Bump the rust-dependencies group with 12 updates

[dependabot]

Bumps the rust-dependencies group with 12 updates:

Package	From	To
serde_json	1.0.149	1.0.150
rand	0.8.5	0.10.1
memmap2	0.9.10	0.9.11
rusqlite	0.31.0	0.40.1
tempfile	3.25.0	3.27.0
pyo3	0.22.6	0.29.0
axum	0.8.8	0.8.9
tokio	1.49.0	1.50.0
tower-http	0.6.8	0.7.0
tracing-subscriber	0.3.22	0.3.23
clap	4.5.60	4.6.1
reqwest	0.12.28	0.13.4

Updates serde_json from 1.0.149 to 1.0.150

Release notes

Sourced from serde_json's releases.

v1.0.150

• Reject non-string enum object keys (#1324, thanks @​puneetdixit200)

Commits

• a1ae73a Release 1.0.150
• 1a360b0 Merge pull request #1324 from puneetdixit200/reject-non-string-enum-keys
• 2037b63 Reject non-string enum object keys
• 5d30df6 Resolve manual_assert_eq pedantic clippy lint
• dc8003a Raise required compiler for preserve_order feature to 1.85
• a42fa98 Unpin CI miri toolchain
• 684a60e Pin CI miri to nightly-2026-02-11
• 7c7da33 Raise required compiler to Rust 1.71
• acf4850 Simplify Number::is_f64
• 6b8ceab Resolve unnecessary_map_or clippy lint
• Additional commits viewable in compare view

Updates rand from 0.8.5 to 0.10.1

Changelog

Sourced from rand's changelog.

[0.10.1] — 2026-02-11

This release includes a fix for a soundness bug; see #1763.

Changes

• Document panic behavior of make_rng and add #[track_caller] (#1761)
• Deprecate feature log (#1763)

#1761: rust-random/rand#1761 #1763: rust-random/rand#1763

[0.10.0] - 2026-02-08

Changes

• The dependency on rand_chacha has been replaced with a dependency on chacha20. This changes the implementation behind StdRng, but the output remains the same. There may be some API breakage when using the ChaCha-types directly as these are now the ones in chacha20 instead of rand_chacha (#1642).
• Rename fns IndexedRandom::choose_multiple -> sample, choose_multiple_array -> sample_array, choose_multiple_weighted -> sample_weighted, struct SliceChooseIter -> IndexedSamples and fns IteratorRandom::choose_multiple -> sample, choose_multiple_fill -> sample_fill (#1632)
• Use Edition 2024 and MSRV 1.85 (#1653)
• Let Fill be implemented for element types, not sliceable types (#1652)
• Fix OsError::raw_os_error on UEFI targets by returning Option<usize> (#1665)
• Replace fn TryRngCore::read_adapter(..) -> RngReadAdapter with simpler struct RngReader (#1669)
• Remove fns SeedableRng::from_os_rng, try_from_os_rng (#1674)
• Remove Clone support for StdRng, ReseedingRng (#1677)
• Use postcard instead of bincode to test the serde feature (#1693)
• Avoid excessive allocation in IteratorRandom::sample when amount is much larger than iterator size (#1695)
• Rename os_rng -> sys_rng, OsRng -> SysRng, OsError -> SysError (#1697)
• Rename Rng -> RngExt as upstream rand_core has renamed RngCore -> Rng (#1717)

Additions

• Add fns IndexedRandom::choose_iter, choose_weighted_iter (#1632)
• Pub export Xoshiro128PlusPlus, Xoshiro256PlusPlus prngs (#1649)
• Pub export ChaCha8Rng, ChaCha12Rng, ChaCha20Rng behind chacha feature (#1659)
• Fn rand::make_rng() -> R where R: SeedableRng (#1734)

Removals

• Removed ReseedingRng (#1722)
• Removed unused feature "nightly" (#1732)
• Removed feature small_rng (#1732)

#1632: rust-random/rand#1632 #1642: rust-random/rand#1642 #1649: rust-random/rand#1649 #1652: rust-random/rand#1652 #1653: rust-random/rand#1653 #1659: rust-random/rand#1659 #1665: rust-random/rand#1665 #1669: rust-random/rand#1669 #1674: rust-random/rand#1674 #1677: rust-random/rand#1677 #1693: rust-random/rand#1693 #1695: rust-random/rand#1695 #1697: rust-random/rand#1697

