fix(deps): update rust dependencies (non-major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
anyhow	dependencies	patch	1.0.102 → 1.0.104
axum	dev-dependencies	patch	0.8.8 → 0.8.9
axum	dependencies	patch	0.8.8 → 0.8.9
base64	dependencies	minor	0.22 → 0.23
chrono	dependencies	patch	0.4.44 → 0.4.45
clap	dependencies	patch	4.6.0 → 4.6.5
hmac	dev-dependencies	minor	0.12 → 0.13
hmac	dependencies	minor	0.12 → 0.13
insta (source)	dev-dependencies	minor	1.46.3 → 1.48.0
ipnet	dependencies	patch	2.12.0 → 2.12.1
jsonschema	dependencies	minor	0.45 → 0.49
opentelemetry (source)	dependencies	minor	0.31 → 0.32
opentelemetry-otlp (source)	dependencies	minor	0.31 → 0.32
opentelemetry_sdk (source)	dependencies	minor	0.31 → 0.32
proptest (source)	dev-dependencies	minor	1.10.0 → 1.11.0
rand (source)	dependencies	minor	0.9 → 0.10
reqwest	dev-dependencies	patch	0.13.2 → 0.13.4
reqwest	dependencies	patch	0.13.2 → 0.13.4
serde (source)	dependencies	patch	1.0.228 → 1.0.229
serde_json	dev-dependencies	patch	1.0.149 → 1.0.151
serde_json	dependencies	patch	1.0.149 → 1.0.151
sha1	dependencies	minor	0.10 → 0.11
sha2	dev-dependencies	minor	0.10 → 0.11
sha2	dependencies	minor	0.10 → 0.11
sqlx	dependencies	minor	0.8 → 0.9
tokio (source)	dev-dependencies	minor	1.50.0 → 1.53.1
tokio (source)	dependencies	minor	1.50.0 → 1.53.1
tower-http	dependencies	minor	0.6 → 0.7
tracing-opentelemetry	dependencies	minor	0.32 → 0.33

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

tokio-rs/axum (axum)

v0.8.9

Compare Source

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#​3597)
• changed: Update minimum rust version to 1.80 (#​3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#​3656)
• fixed: Return specific error message when multipart body limit is exceeded (#​3611)

marshallpierce/rust-base64 (base64)

v0.23.0

Compare Source

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best
  instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar
  GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime
  detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

chronotope/chrono (chrono)

v0.4.45: 0.4.45

Compare Source

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in #​1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in #​1789

clap-rs/clap (clap)

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal

• Update to syn v3

v4.6.3

Compare Source

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes

• (help) Say alias when there is only one

v4.6.1

Compare Source

Fixes

• (derive) Ensure rebuilds happen when an read env variable is changed

RustCrypto/MACs (hmac)

v0.13.0

Compare Source

mitsuhiko/insta (insta)

v1.48.0

Compare Source

• Add strip_ansi_escape_codes setting which removes ANSI escape sequences
  (color codes, cursor movement, etc.) from snapshot content before comparison.
  Requires the filters feature. #​899 (@​pierluigilenoci)
• Add opt-in support for YAML literal blocks for multiline strings in snapshot
  metadata fields such as description and expression. Set
  INSTA_YAML_BLOCK_STYLE=1 to enable. #​851 (@​ivov)
• Setting CI=true normally makes cargo insta test behave as though --check
  was passed. Explicit snapshot handling options such as --accept now take
  precedence over this environment variable, allowing users to override this
  behavior if they want to. #​924
• Fix cargo insta test --profile being forwarded to nextest as the nextest
  profile instead of the cargo build profile; it now translates to
  --cargo-profile for the nextest runner. Add --nextest-profile to select
  the nextest profile. #​910
• Fix cargo insta pending-snapshots printing unusable \\?\-prefixed paths
  on Windows. The --snapshot filter now also accepts partial paths: any
  trailing path suffix of the snapshot file matches, so a bare
  --snapshot my_test.snap works. #​904
• Accepting a binary snapshot no longer fails with os error 2 when its data
  file is missing (e.g. gitignored and not committed). #​914

v1.47.2

Compare Source

• Restore Send + Sync on Settings, Redactions, and Redaction by
  reverting the Arc to Rc change from 1.47.0, which was semver-breaking.
  #​873 #​874
• Add Send + Sync bounds to Comparator trait for consistency with
  Arc-based storage. #​872
• Add compile-time assertion to prevent future auto-trait regressions.

