[dependabot]

Bumps the dependencies group with 4 updates: mongodb, axum-otel-metrics, regex and lru.

Updates mongodb from 3.7.0 to 3.8.0

Release notes

Sourced from mongodb's releases.

v3.8.0

The MongoDB Rust driver team is pleased to announce the v3.8.0 release of the mongodb crate, now available for download from crates.io.

Highlighted Changes

In-Use Encryption String API GA

The string API for in-use encryption (previously named the text API) is now stable and GA! This brings with it the following changes:

• The text-indexes-unstable feature is no longer required to enable this API. The feature still exists for backwards compatibility but does nothing.
• The TextOptions struct is now StringOptions.
• Algorithm::TextPreview is deprecated in favor of Algorithm::String.
• The query types "prefixPreview", "suffixPreview", and "substringPreview" are deprecated in favor of "prefix", "suffix", and "substring" respectively.

The GA API requires mongodb server version 9.0. The preview API can continue to be used with pre-9.0 server versions.

Server 4.2 EOL

As of this release, connecting to server version 4.2 is deprecated. Support for 4.2 will be removed in the 3.9.0 release.

MONGODB-AWS explicit authentication property deprecation

The use of explicit username, password, or the "AWS_SESSION_TOKEN" property with the MONGODB-AWS auth mechanism is deprecated, and will emit warnings when debug assertions are enabled. Support for these will be removed in version 4.0 of the driver.

Hickory performance on Windows

A long-standing bug in the hickory-resolver case when running on Windows caused performance degredation when using a mongodb+srv connection string. Happily, this bug is now fixed, so users who previously used our recommended workaround of a custom DNS configuration on Windows can now remove that workaround.

Full Release Notes

Impactful changes are listed below; for a complete list of changes see this GitHub query.

New Features

• RUST-2402 QE string API GA (#1727)
• RUST-2376 Optionally redact errors containing URI elements (#1708)

Improvements

• RUST-2388 Add AGENTS.md (#1706)
• RUST-2299 Remove warnings about hickory performance (#1712)
• RUST-2358 Update attribute name in OpenTelemetry Spec (#1713)
• RUST-2248 Add deprecation warnings for explicit MONGODB-AWS auth properties (#1716)
• RUST-2369 Add constructor methods for ReadPreference (#1732) (thanks @​OnjoujiToki!)

Bugfixes

• RUST-2437 Fix performance regression in Client::shutdown (#1718)

Commits

• 3630516 release v3.8.0 (#1736)
• 7fc959d RUST-2381 test KMS provider accessToken (#1735)
• 7a3eb9b RUST-2369 Add constructor methods for ReadPreference (#1732)
• 4064403 Bump the rust-dependencies group across 1 directory with 22 updates (#1734)
• 1645c13 RUST-1653 Tidy and consolidate connect_timeout usage (#1731)
• 22ee8fd RUST-2402 QE string API GA (#1727)
• 3e96e47 RUST-2417 build libmongocrypt from source (driver) (#1729)
• f0c4ef5 RUST-2445 Fix explicit encryption prose test case 2 (#1726)
• b78d5f9 Bump the rust-dependencies group with 13 updates (#1728)
• bd447a6 RUST-2447 Update crypto dependencies (#1725)
• Additional commits viewable in compare view

Updates axum-otel-metrics from 0.13.0 to 0.14.1

Release notes

Sourced from axum-otel-metrics's releases.

v0.14.1

🐛 Bug Fixes

• (deps) Bump rand to 0.9.3 in axum-metrics-demo example (e1df2f2)

v0.14.0

🐛 Bug Fixes

• Prevent http.server.active_requests from leaking when requests are cancelled: the gauge is now decremented via a PinnedDrop guard on client disconnect, timeout-layer cancellation, graceful shutdown and handler panics (edab65f)
• [breaking] Align metric labels with the OTel HTTP semantic conventions: add the required url.scheme attribute to all three histograms, record http.response.status_code as int instead of string, normalize unknown request methods to _OTHER, add the {request} unit to http.server.active_requests, and drop the outdated leading 0.0 duration bucket (edab65f)
• Fix the axum-metrics-demo example build (mixed otel 0.31/0.32 stacks) and replace std::thread::sleep with tokio::time::sleep so handlers no longer block tokio workers (0a0d2b4)

🚜 Refactor

• Slim the dependency tree from 81 to 29 crates: drop unused http, futures-util and opentelemetry_sdk dependencies, disable default features of axum, opentelemetry and tower (1f97573)

