fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
anyhow	dependencies	patch	1.0.86 → 1.0.104
axum	dependencies	minor	0.7.5 → 0.8.0
axum-extra	dependencies	minor	0.9.3 → 0.12.0
chrono	dependencies	patch	0.4.38 → 0.4.45
config	dependencies	minor	0.14.0 → 0.15.0
http	dependencies	minor	1.1.0 → 1.4.2
hyper (source)	dependencies	minor	1.4.1 → 1.10.1
hyper-util (source)	dependencies	patch	0.1.6 → 0.1.20
reqwest	dependencies	minor	0.12.4 → 0.13.0
serde (source)	dependencies	patch	1.0.204 → 1.0.229
serde_json	dependencies	patch	1.0.120 → 1.0.151
tower	dependencies	minor	0.4.13 → 0.5.0
tower-http	dependencies	minor	0.5.2 → 0.7.0
tracing (source)	dependencies	patch	0.1.40 → 0.1.44
uuid	dependencies	minor	1.10.0 → 1.24.0

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

v1.0.102

Compare Source

• Remove backtrace dependency (#​438, #​439, #​440, #​441, #​442)

v1.0.101

Compare Source

• Add #[inline] to anyhow::Ok helper (#​437, thanks @​Ibitier)

v1.0.100

Compare Source

• Teach clippy to lint formatting arguments in bail!, ensure!, anyhow! (#​426)

v1.0.99

Compare Source

• Allow build-script cleanup failure with NFSv3 output directory to be non-fatal (#​420)

v1.0.98

Compare Source

• Add self.into_boxed_dyn_error() and self.reallocate_into_boxed_dyn_error_without_backtrace() methods for anyhow::Error (#​415)

v1.0.97

Compare Source

• Documentation improvements

v1.0.96

Compare Source

• Documentation improvements

v1.0.95

Compare Source

• Add Error::from_boxed (#​401, #​402)

v1.0.94

Compare Source

• Documentation improvements

v1.0.93

Compare Source

• Update dev-dependencies to thiserror v2

v1.0.92

Compare Source

• Support Rust 1.82's &raw const and &raw mut syntax inside ensure! (#​390)

v1.0.91

Compare Source

• Ensure OUT_DIR is left with deterministic contents after build script execution (#​388)

v1.0.90

Compare Source

• Documentation improvements

v1.0.89

Compare Source

• Make anyhow::Error's UnwindSafe and RefUnwindSafe impl consistently available between versions of Rust newer and older than 1.72 (#​386)

v1.0.88

Compare Source

• Documentation improvements

v1.0.87

Compare Source

• Support more APIs, including Error::new and Error::chain, in no-std mode on Rust 1.81+ (#​383)

tokio-rs/axum (axum)

v0.8.9

Compare Source

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#​3597)
• changed: Update minimum rust version to 1.80 (#​3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#​3656)
• fixed: Return specific error message when multipart body limit is exceeded (#​3611)

v0.8.8: axum v0.8.8

Compare Source

• Clarify documentation for Router::route_layer (#​3567)

v0.8.7: axum v0.8.7

Compare Source

• Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#​3555)
• Make it easier to visually scan for default features (#​3550)
• Fix some documentation typos

v0.8.6

Compare Source

v0.8.5: axum v0.8.5

Compare Source

• fixed: Reject JSON request bodies with trailing characters after the JSON document (#​3453)
• added: Implement OptionalFromRequest for Multipart (#​3220)
• added: Getter methods Location::{status_code, location}
• added: Support for writing arbitrary binary data into server-sent events (#​3425)]
• added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#​3469)
• added: impl FusedStream for WebSocket (#​3443)
• changed: The sse module and Sse type no longer depend on the tokio feature (#​3154)
• changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#​3377)
• changed: Update minimum rust version to 1.78 (#​3412)

