⬆️ Update Rust Crates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
axum	dependencies	patch	0.8.8 → 0.8.9
clap	dependencies	patch	4.6.0 → 4.6.1
hmac	dependencies	minor	0.12 → 0.13
maxminddb	dependencies	minor	0.27 → 0.28
rand (source)	dependencies	patch	0.10.0 → 0.10.1
reqwest	dependencies	patch	0.13.2 → 0.13.3
sha2	dependencies	minor	0.10 → 0.11
tokio (source)	dependencies	minor	1.50.0 → 1.52.1

---

Release Notes

tokio-rs/axum (axum)

v0.8.9

Compare Source

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#​3597)
• changed: Update minimum rust version to 1.80 (#​3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#​3656)
• fixed: Return specific error message when multipart body limit is exceeded (#​3611)

clap-rs/clap (clap)

v4.6.1

Compare Source

Fixes

• (derive) Ensure rebuilds happen when an read env variable is changed

RustCrypto/MACs (hmac)

v0.13.0

Compare Source

oschwald/maxminddb-rust (maxminddb)

v0.28.1

Compare Source

• Fixed: Databases with an impossible declared search tree size are now
  rejected during open/verify instead of causing runaway allocation
  during validation.
• Fixed: within() now rejects IPv6 CIDRs on IPv4-only databases instead
  of yielding unrelated networks.
• Fixed: Verification now rejects truncated scalar/string payloads instead
  of skipping past them and reporting the database as valid.
• Fixed: LookupResult::network() now uses the reader's measured IPv4
  subtree depth instead of assuming it always begins at bit 96.

v0.28.0

Compare Source

• Performance improvement: Faster search-tree traversal by dispatching
  on the database's record size to monomorphized node readers, replacing
  per-step branching on the record size.
• Performance improvement: Direct deserialization of scalars, sequences,
  maps, and structs through dedicated fast paths instead of routing
  through deserialize_any.
• Performance improvement: IPv4 and IPv6 lookups dispatch to dedicated
  paths, avoiding per-call address-kind checks on the hot path.
• Behavior change: Deserializing a database array into a tuple or
  tuple struct now returns a decoding error when the lengths do not
  match. Previously the mismatch was silently ignored.
• Fixed: A corrupt data pointer that would underflow during resolution
  now returns an InvalidDatabase error instead of panicking.

rust-random/rand (rand)

v0.10.1

Compare Source

This release includes a fix for a soundness bug; see #​1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#​1761)
• Deprecate feature log (#​1763)

seanmonstar/reqwest (reqwest)

v0.13.3

Compare Source

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

RustCrypto/hashes (sha2)

v0.11.0

Compare Source

tokio-rs/tokio (tokio)

v1.52.1: Tokio v1.52.1

Compare Source

1.52.1 (April 16th, 2026)

Fixed

• runtime: revert #​7757 to fix a regression that causes spawn_blocking to hang (#​8057)

v1.52.0: Tokio v1.52.0

Compare Source

1.52.0 (April 14th, 2026)

Added

• io: AioSource::register_borrowed for I/O safety support (#​7992)
• net: add try_io function to unix::pipe sender and receiver types (#​8030)

Added (unstable)

• runtime: Builder::enable_eager_driver_handoff setting enable eager hand off of the I/O and time drivers before polling tasks (#​8010)
• taskdump: add trace_with() for customized task dumps (#​8025)
• taskdump: allow impl FnMut() in trace_with instead of just fn() (#​8040)
• fs: support io_uring in AsyncRead for File (#​7907)

Changed

• runtime: improve spawn_blocking scalability with sharded queue (#​7757)
• runtime: use compare_exchange_weak() in worker queue (#​8028)

Fixed

• runtime: overflow second half of tasks when local queue is filled instead of first half (#​8029)

Documented

• docs: fix typo in oneshot::Sender::send docs (#​8026)
• docs: hide #[tokio::main] attribute in the docs of sync::watch (#​8035)
• net: add docs on ConnectionRefused errors with UDP sockets (#​7870)

v1.51.1: Tokio v1.51.1

Compare Source

1.51.1 (April 8th, 2026)

Fixed

• sync: fix semaphore reopens after forget (#​8021)
• net: surface errors from SO_ERROR on recv for UDP sockets on Linux (#​8001)

Fixed (unstable)

• metrics: fix worker_local_schedule_count test (#​8008)
• rt: do not leak fd when cancelling io_uring open operation (#​7983)

v1.51.0: Tokio v1.51.0

Compare Source

1.51.0 (April 3rd, 2026)

Added

• net: implement get_peer_cred on Hurd (#​7989)
• runtime: add tokio::runtime::worker_index() (#​7921)
• runtime: add runtime name (#​7924)
• runtime: stabilize LocalRuntime (#​7557)
• wasm: add wasm32-wasip2 networking support (#​7933)

Changed

• runtime: steal tasks from the LIFO slot (#​7431)

Fixed

• docs: do not show "Available on non-loom only." doc label (#​7977)
• macros: improve overall macro hygiene (#​7997)
• sync: fix notify_waiters priority in Notify (#​7996)
• sync: fix panic in Chan::recv_many when called with non-empty vector on closed channel (#​7991)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.