Bump the cargo group across 1 directory with 37 updates

[dependabot]

Bumps the cargo group with 37 updates in the / directory:

Package	From	To
opentelemetry	0.32.0	0.33.0
opentelemetry_sdk	0.32.1	0.33.0
opentelemetry-otlp	0.32.0	0.33.0
opentelemetry-http	0.32.0	0.33.0
tracing-opentelemetry	0.33.0	0.34.0
tokio	1.53.1	1.53.2
slatedb	0.15.0	0.17.0
russh	0.62.6	0.64.1
gix-odb	0.84.0	0.85.0
gix-pack	0.74.2	0.75.0
gix-object	0.64.1	0.65.0
gix-hash	0.26.2	0.27.0
gix-traverse	0.61.0	0.62.0
gix-features	0.49.1	0.50.0
gix-actor	0.42.0	0.43.0
flate2	1.1.9	1.1.10
rand	0.8.7	0.10.2
base64	0.22.1	0.23.1
sha2	0.10.9	0.11.0
reqwest	0.13.4	0.13.5
imara-diff	0.1.8	0.2.0
redis	0.27.6	1.6.0
mongodb	3.8.0	3.9.1
jsonwebtoken	11.0.0	11.1.0
pgp	0.20.0	0.21.0
tower-http	0.6.11	0.7.1
slatedb-common	0.15.0	0.17.0
notify	7.0.0	8.2.0
object_store	0.14.1	0.14.2
libc	0.2.189	0.2.190
tokio-tungstenite	0.29.0	0.30.0
clap	4.6.6	4.6.7
socket2	0.5.10	0.6.5
hyper-util	0.1.20	0.1.21
gix	0.87.1	0.88.0
dirs	6.0.0	7.0.0
open	5.4.2	5.4.4

Updates opentelemetry from 0.32.0 to 0.33.0

Release notes

Sourced from opentelemetry's releases.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Changelog

Sourced from opentelemetry's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates opentelemetry_sdk from 0.32.1 to 0.33.0

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates opentelemetry-otlp from 0.32.0 to 0.33.0

Changelog

Sourced from opentelemetry-otlp's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates opentelemetry-http from 0.32.0 to 0.33.0

Release notes

Sourced from opentelemetry-http's releases.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Changelog

Sourced from opentelemetry-http's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates tracing-opentelemetry from 0.33.0 to 0.34.0

Changelog

Sourced from tracing-opentelemetry's changelog.

0.34.0 - 2026-09-20

Other

• Upgrade to OpenTelemetry 0.33, see upstream changelog for details (#268)

Commits

• See full diff in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates slatedb from 0.15.0 to 0.17.0

Release notes

Sourced from slatedb's releases.

v0.17.0

What's Changed

• Scale SsTableView::estimate_size by the visible_range fraction by @​geeknarrator in slatedb/slatedb#2043
• RFC-0033: Rewrite CachedObjectStore by @​criccomini in slatedb/slatedb#2031
• docs: renumber local object mirroring RFC to 0034 by @​criccomini in slatedb/slatedb#2062
• refactor(sst): remove WAL-specific table handling by @​rodesai in slatedb/slatedb#2058
• feat(compactor): configure checkpoint lifetime by @​criccomini in slatedb/slatedb#2063
• chore(foyer): bump to foyer v0.22.4 by @​geeknarrator in slatedb/slatedb#2066
• Add Triplox to the list of adopters by @​FiV0 in slatedb/slatedb#2075
• feat(uniffi): expose with_db_cache and with_db_cache_disabled on DbReaderBuilder by @​flexorRegev in slatedb/slatedb#2070
• add tracing spans slatedb.read and slatedb.read.memtable by @​cadonna in slatedb/slatedb#2048
• Add per-Db block-cache evacuation to disk for shared Foyer hybrid caches by @​geeknarrator in slatedb/slatedb#2034
• Add repository-wide Simple English guidance by @​criccomini in slatedb/slatedb#2077
• Add ObjectStoreBuilder in Uniffi Binding by @​LGouellec in slatedb/slatedb#2068
• Add AI disclosure and enum guidance by @​criccomini in slatedb/slatedb#2078
• Probe point-lookup sources concurrently instead of one at a time by @​hawkaa in slatedb/slatedb#2039
• feat: tag object store calls with segments by @​criccomini in slatedb/slatedb#2074
• feat(manifest): enforce the L0 ULID cutoff invariant by @​geeknarrator in slatedb/slatedb#2079
• [2021] Add DbBuilder::with_write_runtime to place the batch-writer on the caller's runtime by @​1996fanrui in slatedb/slatedb#2082
• Enable filters in range scans by @​yiming-fang in slatedb/slatedb#2076
• Return cache hit or miss results from DbCache fetch methods by @​cadonna in slatedb/slatedb#2083
• Stream L0 flush blocks instead of building the whole SST in memory by @​geeknarrator in slatedb/slatedb#2064
• chore(foyer): bump to foyer v0.22.6 by @​yiming-fang in slatedb/slatedb#2087
• Fix pause ordering in writer fencing test by @​criccomini in slatedb/slatedb#2088
• fix clippy issues when no cache feature enabled by @​cadonna in slatedb/slatedb#2090
• add tracing spans slatedb.read.read_filters and slatedb.read.evaluate_filters by @​cadonna in slatedb/slatedb#2054
• perf(wal): pipeline replay reads with shared limits by @​rodesai in slatedb/slatedb#2059
• Fix descending scan behavior in the sorted run iterator by @​nomiero in slatedb/slatedb#2067
• feat(compactions): enforce RFC 0029 ULID invariants by @​geeknarrator in slatedb/slatedb#2081
• Retry multipart parts with object_store 0.14.2 by @​criccomini in slatedb/slatedb#2094
• Snapshot DST filesystem listings before yielding by @​criccomini in slatedb/slatedb#2095
• Let applications evict the cache entries of retired SSTs by @​yiming-fang in slatedb/slatedb#2092
• add tracing spans slatedb.read.read_index by @​cadonna in slatedb/slatedb#2093
• Raise the key size limit to u32::MAX by @​agavra in slatedb/slatedb#2099
• fix: refresh GC version gauges before boundary updates by @​RanaPriyansh in slatedb/slatedb#2100
• Fix clock inheritance in union clones by @​geeknarrator in slatedb/slatedb#2107
• Add Tasklet to adopters by @​rockwotj in slatedb/slatedb#2114
• fix(clone): don't carry inherited external dbs that hold no SSTs by @​sinbad-io in slatedb/slatedb#2113
• feat(uniffi): expose Admin::delete_db by @​sinbad-io in slatedb/slatedb#2116
• Add an optional sorted-run count trigger for compaction by @​geeknarrator in slatedb/slatedb#2108

New Contributors

• @​LGouellec made their first contribution in slatedb/slatedb#2068
• @​yiming-fang made their first contribution in slatedb/slatedb#2076
• @​RanaPriyansh made their first contribution in slatedb/slatedb#2100
• @​sinbad-io made their first contribution in slatedb/slatedb#2113

Full Changelog: slatedb/slatedb@v0.16.0...v0.17.0

v0.16.0

... (truncated)

Commits

• c1e36fc Bump version to 0.17.0
• 052b1af Add an optional sorted-run count trigger for compaction (#2108)
• c4868b7 feat(uniffi): expose Admin::delete_db (#2116)
• a644322 fix(clone): don't carry inherited external dbs that hold no SSTs (#2113)
• b24c488 Add Tasklet to adopters (#2114)
• 2866a35 Fix clock inheritance in union clones (#2107)
• 0fb3680 fix: refresh GC version gauges before boundary updates (#2100)
• 8519986 Raise the key size limit to u32::MAX (#2099)
• 3c67092 add tracing spans slatedb.read.read_index (#2093)
• a04b941 Let applications evict the cache entries of retired SSTs (#2092)
• Additional commits viewable in compare view

Updates russh from 0.62.6 to 0.64.1

Release notes

Sourced from russh's releases.

v0.64.1

Security fixes

GHSA-4wc5-f2rc-q74m - Unbounded memory allocation in agent protocol server via crafted constraint records

A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message.

v0.64.0

Breaking changes

• 5d9d2b8: drop the legacy ed25519 key parser
  • Dropped the legacy-ed25519-pkcs8-parser feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error.

Security fixes

GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm

Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1

Features

• efa9a03: Add support hostkeys-prove-00@openssh.com support (#767) (@​inureyes) #767

  • Adds client::Handle::hostkeys_prove to ask the server to prove ownership of the host keys it announced via hostkeys-00@openssh.com.

• a0ded76: Support sending custom global requests from the client (#759) (@​ChrisJr404) #759

  • Adds client::Handle::send_global_request(name, data, want_reply)

Fixes

• e8b2fd3: Fix enforce rekey read and time limits (#766) (@​inureyes) #766
• bf05d50: honor want_reply = false on server-side global requests
• dddf72c: bug: Fix partial_success clobber (#773) (@​markovejnovic) #773
• 26487fb: fix: auth-agent-req@openssh.com replies on channel (#774) (#775) (@​markovejnovic) #775
• 36fa1bc: fix(pageant): trim username padding and handle empty principals (#779) (@​t8y2) #779

New Contributors

• @​markovejnovic made their first contribution in Eugeny/russh#773
• @​t8y2 made their first contribution in Eugeny/russh#779
• @​ChrisJr404 made their first contribution in Eugeny/russh#759

Full Changelog: Eugeny/russh@v0.63.3...v0.64.0

v0.63.3

Fixes

• c13b259: enforce inactivity timeout even during stalled writes (Eugene)

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

... (truncated)

Commits

• e5d80a0 v0.64.1
• 4c30503 handle lifetime constraints correctly
• c0fe3b1 bump pageant
• 4973149 v0.64.0
• bf05d50 cleanup
• a0ded76 Support sending custom global requests from the client (#759)
• e8b2fd3 Fix enforce rekey read and time limits (#766)
• efa9a03 Add support hostkeys-prove-00@openssh.com (#767)
• 36fa1bc fix(pageant): trim username padding and handle empty principals (#779)
• d27ff7e add t8y2 as a contributor for code (#780)
• Additional commits viewable in compare view

Updates gix-odb from 0.84.0 to 0.85.0

Release notes

Sourced from gix-odb's releases.

gix-odb v0.85.0

Changed (BREAKING)

• replace forwarding errors with metadata contexts

  looked at the diff in detail, but went through quickly. Enough to give it my name, but really barely so. Some refactoring done as well, but nothing major.

  Return canonical Exn errors for loose and dynamic object lookup, alternate resolution, prefix lookup and integrity verification. Preserve original I/O, decoder, allocation, persistence and custom reader sources instead of forwarding them through operation-specific error enums.

  Use documented scalar Metadata contexts for native paths, object IDs, sizes, pack counts and recursion limits. Keep alternate::Cycle with its discovered directory chain, and preserve explicit retryability for interrupted verification or concurrent disk changes. An absent delta base remains not found, while a recursion limit alone implies neither absence nor corruption. Empty loose files are now classified as corruption.

  Remove empty error namespaces and redundant conversions in porcelain and CLI callers. Keep the genuine I/O boundary for store initialization and pack loading, using the existing adapter to retain both the I/O kind and the complete cause.

  Replace wrapper-construction tests with actual custom-reader, malformed-object, missing-delta and depth-limit failures. Validate metadata and classifications after conversion, including native path values and retained cycle details.

• migrate errors to gix-error

  rubberstamp, but looked at it more to understand why it's more code. Answer: downstream relies on better error classification. However, I think this can also be reduced a bit.

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal requires Rust 1.88, so raise every workspace crate and the advertised badge together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite release lines that support Rust 1.88.

Performance

• avoid redundant in-memory object copies gix_object::Write::write() serialized an object into the trait buffer, then write_stream() copied that buffer again. Override it in the memory proxy so

... (truncated)

Commits

• 37860b3 Release gix-error v0.4.0, gix-date v0.17.0, gix-actor v0.43.0, gix-trace v0.2...
• 7f69d07 chore: add cargo smart-release incantation to justfile
• e11a4c2 report proofing
• 9f1a6cc report September 2026
• 591380a Merge pull request #3019 from GitoxideLabs/mailmap-perf
• b9b3d42 chore(gix-mailmap): modernize integration test layout
• 4163b89 fix(gix-mailmap): build snapshots without quadratic insertion
• 6356013 Merge pull request #2847 from GitoxideLabs/gix-error-completion
• da0f21d change(gix-error)!: unify diagnostics as Message and preserve causes
• f79ab74 Exclude Rust tests and examples from CodeQL analysis
• Additional commits viewable in compare view

Updates gix-pack from 0.74.2 to 0.75.0

Release notes

Sourced from gix-pack's releases.

gix-pack v0.75.0

New Features

• expose the pack header size

  The 12-byte pack header length was repeated in readers, offset validation, and tests,...

  Description has been truncated

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 79641186-7107-4654-9800-db2af3f3c9be

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}