v0.8.4: axum v0.8.4

Compare Source

• added: Router::reset_fallback (#​3320)
• added: WebSocketUpgrade::selected_protocol (#​3248)
• fixed: Panic location for overlapping method routes (#​3319)
• fixed: Don't leak a tokio task when using serve without graceful shutdown (#​3129)

v0.8.3: axum v0.8.3

Compare Source

• added: Implement From<Bytes> for Message (#​3273)
• added: Implement OptionalFromRequest for Json (#​3142)
• added: Implement OptionalFromRequest for Extension (#​3157)
• added: Allow setting the read buffer capacity of WebSocketUpgrade (#​3178)
• changed: Improved code size / compile time of dependent crates (#​3285, #​3294)

v0.8.2: axum v0.8.2

Yanked from crates.io due to unforeseen breaking change, see #​3190 for details

---

• added: Implement OptionalFromRequest for Json (#​3142)
• added: Implement OptionalFromRequest for Extension (#​3157)
• changed: Make the status function of rejections a const function, such
  as JsonRejection, QueryRejection and PathRejection (#​3168)

v0.8.0: axum v0.8.0

Compare Source

since rc.1

Details

• breaking: axum::extract::ws::Message now uses Bytes in place of Vec<u8>,
  and a new Utf8Bytes type in place of String, for its variants (#​3078)
• breaking: Remove OptionalFromRequestParts impl for Query (#​3088)
• changed: Upgraded tokio-tungstenite to 0.26 (#​3078)
• changed: Query/Form: Use serde_path_to_error to report fields that failed to parse (#​3081)

full changelog

You can also read the blog post on tokio

Note: there are further relevant changes in axum-core's changelog

• breaking: Upgrade matchit to 0.8, changing the path parameter syntax from /:single and /*many to /{single} and /{*many}; the old syntax produces a panic to avoid silent change in behavior (#​2645)
• breaking: Require Sync for all handlers and services added to Router and MethodRouter (#​2473)
• breaking: The tuple and tuple_struct Path extractor deserializers now check that the number of parameters matches the tuple length exactly (#​2931)
• breaking: Move Host extractor to axum-extra (#​2956)
• breaking: Remove WebSocket::close. Users should explicitly send close messages themselves. (#​2974)
• breaking: Make serve generic over the listener and IO types (#​2941)
• breaking: Remove Serve::tcp_nodelay and WithGracefulShutdown::tcp_nodelay.
  See serve::ListenerExt for an API that let you set arbitrary TCP stream properties. (#​2941)
• breaking: Option<Path<T>> no longer swallows all error conditions,
  instead rejecting the request in many cases; see its documentation for details (#​2475)
• breaking: axum::extract::ws::Message now uses Bytes in place of Vec<u8>,
  and a new Utf8Bytes type in place of String, for its variants (#​3078)
• fixed: Skip SSE incompatible chars of serde_json::RawValue in Event::json_data (#​2992)
• fixed: Don't panic when array type is used for path segment (#​3039)
• fixed: Avoid setting content-length before middleware.
  This allows middleware to add bodies to requests without needing to manually set content-length (#​2897)
• change: Update minimum rust version to 1.75 (#​2943)
• changed: Upgraded tokio-tungstenite to 0.26 (#​3078)
• changed: Query/Form: Use serde_path_to_error to report fields that failed to parse (#​3081)
• added: Add method_not_allowed_fallback to set a fallback when a path matches but there is no handler for the given HTTP method (#​2903)
• added: Add NoContent as a self-described shortcut for StatusCode::NO_CONTENT (#​2978)
• added: Add support for WebSockets over HTTP/2. They can be enabled by changing get(ws_endpoint) handlers to any(ws_endpoint) (#​2894)
• added: Add MethodFilter::CONNECT, routing::connect[_service] and MethodRouter::connect[_service] (#​2961)
• added: Extend FailedToDeserializePathParams::kind enum with (ErrorKind::DeserializeError). This new variant captures both key, value, and message from named path parameters parse errors, instead of only deserialization error message in ErrorKind::Message. (#​2720)

