build(deps): bump the rust group across 1 directory with 11 updates

[dependabot]

Bumps the rust group with 11 updates in the / directory:

Package	From	To
async-trait	0.1.91	0.1.92
clap	4.6.4	4.6.6
http	1.4.2	1.5.0
libloading	0.8.9	0.9.0
sha2	0.10.9	0.11.0
thiserror	2.0.19	2.0.20
tokio-tungstenite	0.27.0	0.29.0
tower-http	0.6.11	0.7.0
uuid	1.24.0	1.24.1
zip	4.6.1	8.6.0
http-body-util	0.1.4	0.1.5

Updates async-trait from 0.1.91 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

• Resolve double_must_use clippy lint in generated code (#303)

Commits

• 82e7e9e Release 0.1.92
• 9a35cb8 Merge pull request #303 from dtolnay/mustuse
• 875ceec Resolve double_must_use clippy lint
• 62993a5 Raise minimum tested compiler to rust 1.88
• See full diff in compare view

Updates clap from 4.6.4 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

Commits

• 348cff3 chore: Release
• d478377 docs: Update changelog
• 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
• 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
• f90a966 fix(complete): Use spaces for indentation in fish
• dd4997b fix(complete): Don't glob-expand bash positionals
• 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
• 8141e11 chore(deps): Update compatible (dev) (#6398)
• 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
• 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
• Additional commits viewable in compare view

Updates http from 1.4.2 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

• feat(method): add QUERY method by @​seanmonstar in hyperium/http#798
• fix(uri): allow empty paths in uri::Builder by @​seanmonstar in hyperium/http#853
• perf(header,uri): faster value validation, URI parse/format, map inserts by @​geeknoid in hyperium/http#852
• fix(uri): enforce max length in PathAndQuery by @​seanmonstar in hyperium/http#856

New Contributors

• @​geeknoid made their first contribution in hyperium/http#852

Full Changelog: hyperium/http@v1.4.2...v1.5.0

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

Commits

• 16fc9a7 v1.5.0
• e559023 fix(uri): enforce max length in PathAndQuery (#856)
• 2178e17 perf(header,uri): faster value validation, URI parse/format, map inserts (#852)
• 03c8cd7 fix(uri): allow empty paths in uri::Builder (#853)
• bb8705b feat(method): add QUERY method (#798)
• See full diff in compare view

Updates libloading from 0.8.9 to 0.9.0

Commits

• dab97c5 0.9.0 release rites
• e893804 refactor: simplify null checks, remove some iffy implementations
• 4b98285 add no-std support
• See full diff in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

• ffe0939 Release sha2 0.11.0 (#806)
• 8991b65 Use the standard order of the [package] section fields (#807)
• 3d2bc57 sha2: refactor backends (#802)
• faa55fb sha3: bump keccak to v0.2 (#803)
• d3e6489 sha3 v0.11.0-rc.9 (#801)
• bbf6f51 sha2: tweak backend docs (#800)
• 155dbbf sha3: add default value for the DS generic parameter on TurboShake128/256...
• ed514f2 Use published version of keccak v0.2 (#799)
• 702bcd8 Migrate to closure-based keccak (#796)
• 827c043 sha3 v0.11.0-rc.8 (#794)
• Additional commits viewable in compare view

Updates thiserror from 2.0.19 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

• Suppress redundant_field_names clippy lint in generated code (#454)

Commits

• b1d5db5 Release 2.0.20
• c4c3ebd Merge pull request #454 from dtolnay/clippy
• 2266152 Suppress redundant_field_names clippy lint
• 2901cfd Raise minimum tested compiler to rust 1.88
• aa9d91f Update ui tests for version 2.0.19
• See full diff in compare view

Updates tokio-tungstenite from 0.27.0 to 0.29.0

Changelog

Sourced from tokio-tungstenite's changelog.

0.29.0

• Update tungstenite to 0.29.0. See tungstenite release.

0.28.0

• Update tungstenite to 0.28.0. See tungstenite release.

