Bump the cargo group with 13 updates by dependabot[bot] · Pull Request #117 · avelino/mcp

dependabot · 2026-10-08T11:08:02Z

Bumps the cargo group with 13 updates:

Package	From	To
tokio	`1.53.1`	`1.53.2`
reqwest	`0.13.4`	`0.13.5`
dirs	`6.0.0`	`7.0.0`
rand	`0.10.2`	`0.10.3`
open	`5.4.0`	`5.4.4`
comfy-table	`7.2.2`	`8.0.1`
console	`0.16.4`	`0.16.6`
uuid	`1.24.0`	`1.27.0`
jsonwebtoken	`11.0.0`	`11.1.0`
opentelemetry	`0.32.0`	`0.33.0`
opentelemetry_sdk	`0.32.1`	`0.33.0`
opentelemetry-otlp	`0.32.0`	`0.33.0`
tracing-opentelemetry	`0.33.0`	`0.34.0`

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

fs: handle integer overflow in buffered relative seek (#8574)

io: revert "always cleanup AsyncFd registration list on deregister" (#8540)

process: unregister Windows wait before closing child handle (#8564)

rt: drop blocking pool mutex before shutting down rejected task (#8562)

sync: fix mpsc index wraparound in block reclamation (#8546)

sync: forget mpsc Permit before sending value (#8560)

sync: validate MAX_PERMITS in Semaphore::acquire (#8548)

sync: wake broadcast Sender::closed outside mutex (#8558)

task: drop replaced waker outside lock in JoinSet (#8554)

time: drop timer lock before dropping waker in clear_entry (#8552)

time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

fs: clamp io_uring read length to u32::MAX (#8572)

rt: ignore current_thread task dumps from other runtimes (#8544)

rt: preserve io_uring context if a completion waker panics (#8566)

sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)

taskdump: restore deferred leaf wakes during capture (#8445)

time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

ff0c406 chore: prepare Tokio v1.53.2 (#8580)
a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
ec31a9f chore: prepare Tokio v1.51.5 (#8579)
625c851 sync: assign semaphore permits before emitting tracing event (#8542)
832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
9a47992 process: unregister Windows wait before closing child handle (#8564)
2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
Additional commits viewable in compare view

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

Add Error::is_dns() to identify errors caused by DNS resolution failures.

Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).

Add TLS version to TlsInfo extension.

Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.

Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

fix(blocking): preserve version and extensions in TryFromhttp::Request by @wwhsaber in seanmonstar/reqwest#3050

Remove unnecessary clones by @FranciscoTGouveia in seanmonstar/reqwest#3052

Add Referrer and Referrer Policy methods to WASM Request API by @Billy-Sheppard in seanmonstar/reqwest#3049

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in seanmonstar/reqwest#3058

feat: add Error::is_dns() to identify DNS resolution failures by @JoakoI98 in seanmonstar/reqwest#3057

Fix blocking client timeout panic by @V-Mann-Nick in seanmonstar/reqwest#3060

Use LookupIpStrategy::Ipv6AndIpv4 to actually prefer IPv6 when using hickory-dns by @FalkWoldmann in seanmonstar/reqwest#3063

feat: Add ClientBuilder::http1_max_headers by @smaeda-ks in seanmonstar/reqwest#3065

feat: expose the negotiated TLS version via TlsInfo by @dennisameling in seanmonstar/reqwest#3067

fix(error): detect timeouts wrapped in body decode errors by @raphaelroshan in seanmonstar/reqwest#3064

Remove unnecessary clones and a cast by @FranciscoTGouveia in seanmonstar/reqwest#3071

chore(deps): upgrade base64 to 0.23 by @paolobarbolini in seanmonstar/reqwest#3074

perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody by @spellsaif in seanmonstar/reqwest#3085

fix(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture::poll by @spellsaif in seanmonstar/reqwest#3084

src/async_impl/request.rs_improved_doc_for_json_fn: by @Athleteg in seanmonstar/reqwest#3082

fix: proxy could use wrong credentials if many matched by @seanmonstar in seanmonstar/reqwest#3098

