chore(deps): Bump the cargo-patch group across 1 directory with 13 updates

[dependabot]

Bumps the cargo-patch group with 13 updates in the / directory:

Package	From	To
serde_json	1.0.149	1.0.150
rkyv	0.8.15	0.8.16
axum	0.8.8	0.8.9
tower-http	0.6.8	0.6.11
rustls	0.23.37	0.23.40
rustls-pki-types	1.14.0	1.14.1
uuid	1.23.0	1.23.1
clap	4.6.0	4.6.1
normpath	1.5.0	1.5.1
profiling	1.0.17	1.0.18
yoke	0.8.1	0.8.2
libc	0.2.183	0.2.186
assert_cmd	2.2.0	2.2.2

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• dc8003a Raise required compiler for preserve_order feature to 1.85
• a42fa98 Unpin CI miri toolchain
• 684a60e Pin CI miri to nightly-2026-02-11
• 7c7da33 Raise required compiler to Rust 1.71
• acf4850 Simplify Number::is_f64
• 6b8ceab Resolve unnecessary_map_or clippy lint
• Additional commits viewable in compare view

Updates rkyv from 0.8.15 to 0.8.16

Commits

• 47ebe03 Release 0.8.16
• 5828cf5 Harden clear() impls against panicking drops
• 7f93b33 Remove unnecessary Ord bound on MapKV impl
• 71eb72a Fix hashbrown-0_16 impl, update features lists
• 7f18f92 Update to hashbrown 0.17 (#659)
• d3c20a8 feat: implement NoUndef for [T] where T: NoUndef. (#656)
• 985b023 Fix compilation for 32-bit systems using 64-bit pointers
• 18941fb Add into_parts and from_parts for AlignedVec (#653)
• See full diff in compare view

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
• changed: Update minimum rust version to 1.80 (#3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#3656)
• fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

• c59208c revert axum-core changelog changes
• 99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
• 23d7098 Revert "axum-core 0.5.6"
• e8a39ad axum-macros 0.5.1
• 6e9a249 axum-extra 0.12.6
• 0ec9041 axum 0.8.9
• c3fcebb axum-core 0.5.6
• a8790fc update release notes
• 26ba7bb docs: consolidate state management docs in crate root (#3683)
• 9fc59ef Update to tokio-tungstenite 0.29 (#3689)
• Additional commits viewable in compare view

Updates tower-http from 0.6.8 to 0.6.11

Release notes

Sourced from tower-http's releases.

tower-http-0.6.11

Added

• set-header: add SetMultipleResponseHeadersLayer and SetMultipleResponseHeader for setting multiple response headers at once. Supports overriding, appending, and if_not_present modes. Header values can be fixed or computed dynamically via closures (#672)

  use http::{Response, header::{self, HeaderValue}};
  use http_body::Body as _;
  use tower_http::set_header::response::SetMultipleResponseHeadersLayer;
  let layer = SetMultipleResponseHeadersLayer::overriding(vec![
  (header::X_FRAME_OPTIONS, HeaderValue::from_static("DENY")).into(),
  (header::CONTENT_LENGTH, |res: &Response<MyBody>| {
  res.body().size_hint().exact()
  .map(|size| HeaderValue::from_str(&size.to_string()).unwrap())
  }).into(),
  ]);

• set-header: add SetMultipleRequestHeadersLayer and SetMultipleRequestHeaders for setting multiple request headers at once, mirroring the response-side API (#677)

• classify: add From<i32> and From<NonZeroI32> impls for GrpcCode. Unrecognized status codes map to GrpcCode::Unknown (#506)

Changed

• compression: compress application/grpc-web responses. Previously all application/grpc* content types were excluded from compression; now only application/grpc (non-web) is excluded (#408)

Fixed

• fs: fix ServeDir returning 500 instead of 405 for non-GET/HEAD requests when call_fallback_on_method_not_allowed is enabled but no fallback service is configured (#587)
• fs: remove duplicate cfg attribute on is_reserved_dos_name (#675)

#408: tower-rs/tower-http#408 #506: tower-rs/tower-http#506 #587: tower-rs/tower-http#587 #672: tower-rs/tower-http#672 #675: tower-rs/tower-http#675 #677: tower-rs/tower-http#677

All PRs

• ci: fix flaky encoding test, add nightly stress test job by @​jlizen in tower-rs/tower-http#670

... (truncated)