v0.7.9: axum - v0.7.9

Compare Source

• fixed: Avoid setting content-length before middleware (#​3031)

v0.7.8: axum - v0.7.8

Compare Source

• fixed: Skip SSE incompatible chars of serde_json::RawValue in Event::json_data (#​2992)
• added: Add method_not_allowed_fallback to set a fallback when a path matches but there is no handler for the given HTTP method (#​2903)
• added: Add MethodFilter::CONNECT, routing::connect[_service]
  and MethodRouter::connect[_service] (#​2961)
• added: Add NoContent as a self-described shortcut for StatusCode::NO_CONTENT (#​2978)

v0.7.7: axum - v0.7.7

Compare Source

• change: Remove manual tables of content from the documentation, since
  rustdoc now generates tables of content in the sidebar (#​2921)

v0.7.6: axum - v0.7.6

Compare Source

• change: Avoid cloning Arc during deserialization of Path
• added: axum::serve::Serve::tcp_nodelay and axum::serve::WithGracefulShutdown::tcp_nodelay (#​2653)
• added: Router::has_routes function (#​2790)
• change: Update tokio-tungstenite to 0.23 (#​2841)
• added: Serve::local_addr and WithGracefulShutdown::local_addr functions (#​2881)

chronotope/chrono (chrono)

v0.4.45: 0.4.45

Compare Source

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in #​1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in #​1789

v0.4.44: 0.4.44

Compare Source

What's Changed

• docs: match MSRV with Cargo.toml contents by @​coryan in #​1772
• Add track_caller to non-deprecated functions by @​svix-jplatte in #​1774

v0.4.43: 0.4.43

Compare Source

What's Changed

• Install extra components for lint workflow by @​djc in #​1741
• Upgrade windows-bindgen to 0.64 by @​djc in #​1742
• Improve windows-bindgen setup by @​djc in #​1744
• Drop stabilized feature doc_auto_cfg by @​djc in #​1745
• Faster RFC 3339 parsing by @​djc in #​1748
• Update windows-bindgen requirement from 0.64 to 0.65 by @​dependabot[bot] in #​1751
• add NaiveDate::abs_diff by @​Kinrany in #​1752
• Add feature gated defmt support. by @​pebender in #​1747
• Drop deny lints, eager Debug impls are a mixed blessing by @​djc in #​1753
• chore: minor improvement for docs by @​spuradage in #​1756
• Added doctest for the NaiveDate years_since function by @​LucasBou in #​1755
• Prepare 0.4.43 by @​djc in #​1765
• Update copyright year to 2026 in LICENSE.txt by @​taozui472 in #​1767

v0.4.42: 0.4.42

Compare Source

What's Changed

• Add fuzzer for DateTime::parse_from_str by @​tyler92 in #​1700
• Fix wrong amount of micro/milliseconds by @​nmlt in #​1703
• Add warning about MappedLocalTime and wasm by @​lutzky in #​1702
• Fix incorrect parsing of fixed-length second fractions by @​chris-leach in #​1705
• Fix cfgs for wasm32-linux support by @​arjunr2 in #​1707
• Fix OpenHarmony's tzdata parsing by @​ldm0 in #​1679
• Convert NaiveDate to/from days since unix epoch by @​findepi in #​1715
• Add ?Sized bound to related methods of DelayedFormat::write_to by @​Huliiiiii in #​1721
• Add from_timestamp_secs method to DateTime by @​jasonaowen in #​1719
• Migrate to core::error::Error by @​benbrittain in #​1704
• Upgrade to windows-bindgen 0.63 by @​djc in #​1730
• strftime: simplify error handling by @​djc in #​1731