v1.47.1

Compare Source

• Revert sorting of sequences in sort_maps. The change in 1.47.0 sorted all
  Seq values (including Vec), not just non-deterministic collections like
  HashSet, which was a breaking change. #​876

v1.47.0

Compare Source

• Add Comparator trait for customizing how snapshot values are compared. #​872 (@​dstu)
• Sort sequences in sort_maps to fix non-deterministic HashSet snapshots. #​876
• Improve TOML serialization error message for unsupported types, suggesting assert_json_snapshot! or assert_yaml_snapshot! as alternatives. #​880
• Remove unnecessary Send + Sync bounds from Redaction, allowing non-Send closures in dynamic redactions. #​874
• Don't use Arc in Settings unnecessarily. #​873 (@​dstu)
• Upgrade console to 0.16 and MSRV to 1.66. #​885
• Upgrade toml-edit to 0.25. #​882 (@​alexanderkjall)

krisprice/ipnet (ipnet)

v2.12.1

• Fixes bug where Ipv4Subnets(0.0.0.0, u32::MAX-1, 0) and Ipv6Subnets(::, u128::MAX-1, 0) incorrectly included u32::MAX and u128::MAX. See issue #​70.
• Fixes some typos in documentation and error messages

Stranger6667/jsonschema (jsonschema)

v0.49.3

Added

• Canonicalization of a recursive schema with no finite witness, which now folds to false.
• Canonicalization of $dynamicRef and $recursiveRef, which resolve through the dynamic scope and stay symbolic like any other reference. A dangling $dynamicRef errors rather than staying Raw.
• Canonicalization of minContains under uniqueItems, where a demand asking for more matches than its own schema has distinct values now folds to false.
• Canonicalization of a Draft 4 patternProperties coverage closed by additionalProperties: false, spelled as the closed map it was parsed from.
• Canonicalization of a oneOf whose branches repeat, where a repeated branch can never contribute exactly one match.
• Canonicalization of a $ref whose target is an empty schema, which now folds to false.
• Canonicalization of unevaluatedItems beside allOf, where every branch must pass and so the indexes they evaluate are known without the instance.
• Canonicalization of unevaluatedProperties beside allOf, where every branch must pass and so what they evaluate is known without the instance.
• Canonicalization of a Draft 4 type list holding integer beside other types with enum, which previously modeled only when spelled as an allOf.
• Canonicalization of patternProperties patterns matching finitely many keys, such as ^a$ and ^(a|b)$.
• Canonicalization of unevaluatedProperties and unevaluatedItems when no in-place applicator sits beside them.

Fixed

• additionalItems values that are not schemas silently ignored beside an array-form items (they should fail the build like additionalProperties).
• additionalItems beside a boolean items rejecting every instance, such as {"additionalItems": false, "items": false}.
• additionalItems beside a non-array items value failing schema compilation with an error blaming additionalItems (the keyword should be ignored).
• Draft 4 rejecting a size bound at or past 2^64, such as {"maxItems": 18446744073709551616}.
• An integer past the f64 range admitted by a fractional bound it exceeds, such as 1e400 under {"exclusiveMaximum": 0.1}.
• A $ref at the root of an $id-bearing subresource dropped as a self-reference when its pointer matched the one that reached that subresource.
• Canonicalization reusing one definition's body for a same-named definition in another resource, when the name spells a canonical URI.
• unevaluatedItems counting prefixItems as evaluating elements before Draft 2020-12, where it is not a keyword.