Commits

• 1d082ef v0.6.11
• 9c3117d feat: set multiple request header (#677)
• 667e7c7 Remove duplicate cfg attribute for is_reserved_dos_name (#675)
• 7551a9b feat(set_header): refactor and improve multiple header middleware (#672)
• 991e9ee add From<i32> impl for GrpcCode (#506)
• 3962dba Do compress grpc-web responses (#408)
• f0b3bb6 Fix serve_dir method not allowed handling when no fallback is configured (#587)
• d1a571b ci: use static timeout in stress-test workflow (#671)
• 309555a ci: fix flaky encoding test, add nightly stress test job (#670)
• 4532fc2 v0.6.10
• Additional commits viewable in compare view

Updates rustls from 0.23.37 to 0.23.40

Commits

• b44c09f Prepare 0.23.40
• e7a555f Prefer Ord::max to core::cmp
• c0005be ech: base inner name padding on actual extension
• 4e49529 ech: test inner name padding
• 3e06ef1 ech: add both name and "gross" padding
• c574ffd ech: avoid short-lived allocation for padding
• 8bf935c ech: pop comment from match arm
• 9088004 ech: expand maximum_name_length to usize ASAP
• a612901 Default require_ems based on CryptoProvider FIPS status
• 0541605 Cargo: version 0.23.38 -> 0.23.39
• Additional commits viewable in compare view

Updates rustls-pki-types from 1.14.0 to 1.14.1

Release notes

Sourced from rustls-pki-types's releases.

1.14.1

Parsing PEM will now error for PEM sections larger than 256 MB in size, to avoid running out of memory during parsing. The limit was chosen based on historical data from large certificate revocation lists from the web PKI.

What's Changed

• Remove mention of rustls-pemfile from docs by @​ranile in rustls/pki-types#103
• Update ECH reference to RFC9849 by @​ctz in rustls/pki-types#104
• pem: error for sections that are too large by @​djc in rustls/pki-types#106
• Update ECH reference to RFC 9849 by @​ctz in rustls/pki-types#107
• Adjust PEM size limit to account for huge CRLs by @​ctz in rustls/pki-types#108

Commits

• bb3c1da Adjust PEM size limit to account for huge CRLs
• 20bcfe1 Bump version to 1.14.1
• b796d3d pem: error for sections that are too large
• 422d8cf Update ECH reference to RFC 9849
• 14ce65c Remove mention of rustls-pemfile from docs
• See full diff in compare view

Updates uuid from 1.23.0 to 1.23.1

Release notes

Sourced from uuid's releases.

v1.23.1

What's Changed

• Remove deprecated msrv feature from wasm-bindgen dependency by @​guybedford in uuid-rs/uuid#877
• fix: Timestamp::from_gregorian deprecation note by @​aznashwan in uuid-rs/uuid#878
• Prepare for 1.23.1 release by @​KodrAus in uuid-rs/uuid#879

New Contributors

• @​guybedford made their first contribution in uuid-rs/uuid#877
• @​aznashwan made their first contribution in uuid-rs/uuid#878

Full Changelog: uuid-rs/uuid@v1.23.0...v1.23.1

Commits

• ca0c85f Merge pull request #879 from uuid-rs/cargo/v1.23.1
• b4db015 prepare for 1.23.1 release
• 771069d Merge pull request #878 from aznashwan/fix-from-gregorian-deprecation-note
• 80994a2 fix: Timestamp::from_gregorian deprecation note
• 90c5be8 Merge pull request #877 from guybedford/remove-wasm-bindgen-msrv
• 8b8c4f4 Remove deprecated feature from wasm-bindgen dependency
• See full diff in compare view

Updates clap from 4.6.0 to 4.6.1

Release notes

Sourced from clap's releases.

v4.6.1

[4.6.1] - 2026-04-15

Fixes

• (derive) Ensure rebuilds happen when an read env variable is changed

Changelog

Sourced from clap's changelog.

[4.6.1] - 2026-04-15

Fixes

• (derive) Ensure rebuilds happen when an read env variable is changed

Commits

• 1420275 chore: Release
• d2c817d docs: Update changelog
• f88c94e Merge pull request #6341 from epage/sep
• acbb822 fix(complete): Reduce risk of conflict with actual subcommands
• a49fadb refactor(complete): Pull out subcommand separator
• ddc008b Merge pull request #6332 from epage/update
• 497dc50 chore: Update compatible dependencies
• dca2326 Merge pull request #6331 from clap-rs/renovate/j178-prek-action-2.x
• 54bdaa3 chore(deps): Update j178/prek-action action to v2
• f0d30d9 chore: Release
• Additional commits viewable in compare view

Updates normpath from 1.5.0 to 1.5.1

Release notes

Sourced from normpath's releases.

