chore(deps): bump the cargo group across 1 directory with 70 updates

[dependabot]

Bumps the cargo group with 69 updates in the / directory:

Package	From	To
aes-gcm	0.10.3	0.11.0
axum	0.7.9	0.8.8
borsh	1.6.0	1.7.0
bytes	1.11.1	1.12.1
cached-path	0.8.1	0.10.1
camino	1.2.2	1.2.4
candid	0.10.24	0.10.32
chrono	0.4.44	0.4.45
claims	0.7.1	0.8.0
serial_test	3.4.0	3.5.0
const_format	0.2.35	0.2.36
curve25519-dalek	4.1.3	5.0.0
dashmap	5.5.3	6.1.0
dcap-qvl	0.3.12	0.5.2
dirs	5.0.1	6.0.0
ed25519-dalek	2.2.0	3.0.0
either	1.15.0	1.16.0
fixedstr	0.5.10	0.5.11
fragile	2.0.1	2.1.0
generic-array	1.3.5	1.4.3
hkdf	0.12.4	0.13.0
ic-agent	0.39.3	0.48.1
indexmap	2.13.0	2.14.0
itertools	0.14.0	0.15.0
jsonschema	0.17.1	0.47.0
jsonwebtoken	9.3.1	10.4.0
lz4_flex	0.11.6	0.13.1
libp2p-identity	0.2.13	0.2.14
memchr	2.8.0	2.8.3
notify	6.1.1	8.2.0
once_cell	1.21.3	1.21.4
owo-colors	3.5.0	4.3.0
prometheus-client	0.23.1	0.25.0
quote	1.0.44	1.0.46
rand	0.8.5	0.10.2
rust-embed	8.11.0	8.12.0
semver	1.0.27	1.0.28
serde_json	1.0.149	1.0.150
serde_json_canonicalizer	0.2.0	0.3.2
serde_with	3.17.0	3.21.0
sha2	0.10.9	0.11.0
strum	0.26.3	0.27.2
syn	2.0.117	2.0.118
tempfile	3.26.0	3.27.0
tdx-quote	0.0.4	0.0.5
thiserror	1.0.69	2.0.18
tokio-tungstenite	0.24.0	0.28.0
toml	0.8.23	1.0.3+spec-1.1.0
toml_edit	0.22.27	0.23.10+spec-1.0.0
tower	0.4.13	0.5.3
tower-http	0.5.2	0.6.8
tower-sessions	0.12.3	0.15.0
tracing-subscriber	0.3.22	0.3.23
trybuild	1.0.116	1.0.117
ureq	2.12.1	3.3.0
wasmer	6.1.0	7.2.0
wasmer-types	6.1.0	7.2.0
wasmer-compiler-cranelift	6.1.0	7.2.0
webbrowser	1.1.0	1.2.1
zeroize	1.8.2	1.9.0
axum-extra	0.10.3	0.12.5
config	0.13.4	0.15.19
ctor	0.1.26	1.0.8
regex	1.12.3	1.12.4
uuid	1.21.0	1.23.4
mockall	0.11.4	0.15.0
sigstore	0.13.0	0.14.0
rand_chacha	0.3.1	0.9.0
wasmparser	0.118.2	0.253.0

Updates aes-gcm from 0.10.3 to 0.11.0

Commits

• a10b56f aes-gcm v0.11.0 (#852)
• f042e9c aead-stream v0.6.0 (#851)
• b29735a Adopt Trusted Publishing (#854)
• a1fe43f xaes-256-gcm: enable and fix workspace level lints (#850)
• 8cf876f eax: remove toplevel lint attributes (#849)
• 4661ddf ocb3: enable and fix workspace-level lints (#848)
• c821431 eax: enable and fix workspace-level lints (#847)
• d3684bb deoxys: enable and fix workspace-level lints (#846)
• 5e016e2 chacha20poly1305: enable and fix workspace-level lints (#845)
• b3524d3 ccm: enable and fix workspace-level lints (#844)
• Additional commits viewable in compare view

