[dependabot]

Bumps the rust-dependencies group with 5 updates in the / directory:

Package	From	To
config	0.15.25	0.15.27
lazy_static	1.5.0	1.5.1
base64	0.23.0	0.23.1
rmcp	3.4.1	3.5.0
hyper-util	0.1.20	0.1.21

Updates config from 0.15.25 to 0.15.27

Changelog

Sourced from config's changelog.

[0.15.27] - 2026-09-30

Performance

• (toml) Reduced parsing overhead

[0.15.26] - 2026-09-21

Compatibility

• Bump MSRV to 1.88

Internal

• Upgrade json5 to 1.3

Commits

• f14a044 chore: Release config version 0.15.27
• 10db722 docs: Update changelog
• 0bb91d6 perf(toml): Reduce parse overhead (#775)
• 112af24 perf(toml): Reduce parse overhead
• e368ab2 chore: Release config version 0.15.26
• 24c3fc8 docs: Update changelog
• 9926dac chore: Upgrade to json5 (#774)
• 171077e chore: Upgrade json5
• 62d3e7a chore: Update MSRV to 1.88
• af98be4 chore: Update from _rust template (#772)
• Additional commits viewable in compare view

Updates lazy_static from 1.5.0 to 1.5.1

Commits

• See full diff in compare view

Updates base64 from 0.23.0 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• See full diff in compare view

Updates rmcp from 3.4.1 to 3.5.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.5.0

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.0

Added

• update LATEST and add LATEST_WITH_INITIALIZE (#1105)

Fixed

• (model) decode float fields through serde_json::Number (#1300)
• (rmcp) reject duplicate sep-2243 headers (#1274)
• (transport) match explicit default ports in Origin allowlist (#1270)
• (rmcp) tolerate empty cacheScope instead of silently dropping the whole result (#1281)
• (model) preserve explicit null structuredContent in CallToolResult (#1295)

Other

• cargo fmt fixes on validate_standard_headers changes (#1275)

Commits

• 0cde3c5 chore: release v3.5.0 (#1296)
• e02efbf fix(model): decode float fields through serde_json::Number (#1300)
• 972af86 feat: update LATEST and add LATEST_WITH_INITIALIZE (#1105)
• 6e47ca3 chore(deps): bump the github-actions group with 2 updates (#1297)
• 6255c37 chore: reduce dependency update noise (#1293)
• 22ef52a fix(rmcp): reject duplicate sep-2243 headers (#1274)
• 26f3b2e fix(transport): match explicit default ports in Origin allowlist (#1270)
• 6677eee style: cargo fmt fixes on validate_standard_headers changes (#1275)
• fbed447 fix(rmcp): tolerate empty cacheScope instead of silently dropping the whole r...
• 90516bf fix(model): preserve explicit null structuredContent in CallToolResult (#1295)
• See full diff in compare view

Updates hyper-util from 0.1.20 to 0.1.21

Release notes

Sourced from hyper-util's releases.

v0.1.21

Additions

• Add crate-level documentation. (#327)
• Add client::legacy::Builder::http2_header_table_size() method. (#274)
• Add client::legacy::Builder::http2_max_concurrent_streams() method. (#274)
• Add client::legacy::Builder::http2_max_local_error_reset_streams() method. (#277)
• Add client::legacy::connect::HttpConnector::set_mark() method. (#303)
• Add rt::tracing::WithSpanExecutor<E>, hyper_util::rt::tracing::CurrentSpanExecutor<E>, and hyper_util::rt::tracing::MkSpanExecutor<E, F> executors. (#323)

Fixes

• Fix client::legacy::Client so that it properly validates CONNECT responses. (#315)
• Fix client::legacy::Client to cancel the idle interval once its pool empties. (#292)
• Fix client::legacy::Client to properly handle IPv6 addresses when using a SOCKS proxy. (#302)
• Fix client::pool::cache to preserve readiness with clones. (#297)
• Fix client::pool::cache to wake its waiters in FIFO order. (#298)
• Fix client::pool::singleton::Singleton to properly handle cancellation. (#299)
• Fix client::pool::singleton::Singleton to share errors with all waiters. (#296)
• Fix client::proxy::matcher handling for IP wildcards. (#309)
• The tokio/net feature is narrowed to the client-legacy feature flag, from the client feature flag. (#276)
• Various fixes to the client::legacy::Client's SOCKS proxying. (#302) (#307) (#308) (#310)

Changes

This release contains a minor behavioral change for users of the tracing feature flag to be aware of.

