chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
anyhow	workspace.dependencies	patch	1.0.103 → 1.0.104
anymap3	workspace.dependencies	minor	1.0.1 → 1.1.0
arc-swap	workspace.dependencies	patch	1.9.1 → 1.9.2
async-compression	workspace.dependencies	patch	0.4.42 → 0.4.43
async-trait	workspace.dependencies	patch	0.1.89 → 0.1.92
aws-lc-rs	workspace.dependencies	minor	1.17.1 → 1.18.0
bytes	workspace.dependencies	patch	1.12.0 → 1.12.1
bytesize	workspace.dependencies	minor	2.4.0 → 2.7.0
clap	workspace.dependencies	patch	4.6.1 → 4.6.6
crossbeam-queue (source)	workspace.dependencies	patch	0.3.12 → 0.3.13
futures (source)	workspace.dependencies	patch	0.3.32 → 0.3.33	0.3.34
http	workspace.dependencies	minor	1.4.2 → 1.5.0
http-body	workspace.dependencies	minor	1.0.1 → 1.1.0
http-body-util	workspace.dependencies	patch	0.1.3 → 0.1.4	0.1.5
hyper (source)	workspace.dependencies	minor	1.10.1 → 1.11.0
kube	workspace.dependencies	minor	4.0.0 → 4.2.0
libc	workspace.dependencies	patch	0.2.186 → 0.2.189
memchr	workspace.dependencies	patch	2.8.2 → 2.8.3
opentelemetry-semantic-conventions (source)	workspace.dependencies	patch	0.32.0 → 0.32.1
proc-macro2	workspace.dependencies	patch	1.0.106 → 1.0.107
quote	workspace.dependencies	patch	1.0.45 → 1.0.47
rand (source)	workspace.dependencies	patch	0.10.1 → 0.10.2
regex	workspace.dependencies	minor	1.12.4 → 1.13.1
rustls	workspace.dependencies	patch	0.23.41 → 0.23.43
rustls-pki-types	workspace.dependencies	minor	1.14.1 → 1.15.1
serde (source)	workspace.dependencies	patch	1.0.228 → 1.0.229
serde_json	workspace.dependencies	patch	1.0.150 → 1.0.151
serde_with	workspace.dependencies	minor	3.21.0 → 3.22.0
snafu	workspace.dependencies	patch	0.9.1 → 0.9.2
socket2	workspace.dependencies	patch	0.6.4 → 0.6.5
tokio (source)	workspace.dependencies	minor	1.52.3 → 1.53.1
tokio-util (source)	workspace.dependencies	patch	0.7.18 → 0.7.19
triomphe	workspace.dependencies	patch	0.1.15 → 0.1.16
trybuild	workspace.dependencies	patch	1.0.117 → 1.0.120
twox-hash	workspace.dependencies	patch	2.1.2 → 2.1.3
uuid	workspace.dependencies	minor	1.23.3 → 1.24.0	1.24.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

reivilibre/anymap3 (anymap3)

v1.1.0

Compare Source

Removals and Deprecations

• Increase Minimum Supported Rust Version (MSRV) to 1.56 (October 2021). (#​7)

Features

• Support the AnyDebug trait from the anymore crate. Enable with anymore crate feature. Contributed by @​DJMcNab — thank you. (#​5)

Internal Changes

• Add CI for tests and linting. (#​6)
• Fix our tests to work with new Rust versions, which changed the internal representation of TypeId. Runtime behaviour was unaffected. (#​7)

vorner/arc-swap (arc-swap)

v1.9.2

• Document RefCnt must not panic (#​208).

Nullus157/async-compression (async-compression)

v0.4.43

Compare Source

Other

• Fix hang when decoding a corrupt subsequent zstd frame (#​470)

dtolnay/async-trait (async-trait)

v0.1.92

Compare Source

• Resolve double_must_use clippy lint in generated code (#​303)

v0.1.91

Compare Source

v0.1.90

Compare Source

• Update to syn 3

aws/aws-lc-rs (aws-lc-rs)

v1.18.0: aws-lc-rs v1.18.0

Compare Source

AWS-LC-FIPS module updated to 4.x

This release switches aws-lc-fips-sys (used via the fips feature) from the AWS-LC-FIPS 3.x branch to AWS-LC-FIPS 4.0.

• If your project requires FIPS compliance, please consult your local FIPS compliance experts before upgrading. The FIPS v3 module shipped in aws-lc-rs v1.17.x is FIPS 140-3 validated (Certificate #​5314 static, Certificate #​5298 dynamic). The 4.x module has completed validation testing by an accredited lab and has been submitted to NIST for certification. Refer to the CMVP Modules In Progress List for its current status, and to FIPS.md for security policies and supported operating environments.
• Consumers who need to remain on the FIPS 3.x module should pin aws-lc-rs to <1.18.0. See the Cargo Book on Specifying Dependencies.