Performance

• Up to 70% faster evaluate by building each location in a single allocation instead of two, reusing the instance location a node already built, and caching evaluation paths across instance nodes.

v0.49.2

Performance

• Faster serialization of canonicalized schemas.
• Faster macro code generation for subschemas with many keywords.
• Up to 70x faster canonicalization of multipleOf beside numeric bounds far from zero.

v0.49.1

Fixed

• jsonschema-value: Ruby builds on x64-mingw-ucrt.

v0.49.0

Added

• Generic JSON input: options_for builds a validator over any instance representation implementing json::Json, so instances validate without conversion to serde_json::Value. #​239
• meta::validate_for and meta::is_valid_for for checking a schema document held in any representation implementing json::Json against its meta-schema.
• EXPERIMENTAL: Schema canonicalization via jsonschema::canonicalize. It reduces a reasonable subset of JSON Schemas to their normal forms.

Fixed

• multipleOf incorrectly accepted integers past u64 that are not multiples of the divisor.

v0.48.5

Fixed

• Packaging issue again.

v0.48.2

Performance

• Faster validator compilation by pre-sizing internal caches.

v0.48.1

Fixed

• Missing required errors in evaluate() output for schemas with properties and a two-entry required array. #​1220
• contentEncoding errors for invalid UTF-8 after decoding incorrectly had empty instance_path and schema_path.

Performance

• Faster code generation for #[jsonschema::validator] (~5% across benchmarked schemas), via aliasing repeated paths in the emitted code.

v0.48.0

Added

• iter_errors for #[jsonschema::validator]-generated validators.

Fixed

• Per-branch context on generated anyOf and oneOf validation errors, matching runtime validators.
• $recursiveRef in generated validators incorrectly resolved to the innermost $recursiveAnchor (it should resolve to the outermost one).
• Integer instances just outside the i64/u64 range incorrectly compared against numeric bounds through lossy f64 rounding under arbitrary-precision (e.g. {"minimum": -9223372036854775808} accepted -9223372036854775809).

Changed

• One canonical number spelling from canonical::json::to_string under arbitrary-precision ("1e-2" becomes "0.01", "1.50" becomes "1.5") and correctly-rounded float parsing (serde_json's float_roundtrip).

Performance

• Faster multipleOf validation for integer instances with integer divisors, via integer arithmetic instead of floating-point modulo.

v0.47.0

Added

• #[jsonschema::validator] attribute macro (behind the macros feature) that compiles a JSON Schema into is_valid and validate implementations at build time.
• Keyword::iter_errors for reporting multiple validation errors from a single custom keyword. #​1071

Changed

• Bump MSRV to 1.85.0.

Performance

• Faster meta-schema validation and schema compilation with the macros feature, via compile-time meta-schema validators.

Fixed

• type under items asserted with the Validation vocabulary disabled.
• Disabled vocabularies ignored for $ref targets without their own $schema (e.g. $defs entries).

v0.46.10

Fixed

• Stack overflow with a self-referential $dynamicRef combined with unevaluatedProperties or unevaluatedItems.
• Incorrect unevaluatedProperties and unevaluatedItems results when a meta-schema disables the Applicator vocabulary.

v0.46.9

Fixed

• multipleOf incorrectly rounds integer instances above 2^53 to f64 before the divisibility check on builds without the arbitrary-precision feature.
• Stack overflow while preparing a registry containing deeply nested schema documents.

v0.46.8

Fixed

• idn-email format rejected non-ASCII characters in quoted local parts (e.g. "δοκιμή"@​example.com).

v0.46.7

Fixed

• idn-hostname format accepted A-labels that decode to a disallowed code point (e.g. xn--7a).

v0.46.6

Added

• IntoRegistryResource for Arc<Value>. #​1129

Fixed

• prefixItems incorrectly recognised as a known keyword in Draft 2019-09 and earlier (it is 2020-12 only).
• pattern validation errors displayed the internally translated regex instead of the original schema pattern. #​1149

v0.46.5

Fixed

• Percent-encoded characters in $ref URI fragments (e.g. #/$defs/Request%20class) are now decoded when stored as schema_path.

v0.46.4

Fixed

• Panic in the regex engine when matching against patterns with very large {0,N} quantifiers.

v0.46.3

Fixed

• Memory not reclaimed when a Validator for a schema with recursive $ref or $dynamicRef is dropped. #​1125
• Compilation failure on wasm32-wasip1 and wasm32-unknown-emscripten targets.