1.5.1

• Bumped dependency versions

Commits

• 38697db Bump version
• f1f57bc Merge pull request #26 from dylni/dependabot/cargo/uniquote-5.0
• 94ef358 Adjust to "uniquote" API changes
• 3d8ae77 Update uniquote requirement from 4.0 to 5.0
• 1b670a7 Fix new warning
• See full diff in compare view

Updates profiling from 1.0.17 to 1.0.18

Changelog

Sourced from profiling's changelog.

1.0.18

• MSRV updated to 1.85. (Upstream packages adopting edition 2024 cannot be compiled on prior MSRV)
• Update puffin to 0.20

Commits

• See full diff in compare view

Updates yoke from 0.8.1 to 0.8.2

Changelog

Sourced from yoke's changelog.

Changelog

icu 2.2.x

Several crates have had patch releases in the 2.2 stream:

• Components
  • (2.2.1) icu_calendar
    • Fix extended year calculations in Gregorian-like and Coptic-like calendars (unicode-org#7849)

icu4x 2.2

• Components
  • General
    • Use HTTPS links in docs (unicode-org#7212)
    • Update MSRV to 1.86 (unicode-org#7576)
    • Updated to CLDR 48.2 (unicode-org#7792)
    • Replace experimental features with unstable features (unicode-org#7566)
    • Add categories and keywords to Cargo.toml for all components (unicode-org#7737)
  • icu_calendar
    • Add Date::try_new, which replaces Date::try_new_from_codes, and takes typed year/month values. (unicode-org#7773, unicode-org#7764)
    • New methods: Date::try_new (and primarily-internal Calendar::new_date)
    • New types: InputYear, DateNewError
    • Handle possible Overflow values on individual calendars (unicode-org#7795)
    • New Date::try_from_fields API for fully general date construction from various choices of year and month values (unicode-org#7798)
    • New methods: Date::try_from_fields()
    • New types: DateFields, DateFromFieldsOptions, Overflow, MissingFieldsStrategy, DateFromFieldsError
    • New associated method: Calendar::from_fields()
    • New Date arithmetic APIs for adding and subtracting dates (unicode-org#7798, unicode-org#7355, unicode-org#7257)
    • New methods: Date::try_add_with_options, Date::try_added_with_options, Date::try_until_with_options
    • New types: DateDuration, DateAddOptions, DateDifferenceOptions, DateDurationUnit, DateDurationParseError, DateAddError, MismatchedCalendarError
    • New associated items: Calendar::add, Calendar::until, Calendar::DateCompatibilityError
    • Introduce a new Month type, preferred over using month codes (unicode-org#7147, unicode-org#7756)
      • New type: Month
      • New method: MonthInfo::to_input()
    • Introduce year/date ranges to all APIs, documented on the APIs themselves. Date now has a fundamental range (ISO years between ±999,999), and most constructors enforce a stricter range of ±9999 years for input years. (unicode-org#7676, unicode-org#7062, unicode-org#7629, unicode-org#7753, unicode-org#7219, unicode-org#7227)
    • Add constructors with Month for lunisolar calendars (unicode-org#7485)
    • New methods: Date::try_new_korean_traditional(), Date::try_new_chinese_traditional(), Date::try_new_hebrew_v2()
    • Expose LeapStatus on MonthInfo (unicode-org#7667)
    • New method: MonthInfo::leap_status()
    • New enum: LeapStatus
    • (Unstable) Integrate with chrono, jiff, and time (unicode-org#7617, unicode-org#7711)
    • New impls: From<chrono::NaiveDate>, From<jiff::civil::Date>, From<time::Date> for Date<Gregorian>
    • Replace Date::day_of_week by Date::weekday (unicode-org#7288)
      • New method: Date::weekday()
    • Deprecate Date::new_from_iso/Date::to_iso (unicode-org#7287)
    • Deprecate Date::extended_year() (use Date::year().extended_year()) (unicode-org#7289)
    • Remove YearInfo: PartialEq bound (unicode-org#7743)
    • Start producing Meiji era only after Meiji 6 (unicode-org#7503)

... (truncated)

Commits

• See full diff in compare view

Updates libc from 0.2.183 to 0.2.186

Release notes

Sourced from libc's releases.