v0.4.41

Compare Source

What's Changed

• Add subsec_micros and subsec_millis methods to TimeDelta by @​ggoetz in #​1668
• Deprecate NaiveDateTime::UNIX_EPOCH by @​robertbastian in #​1670
• Implement as_seconds_f32 and as_seconds_f64 for TimeDelta by @​ggoetz in #​1671
• chore: fix some comments by @​jimmycathy in #​1677
• Add num_days_in_month method to Datelike trait by @​aslilac in #​1673
• add WeekdaySet, a collection of Weekday that is Copy by @​Kinrany in #​1676
• WeekdaySet tweaks by @​djc in #​1680
• Upgrade to windows-bindgen 0.61 by @​djc in #​1682
• Implemented a consistent Eq trait for NaiveWeek by @​Splashling1789 in #​1687
• TimeZone::from_posix_tz: Treat empty TZ variable as UTC by @​drinkcat in #​1691
• Add support for lossy format strings by @​Qelxiros in #​1693

v0.4.40: 0.4.40

Compare Source

What's Changed

• Add Month::num_days() by @​djc in #​1645
• Update Windows dependencies by @​kennykerr in #​1646
• Feature/round_up method on DurationRound trait by @​MagnumTrader in #​1651
• Expose write_to for DelayedFormat by @​tugtugtug in #​1654
• Update LICENSE.txt by @​maximevtush in #​1656
• docs: fix minor typo by @​samfolo in #​1659
• Use NaiveDateTime for internal tz_info methods. by @​AVee in #​1658
• Upgrade to windows-bindgen 0.60 by @​djc in #​1665
• Add quarter (%q) date string specifier by @​drinkcat in #​1666

v0.4.39: 0.4.39

Compare Source

What's Changed

• #​1577: Changed years_since documentation to match its implementation by @​Taxalo in #​1578
• Remove obsolete weird feature guard by @​djc in #​1582
• Fix format::strftime docs link by @​frederikhors in #​1581
• Fix micros (optional) limit in and_hms_micro_opt by @​qrilka in #​1584
• Update windows-bindgen requirement from 0.56 to 0.57 by @​dependabot in #​1589
• native/date: Improve DelayedFormat doc re Panics by @​behnam-oneschema in #​1590
• Fix typo in rustdoc of from_timestamp_nanos() by @​sgoll in #​1591
• Update windows-bindgen requirement from 0.57 to 0.58 by @​dependabot in #​1594
• docs: document century cutoff for %y by @​MarcoGorelli in #​1598
• Checked NaiveWeek methods by @​bragov4ik in #​1600
• Impl serde::Serialize and serde::Deserialize for TimeDelta by @​Awpteamoose in #​1599
• Derive PartialEq,Eq,Hash,Copy and Clone on NaiveWeek by @​DSeeLP in #​1618
• Support ohos tzdata since ver.oh35 by @​MirageLyu in #​1613
• Use Formatter::pad (instead of write_str) for Weekdays by @​horazont in #​1621
• Fix typos by @​szepeviktor in #​1623
• Fix comment. by @​khuey in #​1624
• chore: add #[inline] to num_days by @​CommanderStorm in #​1627
• fix typo by @​futreall in #​1633
• Update mod.rs by @​donatik27 in #​1638

rust-cli/config-rs (config)

v0.15.25

Compare Source

Fixes

• (ron) Support u64, and not just i64

v0.15.24

Compare Source

Fixes

• (json) Support u64, and not just i64

v0.15.23

Compare Source

Fixes

• Environment::convert_case: correctly apply casing to each key segment

v0.15.22

Compare Source

Documentation

• Polish examples

Internal

• Update winnow

v0.15.21

Compare Source

Compatibility

• Bump MSRV to 1.85

v0.15.20

Compare Source

Fixes

• Serialize the full u64 range

Internal

• (toml) Update to 1.0

v0.15.19

Compare Source

Internal

• (ron) Update to 0.12

v0.15.18

Compare Source

Fixes

• Improve consistency between missing field error messages

v0.15.17

Compare Source

Features

• corn file format support

v0.15.16

Compare Source

Performance

• Allow more build parallelism by depending on serde_core

v0.15.15

Compare Source

Fixes

• (json5) Correctly deserialize null (regressed in 0.15.14)