Commits

• 7930ff2 Bump version
• 38d0465 Update Readme (#369)
• 35d110c Implement into_inner to get the underlying stream (#367)
• f3ae75d Update tungstenite version and fix bugs
• 25b544e Allow getting a reference to the shared inner stream (#363)
• See full diff in compare view

Updates tower-http from 0.6.11 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Updates uuid from 1.24.0 to 1.24.1

Release notes

Sourced from uuid's releases.

v1.24.1

What's Changed

• Fix non-ASCII character handling in parse diagnostics by @​questfever in uuid-rs/uuid#899
• Prepare for 1.24.1 release by @​KodrAus in uuid-rs/uuid#900

New Contributors

• @​questfever made their first contribution in uuid-rs/uuid#899

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

Commits

• 2ea38af Merge pull request #900 from uuid-rs/cargo/v1.24.1
• 9dbeb04 prepare for 1.24.1 release
• e113df8 Merge pull request #899 from questfever/main
• b017765 Fix non-ASCII character handling in parse diagnostics
• See full diff in compare view

Updates zip from 4.6.1 to 8.6.0

Release notes

Sourced from zip's releases.

v8.6.0

🚀 Features

• add compression not supported as enum error (#774)

🐛 Bug Fixes

• allow for [u8] as filename (#775)

🚜 Refactor

• mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
• use and simplify is_dir (#776)

v8.5.1

🚜 Refactor

• change magic finder to stack buffer (#763)
• simplify extra field parsing (#764)

v8.5.0

🐛 Bug Fixes

• remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

• remove useless magic in struct (#730)
• change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

• cleanup README (#758)

v8.4.0

🚀 Features

• add a check for building benches (#748)

🚜 Refactor

• split part of read.rs for code readability (#744)
• remove unused allow (#745)

⚡ Performance

• skip BufReader for Stored files in make_reader (#739)

⚙️ Miscellaneous Tasks

... (truncated)

Changelog

Sourced from zip's changelog.

8.6.0 - 2026-04-25

🚀 Features

• add compression not supported as enum error (#774)

🐛 Bug Fixes

• allow for [u8] as filename (#775)

🚜 Refactor

• mark ZipFlags as non-exhaustive and add test for HasZipMetadata (#777)
• use and simplify is_dir (#776)

8.5.1 - 2026-04-06

🚜 Refactor

• change magic finder to stack buffer (#763)
• simplify extra field parsing (#764)

8.5.0 - 2026-04-01

🐛 Bug Fixes

• remove zip64 comment and add zip64 extensible data sector (#747)

🚜 Refactor

• remove useless magic in struct (#730)
• change extra_field from Arc<Vec> to Arc<[u8]> (#741)

⚙️ Miscellaneous Tasks

• cleanup README (#758)

8.4.0 - 2026-03-23

🚀 Features

• add a check for building benches (#748)

🚜 Refactor

• split part of read.rs for code readability (#744)
• remove unused allow (#745)

⚡ Performance

... (truncated)

Commits

• 771dfc5 chore: release v8.6.0 (#781)
• 8e480cc chore(deps): update sha1 requirement from 0.10 to 0.11 (#767)
• 2513bbe chore(deps): update aes requirement from 0.8 to 0.9 (#787)
• 957e240 ci(deps): bump actions/cache from 5.0.4 to 5.0.5 (#786)
• 0329d9d fix: allow for [u8] as filename (#775)
• ddcf854 ci(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#788)
• 42323a8 ci(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 (#785)
• 901014a ci(deps): bump crate-ci/typos from 1.45.0 to 1.45.1 (#784)
• 07702d4 feat: add compression not supported as enum error (#774)
• 2d0c46b ci(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (#783)
• Additional commits viewable in compare view

Updates http-body-util from 0.1.4 to 0.1.5

Commits

• 07838bd http-body-util v0.1.5
• 612118c docs: migrate from doc_auto_cfg to doc_cfg (#175)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.