v0.46.2

Fixed

• required not enforced when additionalProperties is a schema object and required lists exactly 2 keys.

v0.46.1

Fixed

• Stack overflow with a self-referential $dynamicRef combined with unevaluatedProperties or unevaluatedItems.
• Incorrect unevaluatedProperties and unevaluatedItems results when a meta-schema disables the Applicator vocabulary.

v0.46.0

Added

• ValidatorMap for validating instances against subschemas identified by URI-fragment JSON pointer. #​1075
• CLI: Accept multiple values after -i/--instance (e.g. jsonschema validate schema.json -i *.json). #​1085
• dereference function to recursively inline $ref references. #​422
• CLI: jsonschema dereference subcommand to dereference a schema from the command line.

Breaking Changes

• Registry construction now uses an explicit prepare step, and with_registry now borrows the prepared registry. ValidationOptions::with_resource and ValidationOptions::with_resources were removed in favor of building a Registry first. See the Migration Guide for the details.

Performance

• Avoid registry clones and document clones during validator construction. This improves real-world schema compilation by roughly 10-20% in internal benchmarks.

v0.45.1

Fixed

• Incorrect handling of multipleOf validation for negative numeric instances.
• Incorrect handling of duration format when hours and seconds appear without minutes, or years and days without months.

open-telemetry/opentelemetry-rust (opentelemetry)

v0.32.0

Compare Source

Released 2026-May-08

• Added BoundCounter<T> and BoundHistogram<T> types that cache resolved
  aggregator references for a fixed attribute set. Created via Counter::bind()
  and Histogram::bind(), bound instruments bypass per-call attribute lookup,
  providing significant performance improvements for hot paths where the same
  attributes are used repeatedly. Both types implement Clone so a single bound
  state can be shared across threads or modules without re-binding. Also adds
  the SyncInstrument::bind() trait method and BoundSyncInstrument<T> trait
  for SDK implementors; the trait method has a no-op default so custom
  SyncInstrument impls degrade gracefully without panicking. Gated behind the
  experimental_metrics_bound_instruments feature flag.
• Add reserve method to opentelemetry::propagation::Injector to hint at the number of elements that will be added to avoid multiple resize operations of the underlying data structure. Has an empty default implementation.
• Breaking Removed the following public fields and methods from the SpanBuilder #​3227:
  • trace_id, span_id, end_time, status, sampling_result
  • with_trace_id, with_span_id, with_end_time, with_status, with_sampling_result
• Added #[must_use] attribute to opentelemetry::metrics::AsyncInstrumentBuilder to add compile time warning when .build() is not called on observable instrument builders, preventing silent failures where callbacks are never registered and metrics are never reported.
• Breaking Moved the following SDK sampling types from opentelemetry::trace to opentelemetry_sdk::trace #​3277:
  • SamplingDecision, SamplingResult
  • These types are SDK implementation details and should be imported from opentelemetry_sdk::trace instead.
• "spec_unstable_logs_enabled" feature flag is removed. The capability (and the
  backing specification) is now stable and is enabled by default.
  3278
• Remove the empty "message" field from tracing events emitted via the internal-logs feature
• Fix panic when calling Context::current() from Drop implementations triggered by ContextGuard cleanup (#​3262).

open-telemetry/opentelemetry-rust (opentelemetry-otlp)