v0.15.14

Compare Source

Performance

• (json5) Reduce overhead when loading json5 files

v0.15.13

Compare Source

Fixes

• Skip UTF-8 BOMs when reading files

v0.15.12

Compare Source

Performance

• Upgrade to toml v0.9

v0.15.11

Compare Source

Features

• Deserialize YAML real keys as strings

v0.15.10

Compare Source

Features

• Deserialize YAML boolean keys as strings

Fixes

• Don't panic on non-string YAML keys

v0.15.9

Compare Source

Compatibility

• Upgrade to yaml-rust2 0.10

Documentation

• Provided more jumping off points in the documentation

v0.15.8

Compare Source

Fix

• Don't panic on non-unicode env variable names and values

v0.15.7

Compare Source

Internal

• Update a dependency

v0.15.6

Compare Source

Fixes

• Fix regression from 0.15.3 with reading a table from an empty config

v0.15.5

Compare Source

Fixes

• Include the key on all serde errors

Performance

• Don't clone when merging sources

v0.15.4

Compare Source

Performance

• Reduce TOML build times

v0.15.3

Compare Source

Fixes

• Fix regression from 0.15.3 with reading a table from an empty config

v0.15.2

Compare Source

Fixes

• Provide an error message on path parsing errors (regression from 0.15.0)
• Improve quality of path parsing error messages

v0.15.1

Compare Source

Internal

• (ron) Update to 0.12

v0.15.0

Compare Source

Compatibility

• ConfigError is no longer exhaustive
• ConfigError::Parses type changed
• FileFormat is no longer exhaustive
• Deprecated functions removed
• Case insensitivity from 0.14.0 was reverted

Fixes

• Struct fields, variants, and lookup paths with uppercase letters can be used again (regression from 0.14.0)

v0.14.1

Compare Source

Compatibility

• MSRV is now 1.75

Internal

• Remove dependency on lazy_static
• Update rust-ini from 0.19 to 0.20
• Switch from yaml-rust to yaml-rust2

hyperium/http (http)

v1.4.2

Compare Source

• Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.
• Fix Uri to properly reject DEL characters.

v1.4.1

Compare Source

• Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.
• Fix Extend for HeaderMap to clamp max size hint and not overflow.
• Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.
• Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

v1.4.0

Compare Source

• Add StatusCode::EARLY_HINTS constant for 103 Early Hints.
• Make StatusCode::from_u16 now a const fn.
• Make Authority::from_static now a const fn.
• Make PathAndQuery::from_static now a const fn.
• MSRV increased to 1.57 (allows legible const fn panic messages).

v1.3.1

Compare Source

• Fix validation that all characters are UTF-8 in URI path and query.

v1.3.0

Compare Source

• Allow most UTF-8 characters in URI path and query.
• Fix HeaderMap::reserve() to allocate sufficient capacity.

v1.2.0

Compare Source

• Add StatusCode::TOO_EARLY constant for 425 status.
• Loosen TryFrom<HashMap> for HeaderMap to work with any state generic.
• Change Builder methods to use TryInto instead of TryFrom arguments.
• Make StatusCode::as_u16 a const function.
• Fix Method parsing to allow #$%&' characters.
• Fix HeaderName parsing to reject " characters.
• Fix off by 1 error in Method::from_bytes that could cause extra allocations.

hyperium/hyper (hyper)

v1.10.1

Compare Source

Bug Fixes

• http1: fix busy loop when peer half-closes and open body (#​4086) (c6cb906f, closes #​4085)

v1.10.0

Compare Source

Bug Fixes

• http1:
  • send error when dispatcher is dropped mid-body (#​4069) (b7a679ba, closes #​3995, #​4016)
  • fix reading large bodies on 32-bit systems (#​4056) (b12f6525, closes #​4055)
  • fix rare missed write wakeup on connections v2 (743a3ba0)
• http2:
  • do not reserve capacity before body data is available (#​4061) (99f24345, closes #​4003)
  • reading trailers shouldn't propagate NO_ERROR from early response (#​3998) (e5ad96b1)