AWS-LC-FIPS module	aws-lc-rs
2.0.x	<1.12.0
3.0.x	<1.18.0
4.x	latest

What's Changed

• Switch aws-lc-fips-sys to AWS-LC's "FIPS 4.0" branch by @​justsmth in #​1185
  • aws-lc-fips-sys v0.13.16 -> v0.14.0. Please see the call-out above.
• The ML-DSA signature APIs are now stable 🎉 by @​justsmth in #​1188 and #​1189
  • PqdsaKeyPair, PqdsaPublicKey, PqdsaPrivateKey, PqdsaSigningAlgorithm, PqdsaVerificationAlgorithm, and the ML_DSA_44 / ML_DSA_65 / ML_DSA_87 algorithms (and their _SIGNING counterparts) now live in aws_lc_rs::signature. ML-DSA no longer requires the unstable feature, and is now available under fips -- the FIPS 4.0 module provides ML-DSA, which is what had kept these APIs unstable. See our updated API documentation.
  • Please migrate any use of aws_lc_rs::unstable::signature to aws_lc_rs::signature. The unstable::signature module remains as deprecated aliases and will be removed in a future release.
  • PqdsaKeyPair::to_pkcs8 has been renamed to to_pkcs8v1, since elsewhere in the module an unqualified to_pkcs8 means PKCS#8 v2. A deprecated to_pkcs8 alias remains available under the unstable feature.
  • Existing unstable consumers continue to compile, with deprecation warnings. Two cases need a source change: builds using #![deny(warnings)], and code that glob-imports both signature::* and unstable::signature::*, which now needs an explicit import to disambiguate.
  • Behavior change: PqdsaVerificationAlgorithm::parsed_verify_digest_sig now always returns Unspecified. Digest-then-verify is not an operation defined by FIPS 204 -- pure ML-DSA signs the message itself, and the pre-hash variant (HashML-DSA) uses a distinct domain separator that this API does not implement.
• Add out-of-place AEAD sealing by @​iainmcgin in #​1183
  • Adds seal_separate_out_of_place to LessSafeKey and TlsRecordSealingKey. Every sealing entry point was previously in-place, so a caller whose plaintext was borrowed or shared had to copy it into a scratch buffer purely to make it mutable. This mirrors the existing open_separate_gather, so the sealing and opening directions now match.
• Add rsa::KeyPair::from_components for constructing RSA key pairs from raw components by @​justsmth in #​1175
  • Adds rsa::KeyPairComponents and rsa::KeyPair::from_components, matching ring 0.17, so a signing key can be built from formats such as JWK without first encoding the components as DER. Unlike ring, d and the CRT parameters are validated at construction using RSA_check_key, so keys with inconsistent or placeholder values that ring accepts may be rejected. Unnecessary generic bounds were also removed from PublicKeyComponents.
• Automatically optimize aws-lc for size when opt-level is "s" or "z" by @​justsmth in #​1159
  • The builder now enables AWS-LC's size-optimized configuration (OPENSSL_SMALL, and no AVX-512 assembly on x86_64) whenever Cargo is already building for size. In CI, a small binary exercising SHA-256, AES-256-GCM, and ECDSA P-256 is 36-50% smaller at opt-level=z than at opt-level=3: 50% on x86_64 Linux, 48% on aarch64 macOS, 39% on x86_64 Windows, 36% on aarch64 Linux. Your own savings depend on how much of AWS-LC your binary retains.
  • No algorithms are removed and outputs are unchanged; the trade-off is slower elliptic-curve performance. Set AWS_LC_SYS_SMALL=1/=0 to force it on or off independently of opt-level.
  • FIPS builds do not opt in automatically: aws-lc-fips-sys requires an explicit AWS_LC_FIPS_SYS_SMALL=1, and warns when it is set.
  • Partially addresses #​745; the default size under opt-level=3 footprint is unchanged.
• Export native library build metadata from the -sys crates by @​justsmth in #​1187, including original commits from @​glebpom in #​1184
  • Downstream build scripts compiling C code against AWS-LC can now locate our artifacts via DEP_AWS_LC_* / DEP_AWS_LC_FIPS_* (libdir, libcrypto_path, link_kind, and libssl_path with ssl), consistently across the CC, CMake, and system-library build paths. Existing linker directives are unchanged. On Windows, the *_path values are the link-time artifact (import library), not the runtime DLL.
• Key wrap hardening by @​justsmth in #​1190 and #​1191
  • KeyEncryptionKey::unwrap no longer underflows on ciphertexts shorter than 8 bytes. Since the ciphertext is untrusted input, builds with overflow-checks = true would panic instead of returning the documented Err(Unspecified); default release builds were unaffected.
  • KeyEncryptionKey now zeroizes its key material on drop, consistent with the other key types in this crate.
• docs(signature): correct outdated note about signing a separate digest by @​WesleyRosenblum in #​1186

Upstream AWS-LC (v5.5.0)

aws-lc-sys v0.44.0 aligns with AWS-LC v5.5.0 (previously v5.2.0). See also the release notes for v5.3.0 and v5.4.0.