v0.32.0

Compare Source

Released 2026-May-08

• Add tls-provider-agnostic feature flag for environments that require a custom crypto backend (e.g., OpenSSL for FIPS compliance). Enables TLS code paths without bundling ring or aws-lc-rs.
• Add build() directly on SpanExporterBuilder, MetricExporterBuilder, and LogExporterBuilder
  (before selecting a transport), which auto-selects the transport based on the
  OTEL_EXPORTER_OTLP_PROTOCOL environment variable or enabled features.
  #​3394
• Breaking Removed ExportConfig, HasExportConfig, with_export_config(), HasTonicConfig, HasHttpConfig, TonicConfig, and HttpConfig from public API.
  Use the public WithExportConfig, WithTonicConfig, and WithHttpConfig trait methods instead, which remain unchanged.
• The gRPC/tonic OTLP exporter's build method now returns an error for all signals (traces, metrics, logs) when
  an https:// endpoint is configured but no TLS feature (tls-ring or tls-aws-lc) is enabled, instead of
  silently sending unencrypted traffic. When a TLS feature is enabled and an https:// endpoint is used without
  an explicit .with_tls_config(), a default ClientTlsConfig is automatically applied.
  #​3182
• Prevent auth tokens from leaking in export error messages. gRPC and HTTP
  exporter errors no longer include potentially sensitive server responses
  (e.g., authentication tokens echoed back). Error messages returned to SDK
  processors contain only the gRPC status code or HTTP status code. Full
  details are logged at DEBUG level only.
  #​3021
• Surface pre-flight transport error details at ERROR level when grpc-tonic
  OTLP export fails due to a local misconfiguration. When the returned
  tonic::Status wraps a local transport error (invalid URL, connect failure,
  DNS), its source chain (e.g., "transport error: invalid URI") is appended
  to the returned error so SDK processors surface it at ERROR without
  requiring DEBUG logging. Server-returned gRPC status messages remain
  DEBUG-only to preserve the auth-token leak safeguards from
  #​3021.
  #​3331
• Add support for per-signal protocol environment variables:
  OTEL_EXPORTER_OTLP_TRACES_PROTOCOL, OTEL_EXPORTER_OTLP_METRICS_PROTOCOL,
  OTEL_EXPORTER_OTLP_LOGS_PROTOCOL. These allow configuring different transport protocols
  per signal type. Signal-specific vars take precedence over generic OTEL_EXPORTER_OTLP_PROTOCOL.
  The auto-select build() method on each exporter builder now respects the full priority chain:
  signal-specific env var > generic env var > feature-based default.
• Transport/protocol mismatch validation: HTTP transport returns InvalidConfig when gRPC protocol
  is requested; gRPC transport returns InvalidConfig when an HTTP protocol is requested.
• Breaking: Protocol::default() no longer consults the OTEL_EXPORTER_OTLP_PROTOCOL
  environment variable. It now returns only the feature-based default (http-json > http-proto >
  grpc-tonic). Protocol resolution from environment variables is handled internally by the
  exporter builders. Users who relied on Protocol::default() to read env vars should use
  Protocol::from_env() instead.
• Add support for OTEL_EXPORTER_OTLP_METRICS_TEMPORALITY_PREFERENCE environment variable
  to configure metrics temporality. Accepted values: cumulative (default), delta,
  lowmemory (case-insensitive). Programmatic .with_temporality() overrides the env var.
• Fix NoHttpClient error when multiple HTTP client features are enabled by using priority-based selection (reqwest-client > hyper-client > reqwest-blocking-client). #​2994
• Add partial success response handling for OTLP exporters (traces, metrics, logs) per OTLP spec. Exporters now log warnings when the server returns partial success responses with rejected items and error messages. #​865
• Refactor internal-logs feature in opentelemetry-otlp to reduce unnecessary dependencies3191
• Fixed [#​2777](https://github.com/open-telemetry/opentelemetry rust/issues/2777) to properly handle shutdown_with_timeout() when using grpc-tonic.
• Deprecate tls feature in favor of explicit tls-ring and tls-aws-lc features.
  Migration: Replace tls with tls-ring (or tls-aws-lc). Users of tls-roots or tls-webpki-roots must now also enable one of these.
• Prevent logging of header values in OTLP tonic exporter #​3465

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

v0.32.1

Released 2026-May-23

• BaggagePropagator now enforces the W3C Baggage maximum header length
  (8192 bytes) and maximum list-member count (64) when extracting an inbound
  baggage header. Headers exceeding 8192 bytes are dropped at the
  propagator boundary; headers with more than 64 list members are
  truncated to the first 64 entries. The change keeps the propagator from
  parsing attacker-controlled input beyond the W3C limits instead of doing
  per-entry parse, decode, and allocation work only to discard the excess
  on Baggage insert. See https://www.w3.org/TR/baggage/#limits.
• Reverted the SimpleSpanProcessor telemetry suppression added in 0.32.0
  (see #​3494), which caused a RefCell already borrowed panic when a span
  was started and dropped inside a get_active_span (or Context::map_current)
  closure. Tracked in #​3510. A proper fix for the underlying
  Context::map_current re-entrancy will be investigated separately, after
  which the suppression can be safely re-applied.
• View-provided metric stream name (set via Stream::builder().with_name(...))
  is no longer validated against the instrument name syntax, per
  spec clarification.
  unit and other stream parameters continue to be validated.