Features

• http2:
  • add reset_stream_duration() client option (#​4068) (156a6f6a, closes #​2599)
  • Add 'header_table_size()' method to server builder (#​4062) (6c9182c4)

v1.9.0

Compare Source

Bug Fixes

• ffi: validate null pointers before dereferencing in request/response functions (#​4038 (28e73ccd)
• http1:
  • allow keep-alive for chunked requests with trailers (#​4043) (7211ec25, closes #​4044)
  • use case-insensitive matching for trailer fields (#​4011) (3b344cac, closes #​4010)
  • use httparse config for Servers (#​4002) (bcb8ec57, closes #​3923)
• http2:
  • cancel sending client request body on response future drop (#​4042) (5b17a69e, closes #​4040)
  • non-utf8 char in Connection header may cause panic when calling to_str (#​4019) (c36ca8a5)

Features

• client:
  • expose HTTP/2 current max stream count (#​4026) (d51cb715)
  • add HTTP/2 max_local_error_reset_streams option (#​4021) (57787459)
• error: add 'Error::is_parse_version_h2' method (393c77c7)
• http1: add UpgradeableConnection::into_parts (e21205cf)

v1.8.1 (2025-11-13)

Bug Fixes

• http1: fix consuming extra CPU from previous change (#​3977) (4492f31e)

v1.8.1

Compare Source

Bug Fixes

• http1: fix consuming extra CPU from previous change (#​3977) (4492f31e)

v1.8.0

Compare Source

Bug Fixes

• http1: fix rare missed write wakeup on connections (#​3952) (2377b893)
• http2: fix internals of HTTP/2 CONNECT upgrades (#​3967) (58e0e7dc, closes #​3966)

Features

• rt: add Timer::now() method to allow overriding the instant returned (#​3965) (5509ebe6)

Breaking Changes

• The HTTP/2 client connection no longer allows an executor
  that can not spawn itself.

  This was an oversight originally. The client connection will now include spawning
  a future that keeps a copy of the executor to spawn other futures. Thus, if it is
  !Send, it needs to spawn !Send futures. The likelihood of executors that match
  the previously allowed behavior should be very remote.

  There is also technically a semver break in here, which is that the
  Http2ClientConnExec trait no longer dyn-compatible, because it now expects to
  be Clone. This should not break usage of the conn builder, because it already
  separately had E: Clone bounds. If someone were using dyn Http2ClientConnExec,
  that will break. However, there is no purpose for doing so, and it is not usable
  otherwise, since the trait only exists to propagate bounds into hyper. Thus, the
  breakage should not affect anyone.
  (58e0e7dc)

v1.7.0

Compare Source

Bug Fixes

• server: improve caching accuracy of Date header (#​3887) (436cadd1)

Features

• client:
  • add a TrySendError::error() method (#​3885) (efa0b269)
  • add a TrySendError::message() method (#​3884) (03fd6aff)
• error: add Error::is_shutdown() (#​3863) (b8affd8a, closes #​2745)
• server: add allow_multiple_spaces_in_request_line_delimiters http1 builder method (#​3929) (9749184f)

v1.6.0

Compare Source

Bug Fixes

• server:
  • start http1 header read timeout when conn is idle (#​3828) (10b09ffc, closes #​3780, #​3781)
  • change max_local_error_reset_streams function to &mut self (#​3820) (e981a91e)

Features

• ext: add ext::on_informational() callback extension (#​3818) (8ce1fcfa, closes #​2565)
• server: add http1::Builder::ignore_invalid_headers(bool) option (#​3824) (3817a79b)

Breaking Changes

• http2::Builder::max_local_error_reset_streams() now takes &mut self and returns &mut Self. In practice, this shouldn't break almost anyone. It was the wrong receiver and return types.
  (e981a91e)

v1.5.2 (2024-12-16)

Bug Fixes

• http1:
  • fix intermitent panic parsing partial headers ([#&#82

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.