Build Improvements

• Fix bindings copy from read-only prebuilt AWS-LC install by @​justsmth in #​1194
  • Copies into OUT_DIR now remove any stale destination first and leave the fresh copy writable, so building against a read-only prebuilt install (e.g. the Nix store) no longer fails with Permission denied on a build-script rerun. An OUT_DIR already poisoned by an earlier build now recovers without a cargo clean.

Issues Being Closed

• ML-DSA stabilization? -- #​964
• Expose out-of-place AEAD sealing -- #​1182
• Construct an RSA Key pair from raw private components -- #​791
• aws-lc-sys build script fails to copy bindings from read only prebuild aws-lc on repeat runs -- #​1193

Other Merged PRs

• ci: fix mdbook test failure and run docs checks on PRs by @​justsmth in #​1181
• Publish script fixes: cargo clean failure, and verify aws-lc-rs against minimum published sys crates by @​justsmth in #​1179
• Prepare aws-lc-sys v0.44.0 by @​justsmth in #​1199
• Prepare aws-lc-rs v1.18.0 by @​justsmth in #​1200

New Contributors

• @​iainmcgin made their first contribution in #​1183
• @​glebpom made their first contribution in #​1184 (landed via #​1187)

Full Changelog: aws/aws-lc-rs@v1.17.3...v1.18.0

v1.17.3: aws-lc-rs v1.17.3

Compare Source

What's Changed

• Add public API to check AWS-LC and FIPS versions by @​prasden in #​1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @​Mark-Simulacrum in #​1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @​justsmth in #​1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @​justsmth in #​1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- #​1166
• memcmp probe fails under RPM hardened build flags -- #​1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- #​1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @​justsmth in #​1172
• ci: only run push-triggered workflows on main by @​justsmth in #​1163
• Prepare aws-lc-sys v0.43.0 by @​justsmth in #​1176
• Prepare aws-lc-rs v1.17.2 by @​justsmth in #​1178
• Prepare aws-lc-fips-sys v0.13.16 by @​justsmth in #​1180
• build(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in #​1177

New Contributors

• @​Mark-Simulacrum made their first contribution in #​1174
• @​prasden made their first contribution in #​1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE]
aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

v1.17.2

Compare Source

tokio-rs/bytes (bytes)

v1.12.1

Compare Source

Fixed

• Properly handle when Box::new panics (#​837)

bytesize-rs/bytesize (bytesize)

v2.7.0

Compare Source

• Remove no-alloc support because it removed ByteSize::display() when default features were disabled.

v2.6.0

Compare Source

• Add display styles for IEC and SI bit units.

v2.5.0

Compare Source

• Honor precision when a width is set with formatting args.
• Add #[no_alloc] support.

v2.4.2

Compare Source

• Improve accuracy of parsing large non-decimal byte count strings.

v2.4.1

Compare Source

• Fix rounding error near power-of-unit boundaries.

clap-rs/clap (clap)

v4.6.6

Compare Source

Features

• Add Command::get_overridden_usage

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal

• Update to syn v3

v4.6.3

Compare Source

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes

• (help) Say alias when there is only one

crossbeam-rs/crossbeam (crossbeam-queue)

v0.3.13: crossbeam-queue 0.3.13

Compare Source

• Add push_mut and pop_mut to ArrayQueue and SegQueue. (#​1191)

rust-lang/futures-rs (futures)

v0.3.33

Compare Source

• Fix ReadLine's soundness issue regarding to exception safety. (#​3020)
• Fix unsound Send impl for IterPinRef and Iter. (#​3003)
• Fix stacked borrows violation in compat01as03 implementation. (#​3012)
• Fix memory leak in FuturesUnordered::IntoIter. (#​3005)
• Add portable-atomic-alloc feature and use it in FuturesUnordered. (#​3007)
• Re-export alloc::task::Wake. (#​3010)
• Update spin to 0.12. (#​3014)

hyperium/http (http)

v1.5.0

Compare Source

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

hyperium/http-body (http-body)

v1.1.0

Compare Source

tl;dr

• Implement Add for SizeHint.
• Implement Copy for SizeHint.

hyperium/hyper (hyper)

v1.11.0

Compare Source

Bug Fixes

• http1:
  • discard content-length header when received before transfer-encoding (#​4124) (540fff91, closes #​4123)
  • use append for repeat trailer values in encoder (#​4118) (de1483d7)
  • allow up to max_headers trailers (#​4108) (f584091a)
  • use append for repeat trailers (#​4107) (876effe1)
  • flush buffered data before shutdown (#​4018) (72046cc7, closes #​4022)
  • more strictly enforce max_buf_size when parsing (#​4093) (90ede307, closes #​4081)
• http2: avoid buffering Upgraded writes without send capacity (#​4102) (aecf5abf)

Features

• rt: add ReadBufCursor::initialized_unfilled() method (#​4115) (ccc1e850)

v1.10.1 (2026-05-29)