v0.32.0

Compare Source

Released 2026-May-08

• SimpleSpanProcessor now suppresses telemetry during export, preventing
  telemetry-induced-telemetry feedback loops. This aligns with the existing
  behavior in BatchSpanProcessor and SimpleLogProcessor.
• Removed SimpleConcurrentLogProcessor and the experimental_logs_concurrent_log_processor
  feature flag. The use cases it was designed for (ETW/user_events exporters) are
  better served by modeling those exporters as processors directly.
• Added Counter::bind() and Histogram::bind() SDK implementations that
  return pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>).
  Bound instruments resolve the attribute-to-aggregator mapping once at bind time
  and cache the result, eliminating per-call HashMap lookups. View attribute
  filtering is applied at bind time so the hot path stays free of per-call
  attribute processing. Bound and unbound recordings with the same (post-view)
  attribute set always aggregate into the same data point, including the empty
  attribute set. Bound entries are never evicted during delta collection while
  a handle exists — idle cycles produce no export but the tracker persists. If
  bind() is called at the cardinality limit, the handle binds directly to
  the overflow tracker — its writes stay on the same direct (no-lookup) hot
  path and consistently land in the otel.metric.overflow=true bucket for
  the lifetime of the handle. To recover a bound handle after delta collection
  frees space, drop the existing handle and call bind() again. Gated behind
  the experimental_metrics_bound_instruments feature flag. Benchmarks show
  ~28x speedup for counter operations and ~9x for histograms.
• Delta metrics collection now uses in-place eviction instead of draining the
  HashMap on every collect cycle. Stale attribute sets that received no measurements
  since the last collection are evicted. Note: recovery from cardinality overflow
  now requires 2 collect cycles — the first marks entries as stale, the second
  evicts them.
• Breaking The SDK testing feature is now runtime agnostic. #​3407
  • TokioSpanExporter and new_tokio_test_exporter have been renamed to TestSpanExporter and new_test_exporter.
  • The following transitive dependencies and features have been removed: tokio/rt, tokio/time, tokio/macros, tokio/rt-multi-thread, tokio-stream, experimental_async_runtime
• Store InstrumentationScope in Arc internally in SdkTracer, making tracer clones cheaper (Arc refcount increment instead of deep copy).
• Add 32-bit platform support by using portable-atomic for AtomicI64 and AtomicU64 in the metrics module. This enables compilation on 32-bit ARM targets (e.g., armv5te-unknown-linux-gnueabi, armv7-unknown-linux-gnueabihf).
• Aggregation enum and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.
• Fix service.name Resource attribute fallback to follow OpenTelemetry
  specification by using unknown_service:<process.executable.name> format when
  service name is not explicitly configured. Previously, it only used
  unknown_service.
• Fix SpanExporter::shutdown() default timeout from 5 nanoseconds to 5 seconds.
• Breaking SpanExporter trait methods shutdown, shutdown_with_timeout, and force_flush now take &self instead of &mut self for consistency with LogExporter and PushMetricExporter. Implementers using interior mutability (e.g., Mutex, AtomicBool) require no changes.
• Added Resource::get_ref(&self, key: &Key) -> Option<&Value> to allow retrieving a reference to a resource value without cloning.
• Breaking Removed the following public hidden methods from the SdkTracer #​3227:
  • id_generator, should_sample
• Breaking Moved the following SDK sampling types from opentelemetry::trace to opentelemetry_sdk::trace #​3277:
  • SamplingDecision, SamplingResult
  • These types are SDK implementation details and should be imported from opentelemetry_sdk::trace instead.
• StreamBuilder::build() now rejects usize::MAX as a cardinality limit
  with a validation error. #​3506
• Fix Histogram boundaries being ignored in the presence of views #​3312
• TracerProviderBuilder::with_sampler allows to pass boxed instance of ShouldSample [#​3313][3313]
• Fix ObservableCounter and ObservableUpDownCounter now correctly report only data points from the current measurement cycle, removing stale attribute combinations that are no longer observed. #​3248
• Fix panic when SpanProcessor::on_end calls Context::current() (#​3262).
  • Updated SpanProcessor::on_end documentation to clarify that Context::current() returns the parent context, not the span's context
• Fix traceparent headers with unknown flags (e.g. W3C random-trace-id flag 0x02) being incorrectly rejected. Unknown flags are now accepted and zeroed out as required by the W3C trace-context spec. #​3435
• Breaking InMemoryExporterError has been removed and replaced by OTelSdkError, and a new JaegerRemoteSamplerBuildError introduced to replace last uses of TraceError. #​3458
• "spec_unstable_logs_enabled" feature flag is removed. The capability (and the
  backing specification) is now stable and is enabled by default. #​3278