New Contributors

@wwhsaber made their first contribution in seanmonstar/reqwest#3050

@FranciscoTGouveia made their first contribution in seanmonstar/reqwest#3052

@Billy-Sheppard made their first contribution in seanmonstar/reqwest#3049

@JoakoI98 made their first contribution in seanmonstar/reqwest#3057

@V-Mann-Nick made their first contribution in seanmonstar/reqwest#3060

@FalkWoldmann made their first contribution in seanmonstar/reqwest#3063

@smaeda-ks made their first contribution in seanmonstar/reqwest#3065

@raphaelroshan made their first contribution in seanmonstar/reqwest#3064

@spellsaif made their first contribution in seanmonstar/reqwest#3085

@Athleteg made their first contribution in seanmonstar/reqwest#3082

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

Add Error::is_dns() to identify errors caused by DNS resolution failures.

Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).

Add TLS version to TlsInfo extension.

Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.

Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

Commits

de55373 v0.13.5
4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
9f06fd2 docs: improve description of JSON method (#3082)
5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
4e9a3c7 chore: add pull request template for human-written content
17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
221abe9 chore: Remove unnecessary clones and a cast (#3071)
99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
Additional commits viewable in compare view

Updates dirs from 6.0.0 to 7.0.0

Updates rand from 0.10.2 to 0.10.3

Changelog

Sourced from rand's changelog.

[0.10.3] — 2026-09-20

Fixes

Fix WeightedIndex panic when the sum of float weights is infinite; return Error::Overflow instead (#1808)

Fix spurious Error::NonFinite from Uniform::new_inclusive on large finite float ranges such as 0.0..=f64::MAX (#1821)

Fix possible panic due to sampling a deserialized Uniform<char> (#1831)

Changes

Report exact remaining lengths from WeightedIndex::weights() and reduce overhead when reading weights (#1838)

#1808: rust-random/rand#1808 #1821: rust-random/rand#1821 #1831: rust-random/rand#1831 #1838: rust-random/rand#1838

Commits

9e7d328 Prepare rand 0.10.3 (#1840)
f73ce74 Optimize WeightedIndex weight lookup and iteration (#1838)
ef9e044 Avoid panic from deserialized Uniform\<char> where range == 0 (#1831)
c994eb1 docs: fix angle unit in quick start example (#1839)
33dea4f Test that WeightedIndex rejects INFINITY with Error::Overflow (#1822)
94c9078 Fix Uniform::new_inclusive overflow on large finite float ranges (#1821)
bb1262f Use Xoshiro256PlusPlus in examples/rayon-monte-carlo.rs (#1805)
521fab6 Stop pinning dependencies (#1820)
3f7c433 Stop pinning dependencies
cf4f73e sample_efraimidis_spirakis: error on more than amount non-finite weights (#1814)
Additional commits viewable in compare view

Updates open from 5.4.0 to 5.4.4

Release notes

Sourced from open's releases.

v5.4.4

Bug Fixes

open Windows paths without wildcard expansion

Opening a child of a bracket-named directory fails because Start-Process resolves parent directories as PowerShell wildcard patterns. The isolated Windows regression test reproduced WildcardPatternException for a copied executable under "【Tiny Asa】 [77P7V-712MB]\child" before this change.

Use Test-Path and Invoke-Item with LiteralPath for existing items, retaining Start-Process for URLs and application names. These cmdlets also work under PowerShell Constrained Language Mode. Share the embedded script between Windows and WSL, keep targets in environment data, and stop on launch errors to report a nonzero exit status. Preserve the security boundary established in fd29861: cmd /c start remains opt-in through the insecure feature. No previously removed launcher options are restored.