0.2.186

Added

• Apple: Add KEVENT_FLAG_* constants (#5070)
• Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#5060)

Changed

• CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#5058)

0.2.185

Added

• EspIDF: Add espidf_picolibc cfg for picolibc O_* flag values (#5035)
• Hexagon: add missing constants and fix types for linux-musl (#5042)
• Redox: Add semaphore functions (#5051)
• Windows: Add sprintf, snprintf, and the scanf family (#5024)

Fixed

• Hexagon: Decouple time64 types from musl symbol redirects (#5040)
• Horizon: Change POLL constants from c_short to c_int (#5045)

0.2.184

MSRV

This release increases the MSRV of libc to 1.65. With this update, you can now always use the core::ffi::c_* types with libc definitions, since libc has been changed to reexport from core rather than redefining them. (This usually worked before but had edge cases.) (#4972)

Added

• BSD: Add IP_MINTTL to bsd (#5026)
• Cygwin: Add TIOCM_DSR (#5031)
• FreeBSD: Added xfile structe and file descriptor types (#5002)
• Linux: Add CAN netlink bindings (#5011)
• Linux: Add struct ethhdr (#4239)
• Linux: Add struct ifinfomsg (#5012)
• Linux: Define max_align_t for riscv64 (#5029)
• NetBSD: Add missing CLOCK_ constants (#5020)
• NuttX: Add _SC_HOST_NAME_MAX (#5004)
• VxWorks: Add flock and F_*LCK constants (#4043)
• WASI: Add all _SC_* sysconf constants (#5023)

Deprecated

The remaining fixed-width integer aliases, __uint128_t, __uint128, __int128_t, and __int128, have been deprecated. Use i128 and u128 instead. (#4343)

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.186 - 2026-04-24

Added

• Apple: Add KEVENT_FLAG_* constants (#5070)
• Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#5060)

Changed

• CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#5058)

0.2.185 - 2026-04-13

Added

• EspIDF: Add espidf_picolibc cfg for picolibc O_* flag values (#5035)
• Hexagon: add missing constants and fix types for linux-musl (#5042)
• Redox: Add semaphore functions (#5051)
• Windows: Add sprintf, snprintf, and the scanf family (#5024)

Fixed

• Hexagon: Decouple time64 types from musl symbol redirects (#5040)
• Horizon: Change POLL constants from c_short to c_int (#5045)

0.2.184 - 2026-04-01

MSRV

This release increases the MSRV of libc to 1.65. With this update, you can now always use the core::ffi::c_* types with libc definitions, since libc has been changed to reexport from core rather than redefining them. (This usually worked before but had edge cases.) (#4972)

Added

• BSD: Add IP_MINTTL to bsd (#5026)
• Cygwin: Add TIOCM_DSR (#5031)
• FreeBSD: Added xfile structe and file descriptor types (#5002)
• Linux: Add CAN netlink bindings (#5011)
• Linux: Add struct ethhdr (#4239)
• Linux: Add struct ifinfomsg (#5012)
• Linux: Define max_align_t for riscv64 (#5029)
• NetBSD: Add missing CLOCK_ constants (#5020)
• NuttX: Add _SC_HOST_NAME_MAX (#5004)
• VxWorks: Add flock and F_*LCK constants (#4043)
• WASI: Add all _SC_* sysconf constants (#5023)

Deprecated

... (truncated)

Commits

• 42620ff [0.2] libc: Release 0.2.186
• 9db2eaa apple: add KEVENT_FLAG_* constants
• 3840939 Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE for linux
• f697deb chore: migrate from Cirrus CI to GHA
• 71d5bfc libc: Release 0.2.185
• 1027d1c Revert "ci: Pin nightly to 2026-04-01"
• 0e9c6e5 redox: Add semaphore functions
• 24ef457 feat: add back support for gnu windows x86 in ci
• aa75caf horizon: Change POLL constants from c_short to c_int
• b7eda5a hexagon: add missing constants and fix types for linux-musl
• Additional commits viewable in compare view

Updates assert_cmd from 2.2.0 to 2.2.2

Changelog

Sourced from assert_cmd's changelog.

[2.2.2] - 2026-05-11

Fixes

• Ensure #[track_caller] works for better panic messages

[2.2.1] - 2026-04-17

Internal

• Dependency update

Commits

• feece89 chore: Release assert_cmd version 2.2.2
• 367cdf7 docs: Update changelog
• a98cc85 Merge pull request #289 from marcospb19/track_caller
• cd2e167 fix: .success() not reporting panic location
• 45a1c74 chore(deps): Update Prek to v0.3.13 (#293)
• f1d9b5b chore(deps): Update Prek to v0.3.12 (#292)
• 1d34bab Merge pull request #291 from epage/template
• d9a70ad style: Make clippy happy
• 4f5b5af chore: Update from _rust template
• 1e1d586 chore(renovate): Fix the tag
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.