... (truncated)

Commits

• 27ff4cb Prepare v0.10.1: deprecate feature log (#1763)
• 98d0638 make_rng: document panic and add #[track_caller] (#1761)
• 54e5eaa Fix doc error (#1758)
• 1ce4c08 Bump itoa from 1.0.17 to 1.0.18 in the all-deps group (#1756)
• ccb734b docs: fix typo in doc comment (#1754)
• 357eb7d Bump libc from 0.2.182 to 0.2.183 in the all-deps group (#1753)
• 5e77fe5 Fix trait references in documentation (#1752)
• da89185 Bump the all-deps group with 3 updates (#1751)
• 50516ff Bump the all-deps group with 2 updates (#1749)
• fd71de9 Bump the all-deps group with 2 updates (#1747)
• Additional commits viewable in compare view

Updates memmap2 from 0.9.10 to 0.9.11

Changelog

Sourced from memmap2's changelog.

[0.9.11] - 2026-06-22

Fixed

• Fix unchecked pointer arithmatic in advice_range, unchecked_advise_range, flush_range and flush_async_range.

Changed

• Bump the MSRV from 1.63 to 1.65.

Commits

• 7d76ad3 Merge pull request #171 from RazrFalcon/release/v0.9.11
• 34f87ab Bump version to 0.9.11
• de56043 Merge pull request #170 from RazrFalcon/fix-unchecked-pointer-math
• 8b31409 Bump MSRV to 1.65 (to follow libc).
• cee7cf0 Fix unchecked pointer math.
• e741b00 Merge pull request #166 from andybalaam/typo-crated
• 28fdcdd Fix typo 'crated' -> 'created'
• See full diff in compare view

Updates rusqlite from 0.31.0 to 0.40.1

Release notes

Sourced from rusqlite's releases.

0.40.1

What's Changed

• Fix clippy warnings #1852
• Bump bundled SQLite version to 3.53.2 #1853
• Bump hashlink version #1855
• Fix SQL injection when SAVEPOINT name is tainted #1854

Full Changelog: rusqlite/rusqlite@v0.40.0...v0.40.1

0.40.0

What's Changed

• Breaking changes: Replace VTab macros by constructors #1823
• Breaking changes: Fix VTab::best_index #1824
• Asserts on VTab::connect aux and args #1825
• Breaking changes: Fix VTab::connect / create #1826
• Breaking changes: Allow opting out of using sqlite-wasm-rs on wasm32-unknown-unknown #1828, #1829
• Derive Default for SeriesTabCursor/ArrayTabCursor #1830
• Update link to pre-update hook #1831
• Breaking changes: Fix VTab::connect #1832
• impl From for FromSqlError #1833
• Breaking changes: Fix vtab::dequote #1835
• Bump bundled SQLCipher to version 4.14.0 #1837
• sqlite3_set_errmsg #1752
• Bump sqlite3-parser version #1838
• Fix UB in ToSqlOutput::from_rc #1839
• Ensure miri doesn't complain #1840
• Bump to actions/checkout@v6 #1842
• Add support to UtcDateTime #1843, #1844
• Bump bundled SQLite version to 3.53.1 #1848
• Replace some cfg(not by cfg_select #1850

Full Changelog: rusqlite/rusqlite@v0.39.0...v0.40.0

0.39.0

What's Changed

• Fix constraints on VTab Aux data #1778, #1771
• Fix docs.rs generation #1779
• Fix a small typo in rollback_hook docstring #1780
• Fix some warnings from Intellij #1781
• Minimal doc for features #1783
• Clear hooks only for owning connections #1785, #1784
• Fix link to SQLite C Interface, Prepare Flags #1787
• Comment functions which are not usable from a loadable extension #1789
• Factorize code #1792
• Update getrandom to 0.4 #1798
• Update Cargo.toml #1800
• Fix appveyor #1807
• Add support to unix timestamp for chrono, jiff and time #1808, #1803
• fix(trace): check that the sql string pointer is not NULL #1805
• Bump bundled SQLite version to 3.51.3 #1818

... (truncated)

Commits

• 6d3c282 Merge pull request #1856 from gwenn/0.40.1
• 2ba28b7 Prepare next release
• a021dc7 Merge pull request #1854 from gwenn/savepoint
• 534a149 Merge pull request #1855 from gwenn/hashlink
• 6d9764f Bump hashlink version
• fa574eb Use sqlite3_keyword_check
• 15385cc Fix SQL injection when SAVEPOINT name is tainted
• e5e48f2 Merge pull request #1853 from gwenn/3.53.2
• ac22292 Bump bundled SQLite version to 3.53.2
• c5f8828 Merge pull request #1852 from gwenn/clippy
• Additional commits viewable in compare view

Updates tempfile from 3.25.0 to 3.27.0

Changelog

Sourced from tempfile's changelog.

3.27.0

This release adds TempPath::try_from_path and deprecates TempPath::from_path.

Prior to this release, TempPath::from_path made no attempts to convert relative paths into absolute paths. The following code would have deleted the wrong file:

let tmp_path = TempPath::from_path("foo")
std::env::set_current_dir("/some/other/path").unwrap();
drop(tmp_path);

Now:

1. TempPath::from_path will attempt to convert relative paths into absolute paths. However, this isn't always possible as we need to call std::env::current_dir, which can fail. If we fail to convert the relative path to an absolute path, we simply keep the relative path.
2. The TempPath::try_from_path behaves exactly like TempPath::from_path, except that it returns an error if we fail to convert a relative path into an absolute path (or if the passed path is empty).

Neither function attempt to verify the existence of the file in question.

Thanks to @​meng-xu-cs for reporting this issue.

3.26.0

• Support NamedTempFile::persist on RedoxOS (#393) (thanks to @​Andy-Python-Programmer).

Commits

• See full diff in compare view

Updates pyo3 from 0.22.6 to 0.29.0

Release notes

Sourced from pyo3's releases.

PyO3 0.29.0

This release is a relatively large release with improvements across many areas of PyO3's API.

Build and packaging changes

This release brings full support for Python 3.15 beta. We encourage downstream projects to begin testing and distributing Python 3.15 beta wheels so that the ecosystem can prepare for the 3.15 final release later in the year.

Alongside Python 3.15 support comes support for its new "abi3t" stable ABI which supports both free-threaded and gil-enabled Python builds. For projects distributing stable ABI wheels, we recommend distributing (for each OS/architecture) an abi3 wheel built for your minimum supported Python version, a 3.14t version-specific wheel for free-threaded Python 3.14, and an abi3t wheel to support Python 3.15 (and future versions).

Support for Python 3.7 has been dropped. Support for Python 3.13t, the first experimental free-threaded release of CPython, has also been dropped. 3.14t (and soon 3.15t) is more stable, performant, and the starting point for CPython's own declaration of "support" for the free-threaded build.

The PyO3 build process (via the pyo3-build-config crate) has been adjusted to reduce the cost of rebuilds when the environment used to detect the Python interpreter changes; pyo3-build-config and pyo3-macros will no longer be rebuilt in such cases (although pyo3-ffi and crates downstream of it still will be rebuilt). As a consequence the pyo3_build_config APIs now require crates to have a direct dependency on pyo3 or pyo3-ffi. We hope to continue to reduce rebuild frequency and cost in a future PyO3 release.

Security updates

With the recent boom in AI-assisted security scanning, PyO3 has inevitably had several correctness issues exposed by AI-assisted scanning.

In particular, PyO3 0.29 fixes two security vulnerabilities we will be releasing to the RustSec Advisory Database imminently:

• Missing Sync bound on PyCFunction::new_closure closures
• Possible out of bounds read in BoundTupleIterator::nth_back and BoundListIterator::nth_back

Any code using the above APIs is advised to update as soon as possible.

This release also contains several other minor breaking changes to close soundness holes uncovered by AI-assisted scanning. Our assessment as maintainers was that, excluding the two vulnerability cases listed above, these correctness issues would likely have crashed immediately upon user testing rather than leading to attacker-exploitable pathways. We nevertheless wanted to see them closed without the usual deprecation cycle. These cases are noted in the migration guide.

Other major themes in this release

New in this release is a CLI in pyo3-introspection to generate type stubs along with the experimental-inspect feature. Downstream, maturin has also gained support to generate type stubs using the feature. The feature is reaching a point where substantial amount of type stubs can be generated automatically. We would like to encourage users to begin using this feature and helping us find what functionality is missing, with a hope we can declare its API stable given sufficient feedback.

A substantial amount of effort has been invested in pyo3-ffi as part of the process of extending it with 3.15's new APIs. There have been many missing APIs from older Python versions added. There have also been a number of fixes to incorrect definitions (these are breaking changes, but also necessary for correctness); we hope there will be far fewer such cases in the future due to more comprehensive checking added to PyO3's CI. Finally, many private CPython APIs (those with _Py underscore-named prefix) have been removed from pyo3-ffi's public API.

In closing

There are also many other incremental improvements, bug fixes and smaller features; full detail can be found in the CHANGELOG.

Please consult the migration guide for help upgrading.

Thank you to everyone who contributed code, documentation, design ideas, bug reports, and feedback. The following contributors' commits are included in this release:

@​Alc-Alc @​alex @​anuraaga @​BD103 @​bschoenmaeckers @​Cheukting @​chirizxc @​ChristopherRabotin @​clin1234 @​codeguru42 @​davidhewitt

... (truncated)

Changelog

Sourced from pyo3's changelog.

[0.29.0] - 2026-06-11

Packaging

• Support the new PEP 803 abi3t ABI with new abi3t and abi3t-py315 features. #5807
• pyo3-macros-backend no longer depends on pyo3-build-config. #5809
• Drop support for Python 3.13t (3.14t and above continue to be supported; CPython declared free-threading supported starting with Python 3.14). #5865
• Drop support for Python 3.7. #5912
• Extend range of supported versions of hashbrown optional dependency to include version 0.17. #5973
• Support Python 3.15.0b1. #6014
• pyo3-ffi is now no_std. #6022

Added

• Add PyErr::set_traceback to set the traceback of an exception object. #5349
• Add PyUnicodeDecodeError::new_err_from_utf8 to create a PyErr from a str::Utf8Error. #5668
• experimental-inspect: implement INPUT_TYPE and OUTPUT_TYPE on optional third-party crate conversions. #5770
• experimental-inspect: include doc comments in generated stubs. #5782
• Add pyo3_build_config::PythonAbi, pyo3_build_config::PythonAbiKind, pyo3_build_config::PythonAbiBuilder, pyo3_build_config::InterpreterConfig::target_abi, and pyo3_build_config::InterpreterConfigBuilder::target_abi. #5807
• Add Borrowed::get as an equivalent to Bound::get and Py::get. #5849
• Add PyFrame::new, PyTraceBack::new, and PyFrameMethods::line_number. #5857
• Add PyUntypedBuffer::obj to retrieve the Python object owning the buffer. #5870
• Add PyCapsule::new_with_value and PyCapsule::new_with_value_and_destructor. #5881
• Add PyErr::set_context and PyErr::context. #5887
• Add a small CLI to pyo3-introspection to generate stubs. #5904
• Add Python::version_str. #5921
• Add TryFrom<&Bound<T>> for PyRef<T>, PyRefMut<T>, PyClassGuard<T> and PyClassGuardMut<T>. #5922
• Add From<&Bound<T>> for Bound<T> and Py<T> #5922
• Add PyDictMethods::set_default and PyDictMethods::set_default_ref to allow atomically setting default values in a PyDict. #5955
• add PyFrameMethods::outer|code|var|builtins|globals|locals. #5967
• Add From conversions for PyErr from std::time::TryFromFloatSecsError, std::time::SystemTimeError, std::path::StripPrefixError, std::env::JoinPathsError, std::char::ParseCharError, and std::char::CharTryFromError. #6001
• Add pyo3_build_config::InterpreterConfigBuilder. #6034
• Add PyCapsule::import_pointer #6066
• Add PyClassGuardMapMut. #6073
• Expose PyListMethods::get_item_unchecked, PyTupleMethods::get_item_unchecked, and PyTupleMethods::get_borrowed_item_unchecked on abi3. #6075
• Add PyClassGuardMapSuper. #6104
• Add PyClassGuard and PyClassGuardMut to pyo3::prelude. #6112
• Add Debug impls for PyClassGuard and PyClassGuardMut. #6112
• Enable extending PyDateTime, PyDate, PyTime, PyDelta and PyTzInfo on abi3 with python 3.12+. #6115
• Expose PyFunction available on abi3. #6117
• FFI definitions:
  • Added FFI definitions PyUnstable_Object_IsUniquelyReferenced, PyUnstable_Object_IsUniquelyReferencedTemporary, PyUnstable_EnableTryIncref, and PyUnstable_TryIncref. #5828
  • Add FFI definitions ffi::PyErr_GetHandledException and ffi::PyErr_SetHandledException. #5887
  • Add FFI definition Py_HASH_SIPHASH13. #5891
  • Add FFI definition PyStructSequence_UnnamedField constant on Python 3.9 and up (or 3.11 with abi3 features). #5892
  • Add FFI definitions PyUnstable_InterpreterFrame_GetCode, PyUnstable_InterpreterFrame_GetLasti, PyUnstable_InterpreterFrame_GetLine, and PyUnstable_ExecutableKinds. #5932
  • Add FFI definitions PyMarshal_WriteLongToFile, PyMarshal_WriteObjectToFile, PyMarshal_ReadLongFromFile, PyMarshal_ReadShortFromFile, PyMarshal_ReadObjectFromFile, and PyMarshal_ReadLastObjectFromFile. #5934
  • Add FFI definitions PyObject_GetAIter, PyAIter_Check, PyMapping_HasKeyWithError, PyMapping_HasKeyStringWithError, PyMapping_GetOptionalItem, PyMapping_GetOptionalItemString, PySequence_ITEM, PySequence_Fast_GET_SIZE, PySequence_Fast_GET_ITEM, and PySequence_Fast_ITEMS. #5942
  • Add FFI definition compat::PyObject_HasAttrWithError. #5944
  • Add FFI definitions PyDict_SetDefault, PyDict_SetDefaultRef, PyDict_ContainsString, PyDict_Pop, PyDict_PopString, PyDict_ClearWatcher, PyDict_Watch, PyDict_Unwatch, and PyFrozenDict_New. #5947

... (truncated)

Commits

• 0f90242 release: 0.29.0 (#6107)
• cd128ed doc: mention abi3t, python3t.dll, and abi3t_compat folder in FAQ (#6124)
• 7e2ef18 Avoid type checks in methods where CPython already guarantees the received ty...
• f930199 docs: additional detail in migration guide for 0.29 (#6123)
• 91ab0d1 Enable Windows abi3t tests (#6106)
• fe0fdd5 add PyLong* API (3.14+) (#6016)
• f41b1df Hang when reattaching after detach during shutdown (#6085)
• 5ae66a8 Fix double import on RustPython (#6122)
• ad4a510 PyFunction: enable some extra tests with abi3 (#6118)
• c79ac0e ci: Add test for minimum supported debug build of Python (#5852)
• Additional commits viewable in compare view

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
• changed: Update minimum rust version to 1.80 (#3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#3656)
• fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

• c59208c revert axum-core changelog changes
• 99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
• 23d7098 Revert "axum-core 0.5.6"
• e8a39ad axum-macros 0.5.1
• 6e9a249 axum-extra 0.12.6
• 0ec9041 axum 0.8.9
• c3fcebb axum-core 0.5.6
• a8790fc update release notes
• 26ba7bb docs: consolidate state management docs in crate root (#3683)
• 9fc59ef Update to tokio-tungstenite 0.29 (#3689)
• Additional commits viewable in compare view

Updates tokio from 1.49.0 to 1.50.0

Release notes

Sourced from tokio's releases.

Tokio v1.50.0

1.50.0 (Mar 3rd, 2026)

Added

• net: add TcpStream::set_zero_linger (#7837)
• rt: add is_rt_shutdown_err (#7771)

Changed

• io: add optimizer hint that memchr returns in-bounds pointer (#7792)
• io: implement vectored writes for write_buf (#7871)
• runtime: panic when event_interval is set to 0 (#7838)
• runtime: shorten default thread name to fit in Linux limit (#7880)
• signal: remember the result of SetConsoleCtrlHandler (#7833)
• signal: specialize windows Registry (#7885)

Fixed

• io: always cleanup AsyncFd registration list on deregister (#7773)
• macros: remove (most) local use declarations in tokio::select! (#7929)
• net: fix GET_BUF_SIZE constant for target_os = "android" (#7889)
• runtime: avoid redundant unpark in current_thread scheduler (#7834)
• runtime: don't park in current_thread if before_park defers waker (#7835)
• io: fix write readiness on ESP32 on short writes (#7872)
• runtime: wake deferred tasks before entering block_in_place (#7879)
• sync: drop rx waker when oneshot receiver is dropped (#7886)
• runtime: fix double increment of num_idle_threads on shutdown (#7910, #7918, #7922)

Unstable

• fs: check for io-uring opcode support (#7815)
• runtime: avoid lock acquisition after uring init (#7850)

Documented

• docs: update outdated unstable features section (#7839)
• io: clarify the behavior of AsyncWriteExt::shutdown() (#7908)
• io: explain how to flush stdout/stderr (#7904)
• io: fix incorrect and confusing AsyncWrite documentation (#7875)
• rt: clarify the documentation of Runtime::spawn (#7803)
• rt: fix missing quotation in docs (#7925)
• runtime: correct the default thread name in docs (#7896)
• runtime: fix event_interval doc (#7932)
• sync: clarify RwLock fairness documentation (#7919)
• sync: clarify that recv returns None once closed and no more messages (#7920)
• task: clarify when to use spawn_blocking vs dedicated threads (#7923)
• task: doc that task drops before JoinHandle completion (#7825)
• signal: guarantee that listeners never return None (#7869)
• task: fix task module feature flags in docs (#7891)

... (truncated)

Commits

• 0273e45 chore: prepare Tokio v1.50.0 (#7934)
• e3ee4e5 chore: prepare tokio-macros v2.6.1 (#7943)
• 8c980ea io: add write_all_vectored to tokio-util (#7768)
• e35fd6d ci: fix patch during clippy step (#7935)
• 03fe44c runtime: fix event_interval doc (#7932)
• d18e5df io: fix race in Mock::poll_write (#7882)
• f21f269 runtime: fix race condition during the blocking pool shutdown (#7922)
• d81e8f0 macros: remove (most) local use declarations in tokio::select! (#7929)
• 25e7f26 rt: fix missing quotation in docs (#7925)
• e1a91ef util: fix typo in docs (#7926)
• Additional commits viewable in compare view

Updates tower-http from 0.6.8 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Updates tracing-subscriber from 0.3.22 to 0.3.23

Release notes

Sourced from tracing-subscriber's releases.

tracing-subscriber 0.3.23

Fixed

• Allow ansi sanitization to be disabled (#3484)

#3484: tokio-rs/tracing#3484

Commits

• 54ede4d chore: prepare tracing-subscriber 0.3.23 (#3490)
• 37558d5 subscriber: allow ansi sanitization to be disabled (#3484)
• efc690f core: add missing const (#3449)
• 0c32367 core: Use const initializers instead of once_cell
• 9feb241 docs: add arcswap reload crate to related (#3442)
• 2d55f6f chore: prepare tracing 0.1.44 (#3439)
• 10a9e83 chore: prepare tracing-core 0.1.36 (#3440)
• ee82cf9 tracing: fix record_all panic (#3432)
• 9978c36 chore: prepare tracing-mock 0.1.0-beta.3 (#3429)
• See full diff in compare view

Updates clap from 4.5.60 to 4.6.1

Release notes

Sourced from clap's releases.

v4.6.1

[4.6.1] - 2026-04-15

Fixes

• (derive) Ensure rebuilds happen when an read env variable is changed

Changelog

Sourced from clap's changelog.

[4.6.1] - 2026-04-15

Fixes

• (derive) Ensure rebuilds happen when an read env variable is changed

[4.6.0] - 2026-03-12

Compatibility

• Update MSRV to 1.85

[4...

Description has been truncated