The integration test launches only a copy of its own test binary, which records its executable path and exits. It checks absolute and relative paths with invalid and valid bracket patterns, Unicode, backticks, quotes, shell metacharacters, and leading dashes in normal and constrained PowerShell sessions, plus failure for a missing executable. It requires neither Explorer nor registered document or URL handlers. Adjust the existing fallback assertion to also allow the opt-in cmd launcher after Explorer with all features enabled.

Validated locally on Windows with PowerShell 5.1.26100.33438 and rustc 1.97.1: cargo test and cargo test --all-features each passed all 19 tests, including the behavioral regression. git diff --check passed, and cargo package --list includes the embedded script. Test-Path returned false without errors for representative https, mailto, and file URLs. Actual GUI folder, document, URL handling and WSL interop were not exercised locally.

Commit Statistics

2 commits contributed to the release.

8 days passed between releases.

1 commit was understood as conventional.

1 unique issue was worked on: #132

Commit Details

#132

Open Windows paths without wildcard expansion (ad95c40)

Uncategorized

... (truncated)

Changelog

Sourced from open's changelog.

5.4.4 (2026-09-10)

Bug Fixes

open Windows paths without wildcard expansion

Opening a child of a bracket-named directory fails because Start-Process resolves parent directories as PowerShell wildcard patterns. The isolated Windows regression test reproduced WildcardPatternException for a copied executable under "【Tiny Asa】 [77P7V-712MB]\child" before this change.

Use Test-Path and Invoke-Item with LiteralPath for existing items, retaining Start-Process for URLs and application names. These cmdlets also work under PowerShell Constrained Language Mode. Share the embedded script between Windows and WSL, keep targets in environment data, and stop on launch errors to report a nonzero exit status. Preserve the security boundary established in fd29861: cmd /c start remains opt-in through the insecure feature. No previously removed launcher options are restored.

The integration test launches only a copy of its own test binary, which records its executable path and exits. It checks absolute and relative paths with invalid and valid bracket patterns, Unicode, backticks, quotes, shell metacharacters, and leading dashes in normal and constrained PowerShell sessions, plus failure for a missing executable. It requires neither Explorer nor registered document or URL handlers. Adjust the existing fallback assertion to also allow the opt-in cmd launcher after Explorer with all features enabled.

Validated locally on Windows with PowerShell 5.1.26100.33438 and rustc 1.97.1: cargo test and cargo test --all-features each passed all 19 tests, including the behavioral regression. git diff --check passed, and cargo package --list includes the embedded script. Test-Path returned false without errors for representative https, mailto, and file URLs. Actual GUI folder, document, URL handling and WSL interop were not exercised locally.

Commit Statistics

2 commits contributed to the release.

8 days passed between releases.

1 commit was understood as conventional.

1 unique issue was worked on: #132

Commit Details

... (truncated)

Commits

ba35e00 Release open v5.4.4
45317f8 Merge pull request #133 from Byron/fix-open-on-windows
ad95c40 fix: open Windows paths without wildcard expansion (#132)
9551952 Release open v5.4.3
136d4d0 Merge pull request #131 from ncfavier/reap
43e601d review
a78c0ca fix: wait for intermediate child to terminate when double-forking
1a3ef5d Release open v5.4.2
7468760 Merge pull request #130 from s00d/fix/macos-that-detached-zombies
351bb54 review
Additional commits viewable in compare view

Updates comfy-table from 7.2.2 to 8.0.1

Release notes

Sourced from comfy-table's releases.

v8.0.0

[8.0.0] - 05.08.2026

Breaking Changes
The following types and functions have been removed:

TableComponent enum

The modifiers module and Table::apply_modifier have been removed.

Table::current_style_as_preset

Table::set_style

Table::style

Table::remove_style

Table::load_preset
The positional preset string format has been replaced with the new TableStyle, LineStyle and ContentLineStyle types. The old approach of having "stringified" presets was too finicky and also implicitly bound to the order of variants in the old TableComponent enum. It was just not a good design.