proptest-rs/proptest (proptest)

v1.11.0

Compare Source

rust-random/rand (rand)

v0.10.2

Compare Source

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#​1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#​1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#​1791)

v0.10.1

Compare Source

This release includes a fix for a soundness bug; see #​1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#​1761)
• Deprecate feature log (#​1763)

v0.10.0

Compare Source

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#​1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#​1632)
• Use Edition 2024 and MSRV 1.85 (#​1653)
• Let Fill be implemented for element types, not sliceable types (#​1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#​1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#​1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#​1674)
• Remove Clone support for StdRng, ReseedingRng (#​1677)
• Use postcard instead of bincode to test the serde feature (#​1693)
• Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#​1695)
• Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#​1697)
• Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#​1717)

Additions

• Add fns IndexedRandom::choose_iter, choose_weighted_iter (#​1632)
• Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#​1649)
• Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#​1659)
• Fn rand::make_rng() -> R where R: SeedableRng (#​1734)

Removals

• Removed ReseedingRng (#​1722)
• Removed unused feature "nightly" (#​1732)
• Removed feature small_rng (#​1732)

v0.9.5

Compare Source

What's Changed

• rand v0.9.5: backport #​1790 by @​dhardy in #​1803

Full Changelog: rust-random/rand@0.9.4...0.9.5

v0.9.4

Compare Source

Fixes

• Fix doc build (#​1766)

Full Changelog: rust-random/rand@0.9.3...0.9.4

v0.9.3

Compare Source

seanmonstar/reqwest (reqwest)

v0.13.4

Compare Source

• Add ClientBuilder::tls_sslkeylogfile(bool) option to allow using the related environment variable.
• Add ClientBuilder::http2_keep_alive_* options for the blocking client.
• Add TLS 1.3 support when using native-tls backend.
• Fix redirect handling to strip sensitive headers when the scheme changes.
• Fix HTTP/3 happy-eyeball connection creation.
• Upgrade hickory-resolver to 0.26.

v0.13.3

Compare Source

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

serde-rs/json (serde_json)

v1.0.151

Compare Source

• Add RawValue::from_string_unchecked (#​1331, thanks @​WonderLawrence)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

RustCrypto/hashes (sha1)

v0.11.0

Compare Source

v0.10.7

Compare Source

launchbadge/sqlx (sqlx)

v0.9.0

Compare Source

Important Announcements

New Github Organization

Shortly after this release is published, the SQLx repository will be transferred to a new GitHub organization:
https://github.com/transact-rs/

This is because SQLx has not been owned or maintained by LaunchBadge, LLC. for a few years now, and has since been
informally transferred to the collective ownership of its principal authors. Moving the repository to a new
organization makes this change more clear, and also allows for potentially inviting outside collaborators.

Cargo.lock Removed from Tracking

The Cargo.lock has been removed from tracking in Git. CI should now always test with the latest versions of
all dependencies by default, alongside our pass that checks with cargo generate-lockfile -Z minimal-versions.