Bug Fixes

• http1: fix busy loop when peer half-closes and open body (#​4086) (c6cb906f, closes #​4085)

kube-rs/kube (kube)

v4.2.0

Compare Source

===================

• see kube-rs/kube@4.0.0...main

rust-lang/libc (libc)

v0.2.189

Compare Source

Added

• Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#​5270)
• Linux SPARC: Enable the clone3 syscall (#​4980)
• Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#​5274)

Deprecated

• Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

• Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
• NuttX: Fix wchar_t definition under Arm (#​5245)
• Windows: Add back link names for time-related symbols (#​5300)

v0.2.188

Compare Source

Changed

• Restore Send and Sync for DIR (35b062263401)

These were removed in 0.2.187 because libc does not actually make Send and Sync
guarantees about DIR (or other extern types), but this caused some crates to break.
The traits are added back for now to allow time to migrate, but will be removed again
in the future; please make sure your crates are not relying on libc::DIR: Send or
libc::DIR: Sync.

v0.2.187

Compare Source

This release contains a number of improvements related to 64-bit time_t configuration.
Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced
with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to
specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

• The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits

• uClibc now supports a similar configuration option:

  RUSTFLAGS='--cfg=libc_unstable_uclibc_time64'

As a reminder, these options are under active development and may change in the future
(hence the "unstable" in the name). It likely that we will harmonize everything under a
single configuration option before considering them stable.

Support

• Add support for aarch64-unknown-linux-pauthtest (#​5065)
• Add support for new QNX targets (#​5241)
• Better document breaking change policy and recommended usage (#​5179)

Added

• Android: Add POSIX_SPAWN_* constants (#​5104)
• Android: Add getpwent, setpwent, and endpwent (#​5160)
• Android: Add preadv2 and pwritev2 (#​5157)
• Android: Add seccomp_notif* structures (#​5224)
• Android: Add timer_[create, delete, getoverrun, gettime, settime] (#​5108)
• Apple: Add PROC_PIDT_SHORTBSDINFO and proc_bsdshortinfo (#​5110)
• Apple: Add SIOC* constants from sockio.h (#​5263)
• Apple: Add _IOR, _IOW, _IOWR (#​5264)
• Apple: Add bpf_program and bpf_insn (#​5235)
• Apple: Add additional kqueue constants (#​5077)
• Apple: Update vm_statistics64 with recently added fields (#​5253)
• Apple: add IN6_IFF_* and SIOCGIFAFLAG_IN6 (#​5239)
• Dragonfly: Add O_*, POSIX_FADV_*, NI*, and a few other missing constants (#​5116)
• Dragonfly: add fdatasync, dlvsym, reallocarray, qsort_r, pthread_*affinity_np, ftok, extattr_*, and dup3 (#​5116)
• Emscripten: Add in6_pktinfo (#​5256)
• FreeBSD: Add SOL_LOCAL (#​5185)
• FreeBSD: Add DLT_* constants (#​5235)
• FreeBSD: Add PROC_LOGSIGEXIT_* and PPROT_* (#​4657)
• FreeBSD: Add SO_RERROR (#​5260)
• FreeBSD: add IN6_IFF_*, in6_ifreq, and SIOCGIFAFLAG_IN6 (#​5239)
• FreeBSD: add _IO* helpers from sys/ioccom.h (#​5239)
• Glibc: Add PTHREAD_*_MUTEX_INITIALIZER_NP for riscv64 (#​5094)
• Glibc: Add new fields to struct tcp_info (#​5215)
• Linux: Add OPEN_TREE_NAMESPACE (#​5145)
• Linux: Add SECCOMP_IOCTL_* constants (#​5224)
• Linux: Add SO_DETACH_REUSEPORT_BPF (#​5081)
• Linux: Add futex_waitv (#​5125)
• Linux: Add constants for fsopen, fsconfig, fsmount, and fspick (#​5145)
• Linux: Add fields to statx present since 6.16 (#​4621)
• Linux: Add network entry API (#​5049)
• Linux: add ifaddrmsg and rtattr (#​5234)
• Linux: add sockaddr_iucv (#​5041)
• MacOS: Add ENOTCAPABLE (#​4925)
• Musl: Add renameat2 (#​5113)
• NuttX: Add F_SETFD (#​5258)
• NuttX: Add POLLRD* and POLLWR* constants (#​5258)
• NuttX: Add SO_KEEPALIVE and TCP keepalive constants (#​5111)
• NuttX: Add TCP_MAXSEG (#​5258)
• NuttX: Add eventfd and EFD_* constants (#​5258)
• NuttX: Add pipe2 (#​5258)
• NuttX: Add strerror_r (#​5258)
• NuttX: Add netinet structs and constants (#​5258)
• NuttX: Add socket structs, functions and constants (#​5258)
• QuRT: Add POSIX timer functions (#​5091)
• QuRT: Add missing pthread functions from QuRT SDK headers (#​5091)
• QuRT: Add missing unistd process and file functions (#​5091)
• QuRT: Add mqueue subsystem (message queues, select/pselect) (#​5091)
• Redox: Add *at and dirent functions (#​5117)
• Solarish: Add IP TTL and IPv6 Hop Limit consts (#​5089)
• Solarish: Add port_alert and PORT_ALERT* constants (#​5203)
• Solarish: add AI_CANONNAME (#​5085)
• aarch64: Add SYS_sendfile and SYS_fadvise64 constants (#​5133)