Updates axum from 0.7.9 to 0.8.8

Release notes

Sourced from axum's releases.

axum v0.8.8

• Clarify documentation for Router::route_layer (#3567)

#3567: tokio-rs/axum#3567

axum v0.8.7

• Relax implicit Send / Sync bounds on RouterAsService, RouterIntoService (#3555)
• Make it easier to visually scan for default features (#3550)
• Fix some documentation typos

#3550: tokio-rs/axum#3550 #3555: tokio-rs/axum#3555

axum v0.8.5

• fixed: Reject JSON request bodies with trailing characters after the JSON document (#3453)
• added: Implement OptionalFromRequest for Multipart (#3220)
• added: Getter methods Location::{status_code, location}
• added: Support for writing arbitrary binary data into server-sent events (#3425)]
• added: middleware::ResponseAxumBodyLayer for mapping response body to axum::body::Body (#3469)
• added: impl FusedStream for WebSocket (#3443)
• changed: The sse module and Sse type no longer depend on the tokio feature (#3154)
• changed: If the location given to one of Redirects constructors is not a valid header value, instead of panicking on construction, the IntoResponse impl now returns an HTTP 500, just like Json does when serialization fails (#3377)
• changed: Update minimum rust version to 1.78 (#3412)

#3154: tokio-rs/axum#3154 #3220: tokio-rs/axum#3220 #3377: tokio-rs/axum#3377 #3412: tokio-rs/axum#3412 #3425: tokio-rs/axum#3425 #3443: tokio-rs/axum#3443 #3453: tokio-rs/axum#3453 #3469: tokio-rs/axum#3469

axum v0.8.4

• added: Router::reset_fallback (#3320)
• added: WebSocketUpgrade::selected_protocol (#3248)
• fixed: Panic location for overlapping method routes (#3319)
• fixed: Don't leak a tokio task when using serve without graceful shutdown (#3129)

#3319: tokio-rs/axum#3319 #3320: tokio-rs/axum#3320 #3248: tokio-rs/axum#3248 #3129: tokio-rs/axum#3129

axum v0.8.3

• added: Implement From<Bytes> for Message (#3273)
• added: Implement OptionalFromRequest for Json (#3142)
• added: Implement OptionalFromRequest for Extension (#3157)
• added: Allow setting the read buffer capacity of WebSocketUpgrade (#3178)

... (truncated)

Commits

• d07863f Release axum v0.8.8 and axum-extra v0.12.3
• 287c674 axum-extra: Make typed-routing feature enable routing feature (#3514)
• f5804aa SecondElementIs: Correct a small inconsistency (#3559)
• f51f3ba axum-extra: Add trailing newline to pretty JSON response (#3526)
• 816407a Fix integer underflow in try_range_response for empty files (#3566)
• 78656eb docs: Clarify route_layer does not apply middleware to the fallback handler...
• 4404f27 Release axum v0.8.7 and axum-extra v0.12.2
• 8f1545a Fix typo in extractors guide (#3554)
• 4fc3faa Relax implicit Send / Sync bounds (#3555)
• a05920c Make it easier to visually scan for default features (#3550)
• Additional commits viewable in compare view

Updates borsh from 1.6.0 to 1.7.0

Release notes

Sourced from borsh's releases.

borsh-derive-v1.7.0

No release notes provided.

borsh-v1.7.0

Added

• impl BorshSerialize and BorshDeserialize for Uuid (#366)

Fixed

• handle PhantomData in enum schema derive (#369)

Other

• cover schema predicate bounds referencing filtered enum params (#372)
• fix the build on current toolchains (#368)

borsh-derive-v1.6.1

No release notes provided.

borsh-v1.6.1

Fixed

• keep bytes no_std unless borsh std is enabled (#364)

Changelog

Sourced from borsh's changelog.

1.7.0 - 2026-06-17

Added

• impl BorshSerialize and BorshDeserialize for Uuid (#366)

Fixed

• handle PhantomData in enum schema derive (#369)

Other

• cover schema predicate bounds referencing filtered enum params (#372)
• fix the build on current toolchains (#368)

1.6.1 - 2026-03-15

Fixed

• keep bytes no_std unless borsh std is enabled (#364)

Commits

• 3348776 chore: release v1.7.0 (#370)
• 9e48f60 test: cover schema predicate bounds referencing filtered enum params (#372)
• 1133023 fix: handle PhantomData in enum schema derive (#369)
• b53e108 ci: use org-level NEARPROTOCOL_CI_PR_ACCESS token for release-plz (#371)
• 47e132f feat: impl BorshSerialize and BorshDeserialize for Uuid (#366)
• aa2e794 ci: fix the build on current toolchains (#368)
• f8109c7 chore: release v1.6.1 (#365)
• d099f8c fix: keep bytes no_std unless borsh std is enabled (#364)
• 2801032 docs: add devex team to CODEOWNERS (#362)
• See full diff in compare view

Updates bytes from 1.11.1 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

Bytes v1.12.0

1.12.0 (June 18th, 2026)

Added

• Add BytesMut::extend_from_within() (#818)
• Add BytesMut::try_unsplit() (#746)

Fixed

• Fix panic in get_int if nbytes is zero (#806)

Changed

• Pass vtable data by value (#826)
• Exclude development scripts from published package (#810)

Documented

• Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

1.12.0 (June 18th, 2026)

Added

• Add BytesMut::extend_from_within() (#818)
• Add BytesMut::try_unsplit() (#746)

Fixed

• Fix panic in get_int if nbytes is zero (#806)

Changed

• Pass vtable data by value (#826)
• Exclude development scripts from published package (#810)

Documented

• Document that BytesMut::{reserve,try_reserve} doesn't preserve unused capacity (#808)

Commits

• 76c0fbb Release bytes v1.12.1 (#838)
• 924c82b Handle unwinding from Box::new (#837)
• 91402ce Release bytes v1.12.0 (#831)
• 2256e6d chore: add safety comments on unsafe blocks (#827)
• 245adff Pass vtable data by value (#826)
• 00cc5ff Implement BytesMut::extend_from_within (#818)
• 5b79d31 Merge tag 'v1.11.1'
• 804ee6d Make try_unsplit method public (#746)
• fd426ca Exclude development scripts from published package (#810)
• b4ed70d Add test for copy_to_bytes() -> BytesMut avoiding clone (#809)
• Additional commits viewable in compare view

Updates cached-path from 0.8.1 to 0.10.1

Release notes

Sourced from cached-path's releases.

v0.10.1

What's new

Changed ⚠️

• Updated various dependencies.

Commits

e1b4519 Update dependencies (#90)

v0.10.0

What's new

Commits

13c3f25 update readme 90f03cd feat: add a progress-bar feature to disable indicatif dependency (#89) 06b2eb4 bump actions/cache 3373bd0 replace deprecated cargo_bin call (#88)

v0.9.0

What's new

Changed ⚠️

• Updated reqwest dependency from 0.11 to 0.12.

Commits

00f71e3 update reqwest to 0.12 (#86)

Changelog

Sourced from cached-path's changelog.

v0.10.1 - 2026-03-04

Changed

• Updated various dependencies.

v0.10.0 - 2025-12-19

Added

• Added a progress-bar feature to enable the indicatif dependency.

v0.9.0 - 2025-08-25

Changed

• Updated reqwest dependency from 0.11 to 0.12.

Commits

• b5ecb42 Prepare for release v0.10.1
• e1b4519 Update dependencies (#90)
• 46eef11 Prepare for release v0.10.0
• 13c3f25 update readme
• 90f03cd feat: add a progress-bar feature to disable indicatif dependency (#89)
• 06b2eb4 bump actions/cache
• 3373bd0 replace deprecated cargo_bin call (#88)
• c449ca1 Prepare for release v0.9.0
• 00f71e3 update reqwest to 0.12 (#86)
• See full diff in compare view

Updates camino from 1.2.2 to 1.2.4

Release notes

Sourced from camino's releases.

camino 1.2.4

Added

Methods to convert between Box<Utf8Path> and Box<Path>:

• From<Box<Utf8Path>> for Box<Path> (as of release, not documented due to rust-lang/rust#158466).
• Utf8Path::into_std_boxed_path(self: Box<Self>)
• Utf8Path::from_boxed_path(path: Box<Path>)
• TryFrom<Box<Path>> for Box<Utf8Path>

Thanks nicopap for your first contribution!

camino 1.2.3

Performance improvements

• Utf8Path::hash now delegates to std::path::Path::hash, resulting in hashing requiring ~2x fewer instructions. Thanks stormslowly for your first contribution!

Changelog

Sourced from camino's changelog.

[1.2.4] - 2026-06-27

Added

Methods to convert between Box<Utf8Path> and Box<Path>:

• From<Box<Utf8Path>> for Box<Path> (as of release, not documented due to rust-lang/rust#158466).
• Utf8Path::into_std_boxed_path(self: Box<Self>)
• Utf8Path::from_boxed_path(path: Box<Path>)
• TryFrom<Box<Path>> for Box<Utf8Path>

Thanks nicopap for your first contribution!

[1.2.3] - 2026-06-18

Performance improvements

• Utf8Path::hash now delegates to std::path::Path::hash, resulting in hashing requiring ~2x fewer instructions. Thanks stormslowly for your first contribution!

Commits

• 8966366 [camino] version 1.2.4
• abf526b [meta] prepare release
• 417c6e1 docs: fix dangling [from] link in into_std_boxed_path (#125)
• 6d25706 add Box<Path> -> Box<Utf8Path> conversion (#124)
• 816ddeb test Box\<Utf8Path> conversions, and other review fixes (#123)
• e437cc3 Add conversion from Box<Utf8Path> to Box<Path> (#122)
• 0b4c744 [camino] version 1.2.3
• feac129 [meta] prepare changelog
• f806a85 add cargo-release autoreplacements
• 6368097 perf: delegate Utf8Path::hash to the wrapped Path (#120)
• Additional commits viewable in compare view

Updates candid from 0.10.24 to 0.10.32

Changelog

Sourced from candid's changelog.

Candid 0.10.32

• Non-breaking changes:
  • A service reference now decodes where a principal is expected: service <actortype> is a subtype of principal (spec addition: service <: principal, modelled analogously to nat <: int). The subtype checker and the deserializer accept a service reference at type principal; the two share an identical wire encoding, so the coercion is the identity on the reference. The reverse (a principal at a service type) remains rejected.

2026-07-03

ic_principal 0.1.5

• Non-breaking changes:
  • Make Principal::as_slice(), Principal::len() and Principal::as_fixed_bytes() const functions.

2026-07-02

ic_principal 0.1.4

• Non-breaking changes:
  • Add Principal::as_fixed_bytes(), returning a reference to the underlying fixed-size [u8; MAX_LENGTH_IN_BYTES] backing array. Bytes at index len() and beyond are always zero.
  • Add Principal::len(), returning the number of significant bytes in the Principal (equivalent to as_slice().len()).

2026-06-25

Candid 0.10.31

• Non-breaking changes:
  • Encode and decode large Nat/Int values in linear time. Values beyond the u64/i64 fast path were previously processed one LEB128/SLEB128 group at a time, shifting the whole bignum on every byte (O(n²) in the encoded length); they now build the value in a single O(n) pass.

didc 0.6.2

• Non-breaking changes:
  • Upgrade candid_parser dependency to v0.4.0.

2026-06-23

Candid 0.10.30

• Non-breaking changes:
  • Add pretty::utils::sep_enclose and sep_enclose_space: list/tuple pretty-printing combinators that separate items and enclose them in delimiters, emitting a trailing separator on multi-line layouts.
  • Add TypeEnv::to_sorted_iter() to iterate bindings in a deterministic, key-sorted order.

candid_parser 0.4.0

• Breaking changes:
  • Parse and preserve named function arguments and results. The AST now carries argument names so consumers (e.g. binding generators) can emit meaningful parameter names:
    • New syntax::IDLArgType { typ: IDLType, name: Option<String> } with IDLArgType::new / IDLArgType::new_with_name. Purely numeric names are normalized to None.
    • syntax::FuncType::{args, rets}, syntax::IDLType::ClassT, syntax::IDLTypes::args, and syntax::IDLInitArgs::args now hold Vec<IDLArgType> instead of Vec<IDLType>.
    • The pretty-printer now round-trips argument names (e.g. (from : principal)).
  • Type checking is unchanged: names are dropped when lowering to candid::types::Function, so the candid crate is unaffected.

2026-05-27

... (truncated)

Commits

• See full diff in compare view

Updates chrono from 0.4.44 to 0.4.45

Release notes

Sourced from chrono's releases.

0.4.45

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in chronotope/chrono#1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in chronotope/chrono#1789

Commits

• 1703382 Prepare 0.4.45 release
• 881f9ab tz_data: fix tzdata locations on Android
• f14ead4 fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow
• c6063e6 Update similar-asserts requirement from 1.6.1 to 2.0.0
• 120686c Bump codecov/codecov-action from 5 to 6
• See full diff in compare view

Updates claims from 0.7.1 to 0.8.0

Release notes

Sourced from claims's releases.

0.8.0

Changed

• assert_err_eq, assert_ok_eq, and assert_some_eq now properly display custom messages.
• MSRV raised to 1.38.0.
• Rust edition bumped to 2018.
• Improved error messages.
• Removed Debug requirement for Ok(T) in assert_ready_ok! macro.
• Removed Debug requirement for Err(E) in assert_ready_err! macro.

Fixed

• Corrected the name of debug_assert_ready_ok_eq! to debug_assert_ready_eq!.
• assert_pending! and debug_assert_pending! now correctly display custom messages.
• assert_ready! and debug_assert_ready! now correctly display custom messages.
• debug_assert_pending! no longer emits warnings for unused values.
• assert_matches! and debug_assert_matches! no longer emit warnings if the given pattern covers all cases.
• assert_matches! and debug_assert_matches! now include if guard in the pattern in the error message.
• Fixed macro hygiene issues for all macros.

Removed

• Dependency on autocfg.

Changelog

Sourced from claims's changelog.

0.8.0 - 2024-11-16

Changed

• assert_err_eq, assert_ok_eq, and assert_some_eq now properly display custom messages.
• MSRV raised to 1.38.0.
• Rust edition bumped to 2018.
• Improved error messages.
• Removed Debug requirement for Ok(T) in assert_ready_ok! macro.
• Removed Debug requirement for Err(E) in assert_ready_err! macro.

Fixed

• Corrected the name of debug_assert_ready_ok_eq! to debug_assert_ready_eq!.
• assert_pending! and debug_assert_pending! now correctly display custom messages.
• assert_ready! and debug_assert_ready! now correctly display custom messages.
• debug_assert_pending! no longer emits warnings for unused values.
• assert_matches! and debug_assert_matches! no longer emit warnings if the given pattern covers all cases.
• assert_matches! and debug_assert_matches! now include if guard in the pattern in the error message.
• Fixed macro hygiene issues for all macros.

Removed

• Dependency on autocfg.