This should eliminate the need for any PRs that update dependencies to also update Cargo.lock or
contend with an endless stream of merge conflicts against it.

N.B. cargo install --locked sqlx-cli will no longer work. However, cargo install sqlx-cli has always
used the latest dependencies by default, ignoring the lockfile, so most users should not be affected. For users
requiring reproducible builds, consider maintaining your own lockfile instead; historically, we only ran cargo update
sporadically, so relying on SQLx's lockfile offered few guarantees anyway.

See [the manual page for cargo install][man-cargo-install] for details.

Breaking

As per our MSRV policy, the supported Rust version for this release cycle is 1.94.0.

• [[#​3383]]: feat: create sqlx.toml format [[@​abonander]]
  • SQLx and sqlx-cli now support per-crate configuration files (sqlx.toml)
  • New functionality includes, but is not limited to:
    • Rename DATABASE_URL for a crate (for multi-database workspaces)
    • Set global type overrides for the macros (supporting custom types)
    • Rename or relocate the _sqlx_migrations table (for multiple crates using the same database)
    • Set characters to ignore when hashing migrations (e.g. ignore whitespace)
  • More to be implemented in future releases.
  • Enable feature sqlx-toml to use.
    • sqlx-cli has it enabled by default, but sqlx does not.
    • Default features of library crates can be hard to completely turn off because of [feature unification],
      so it's better to keep the default feature set as limited as possible.
      [This is something we learned the hard way.][preferred-crates]
  • Guide: see sqlx::_config module in documentation.
  • Reference: [Link]
  • Examples (written for Postgres but can be adapted to other databases; PRs welcome!):
    • Multiple databases using DATABASE_URL renaming and global type overrides: [Link]
    • Multi-tenant database using _sqlx_migrations renaming and multiple schemas: [Link]
    • Force use of chrono when time is enabled (e.g. when using tower-sessions-sqlx-store): [[Link][preferred-crates]]
      • Forcing bigdecimal when rust_decimal is enabled is also shown, but problems with chrono/time are more common.
  • Breaking changes:
    • Significant changes to the Migrate trait
    • sqlx::migrate::resolve_blocking() is now #[doc(hidden)] and thus SemVer-exempt.
• [[#​3486]]: fix(logs): Correct spelling of aquired_after_secs tracing field [[@​iamjpotts]]
  • Breaking behavior change: implementations parsing tracing logs from SQLx will need to update the spelling.
• [[#​3495]]: feat(postgres): remove lifetime from PgAdvisoryLockGuard [[@​bonsairobo]]
• [[#​3526]]: Return &mut Self from the migrator set_ methods [[@​nipunn1313]]
  • Minor breaking change: Migrator::set_ignore_missing and set_locking now return &mut Self instead of &Self
    which may break code in rare circumstances.
• [[#​3541]]: Postgres: force generic plan for better nullability inference. [[@​joeydewaal]]
  • Breaking change: may alter the output of the query!() macros for certain queries in Postgres.
• [[#​3613]]: fix: RawSql lifetime issues [[@​abonander]]
  • Breaking change: adds DB type parameter to all methods of RawSql
• [[#​3670]]: Bump ipnetwork to v0.21.1 [[@​BeauGieskens]]
• [[#​3674]]: Implement Decode, Encode and Type for Box, Arc, Cow and Rc [[@​joeydewaal]]
  • Breaking change: impl Decode for Cow now always decodes Cow::Owned, lifetime is unlinked
  • See this discussion for motivation: #​3674 (comment)
• [[#​3723]]: Add SqlStr [[@​joeydewaal]]
  • Breaking change: all query*() functions now take impl SqlSafeStr
    which is only implemented for &'static str and AssertSqlSafe.
    For all others, wrap in AssertSqlSafe(<query>).
  • This, along with [[#​3960]], finally allows returning owned queries as the type will be Query<'static, DB>.
  • SqlSafeStr trait is deliberat

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[recuu-pfeg]

sha1/sha2 0.11 has breaking API changes in HMAC (Mac trait). Needs code updates in src/verify.rs. Will address after v0.6.0 release.