The new design, in comparison, has a nice and (hopefully) intuitive API to define a style. On top of that, all functions on TableStyle are const, so custom styles can still be declared as constants:
const MY_STYLE: TableStyle = TableStyle::new()
    .top_border(LineStyle::new('┌', '─', '┬', '┐'))
    .header_lines(ContentLineStyle::new('│', '┆', '│'))
    .header_separator(LineStyle::new('╞', '═', '╪', '╡'))
    .content_lines(ContentLineStyle::new('│', '┆', '│'))
    .bottom_border(LineStyle::new('└', '─', '┴', '┘'));
The new API looks as follows:
Presets in comfy_table::presets::* are now TableStyle constants.

Table::load_style(style) has been added to load a preset or custom style.

Table::style() and Table::style_mut() to get a handle to the style used by the table. The mut handle can be used to change the style.

Instead of modifiers, there are now functions on TableStyle TableStyle::with_rounded_corners/TableStyle::with_solid_inner_borders.
All fields of TableStyle, LineStyle and ContentLineStyle are public:
table.style_mut().top_border.left = Some('╭');
The default truncation indicator is now … instead of .... This should make it more obvious that there's more text and consumes less visual space.
Fix

Various performance improvements that reduce table formatting time quite a bit:

~36% for "normal" tables (The readme of the project). 17µs -> 11µs

~34% for "larger" tables, which I would consider a reasonable usecase. 253µs -> 172µs

~70% for very large tables, i.e. a 10x500 table. -> 20.8ms -> 6.15ms

Most of these improvements boil down to:

... (truncated)

Changelog

Sourced from comfy-table's changelog.

[8.0.1] - 2026-09-25

Set MSRV to 1.88

[8.0.0] - 2026-08-05

Breaking Changes
The following types and functions have been removed:

TableComponent enum

The modifiers module and Table::apply_modifier have been removed.

Table::current_style_as_preset

Table::set_style

Table::style

Table::remove_style

Table::load_preset
The positional preset string format has been replaced with the new TableStyle, LineStyle and ContentLineStyle types. The old approach of having "stringified" presets was too finicky and also implicitly bound to the order of variants in the old TableComponent enum. It was just not a good design.

The new design, in comparison, has a nice and (hopefully) intuitive API to define a style. On top of that, all functions on TableStyle are const, so custom styles can still be declared as constants:
const MY_STYLE: TableStyle = TableStyle::new()
    .top_border(LineStyle::new('┌', '─', '┬', '┐'))
    .header_lines(ContentLineStyle::new('│', '┆', '│'))
    .header_separator(LineStyle::new('╞', '═', '╪', '╡'))
    .content_lines(ContentLineStyle::new('│', '┆', '│'))
    .bottom_border(LineStyle::new('└', '─', '┴', '┘'));
The new API looks as follows:
Presets in comfy_table::presets::* are now TableStyle constants.

Table::load_style(style) has been added to load a preset or custom style.

Table::style() and Table::style_mut() to get a handle to the style used by the table. The mut handle can be used to change the style.

Instead of modifiers, there are now functions on TableStyle TableStyle::with_rounded_corners/TableStyle::with_solid_inner_borders.
All fields of TableStyle, LineStyle and ContentLineStyle are public:
table.style_mut().top_border.left = Some('╭');
The default truncation indicator is now … instead of .... This should make it more obvious that there's more text and consumes less visual space.
Fix

Various performance improvements that reduce table formatting time quite a bit:

~36% for "normal" tables (The readme of the project). 17µs -> 11µs

~34% for "larger" tables, which I would consider a reasonable usecase. 253µs -> 172µs

... (truncated)

Commits

b947cb6 chore: Release comfy-table version 8.0.1
283fed2 chore: Set msrv to 1.88
bbd884f Merge pull request #212 from Nukesor/dependabot/cargo/rstest-0.27
f3c6d7e build(deps): update rstest requirement from 0.26 to 0.27
cf91e01 chore: Release comfy-table version 8.0.0
38f044c chore: Prepare release
401171a refactor: Replace old presets with TableStyle
f4be04a chore: Fix and extend lints
1bdfda2 perf: Don't allocate strings when splitting
36bd44f perf: Track line width in split_line
Additional commits viewable in compare view

Updates console from 0.16.4 to 0.16.6

Release notes

Sourced from console's releases.

0.16.6

What's Changed

Fix truncate_str panicking mid-character without ansi-parsing by @lenamonj in console-rs/console#296

perf: accelerate printable ASCII text width by @dexhunter in console-rs/console#297

fix: measure the truncation tail in visible columns, not raw width by @youdie006 in console-rs/console#298

Prepare 0.16.6 by @djc in console-rs/console#299

0.16.5

What's Changed

Strip OSC and DCS sequences to support e.g. OSC 8 hyperlinks over tmux. by @khoek in console-rs/console#280

Commits

4329b77 Bump version to 0.16.6
bdf46b0 utils: wrap tests in module
4f54213 fix: measure the truncation tail in visible columns
ed342d0 test: consolidate text width regression coverage
48b99e9 perf: accelerate printable ASCII text width
abf0358 Fix truncate_str panicking mid-character without ansi-parsing
ac3cb73 Bump version to 0.16.5
97a91ae ansi: strip OSC and DCS sequences
See full diff in compare view

Updates uuid from 1.24.0 to 1.27.0

Release notes

Sourced from uuid's releases.

v1.27.0

What's Changed

Accept case-insensitive urn:uuid: prefixes when parsing by @jaideeppyne in uuid-rs/uuid#912

Fix ordering of V7 UUIDs created by earlier seconds 8000 with later subsec nanos by @KodrAus in uuid-rs/uuid#915

Prepare for 1.27.0 release by @KodrAus in uuid-rs/uuid#917

New Contributors

@jaideeppyne made their first contribution in uuid-rs/uuid#912

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

v1.26.1

What's Changed

Seat the v7 counter below the version nibble by @lenamonj in uuid-rs/uuid#907

Don't panic in overflowing Timestamp to SystemTime conversion by @KodrAus in uuid-rs/uuid#909

Prepare for 1.26.1 release by @KodrAus in uuid-rs/uuid#910

New Contributors

@lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

Add ContextV7::with_additional_precision_bits by @ChrisJr404 in uuid-rs/uuid#904

Prepare for 1.26.0 release by @KodrAus in uuid-rs/uuid#905

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

1.25.0

What's Changed

Add a serde::bytes module that encodes a Uuid as a byte string by @ChrisJr404 in uuid-rs/uuid#902

Prepare for 1.25.0 release by @KodrAus in uuid-rs/uuid#903

New Contributors

@ChrisJr404 made their first contribution in uuid-rs/uuid#902

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

Fix non-ASCII character handling in parse diagnostics by @questfever in uuid-rs/uuid#899

Prepare for 1.24.1 release by @KodrAus in uuid-rs/uuid#900

New Contributors

@questfever made their first contribution in uuid-rs/uuid#899

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

Commits

b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
ffd8ec5 prepare for 1.27.0 release
4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
a1aa126 Merge pull request #912 from jaideeppyne/fix/urn-prefix-case-insensitive
4639d67 fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos
2723703 bump MSRV to 1.89.0
a3e64fa refactor: simplify URN prefix parsing
5055fd4 refactor: inline case-insensitive URN prefix checks
cb8b1d5 refactor: simplify case-insensitive URN parsing
285967d Accept case-insensitive urn:uuid: prefixes when parsing
Additional commits viewable in compare view

Updates jsonwebtoken from 11.0.0 to 11.1.0

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

Add dangerous::insecure_decode_claims

Commits

4c0ae75 Ready for release
46690b5 Add insecure_decode_claims (#539)
See full diff in compare view

Updates opentelemetry from 0.32.0 to 0.33.0

Release notes

Sourced from opentelemetry's releases.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Changelog

Sourced from opentelemetry's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.

Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.

Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.

Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
e652efd refactor(otlp): finalize exporter build error API (#3692)
8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
e085c61 ci: use supported Debian image for benchmarks (#3744)
6c5fd58 fix(proto): accept omitted partial success fields (#3739)
51b36a7 fix(otlp): handle enum environment values consistently (#3730)
Additional commits viewable in compare view

Updates opentelemetry_sdk from 0.32.1 to 0.33.0

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.

Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.

Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.

Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
e652efd refactor(otlp): finalize exporter build error API (#3692)
8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
e085c61 ci: use supported Debian image for benchmarks (#3744)
6c5fd58 fix(proto): accept omitted partial success fields (#3739)
51b36a7 fix(otlp): handle enum environment values consistently (#3730)
Additional commits viewable in compare view

Updates opentelemetry-otlp from 0.32.0 to 0.33.0

Changelog

Sourced from Description has been truncated

Bumps the cargo group with 13 updates: | Package | From | To | | --- | --- | --- | | [tokio](https://github.com/tokio-rs/tokio) | `1.53.1` | `1.53.2` | | [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.4` | `0.13.5` | | dirs | `6.0.0` | `7.0.0` | | [rand](https://github.com/rust-random/rand) | `0.10.2` | `0.10.3` | | [open](https://github.com/Byron/open-rs) | `5.4.0` | `5.4.4` | | [comfy-table](https://github.com/nukesor/comfy-table) | `7.2.2` | `8.0.1` | | [console](https://github.com/console-rs/console) | `0.16.4` | `0.16.6` | | [uuid](https://github.com/uuid-rs/uuid) | `1.24.0` | `1.27.0` | | [jsonwebtoken](https://github.com/Keats/jsonwebtoken) | `11.0.0` | `11.1.0` | | [opentelemetry](https://github.com/open-telemetry/opentelemetry-rust) | `0.32.0` | `0.33.0` | | [opentelemetry_sdk](https://github.com/open-telemetry/opentelemetry-rust) | `0.32.1` | `0.33.0` | | [opentelemetry-otlp](https://github.com/open-telemetry/opentelemetry-rust) | `0.32.0` | `0.33.0` | | [tracing-opentelemetry](https://github.com/tokio-rs/tracing-opentelemetry) | `0.33.0` | `0.34.0` | Updates `tokio` from 1.53.1 to 1.53.2 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.53.1...tokio-1.53.2) Updates `reqwest` from 0.13.4 to 0.13.5 - [Release notes](https://github.com/seanmonstar/reqwest/releases) - [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md) - [Commits](seanmonstar/reqwest@v0.13.4...v0.13.5) Updates `dirs` from 6.0.0 to 7.0.0 Updates `rand` from 0.10.2 to 0.10.3 - [Release notes](https://github.com/rust-random/rand/releases) - [Changelog](https://github.com/rust-random/rand/blob/master/CHANGELOG.md) - [Commits](rust-random/rand@0.10.2...0.10.3) Updates `open` from 5.4.0 to 5.4.4 - [Release notes](https://github.com/Byron/open-rs/releases) - [Changelog](https://github.com/Byron/open-rs/blob/main/changelog.md) - [Commits](Byron/open-rs@v5.4.0...v5.4.4) Updates `comfy-table` from 7.2.2 to 8.0.1 - [Release notes](https://github.com/nukesor/comfy-table/releases) - [Changelog](https://github.com/Nukesor/comfy-table/blob/main/CHANGELOG.md) - [Commits](Nukesor/comfy-table@v7.2.2...v8.0.1) Updates `console` from 0.16.4 to 0.16.6 - [Release notes](https://github.com/console-rs/console/releases) - [Changelog](https://github.com/console-rs/console/blob/main/CHANGELOG.md) - [Commits](console-rs/console@0.16.4...0.16.6) Updates `uuid` from 1.24.0 to 1.27.0 - [Release notes](https://github.com/uuid-rs/uuid/releases) - [Commits](uuid-rs/uuid@v1.24.0...v1.27.0) Updates `jsonwebtoken` from 11.0.0 to 11.1.0 - [Changelog](https://github.com/Keats/jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](Keats/jsonwebtoken@v11.0.0...v11.1.0) Updates `opentelemetry` from 0.32.0 to 0.33.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry-0.33.0/docs/release_0.33.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-0.32.0...opentelemetry-0.33.0) Updates `opentelemetry_sdk` from 0.32.1 to 0.33.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry_sdk-0.33.0/docs/release_0.33.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-semantic-conventions-0.32.1...opentelemetry_sdk-0.33.0) Updates `opentelemetry-otlp` from 0.32.0 to 0.33.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-rust/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry-otlp-0.33.0/docs/release_0.33.md) - [Commits](open-telemetry/opentelemetry-rust@opentelemetry-otlp-0.32.0...opentelemetry-otlp-0.33.0) Updates `tracing-opentelemetry` from 0.33.0 to 0.34.0 - [Release notes](https://github.com/tokio-rs/tracing-opentelemetry/releases) - [Changelog](https://github.com/tokio-rs/tracing-opentelemetry/blob/v0.1.x/CHANGELOG.md) - [Commits](https://github.com/tokio-rs/tracing-opentelemetry/commits) --- updated-dependencies: - dependency-name: tokio dependency-version: 1.53.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: reqwest dependency-version: 0.13.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: dirs dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: rand dependency-version: 0.10.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: open dependency-version: 5.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: comfy-table dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: cargo - dependency-name: console dependency-version: 0.16.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: cargo - dependency-name: uuid dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: jsonwebtoken dependency-version: 11.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: opentelemetry dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: opentelemetry_sdk dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: opentelemetry-otlp dependency-version: 0.33.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo - dependency-name: tracing-opentelemetry dependency-version: 0.34.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: cargo ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-14T11:12:55Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Oct 8, 2026

avelino mentioned this pull request Oct 14, 2026

deps: fix RustSec advisories, take over cargo group, add advisories gate #119

Merged

dependabot Bot closed this Oct 14, 2026

dependabot Bot deleted the dependabot/cargo/cargo-2a6b23aee1 branch October 14, 2026 11:13

Navigation Menu

Repository navigation

Bump the cargo group with 13 updates - #117

Bump the cargo group with 13 updates#117
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/cargo-2a6b23aee1

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

Uh oh!

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

Fixed (unstable)

v0.13.5

tl;dr

What's Changed

New Contributors

v0.13.5

[0.10.3] — 2026-09-20

Fixes

Changes

v5.4.4

Bug Fixes

Commit Statistics

Commit Details

5.4.4 (2026-09-10)

Bug Fixes

Commit Statistics

Commit Details

v8.0.0

[8.0.0] - 05.08.2026

Breaking Changes

Fix

[8.0.1] - 2026-09-25

[8.0.0] - 2026-08-05

Breaking Changes

Fix

0.16.6

What's Changed

0.16.5

What's Changed

v1.27.0

What's Changed

New Contributors

v1.26.1

What's Changed

New Contributors

v1.26.0

What's Changed

1.25.0

What's Changed

New Contributors

v1.24.1

What's Changed

New Contributors

11.1.0 (2026-09-16)

0.33.0

opentelemetry-semantic-conventions-0.32.1

Release Notes 0.33

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Retries enabled by default

Stabilisation cleanups

Release Notes 0.33

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Retries enabled by default

Stabilisation cleanups

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants