[dependabot]

Bumps the cargo group with 24 updates in the / directory:

Package	From	To
anyhow	1.0.103	1.0.104
arc-swap	1.9.2	1.9.5
async-trait	0.1.89	0.1.92
axum-server	0.8.0	0.9.0
base64	0.22.1	0.23.1
futures	0.3.32	0.3.34
jsonwebtoken	10.4.0	11.1.0
k8s-openapi	0.28.0	0.29.0
kube	4.0.0	5.0.0
oci-client	0.17.0	0.18.0
opentelemetry	0.32.0	0.33.1
opentelemetry-otlp	0.32.0	0.33.1
opentelemetry_sdk	0.32.1	0.33.1
regex	1.13.0	1.13.1
reqwest	0.13.4	0.13.5
rmcp	2.2.0	3.9.0
serde	1.0.228	1.0.229
serde_json	1.0.150	1.0.154
sha2	0.11.0	0.11.1
sigstore-verify	0.11.0	0.16.0
thiserror	2.0.18	2.0.21
tokio	1.52.3	1.54.1
tower-http	0.7.0	0.7.1
tracing-opentelemetry	0.33.0	0.34.0

Updates anyhow from 1.0.103 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

• Update syn dev-dependency to version 3

Commits

• 1dbe186 Release 1.0.104
• f6479f8 Update to syn 3
• See full diff in compare view

Updates arc-swap from 1.9.2 to 1.9.5

Changelog

Sourced from arc-swap's changelog.

1.9.5

• Fix load returning a value stored into a different instance (type confusion) after the address of a freed value is reused by another instance (#210). This is the bug the rwlock-strategy feature of 1.9.3 worked around.

1.9.4

• Fix use-after-free when strong and weak pointers to the same allocation are stored in different instances (#214). Adds RefCnt::TAG (defaults to 0, so existing implementations still compile); storing a pointer with the tag bits set panics (#214).

1.9.3

• rwlock-strategy feature: RwLock<()> as an explicit, opt-in strategy (ArcSwapAny<Arc<T>, RwLock<()>>). DefaultStrategy is unchanged (#210, #211).

Commits

• See full diff in compare view

Updates async-trait from 0.1.89 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

• Resolve double_must_use clippy lint in generated code (#303)

0.1.91

• Update to syn 3 (#299)
• Fix mutability for by-reference receivers (#301)

0.1.90

(yanked)

Commits

• 82e7e9e Release 0.1.92
• 9a35cb8 Merge pull request #303 from dtolnay/mustuse
• 875ceec Resolve double_must_use clippy lint
• 62993a5 Raise minimum tested compiler to rust 1.88
• d049ee0 Release 0.1.91
• 7a0961f Merge pull request #301 from dtolnay/mutability
• 740f86f Ignore mut_mut pedantic clippy lint in test
• 4699cd3 Fix mutability for by-reference receivers
• 6dd3573 Add regression test for issue 300
• 2371797 Release 0.1.90
• Additional commits viewable in compare view

Updates axum-server from 0.8.0 to 0.9.0

Release notes

Sourced from axum-server's releases.

v0.9.0

• added: Server::first_request_timeout, which closes connections that do not send a request in time. This also covers the protocol detection read that hyper does before any HTTP timeout applies.
• added: Server::accept_error_handler, which reports connection accept errors instead of silently dropping them.
• added: TLS acceptors now add axum_server::tls::TlsInfo (SNI, ALPN, and client certificates) to request extensions as Arc<TlsInfo> for both rustls and OpenSSL.
• added: axum_server::accept::LocalAddrAcceptor adds the local socket address of the connection to request extensions as LocalAddr.
• added: RustlsConfig::from_sni_pem_files, which selects the certificate using the server name sent by the client through SNI.
• added: the tls-rustls-encrypted-keys feature and RustlsConfig::from_pem_with_password plus file and reload variants, for encrypted PKCS#8 private keys.
• added: accept::TcpConfigAcceptor, accept::TcpSocketConfig, and accept::TcpKeepaliveConfig apply TCP_NODELAY and TCP keepalive settings to accepted connections.
• added: a timeouts example showing the request, header, keep-alive, and TLS handshake timeouts.
• added: a reverse_proxy example that terminates TLS and forwards requests to an HTTP upstream.
• breaking: TLS acceptors now return a tls::TlsService wrapper service. Custom acceptors that wrap a TLS acceptor and assume the service type is unchanged need to be updated; examples/rustls_session.rs now uses the built-in TlsInfo.
• fixed: Handle::listening() now returns None after a bind failure instead of waiting forever, and no longer races with server startup.
• fixed: RustlsConfig::from_pem_chain_file now sets the h2 and http/1.1 ALPN protocols like the other RustlsConfig constructors.
• fixed: Connections that are still performing the TLS handshake are now cancelled on shutdown instead of keeping a task and file descriptor alive until the handshake timeout.
• fixed: A timer is now installed by default, so header_read_timeout and keep_alive_timeout no longer panic with "timeout set, but no timer set".
• fixed: from_tcp and from_unix now put the provided listener into non-blocking mode, as required by Tokio. The from_std_listener examples work without extra setup.
• fixed: Server::acceptor and Server::map now preserve the HTTP version selected by http1_only/http2_only.
• changed: The tls-rustls feature now enables TLS 1.2, restoring the behavior from before 0.7.0.
• changed: fs-err is now an optional dependency and is only pulled in by the rustls features.

Changelog

Sourced from axum-server's changelog.

0.9.0 (6. November 2026)

• added: Server::first_request_timeout, which closes connections that do not send a request in time. This also covers the protocol detection read that hyper does before any HTTP timeout applies.
• added: Server::accept_error_handler, which reports connection accept errors instead of silently dropping them.
• added: TLS acceptors now add axum_server::tls::TlsInfo (SNI, ALPN, and client certificates) to request extensions as Arc<TlsInfo> for both rustls and OpenSSL.
• added: axum_server::accept::LocalAddrAcceptor adds the local socket address of the connection to request extensions as LocalAddr.
• added: RustlsConfig::from_sni_pem_files, which selects the certificate using the server name sent by the client through SNI.
• added: the tls-rustls-encrypted-keys feature and RustlsConfig::from_pem_with_password plus file and reload variants, for encrypted PKCS#8 private keys.
• added: accept::TcpConfigAcceptor, accept::TcpSocketConfig, and accept::TcpKeepaliveConfig apply TCP_NODELAY and TCP keepalive settings to accepted connections.
• added: a timeouts example showing the request, header, keep-alive, and TLS handshake timeouts.
• added: a reverse_proxy example that terminates TLS and forwards requests to an HTTP upstream.
• breaking: TLS acceptors now return a tls::TlsService wrapper service. Custom acceptors that wrap a TLS acceptor and assume the service type is unchanged need to be updated; examples/rustls_session.rs now uses the built-in TlsInfo.
• fixed: Handle::listening() now returns None after a bind failure instead of waiting forever, and no longer races with server startup.
• fixed: RustlsConfig::from_pem_chain_file now sets the h2 and http/1.1 ALPN protocols like the other RustlsConfig constructors.
• fixed: Connections that are still performing the TLS handshake are now cancelled on shutdown instead of keeping a task and file descriptor alive until the handshake timeout.
• fixed: A timer is now installed by default, so header_read_timeout and keep_alive_timeout no longer panic with "timeout set, but no timer set".
• fixed: from_tcp and from_unix now put the provided listener into non-blocking mode, as required by Tokio. The from_std_listener examples work without extra setup.
• fixed: Server::acceptor and Server::map now preserve the HTTP version selected by http1_only/http2_only.
• changed: The tls-rustls feature now enables TLS 1.2, restoring the behavior from before 0.7.0.
• changed: fs-err is now an optional dependency and is only pulled in by the rustls features.

Commits

• d456d10 Merge pull request #200 from programatik29/release/0.9.0
• b66eddc Version 0.9.0
• d5e59a9 Merge pull request #198 from programatik29/feature/tcp-socket-options
• 5d15eb7 feat(accept): add TCP socket option acceptor
• 66117ae Merge pull request #197 from programatik29/feature/tls-config-conveniences
• 59b7814 feat(tls-rustls): add SNI certificate selection and encrypted keys
• dc6c073 Merge pull request #196 from programatik29/feature/connection-info
• bf02c3d feat(tls): expose TLS connection info and local address to handlers
• 4a992c9 Merge pull request #195 from programatik29/feature/server-timeout-and-errors
• cf74b72 feat(server): add first request timeout and accept error handler
• Additional commits viewable in compare view

Updates base64 from 0.22.1 to 0.23.1

Changelog

Sourced from base64's changelog.

0.23.1

• Make the tests build again on non-SIMD architectures

0.23.0

• Added more consts for preconfigured configs and engines
• Make DecodeError::InvalidLastSymbol more clear by including the decoded value
• Added SIMD-accelerated engines behind the default-on simd-unsafe feature: Simd picks the best instruction set at runtime (AVX2 on x86_64, NEON on aarch64) and falls back to the scalar GeneralPurpose engine, while Avx2 and Neon target one instruction set with no runtime detection and work in no_std. The engines support the standard and URL-safe alphabets.
• Update MSRV to 1.71.0
• Add support for custom padding symbols

Commits

• 069bf70 v0.23.1
• 6ab1fb0 Merge pull request #310 from musicinmybrain/test-on-non-simd-arches
• 7cffce6 Fix testing on architectures without unsafe SIMD support
• e34f9a0 Merge pull request #308 from atouchet/com
• e9240c9 Remove outdated comment
• 9e9220a v0.23.0
• 870326e Merge pull request #306 from marshallpierce/mp/trailing-bits-docs
• fbec5f1 Document no trailing trailing bits
• 0a23549 Merge pull request #305 from marshallpierce/mp/edition-2021
• f10b7e2 Update deps & edition
• Additional commits viewable in compare view

Updates futures from 0.3.32 to 0.3.34

Release notes

Sourced from futures's releases.

0.3.34

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

0.3.33

• Fix ReadLine's soundness issue regarding to exception safety. (#3020)
• Fix unsound Send impl for IterPinRef and Iter. (#3003)
• Fix stacked borrows violation in compat01as03 implementation. (#3012)
• Fix memory leak in FuturesUnordered::IntoIter. (#3005)
• Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
• Re-export alloc::task::Wake. (#3010)
• Update spin to 0.12. (#3014)

Changelog

Sourced from futures's changelog.

0.3.34 - 2026-08-11

• Preserve cloned waker identity. (#3032)
• Updato syn to 3. (#3028)

0.3.33 - 2026-07-18

• Fix ReadLine's soundness issue regarding to exception safety. (#3020)
• Fix unsound Send impl for IterPinRef and Iter. (#3003)
• Fix stacked borrows violation in compat01as03 implementation. (#3012)
• Fix memory leak in FuturesUnordered::IntoIter. (#3005)
• Add portable-atomic-alloc feature and use it in FuturesUnordered. (#3007)
• Re-export alloc::task::Wake. (#3010)
• Update spin to 0.12. (#3014)

Commits

• 705e6b5 Release 0.3.34
• 616dac7 compat: Inline RawWaker clone function
• 4176369 Inline remaining RawWaker clone functions
• f17a895 Fix cloned FuturesUnordered waker identity
• 51d62ad macro: bump syn to v3 (#3028)
• 9e26177 ci: Reduce timeout-minutes
• b2d0983 tsan: Enable Adaptive Delay
• f733d0e Miri: Ignore compat tests
• e5def2f Rename default branch to main
• 89cc254 Release 0.3.33
• Additional commits viewable in compare view

Updates jsonwebtoken from 10.4.0 to 11.1.0

Changelog

Sourced from jsonwebtoken's changelog.

11.1.0 (2026-09-16)

• Add dangerous::insecure_decode_claims

11.0.0 (2026-07-24)

• Add conversions between Algorithm and KeyAlgorithm
• JWKs can now be created from DecodingKeys, creation from EncodingKey and DecodingKey now supports Ed25519 as well
• JWKs with unknown key types are now deserializable
• BREAKING: Algorithm, KeyAlgorithm, EllipticCurve and ThumbprintHash are now non_exhaustive
• BREAKING: Jwk.thumbprint now returns a Result<_>
• BREAKING: Header.extras is now a struct that allows for deserialization to any T
• BREAKING: Implicit features resulting from optional crates have been removed
• BREAKING: Validation.insecure_disable_signature_validation has been removed, use dangerous::insecure_decode instead
• BREAKING: EncodingKey.inner has been renamed to as_bytes, try_get_hmac_secret has been removed
• BREAKING: DecodingKey.as_bytes and try_get_hmac_secret have been removed, use try_get_as_bytes instead

Changes for CryptoProviders

• When constructing HMAC signers, the algorithm family must now be verified on construction
• JwkUtils has been renamed to KeyUtils
  • compute_digest now returns a Result<_>
  • extract_rsa_public_key_components has been renamed to rsa_pub_components_from_private_key
  • rsa_pub_components_from_public_key has been added
  • extract_ec_public_key_coordinates has been renamed to ec_pub_components_from_private_key
  • ed_pub_components_from_private_key has been added

Commits

• 4c0ae75 Ready for release
• 46690b5 Add insecure_decode_claims (#539)
• 900010f Bump v11
• 6aac5ae Allow deserializing unknown key type JWKs (#530)
• e7ea8f0 Implement Default on JwkSet (#527)
• 249f5f7 Don't panic when computing thumbprint (#524)
• b5d9c38 Prepare for v11 release (#522)
• 6086da7 Unify encoding and decoding key APIs (#515)
• 474728f Remove deprecated insecure_disable_signature_validation (#521)
• 31a1dc6 Feat: Added support for JWK decoding Ed25519 keys (#506)
• Additional commits viewable in compare view

Updates k8s-openapi from 0.28.0 to 0.29.0

Release notes

Sourced from k8s-openapi's releases.

v0.29.0

k8s-openapi

• BREAKING CHANGE: Added support for Kubernetes 1.37 under the v1_37 feature.

• BREAKING CHANGE: Dropped support for Kubernetes 1.32.

• BREAKING CHANGE: schemars v0.8 support has been removed again.

• Some, but not all, resource types have non-Optional spec fields in v1.37, due to a Kubernetes upstream change. It is likely that eventually all spec fields will become non-optional, but currently upstream has only made partial progress towards this. k8s-openapi normally backports such fixes to old versions, but given the partial nature of upstream's change and uncertainty of its scope, this has not been backported as of now.

Corresponding Kubernetes API server versions:

• v1.33.13
• v1.34.13
• v1.35.10
• v1.36.6
• v1.37.2

k8s-openapi-codegen-common

• FEATURE: schemars v0.8 support has been removed again.

k8s-openapi-derive

• FEATURE: schemars v0.8 support has been removed again.

Changelog

Sourced from k8s-openapi's changelog.

v0.29.0 (2026-10-27)

k8s-openapi

• BREAKING CHANGE: Added support for Kubernetes 1.37 under the v1_37 feature.

• BREAKING CHANGE: Dropped support for Kubernetes 1.32.

• BREAKING CHANGE: schemars v0.8 support has been removed again.

• Some, but not all, resource types have non-Optional spec fields in v1.37, due to a Kubernetes upstream change. It is likely that eventually all spec fields will become non-optional, but currently upstream has only made partial progress towards this. k8s-openapi normally backports such fixes to old versions, but given the partial nature of upstream's change and uncertainty of its scope, this has not been backported as of now.

Corresponding Kubernetes API server versions:

• v1.33.13
• v1.34.13
• v1.35.10
• v1.36.6
• v1.37.2

k8s-openapi-codegen-common

• FEATURE: schemars v0.8 support has been removed again.

k8s-openapi-derive

• FEATURE: schemars v0.8 support has been removed again.

---

Commits

• ec1be51 v0.29.0
• bf4c9f3 Fix new clippy lint about assert!(.is_empty()).
• c8a38b0 Update to v1.34.13, v1.35.10, v1.36.6, v1.37.2
• e1ad9af Update to E2024.
• 68a3d34 Remove schemars v0.8 support again.
• d5b24a5 Update to v1.34.12, v1.35.9, v1.36.5, v1.37.1
• b606f6b Update kind to v0.33.0
• 155d094 Add v1.37 and drop v1.32
• 3aba016 Update to v1.34.11, v1.35.8, v1.36.4
• 7c68a07 Update to v1.34.10, v1.35.7, v1.36.3
• See full diff in compare view

Updates kube from 4.0.0 to 5.0.0

Release notes

Sourced from kube's releases.

5.0.0

New Major

As per the release schedule to match up with the latest Kubernetes Garhwal release. Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_37 support via k8s-openapi 0.29

Please upgrade k8s-openapi along with kube to avoid conflicts.

Semver Breaking Upgrades

Upgrades to several other important libraries that we couldn't do until the major. These include tower-http@0.7, serde-saphyr@2, syn@3, base64@0.23 , pem@4,

Important Additions

A new Api::dynamic ctor has been added as well as Api::constrain* methods to change an Api's namespace. Simplifies Api handling when dealing with discovery;

// before
let api: Api<DynamicObject> = if caps.scope == Scope::Cluster {
    Api::all_with(client.clone(), &ar)
} else {
    Api::default_namespaced_with(client.clone(), &ar)
};
// after
let api: Api<DynamicObject> = Api::dynamic(client.clone(), &ar, &caps.scope).constrain_default();

• #[kube(no_spec)] to support non-standard crs without a .spec; kube-rs/kube#2071
• A DynamicObject can now be used to perform a discovery::resolve_object lookup; kube-rs/kube#2031

Custom client can now use a customizable executor to deal with different lifestyle semantics of spans. Really hairy issue propagated through multiple repos.

Fixes

Many fixes this release worth checking below. Of particular importance;

Watcher Fixes

Two important ones; EOF recovery + missing init for the new (not-yet-default) StreamingList watch mode. Watcher also allows longer watches now.

Errors + Docs

Many smaller fixes to improve error handling; their accuracy, management of the Error size, and what to print.

Notable new docs on advanced finalizer pitfalls.

Internals

As usual there's a lot of ongoing work that improves internal ergonomics and maintainability that is normally hidden from the changelog.

In particular this release, a special thank you to @​daemonfire300 for the new test suite for advanced watcher specifics, which allows us to test more complicated watcher edge cases (including one of the fixes above).

... (truncated)

Changelog

Sourced from kube's changelog.

5.0.0 / 2026-11-01

New Major

As per the release schedule to match up with the latest Kubernetes Garhwal release. Lots of fixes and improvements. Thanks to everyone who contributed!

Kubernetes v1_37 support via k8s-openapi 0.29

Please upgrade k8s-openapi along with kube to avoid conflicts.

Semver Breaking Upgrades

Upgrades to several other important libraries that we couldn't do until the major. These include tower-http@0.7, serde-saphyr@2, syn@3, base64@0.23 , pem@4,

Important Additions

A new Api::dynamic ctor has been added as well as Api::constrain* methods to change an Api's namespace. Simplifies Api handling when dealing with discovery;

// before
let api: Api<DynamicObject> = if caps.scope == Scope::Cluster {
    Api::all_with(client.clone(), &ar)
} else {
    Api::default_namespaced_with(client.clone(), &ar)
};
// after
let api: Api<DynamicObject> = Api::dynamic(client.clone(), &ar, &caps.scope).constrain_default();

• #[kube(no_spec)] to support non-standard crs without a .spec; kube-rs/kube#2071
• A DynamicObject can now be used to perform a discovery::resolve_object lookup; kube-rs/kube#2031

Custom client can now use a customizable executor to deal with different lifestyle semantics of spans. Really hairy issue propagated through multiple repos.

Fixes

Many fixes this release worth checking below. Of particular importance;

Watcher Fixes

Two important ones; EOF recovery + missing init for the new (not-yet-default) StreamingList watch mode. Watcher also allows longer watches now.

Errors + Docs

Many smaller fixes to improve error handling; their accuracy, management of the Error size, and what to print.

Notable new docs on advanced finalizer pitfalls.

Internals

As usual there's a lot of ongoing work that improves internal ergonomics and maintainability that is normally hidden from the changelog.

In particular this release, a special thank you to @​daemonfire300 for the new test suite for advanced watcher specifics, which allows us to test more complicated watcher edge cases (including one of the fixes above).

... (truncated)

Commits

• 54a3128 release 5.0.0
• 4263e79 readme bumps
• 212d718 Remove deprecated alias for EventFlated (#2124)
• 28e3d13 Attach the event cache test to a different object (#2123)
• 9cf4d06 Group proxy with the other transport features in cargo-hack (#2105)
• b194763 update k8s-openapi to 0.29 (#2120)
• 4610180 fix(config): populate missing impersonation headers (#2116)
• 80de5bf Expose hyper-timeout's reset_reader_on_write config (#2111)
• 1f316bb Drop redundant status field from AuthError::AuthExecRun (#2099)
• debe79e fix: emit Event::Init when a StreamingList initial watch opens (#2118)
• Additional commits viewable in compare view

Updates oci-client from 0.17.0 to 0.18.0

Release notes

Sourced from oci-client's releases.

v0.18.0

What's Changed

• chore(deps): Bump EmbarkStudios/cargo-deny-action from 2.0.18 to 2.0.19 by @​dependabot[bot] in oras-project/rust-oci-client#261
• fix: URL-encode artifactType in pull_referrers query by @​obassett in oras-project/rust-oci-client#265
• chore(deps): Update oci-spec requirement from 0.9 to 0.10 by @​dependabot[bot] in oras-project/rust-oci-client#269
• chore(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in oras-project/rust-oci-client#268
• chore: update cargo-deny config by @​flavio in oras-project/rust-oci-client#262
• chore(deps): Bump EmbarkStudios/cargo-deny-action from 2.0.19 to 2.0.20 by @​dependabot[bot] in oras-project/rust-oci-client#267
• ci: proc-macro-error2 is no longer maintained, update cargo deny by @​flavio in oras-project/rust-oci-client#271
• fix: do not dump sensitive data in debug mode by @​flavio in oras-project/rust-oci-client#260
• feat(token_cache): allow programmatic access to the client token cache by @​vdice in oras-project/rust-oci-client#270
• chore(deps): Update itertools requirement from 0.14 to 0.15 by @​dependabot[bot] in oras-project/rust-oci-client#276
• chore(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in oras-project/rust-oci-client#275
• fix(client): Allow null in /tags/list responses by @​featherbread in oras-project/rust-oci-client#277
• push: avoid hashing each layer twice by @​vadika in oras-project/rust-oci-client#272
• feat(monostream): Monolithic stream push by @​slakkala in oras-project/rust-oci-client#273
• test: add regression coverage for pull_blob on a 404 (#64) by @​obassett in oras-project/rust-oci-client#266
• Remove lazy_static dependency by @​Expyron in oras-project/rust-oci-client#280
• chore(deps): Update testcontainers requirement from 0.27 to 0.28 by @​dependabot[bot] in oras-project/rust-oci-client#287
• chore(deps): Update jsonwebtoken requirement from 10.3 to 11.0 by @​dependabot[bot] in oras-project/rust-oci-client#285
• chore(deps): Bump actions/checkout from 7.0.0 to 7.0.1 by @​dependabot[bot] in oras-project/rust-oci-client#283
• Align ownership by @​sabre1041 in oras-project/rust-oci-client#289
• chore(deps): Update rstest requirement from 0.26 to 0.27 by @​dependabot[bot] in oras-project/rust-oci-client#291
• chore(deps): Bump EmbarkStudios/cargo-deny-action from 2.0.20 to 2.1.1 by @​dependabot[bot] in oras-project/rust-oci-client#281
• fix: handle unknown error codes and non UTF-8 server error bodies by @​renshao in oras-project/rust-oci-client#290
• feat: add provider-neutral rustls support by @​gakonst in oras-project/rust-oci-client#286
• ci: enable zizmor by @​flavio in oras-project/rust-oci-client#293
• chunked push without digest by @​flavio in oras-project/rust-oci-client#292
• chore: prepare 0.18.0 release by @​flavio in oras-project/rust-oci-client#295

New Contributors

• @​obassett made their first contribution in oras-project/rust-oci-client#265
• @​featherbread made their first contribution in oras-project/rust-oci-client#277
• @​vadika made their first contribution in oras-project/rust-oci-client#272
• @​slakkala made their first contribution in oras-project/rust-oci-client#273
• @​Expyron made their first contribution in oras-project/rust-oci-client#280
• @​sabre1041 made their first contribution in oras-project/rust-oci-client#289
• @​renshao made their first contribution in oras-project/rust-oci-client#290
• @​gakonst made their first contribution in oras-project/rust-oci-client#286

Full Changelog: oras-project/rust-oci-client@v0.17.0...v0.18.0

Commits

• 129ee8f Merge pull request #295 from flavio/prepare-0.18.0-release
• ddc27a0 chore: prepare 0.18.0 release
• 578ef50 Merge commit from fork
• 369cb9e fix(client): do not send credentials to hosts outside of the registry
• 90a8330 Merge pull request #292 from flavio/chunked-push-without-digest
• 524da21 Merge pull request #293 from flavio/zizmor
• fe15e9f ci: enable zizmor
• bc564de refactor(client): harden chunked stream push
• 7c3a735 feat: implement chunked blob push without upfront digest calculation
• ec89a0c Merge pull request #286 from gakonst/feat/rustls-no-provider
• Additional commits viewable in compare view

Updates opentelemetry from 0.32.0 to 0.33.1

Release notes

Sourced from opentelemetry's releases.

0.33.1

The OTLP exporters for Logs and Metrics are now stable.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Commits

• 372ebbc chore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)
• 5582e71 docs(logs): polish design doc and fill perf numbers (#3566)
• 7ce1269 fix(sdk): log when the periodic metrics reader panics (#3777)
• b547036 fix(prometheus): keep resource labels when scope info is disabled (#3751)
• e8480db chore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)
• 0fdfc48 feat(proto): Add support for protobuffer descriptor output (#3675)
• 87929d7 ci: install markdown-link-check from npm (#3661)
• ff2ab2d docs(trace): explain async context propagation (#3759)
• 2595432 fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...
• 952bdee fix: accept optional whitespace in TraceState (#3761)
• Additional commits viewable in compare view

Updates opentelemetry-otlp from 0.32.0 to 0.33.1

Commits

• 372ebbc chore: prepare 0.33.1 release and stabilize OTLP logs and metrics (#3782)
• 5582e71 docs(logs): polish design doc and fill perf numbers (#3566)
• 7ce1269 fix(sdk): log when the periodic metrics reader panics (#3777)
• b547036 fix(prometheus): keep resource labels when scope info is disabled (#3751)
• e8480db chore(deps): bump rust-toolchain from 1.98.0 to 1.99.0 (#3770)
• 0fdfc48 feat(proto): Add support for protobuffer descriptor output (#3675)
• 87929d7 ci: install markdown-link-check from npm (#3661)
• ff2ab2d docs(trace): explain async context propagation (#3759)
• 2595432 fix(proto): accept omitted default fields in OTLP/JSON exponential histogram,...
• 952bdee fix: accept optional whitespace in TraceState (#3761)
• Additional commits viewable in