This feature flag was introduced in v0.1.11. When enabled, rt::TokioExecutor<E> began propagating the currently active tracing::Span to spawned tasks when hyper::rt::Executor::execute() is called. This caused issues for some users, due to background tasks keeping a span open for the duration of a long-lived connection.

This behavior has now been removed from rt::TokioExecutor<E> (#322) by default. A collection of executor wrappers have been added to a new rt::tracing submodule, to provide facilities for instrumenting a client or server's spawned tasks. See the module-level documentation of rt::tracing for more information.

To temporarily preserve the previous rt::TokioExecutor<E> span propagation behavior, enable the rt-tracing-exec-force feature. Note that this feature flag will be removed in a future release.

This release bumps the minimal supported Rust version (MSRV) from 1.64 to 1.85.

This release bumps the rust edition from 2021 to 2024.

... (truncated)

Changelog

Sourced from hyper-util's changelog.

0.1.21 (2026-09-24)

This release bumps the minimal supported Rust version (MSRV) from 1.64 to 1.85.

This release bumps the rust edition from 2021 to 2024.

Additions

• Add crate-level documentation. (#327)
• Add client::legacy::Builder::http2_header_table_size() method. (#274)
• Add client::legacy::Builder::http2_max_concurrent_streams() method. (#274)
• Add client::legacy::Builder::http2_max_local_error_reset_streams() method. (#277)
• Add client::legacy::connect::HttpConnector::set_mark() method. (#303)
• Add rt::tracing::WithSpanExecutor<E>, hyper_util::rt::tracing::CurrentSpanExecutor<E>, and hyper_util::rt::tracing::MkSpanExecutor<E, F> executors. (#323)

Fixes

• Fix client::legacy::Client so that it properly validates CONNECT responses. (#315)
• Fix client::legacy::Client to cancel the idle interval once its pool empties. (#292)
• Fix client::legacy::Client to properly handle IPv6 addresses when using a SOCKS proxy. (#302)
• Fix client::pool::cache to preserve readiness with clones. (#297)
• Fix client::pool::cache to wake its waiters in FIFO order. (#298)
• Fix client::pool::singleton::Singleton to properly handle cancellation. (#299)
• Fix client::pool::singleton::Singleton to share errors with all waiters. (#296)
• Fix client::proxy::matcher handling for IP wildcards. (#309)
• The tokio/net feature is narrowed to the client-legacy feature flag, from the client feature flag. (#276)
• Various fixes to the client::legacy::Client's SOCKS proxying. (#302) (#307) (#308) (#310)

Changes

This release contains a minor behavioral change for users of the tracing feature flag to be aware of.

This feature flag was introduced in v0.1.11. When enabled, rt::TokioExecutor<E> began propagating the currently active tracing::Span to spawned tasks when hyper::rt::Executor::execute() is called. This caused issues for some users, due to background tasks keeping a span open for the duration of a long-lived connection.

This behavior has now been removed from rt::TokioExecutor<E> (#322) by default. A collection of executor wrappers have been added to a new rt::tracing submodule, to provide facilities for instrumenting a client or server's spawned tasks. See the module-level documentation of rt::tracing for more information.

To temporarily preserve the previous rt::TokioExecutor<E> span propagation behavior, enable the rt-tracing-exec-force feature. Note that this feature flag will be removed in a future release.

Commits

• 23a8689 v0.1.21
• cdb2346 doc(client/pool): add broken_intra_doc_links allowance (#326)
• 13b6110 chore(error): remove disabled hyper_util::error submodule (#325)
• b9ee451 docs(lib): add crate-level documentation (#327)
• d6b7d7e feat(rt/tracing): introduce tracing executors (#323)
• f2da915 feat(client): add HttpConnector::set_mark for SO_MARK (#303)
• 4dbd494 feat(rt): change TokioExecutor to not trace, add rt-tracing-exec-force feat...
• d480d9f fix(client): parse proxy CONNECT response with httparse (#315)
• 7e0958b chore(ci): simplify msrv check (#317)
• 0734568 chore(ci): update to actions/checkout@v7 (#316)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.