Deprecated

• Dragonfly: Deprecate compatibility aliases CPUCTL_RSMSR and UTX_DB_LASTLOG (#​5116)

Fixed

• breaking NetBSD: Correct ts from *const timespec to *mut timespec in _lwp_park` (#​5169)
• breaking Linux GNU: Change overflowing PTRACE_*ET_SYSCALL_USER_DISPATCH_CONFIG constants from u8 to c_uint (#​4936)
• Fix the soundness bug in the representation of extern types (#​5021)
• Cygwin: fix cpuset_t typo in CPU_ZERO (#​5098)
• Dragonfly: ABI fixes including regex offsets, ifaddrs, pthread barriers, process sizing fields, and mcontext alignment (#​5116)
• Dragonfly: Correct values of CPUCTL_CPUID*, EV_HUP, and EV_SYSFLAGS (#​5116)
• Emscripten: fix pthread type sizes for wasm64 (MEMORY64) (#​5156)
• Horizon: Fix the value of POLLOUT (#​5090)
• Linux: Correct the value of EPIOC[GS]PARAMS with nonstandard _IOC (#​5188)
• Make VxWorks shims unsafe (#​3727)
• NetBSD: Correct getmntinfo to link __getmntinfo13 (#​5251)
• QNX: Fix the value of PTHREAD_MUTEX_INITIALIZER (#​5241)
• QuRT: fix type and definition inaccuracies against SDK headers (#​5091)
• Windows: Correctly link to 32-bit time routines on 32-bit platforms (#​5059)
• uClibc: Fix constants accidentally removed (#​5141)
• uclibc: Fix build issues (#​5046)
• uclibc: Fix type of PRIO_PROCESS and friends (#​5046)

Changed

• AIX, TeeOS: Drop unneeded -> c_void (#​5240)
• Apple: Change AIO_LISTIO_MAX to account for changes in macOS 27 (#​5253)
• Glibc: Update the value of MS_NOUSER (#​5215)
• L4Re: Update definitions and test infra (#​5275)
• Linux: Update the value of SW_MAX and SW_CNT (#​5215)
• MacOS: Add swapped_count to vm_statistics64 (#​4926)
• Windows: Windows-GNU now respects libc_unstable_gnu_time_bits for 64-bit time_t config (#​5062)

Removed

• Dragonfly: Remove FreeBSD-only Elf32_Lword, ip_mreq_source, and IP_ constants (#​5116)
• Dragonfly: Remove private VM type bindings (#​5116)
• Linux: Remove KERN_REALROOTDEV and VM_LAPTOP_MODE (#​5177)
• VxWorks: Remove non-user-facing (kernel) API (#​5129)

Other

• Print config information if LIBC_BUILD_VERBOSE is set (#​5272)
• Annotate *LAST constants as potentially changing (#​5120)
• Annotate *MAX constants as potentially changing (#​5122)
• BSD: Annotate ELAST constants as potentially changing (#​5118)
• FreeBSD: Annotate RAND_MAX as potentially changing (#​5119)
• Linux, L4re: Annotate *NUM constants as potentially changing (#​5123)
• QNX: Restructure to support new platforms (#​4984)
• Unix: Annotate *COUNT constants as potentially changing (#​5121)
• uClibc: Add unstable support of 64-bit time_t (#​5046)
• (internal) FreeBSD: Replace unstable env to set version with an unstable cfg (#​5201)
• (internal) Glibc: Remove public configuration for file offset bits (#​5268)
• (internal) Linux: Delete config via RUST_LIBC_UNSTABLE_LINUX_TIME_BITS64 (#​5197)
• (internal) Replace RUST_LIBC_UNSTABLE env with libc_unstable* cfg (#​4977)

BurntSushi/memchr (memchr)

v2.8.3

Compare Source

open-telemetry/opentelemetry-rust (opentelemetry-semantic-conventions)

v0.32.1

Compare Source

Released 2026-Jun-26

• Update to v1.42.0 of the semantic conventions.

dtolnay/proc-macro2 (proc-macro2)

v1.0.107

Compare Source

• Documentation improvements

dtolnay/quote (quote)

v1.0.47

Compare Source

• Documentation improvements

v1.0.46

Compare Source

• Avoid repeated get_span in quote_spanned (#​329, thanks @​Noratrieb)

rust-random/rand (rand)

v0.10.2

Compare Source

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#​1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#​1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#​1791)

rust-lang/regex (regex)

v1.13.1

Compare Source

===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#​1364 for (many) more details.

Bug fixes:

• #​1354:
  Fixes previously unsound reverse suffix and inner optimizations.

v1.13.0

Compare Source

===================
This release includes a new API, a regex! macro, for lazy compilation of
a regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:

use regex::regex;

fn is_match(line: &str) -> bool {
    // The regex will be compiled approximately once and reused automatically.
    // This avoids the footgun of using `Regex::new` here, which would
    // guarantee that it would be compiled every time this routine is called.
    // This would likely make this routine much slower than it needs to be.
    regex!(r"bar|baz").is_match(line)
}

let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";

let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #​709:
  Add a new regex! macro for efficient and automatic reuse of a compiled regex.

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

serde-rs/json (serde_json)

v1.0.151

Compare Source

• Add RawValue::from_string_unchecked (#​1331, thanks @​WonderLawrence)

jonasbb/serde_with (serde_with)

v3.22.0: serde_with v3.22.0

Compare Source

Added

• Add support for jiff v0.2 behind the new jiff_0_2 feature flag (#​936)
  jiff::SignedDuration works with DurationSeconds and its variants.
  jiff::Timestamp, jiff::Zoned, and jiff::civil::DateTime work with TimestampSeconds and its variants.
  Deserializing a jiff::Zoned uses the system time zone, like chrono::DateTime<Local>.

Fixed

• Extend the GHSA-7gcf-g7xr-8hxj fix to the duplicate-key-prevention collections.
  The rust::sets_duplicate_value_is_error, rust::maps_duplicate_key_is_error, rust::sets_last_value_wins, and rust::maps_first_key_wins adapters created their backing sets/maps with with_capacity_and_hasher using the raw deserializer size_hint, bypassing the size_hint_cautious cap added in #​966 (the clippy.toml disallowed_methods lint only covers Vec::with_capacity, not with_capacity_and_hasher, so these sites were not flagged).
  Attacker-controlled input claiming a huge length could panic with Hash table capacity overflow before a single element was read. All such constructions now route through size_hint_cautious.

shepmaster/snafu (snafu)

v0.9.2

Compare Source

Fixed

• The whatever macro no longer triggers the
  semicolon_in_expressions_from_macros lint.

rust-lang/socket2 (socket2)

v0.6.5

• Add support for Emscripten (wasm32)
  (#​660).
• Add support for NuttX
  (#​663).
• Enable Socket::(set_)tos_v4 on illumos
  (#​662).

tokio-rs/tokio (tokio)

v1.53.1: Tokio v1.53.1

Compare Source

1.53.1 (July 20th, 2026)

Fixed

• signal: restore MSRV by removing OnceLock::wait from the Windows handler (#​8300)

Fixed (unstable)

• time: fix alt timer cancellation and insertion race (#​8252)

Documented

• runtime: remove dead link definition in Runtime::block_on (#​8301)

v1.53.0: Tokio v1.53.0

Compare Source

1.53.0 (July 17th, 2026)

Added

• fs: implement From<OwnedFd> and From<OwnedHandle> for File ([#​8266])
• metrics: add task schedule latency metric ([#​7986])
• net: add SocketAddr methods to Unix sockets ([#​8144])

Changed

• io: add #[inline] to IO trait impls for in-memory types ([#​8242])
• net: implement UCred::pid on FreeBSD ([#​8086])
• net: support Nuttx target os ([#​8259])
• signal: refactor global variables on Windows ([#​8231])
• sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders ([#​8095])
• taskdump: support taskdumps on s390x ([#​8192])
• time: add #[track_caller] to timeout_at() ([#​8077])
• time: consolidate mutex locks on spurious poll ([#​8124])
• time: defer waker clone on spurious poll ([#​8107])
• time: move lazy-registration state into Sleep ([#​8132])
• tracing: remove unnecessary span clone ([#​8126])

Fixed

• io: do not treat zero-length reads as EOF in Chain ([#​8251])
• net: use getpe

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[datadog-prod-us1-3]

The Linux artifact published with a -fips tag would move from AWS-LC-FIPS 3.x’s validated module to 4.x, which the dependency release notes say is still awaiting NIST certification. Pin aws-lc-rs below 1.18 before shipping to customers that require validated cryptography.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 78e1a9e · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-prod-us1-3]

Keep the validated module in FIPS images

Customers using the advertised -fips image could deploy a cryptographic module without a current NIST certificate, violating their compliance requirements.

Assertion details

• Input: Any Linux agent-data-plane image built with the fips feature; release CI publishes both amd64 and arm64 variants with a -fips tag.
• Expected: Constrain the workspace aws-lc-rs dependency to <1.18, then regenerate Cargo.lock so Linux FIPS artifacts retain the validated 3.x module until 4.x is certified and approved. This is a multi-file generated-lockfile fix, so no inline suggestion is safe.
• Actual: Cargo.lock upgrades aws-lc-fips-sys from 0.13.14 to 0.14.1 through aws-lc-rs 1.18.0. The supplied upstream release notes state this switches from validated AWS-LC-FIPS 3.x to 4.x, which is awaiting NIST certification, and direct validation-required consumers to pin below 1.18. Existing tests only check approved algorithms and cannot detect certification status.

Was this helpful? React 👍 or 👎
_{🤖 Datadog Autotest · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[pr-commenter]

Regression Detector (Agent Data Plane)

Run ID: f5576340-d58d-4d53-b1b6-516dd0deda26
Baseline: d6c6e40d · Comparison: a4e8d1b0 · diff

Optimization Goals: ✅ No significant changes detected

Fine details of change detection per experiment (5)

Experiments configured erratic: true are tagged (ignored) and skipped when determining which experiments regressed or improved. Experiments which are detected as erratic at runtime are tagged (erratic) to flag that the run's sample dispersion was high, but their regression / improvement signal still counts.

experiment	goal	Δ mean %	links
quality_gates_rss_dsd_ultraheavy	memory	⚪ +0.84	metrics profiles logs
quality_gates_rss_dsd_low	memory	⚪ +0.36	metrics profiles logs
quality_gates_rss_dsd_heavy	memory	⚪ +0.29	metrics profiles logs
quality_gates_rss_dsd_medium	memory	⚪ +0.13	metrics profiles logs
quality_gates_rss_idle	memory	⚪ -0.96	metrics profiles logs

Bounds Checks: ❌ Failed (5)

experiment	check	replicates	observed	links
quality_gates_rss_dsd_heavy	memory_usage	10/10	✅ 228 MiB ≤ 250 MiB	metrics profiles logs
quality_gates_rss_dsd_low	memory_usage	10/10	✅ 51.6 MiB ≤ 60 MiB	metrics profiles logs
quality_gates_rss_dsd_medium	memory_usage	10/10	✅ 90.3 MiB ≤ 100 MiB	metrics profiles logs
quality_gates_rss_dsd_ultraheavy	memory_usage	9/10	❌ 451 MiB ≤ 420 MiB	metrics profiles logs
quality_gates_rss_idle	memory_usage	10/10	✅ 31.5 MiB ≤ 40 MiB	metrics profiles logs

Explanation

A change is flagged as a regression when |Δ mean %| > 5.00% in the regressing direction for its optimization goal AND SMP marks the experiment as a regression (is_regression: true). Improvements use the matching criteria for the improving direction. Experiments configured erratic: true (tagged (ignored)) are skipped outright; experiments detected as erratic at runtime (tagged (erratic)) still count, since that flag describes sample dispersion rather than directional certainty. The Δ mean % cell is colored accordingly: 🟢 = improvement, 🔴 = regression, ⚪ = neutral. Reduction in CPU or memory is an improvement; reduction in ingress throughput is a regression. Experiments tagged (no analysis) show ⚠️ n/a: SMP ran them but produced no analysis, usually because a replicate failed and exhausted its retries. Check the SMP report for that experiment's replicate failures.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[jszwedko]

[Claude Sonnet 5] Correct — researched this: AWS-LC-FIPS 3.x (statically/dynamically linked, NIST CMVP certs #5314 / #5298) is validated. AWS-LC-FIPS 4.x, which aws-lc-fips-sys 0.14.x (pulled in by aws-lc-rs 1.18.0) switches to, has only completed lab testing and been submitted to NIST — it's on the CMVP Modules In Process list, not yet certified.

Pinned the workspace aws-lc-rs dependency to <1.18 and regenerated Cargo.lock (back to aws-lc-fips-sys 0.13.16, still on the validated 3.x module). Added a comment on the pin with links to check certification status before lifting it.

Also fixed the two other unrelated CI failures in this PR (both pre-existing bugs exposed by the dependency bumps, not caused by them):

• a new clippy clone_on_copy lint on SizeHint in saluki-io
• opentelemetry-semantic-conventions 0.32.1 dropping its re-export of CONTAINER_RUNTIME, fixed by hardcoding the attribute key like the other legacy entries in that mapping table

All pushed to this branch; local cargo check, clippy, fmt, license check, and the affected crates' test suites (1092 tests) pass.

[pr-commenter]

Binary Size Analysis (Agent Data Plane)

Baseline: d6c6e40 · Comparison: a4e8d1b · diff
Analysis Configuration: stripped binaries · Pass/Fail Threshold: +5%
Sizes: 41.27 MiB (baseline) vs 41.36 MiB (comparison)
Size Change: +92.20 KiB (+0.22%)

✅ Binary size difference within threshold

Changes by Module

Module	File Size	Symbols
tracing	+142.95 KiB	144
saluki_common::resource_tracking::groups	-135.89 KiB	61
core	+54.24 KiB	23070
anon.669f3aac70ab18aac424c8e884be9a37.15.llvm.11594395322186070468	-48.93 KiB	1
anon.d15165b779ce1adcaf29452fba6b3007.15.llvm.2684547316652132182	+48.93 KiB	1
figment	+46.72 KiB	536
serde_core	-41.54 KiB	1370
aho_corasick	-32.23 KiB	353
regex_automata	+22.27 KiB	862
serde_with	+22.18 KiB	56
hashbrown	-19.09 KiB	1843
std	+18.90 KiB	1097
anon.110a66aa4385e674c9df2a56bf46ad27.917.llvm.10835410169155227490	+18.14 KiB	1
anon.a0ca6a6a6723caf97f9e22a220a3e9ae.917.llvm.12682091795628431370	-18.14 KiB	1
axum	+18.03 KiB	649
anon.6c8cc82583d787f2710e1f8f86e78987.13.llvm.13314861055718887123	-17.17 KiB	1
anon.02bf67948436217f6a5753b94789b9ab.448.llvm.15222010805392624731	+17.09 KiB	1
h2	+16.28 KiB	2460
quick_cache	-15.54 KiB	218
saluki_common::task::instrument	-15.40 KiB	86

Detailed Symbol Changes

    FILE SIZE        VM SIZE    
 --------------  -------------- 
  +0.3% +96.9Ki  +0.2% +60.7Ki    [90773 Others]
  [NEW] +59.6Ki  [NEW] +59.4Ki    saluki_components::common::datadog::io::run_endpoint_io_loop::_{{closure}}::h0e45d570b786d3ec
  [NEW] +56.9Ki  [NEW] +56.5Ki    _<datadog_agent_config::generated::datadog_configuration::_::<impl serde_core::de::Deserialize for datadog_agent_config::generated::datadog_configuration::DatadogConfiguration>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::h2a0c132d3afaf9d1
  [NEW] +48.9Ki  [NEW] +48.8Ki    anon.d15165b779ce1adcaf29452fba6b3007.15.llvm.2684547316652132182
  [NEW] +39.6Ki  [NEW] +39.5Ki    agent_data_plane::cli::run::create_topology::_{{closure}}::h1c380ef10fcd2e37
  [NEW] +39.5Ki  [NEW] +39.3Ki    _<saluki_components::forwarders::otlp::OtlpForwarder as saluki_core::components::forwarders::Forwarder>::run::_{{closure}}::hbc6b0b4293bf546b
  [NEW] +38.0Ki  [NEW] +37.9Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::h8b4c35eb1c8f88c6
  [NEW] +37.1Ki  [NEW] +36.9Ki    _<saluki_components::transforms::aggregate::Aggregate as saluki_core::components::transforms::Transform>::run::_{{closure}}::h5c95a9160b627edf
  [NEW] +34.5Ki  [NEW] +34.3Ki    datadog_agent_commons::ipc::client::RemoteAgentClient::from_client_configuration::_{{closure}}::_{{closure}}::_{{closure}}::h3f9ec633d6e549df
  [NEW] +31.2Ki  [NEW] +31.1Ki    agent_data_plane::cli::dogstatsd::run_dogstatsd_command::_{{closure}}::hfec45837aeb9d72d
  [NEW] +30.9Ki  [NEW] +30.6Ki    _<saluki_components::sources::dogstatsd::_::<impl serde_core::de::Deserialize for saluki_components::sources::dogstatsd::DogStatsDConfiguration>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::h8bb9e60f1cbd5d84
  [DEL] -28.5Ki  [DEL] -28.3Ki    agent_data_plane::dogstatsd_contexts::artifact::for_each_record::h39b2832027986acc
  [DEL] -30.6Ki  [DEL] -30.4Ki    agent_data_plane::cli::dogstatsd::run_dogstatsd_command::_{{closure}}::h8e6a26bba5766166
  [DEL] -35.5Ki  [DEL] -35.2Ki    _<saluki_components::sources::dogstatsd::_::<impl serde_core::de::Deserialize for saluki_components::sources::dogstatsd::DogStatsDConfiguration>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::h6a606a7931ae90c3
  [DEL] -38.5Ki  [DEL] -38.3Ki    _<saluki_components::transforms::aggregate::Aggregate as saluki_core::components::transforms::Transform>::run::_{{closure}}::h5212ad494e6e6d30
  [DEL] -39.5Ki  [DEL] -39.3Ki    _<saluki_components::forwarders::otlp::OtlpForwarder as saluki_core::components::forwarders::Forwarder>::run::_{{closure}}::hcd2e7e0448ed9644
  [DEL] -40.3Ki  [DEL] -40.2Ki    agent_data_plane::cli::run::create_topology::_{{closure}}::h23953cd93c271a64
  [DEL] -42.2Ki  [DEL] -42.1Ki    agent_data_plane::cli::run::handle_run_command::_{{closure}}::h8c5bc31d01253285
  [DEL] -48.9Ki  [DEL] -48.8Ki    anon.669f3aac70ab18aac424c8e884be9a37.15.llvm.11594395322186070468
  [DEL] -56.9Ki  [DEL] -56.6Ki    _<datadog_agent_config::generated::datadog_configuration::_::<impl serde_core::de::Deserialize for datadog_agent_config::generated::datadog_configuration::DatadogConfiguration>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map::h7fe123438a19c2ad
  [DEL] -60.1Ki  [DEL] -59.9Ki    saluki_components::common::datadog::io::run_endpoint_io_loop::_{{closure}}::hd9fc277b29cf0b9d
  +0.2% +92.2Ki  +0.2% +55.9Ki    TOTAL