabling Hyper protocols. HTTP/1-only builds, including WebSocket support, no longer compile h2 unless another dependency enables HTTP/2. Default protocol support is unchanged.
• Align the OpenTelemetry examples with the 0.33 dependencies used by salvo-otel.

[1.0.0] - 2026-09-24

Security

• Static file responses no longer serve XML-based documents inline, which allowed stored XSS when an application served attacker-supplied uploads. image/svg+xml and text/xml were classified as inline by their top-level image/text type, so an uploaded SVG carrying <script> — or an XML document naming an XSLT stylesheet through <?xml-stylesheet ?> — executed script in the serving origin when opened. XML-based content types now default to attachment, matching how application/xml and application/xhtml+xml already behaved. That covers the +xml suffix, an xml subtype, RFC 7303's xml-dtd and xml-external-parsed-entity, and the legacy text/xsl that <?xml-stylesheet ?> itself names. text/html still defaults to inline. Reported by sl91994.
• NamedFile and StaticEmbed responses now carry X-Content-Type-Options: nosniff.
• salvo-otel no longer records the full request URI. Metrics dropped url.full entirely, so query strings no longer become metric dimensions. Tracing replaced it with url.path plus a url.query whose sig, Signature, AWSAccessKeyId and X-Goog-Signature values are redacted, as the semantic conventions require.

Added

• NamedFileBuilder::use_content_type_options and NamedFile::use_content_type_options to control the X-Content-Type-Options header.
• StaticDir::disposition_type, StaticDir::use_content_type_options, StaticFile::disposition_type, StaticFile::attached_name and StaticFile::use_content_type_options, so applications serving trusted assets can opt back into inline rendering, which previously had no public API on either handler.
• NamedFileBuilder::disposition_name, which sets the name Content-Disposition reports without forcing the disposition to attachment the way attached_name does.
• Cookie extractors now support structured JSON values. CookieParam<T> falls back to JSON when scalar conversion fails, while #[derive(Extractible)] accepts explicit cookie field sources such as #[salvo(extract(source(from = "cookie", parse = "json")))].
• Changelog established for upcoming releases.
• Opt-in RFC 9457 Problem Details responses with typed extension members and OpenAPI integration via the rfc9457 feature.
• Initial opt-in OpenAPI 3.2 document support in salvo-oapi, including the $self field.
• OpenAPI 3.2 object model in salvo-oapi:

... (truncated)

Commits

• 083a17e Release 1.0.1
• 9c36d16 fix(quinn): finish QUIC handshakes on the connection task (#1711)
• 331d1de fix(core): honor HTTP protocol feature flags (#1713)
• e011f4d fix(examples): align OpenTelemetry examples with 0.33 (#1710)
• bab1a7c Release 1.0.0
• fcff5db build(deps): upgrade OpenTelemetry crates to 0.33 together (#1709)
• 6aec86a fix(serve-static): block paths beneath dot directories (#1708)
• 9beb091 build(deps): update zstd requirement from 0.13 to 0.14 (#1703)
• ca0748a feat(otel)!: follow the OpenTelemetry HTTP semantic conventions (#1700)
• 568afd4 Upgrade certon to 0.3 (#1702)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.