Commits

• See full diff in compare view

Updates serial_test from 3.4.0 to 3.5.0

Release notes

Sourced from serial_test's releases.

v3.5.0

What's Changed

• Replace scc/sdd with std::sync::Mutex for Miri strict provenance compatibility by @​justanotheranonymoususer in palfrey/serial_test#157

New Contributors

• @​justanotheranonymoususer made their first contribution in palfrey/serial_test#157

Full Changelog: palfrey/serial_test@v3.4.0...v3.5.0

Commits

• 6181f64 3.5.0
• 480bead Merge pull request #157 from justanotheranonymoususer/remove-scc-dep
• e03019e Update ci.yml
• 820c0f3 Update ci.yml
• 62a89b0 Only skip file_lock with filesystem access
• 5ff5501 Update ci.yml
• 0bd996d Let's try --all-features
• 338e4ed Fix formatting
• a55cde5 Cleanup code_lock.rs
• 9ad7a8f Remove unnecessary test leftover changes
• Additional commits viewable in compare view

Updates const_format from 0.2.35 to 0.2.36

Changelog

Sourced from const_format's changelog.

0.2.36

Breaking change: bumped Minimum Supported Rust Version to Rust 1.71. This change is motivated by quote increasing its MSRV to 1.71.

Now the "rust_1_64" feature is effectively always enabled, so these items are always enabled:

• const_format::str_split

Deprecated these items because their replacements now take constant time to run:

• const_format::fmt::StrWriter::as_bytes_alt: superceeded by as_bytes
• const_format::fmt::StrWriter::as_str_alt: superceeded by as_str
• const_format::fmt::StrWriterMut::as_bytes_alt: superceeded by as_bytes
• const_format::fmt::StrWriterMut::as_str_alt: superceeded by as_str
• const_format::utils::slice_up_to_len_alt: superceeded by slice_up_to_len

Changed these methods from being conditionally const (by requiring the "rust_1_64" feature to be const) to being unconditionally const:

• const_format::fmt::StrWriter::as_bytes
• const_format::fmt::StrWriter::as_str
• const_format::fmt::StrWriterMut::as_bytes
• const_format::fmt::StrWriterMut::as_str

Changed this method to be const:

• const_format::AsciiStr::as_str

Fixed nightly 2026-04-09 compatibility when cargo update -Z minimal-versions is used by bumping konst internal dependency to "0.2.20" version

Commits

• See full diff in compare view

Updates curve25519-dalek from 4.1.3 to 5.0.0

Commits

• 07bef73 Prep v5.0 major release (#916)
• 0cd94ea ed: Implement KeySizeUser, TryKeyInit, and Generate for SigningKey. A...
• eeaf902 perf(lizard): skip negative preimages in lizard_decode (#882)
• 78abeae Fix running doc tests (#914)
• 4cf8db2 Support AVX512 on stable Rust (#913)
• d995caf Prep v5.0-rc.1 (#911)
• 1c14d54 curve: Bring back ff and group (#909)
• 58b331c curve,x,ed: re-export rand_core (#908)
• 70e82aa Prep v5.0-rc.0 (#906)
• 13ac5e6 curve: Remove ff/group features for now (#907)
• Additional commits viewable in compare view

Updates dashmap from 5.5.3 to 6.1.0

Release notes

Sourced from dashmap's releases.

v6.1.0

• xacrimon/dashmap#308

v6.0.1

This is a patch release, now the main release for v6 as v6.0.0 was yanked shortly after release.

Thanks to @​JesusGuzmanJr for notifying me about a critical bug that was introduced so that I could resolve it: #304.

PRs for this release: #305 + xacrimon/dashmap@d5c8be6

v6.0.0

This release contains performance optimizations, most notably 10-40% gains on Apple Silicon but also 5-10% gains when measured in Intel Sapphire Rapids. This work was accomplished in:

• #303
• #287

Minor QoL improvements were made in:

• #302
• #300

Special to the following contributors for making this release possible:

• @​conradludgate
• @​arthurprs
• @​joshtriplett
• @​dtzxporter

v6.0.0-rc.1

This release contains performance optimizations, most notably 10-40% gains on Apple Silicon but also 5-10% gains when measured in Intel Sapphire Rapids. This work was accomplished in:

• #303
• #287

Minor QoL improvements were made in:

• #302
• #300

Special to the following contributors for making this release possible:

• @​conradludgate
• @​arthurprs
• @​joshtriplett
• @​dtzxporter

Commits

• f2d248e v6.1.0
• da6ac5e Add typesize::TypeSize implementation for DashMap/DashSet (#308)
• 633aadb v6.0.1
• d5c8be6 add shrink_to_fit test
• 488dbfa fix deadlock in shrink_to_fit (#305)
• 458238c v6.0.0
• 1e3df1a v6.0.0-rc.1
• bdb86b0 Merge branch 'arthurprs-small-optimizations'
• 4cdfc39 fix: merge errors
• 74b34f8 Merge branch 'small-optimizations' of github.com:arthurprs/dashmap into arthu...
• Additional commits viewable in compare view

Updates dcap-qvl from 0.3.12 to 0.5.2

Release notes

Sourced from dcap-qvl's releases.

Release v0.5.2

Changes in v0.5.2

• ci: fire Android + npm publishes on the unified v* tag too (#185)
• release: unify all versions at 0.5.2 (#184)
• ci(mobile/ios): auth satellite push via deploy key, not PAT (#183)
• feat(mobile/ios): Swift Package release pipeline via dcap-qvl-swift satellite (#182)
• ci(mobile/android): auto-publish releases (automaticRelease = true) (#181)
• fix(mobile/android): strip 16.7 MB dead .so + on-device test, v0.5.1 (#180)
• fix(mobile/android): publish via Central Portal bundle (Vanniktech plugin) (#179)
• ci(mobile/android): Maven Central release workflow + Sonatype onboarding (#173)
• feat(mobile): native Kotlin and Swift bindings via UniFFI (#172)
• refactor(x509): revert default pck_ca/extension impls to readable form (#177)
• refactor(config): replace issuer_contains(&[u8]) with pck_ca() -> Option<PckCa> (#158)
• fix(js): decode X.509 issuer/subject DN properly so getCertIssuer thus getCollateral works (#175)
• chore(npm): bump version to 0.4.1

Python Package

This release includes Python wheels for multiple platforms:

• Linux: x86_64, x86, aarch64, armv7, s390x, ppc64le
• Windows: x64, x86
• macOS: x86_64, aarch64 (Apple Silicon)

Install with: pip install dcap-qvl==0.5.2

Rust Crate

Add to your Cargo.toml:

dcap-qvl = "0.5.2"

Release v0.4.1

Changes in v0.4.1

• chore: release v0.4.1 (#167)
• feat(js): port QuoteVerifier.allowServiceTd() to pure-JS binding
• feat: opt-in QuoteVerifier::allow_debug() (#165)
• feat: expose CollateralClient::fetch_for_fmspc_without_pck_chain()
• style: fix rustfmt formatting in QuoteVerifier::new
• fix: restore mr_service_td check with opt-in flag for TDX 1.5
• style: cargo fmt
• test+samples: cover overlong components and update sample expectation
• fix(verify): validate TCB component count before zip comparison
• fix: allow non-zero mr_service_td in TDX 1.5 quotes
• build(deps): bump the github-actions group across 1 directory with 2 updates
• chore(deps): bump reqwest 0.12 → 0.13 + compatible upgrades (#157)
• feat(collateral): abstract HTTP transport behind HttpClient trait (#156)
• ci: add json-core feature matrix entry to rust.yml

... (truncated)

Commits

• 31a32a4 ci: fire Android + npm publishes on the unified v* tag too (#185)
• c302a1d release: unify all versions at 0.5.2 (#184)
• 9388e72 ci(mobile/ios): auth satellite push via deploy key, not PAT (#183)
• f061ff8 feat(mobile/ios): Swift Package release pipeline via dcap-qvl-swift satellite...
• ad1239a ci(mobile/android): auto-publish releases (automaticRelease = true) (#181)
• 470c111 fix(mobile/android): strip 16.7 MB dead .so + on-device test, v0.5.1 (#180)
• 4ad68aa fix(mobile/android): publish via Central Portal bundle (Vanniktech plugin) (#...
• 6c4d9d8 ci(mobile/android): Maven Central release workflow + Sonatype onboarding (#173)
• eeba7be feat(mobile): native Kotlin and Swift bindings via UniFFI (#172)
• d357022 refactor(x509): revert default pck_ca/extension impls to readable form (#...
• Additional commits viewable in compare view

Updates dirs from 5.0.1 to 6.0.0

Commits

• See full diff in compare view

Updates ed25519-dalek from 2.2.0 to 3.0.0

Changelog

Sourced from ed25519-dalek's changelog.

3.0.0

• Update the digest dependency to 0.9. This requires a major version because the digest traits are part of t...

  Description has been truncated

  ---

  [!NOTE]
  High Risk
  Large semver jumps across cryptography (ed25519/curve25519, aes-gcm, sha2), auth/JWT, and the axum/tower HTTP surface mean behavior or API compile fixes may be required even if the diff is mostly manifests.

  Overview
  Bulk Dependabot refresh of the workspace [workspace.dependencies] and Cargo.lock, touching on the order of 70 crates with no described application-logic refactors.

  Notable major/minor moves include axum 0.8 / tower-http 0.6 / tower-sessions 0.15 (HTTP stack), ed25519-dalek 3 and curve25519-dalek 5 (signing), rand 0.10 (with rand_chacha 0.9 in node tests), wasmer 7.2, thiserror 2, ureq 3, jsonwebtoken 10, toml 1, dashmap 6, ic-agent 0.48, and wasmparser 0.253 (ABI tools). Several crates also pin bumped versions locally (e.g. mero-auth crypto/HTTP deps, sha2 0.11 in blob apps, sigstore 0.14 in merod).

  ^{Reviewed by Cursor Bugbot for commit ad6ad6b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

E2E Rust Apps Failed

One or more E2E workflows (scaffolding-e2e, xcall-example) failed.

Please check the workflow logs for more details.

[meroreviewer]

🤖 AI Code Reviewer

Reviewed by 3 agents | Quality score: 95% | Review time: 140.0s

---

✅ No Issues Found

All agents reviewed the code and found no issues. LGTM! 🎉

---

_{🤖 Generated by AI Code Reviewer | Review ID: review-ddc922f1}

[meroreviewer]

Documentation Review

The following documentation may need updates based on the changes in this PR:

• 🟡 AGENTS.md: AGENTS.md exists but was not updated — consider updating it to reflect the architecture changes in this PR.
• 🟡 CONTRIBUTING.md: CONTRIBUTING.md exists but was not updated — consider updating it to reflect the architecture changes in this PR.
• 🟡 architecture/crates/auth.html: Files matching crates/auth/** were changed but architecture/crates/auth.html was not updated (per source_to_docs_mapping).
• 🟡 architecture/crates/node.html: Files matching crates/node/** were changed but architecture/crates/node.html was not updated (per source_to_docs_mapping).
• 🟡 architecture/crates/sync.html: Files matching crates/node/** were changed but architecture/crates/sync.html was not updated (per source_to_docs_mapping).
• 🟡 architecture/crates/tools.html: Files matching crates/merod/** were changed but architecture/crates/tools.html was not updated (per source_to_docs_mapping).
• 🟡 docs/: Static HTML docs in docs/ may need updating — architecture-impacting changes detected. On merge, update-docs will scan this directory and open a PR if any pages need to change.

[frdomovic]

needs rustc 1.94 vs pinned 1.88 + multi-crate breaking migrations

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml