chore(deps): bump connectrpc from 0.8.1 to 0.9.0 in /api

[dependabot]

Bumps connectrpc from 0.8.1 to 0.9.0.

Release notes

Sourced from connectrpc's releases.

v0.9.0

What's Changed

• docs: BSR remote plugin is now published by @​iainmcgin in connectrpc/connect-rust#223
• client: make BidiStream receive initialization cancellation-safe by @​EffortlessSteven in connectrpc/connect-rust#221
• client: stop the client-stream transport task when the call is abandoned by @​EffortlessSteven in connectrpc/connect-rust#226
• build: carry proto comments into generated docs via --include_source_info by @​iainmcgin in connectrpc/connect-rust#225
• codegen: advertise proto edition 2024 by @​iainmcgin in connectrpc/connect-rust#231
• server: pass large response payloads through by refcount instead of copying by @​iainmcgin in connectrpc/connect-rust#219
• deps: move to buffa 0.9 by @​iainmcgin in connectrpc/connect-rust#233
• client: take an async Stream for client-streaming requests by @​iainmcgin in connectrpc/connect-rust#227
• client: add BidiStream::into_split for independently owned halves by @​iainmcgin in connectrpc/connect-rust#228
• server: encode view responses without copying their large fields by @​iainmcgin in connectrpc/connect-rust#232
• response: say what the segment coalescing actually does by @​iainmcgin in connectrpc/connect-rust#234
• server: make the element-memory decode budget configurable by @​iainmcgin in connectrpc/connect-rust#235
• codegen: decode descriptor sets under buffa 0.9.1's tooling budget by @​iainmcgin in connectrpc/connect-rust#239
• client: Http2ConnectionBuilder::local_address to pin the source address by @​rpb-ant in connectrpc/connect-rust#267
• conformance: remove the local debug proxy scaffolding by @​iainmcgin in connectrpc/connect-rust#256
• codegen: fail when a type is absent from the descriptor set by @​iainmcgin in connectrpc/connect-rust#259
• compression: remove the unused streaming-compression surface by @​iainmcgin in connectrpc/connect-rust#260
• config: prefix the remaining setters with with_ and hide Limits' fields by @​iainmcgin in connectrpc/connect-rust#261
• client: carry response metadata on every terminal error by @​iainmcgin in connectrpc/connect-rust#262
• client: resolve the gRPC unary response status before the HTTP status by @​iainmcgin in connectrpc/connect-rust#257
• server: apply the configured element budget to interceptor payloads by @​iainmcgin in connectrpc/connect-rust#258
• client: classify post-deadline transport failures as deadline_exceeded by @​iainmcgin in connectrpc/connect-rust#238
• client: make the response element-memory budget configurable by @​iainmcgin in connectrpc/connect-rust#236
• client: validate streaming gRPC response content types by @​EffortlessSteven in connectrpc/connect-rust#266
• error: preserve the source chain of client transport failures by @​christopherwxyz in connectrpc/connect-rust#240
• interceptor: plumbing for re-runnable chains and lazily-encoded payloads by @​aknott-ant in connectrpc/connect-rust#269
• client: identify the RPC by Spec in call_*; clients pass FOO_SPEC.with_origin(Client) by @​aknott-ant in connectrpc/connect-rust#270
• server: stream response items as segments so large fields are not copied by @​rkk-ant in connectrpc/connect-rust#271
• docs: say where interceptors run relative to the body, and where authentication belongs by @​iainmcgin in connectrpc/connect-rust#273
• Per-route request limits by @​iainmcgin in connectrpc/connect-rust#272
• release: v0.9.0 by @​iainmcgin in connectrpc/connect-rust#274

New Contributors

• @​christopherwxyz made their first contribution in connectrpc/connect-rust#240
• @​rkk-ant made their first contribution in connectrpc/connect-rust#271

Full Changelog: connectrpc/connect-rust@v0.8.1...v0.9.0

Changelog

Sourced from connectrpc's changelog.

[0.9.0] - 2026-08-24

Added

• BidiStream::into_split splits a bidirectional stream into independently owned BidiSendHalf and BidiRecvHalf, so the two sides can be driven from separate tasks (true full duplex). The split is a plain move of the stream's two sides — no locking is added. Dropping the send half (or calling close_send) ends the request body cleanly while the RPC continues; dropping the receive half cancels the RPC, matching the behavior of dropping a whole BidiStream.

• protoc-gen-connect-rust now advertises proto edition 2024 as its maximum supported edition (#229). Previously protoc refused to run the generator against an edition = "2024" file at all. Generated stubs are unchanged: the features edition 2024 introduced, enforce_naming_style and default_symbol_visibility, are enforced by protoc while compiling and do not affect the service descriptors the generator reads.

  #229: connectrpc/connect-rust#229

• The decode-time element-memory budget is now configurable. buffa 0.9 introduced a 32 MiB budget on the memory a single decode may commit to repeated, map, string and bytes elements — an amplification defence, charged on element footprint rather than on contents, so a few bytes on the wire cannot ask the decoder to materialize a very large number of small elements. A single large payload is unaffected however big it grows.

  Until now that budget applied to every received message with no way to change it, so a legitimate message carrying very many small elements that 0.8 accepted would be rejected with no recourse. Servers set it through the existing Limits:

  ConnectRpcService::new(dispatcher)
      .with_limits(Limits::default().with_element_memory_limit(128 * 1024 * 1024))

  Limits::unlimited() lifts it along with the other limits.

  It applies to every server receive path — unary, server-streaming, client-streaming and bidi, on both the generated dispatch and hand-registered handlers, view-based and owned-message alike. On a proto wire it also governs an interceptor's own decode of the inbound request body, through both Payload::message and Payload::view, on all four of those shapes — so an interceptor is held to the same budget as the handler behind it. JSON bodies are decoded without it, on the interceptor and handler paths alike. A rejection now names the limit to raise, since it is the one decode failure an operator can fix without the peer changing anything.

... (truncated)

Commits

• 26e77f2 release: v0.9.0 (#274)
• c3aaeaa Per-route request limits (#272)
• 3dfdc70 docs: say where interceptors run relative to the body, and where authenticati...
• 03f382b server: stream response items as segments so large fields are not copied (#271)
• 48e36e6 client: identify the RPC by Spec in call_*; clients pass FOO_SPEC.with_origin...
• 5e9fec7 interceptor: plumbing for re-runnable chains and lazily-encoded payloads (#269)
• 72bfc38 error: preserve the source chain of client transport failures (#240)
• 062ab66 client: validate streaming gRPC response content types (#266)
• cb0427a client: make the response element-memory budget configurable (#236)
• a49b165 client: classify post-deadline transport failures as deadline_exceeded (#238)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)