⚡ Performance

• Cut per-request heap allocations from ~8 to 2: static &'static str method labels, Arc<str> route/host attribute values passed to KeyValue without re-allocation, and MetricState shared via Arc instead of cloned per request (edab65f)

⚙️ Miscellaneous Tasks

• Add keywords and categories to Cargo.toml for crates.io discoverability (591c2c9)

Chore

• (deps) [breaking] Bump the opentelemetry group to 0.32; opentelemetry types are part of the public API, so downstream users must upgrade their otel stack to 0.32 as well (49477dc)
• (deps) Update axum-test requirement from 20.0.0 to 21.0.0 (2d33b9f)
• (deps) Update tokio to version 1.52 in dev-dependencies (911fda3)

Changelog

Sourced from axum-otel-metrics's changelog.

[0.14.1] - 2026-07-12

🐛 Bug Fixes

• (deps) Bump rand to 0.9.3 in axum-metrics-demo example (e1df2f2)

[0.14.0] - 2026-07-10

🐛 Bug Fixes

• Prevent http.server.active_requests from leaking when requests are cancelled: the gauge is now decremented via a PinnedDrop guard on client disconnect, timeout-layer cancellation, graceful shutdown and handler panics (edab65f)
• [breaking] Align metric labels with the OTel HTTP semantic conventions: add the required url.scheme attribute to all three histograms, record http.response.status_code as int instead of string, normalize unknown request methods to _OTHER, add the {request} unit to http.server.active_requests, and drop the outdated leading 0.0 duration bucket (edab65f)
• Fix the axum-metrics-demo example build (mixed otel 0.31/0.32 stacks) and replace std::thread::sleep with tokio::time::sleep so handlers no longer block tokio workers (0a0d2b4)

🚜 Refactor

• Slim the dependency tree from 81 to 29 crates: drop unused http, futures-util and opentelemetry_sdk dependencies, disable default features of axum, opentelemetry and tower (1f97573)

⚡ Performance

• Cut per-request heap allocations from ~8 to 2: static &'static str method labels, Arc<str> route/host attribute values passed to KeyValue without re-allocation, and MetricState shared via Arc instead of cloned per request (edab65f)

⚙️ Miscellaneous Tasks

• Add keywords and categories to Cargo.toml for crates.io discoverability (591c2c9)

Chore

• (deps) [breaking] Bump the opentelemetry group to 0.32; opentelemetry types are part of the public API, so downstream users must upgrade their otel stack to 0.32 as well (49477dc)
• (deps) Update axum-test requirement from 20.0.0 to 21.0.0 (2d33b9f)
• (deps) Update tokio to version 1.52 in dev-dependencies (911fda3)

Commits

• 86c950a chore: bump version to 0.14.1
• e1df2f2 fix(deps): bump rand to 0.9.3 in axum-metrics-demo example
• 003434f chore: bump version to 0.14.0
• 319c264 chore: remove stray git-cliff stderr line from CHANGELOG
• 0a0d2b4 fix(examples): align otel deps to 0.32 and stop blocking the runtime
• 591c2c9 chore: add keywords and categories for crates.io discoverability
• 1f97573 refactor(deps): slim dependency tree from 81 to 29 crates
• edab65f fix: prevent active_requests leak and align labels with OTel semconv
• 73d3744 style: cargo fmt
• 1349981 chore(deps): update opentelemetry dependencies to latest versions in axum-met...
• Additional commits viewable in compare view

Updates regex from 1.12.4 to 1.13.0

Changelog

Sourced from regex's changelog.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

Commits

• 926af2e 1.13.0
• 7d941a9 regex-automata-0.4.15
• e358341 api: add regex! macro for lazy compilation
• c420333 automata: disable miri on a couple doc tests
• b9d2cf7 github: add FUNDING link
• 0858006 docs: add AI policy for contributors
• 468fc64 automata: reject dense DFA start states that are match states
• See full diff in compare view

Updates lru from 0.18.0 to 0.18.1

Changelog

Sourced from lru's changelog.

v0.18.1 - 2026-07-09

• Add find_and_promote method.

Commits

• c6620d1 Merge pull request #237 from jeromefroe/jerome/prepare-0-18-1-release
• da3c0fc Prepare 0.18.1 release
• 1166263 Merge pull request #236 from pixmaip/find-and-promote
• 2daba12 Apply suggestions from code review
• 2ea00dc feat: add find_and_promote API
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions