Bump the cargo group across 1 directory with 32 updates

[dependabot]

Bumps the cargo group with 32 updates in the / directory:

Package	From	To
opentelemetry	0.32.0	0.33.0
opentelemetry_sdk	0.32.1	0.33.0
opentelemetry-otlp	0.32.0	0.33.0
opentelemetry-http	0.32.0	0.33.0
tracing-opentelemetry	0.33.0	0.34.0
tokio	1.53.1	1.53.2
slatedb	0.15.0	0.17.0
russh	0.62.6	0.64.1
gix-features	0.49.1	0.50.0
gix-actor	0.42.0	0.44.0
flate2	1.1.9	1.1.10
rand	0.8.7	0.10.2
base64	0.22.1	0.23.1
sha2	0.10.9	0.11.0
reqwest	0.13.4	0.13.5
imara-diff	0.1.8	0.2.0
redis	0.27.6	1.6.0
mongodb	3.8.0	3.9.1
jsonwebtoken	11.0.0	11.1.0
pgp	0.20.0	0.21.0
tower-http	0.6.11	0.7.1
slatedb-common	0.15.0	0.17.0
notify	7.0.0	8.2.0
object_store	0.14.1	0.14.2
libc	0.2.189	0.2.190
tokio-tungstenite	0.29.0	0.30.0
clap	4.6.6	4.6.7
socket2	0.5.10	0.6.5
hyper-util	0.1.20	0.1.21
dirs	6.0.0	7.0.0
open	5.4.2	5.4.4
tun	0.7.22	0.8.14

Updates opentelemetry from 0.32.0 to 0.33.0

Release notes

Sourced from opentelemetry's releases.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Changelog

Sourced from opentelemetry's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates opentelemetry_sdk from 0.32.1 to 0.33.0

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates opentelemetry-otlp from 0.32.0 to 0.33.0

Changelog

Sourced from opentelemetry-otlp's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates opentelemetry-http from 0.32.0 to 0.33.0

Release notes

Sourced from opentelemetry-http's releases.

0.33.0

See the 0.33.0 release notes and migration guidance.

The OTLP exporters for Logs and Metrics remain release candidates. We plan to declare them stable in 0.33.1 after approximately two weeks of validation, provided no issues requiring breaking API changes arise. The Logs and Metrics API and SDK remain stable; Distributed Tracing remains pre-stable.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Changelog

Sourced from opentelemetry-http's changelog.

Release Notes 0.33

The OTLP exporters for Logs and Metrics remain in release-candidate (RC) status in OpenTelemetry Rust 0.33.0. We intend to declare them stable in 0.33.1, approximately two weeks after this release, provided the RC period does not uncover any issues requiring breaking API changes. During this period, we expect only compatible fixes, documentation updates, and low-risk internal optimisations.

OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and completes the stabilisation cleanups that began in 0.32. The Logs and Metrics API and SDK remain stable with no breaking changes. The Distributed Tracing API, SDK, and OTLP exporter remain pre-stable, and this release includes intentional breaking changes in that area to continue preparing it for stabilisation.

For detailed changelogs of individual crates, refer to their respective changelog files. This document summarises the key changes.

Key Changes

OTLP Exporters for Logs and Metrics (RC)

Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC for a final validation period. If no issues requiring breaking API changes are identified, we intend to declare them stable in 0.33.1 approximately two weeks after this release.

Retries enabled by default

OTLP/HTTP and OTLP/gRPC retries are now enabled by default with exponential backoff, jitter, and up to 3 retries (4 attempts total). Use .with_retry_policy(RetryPolicy::disabled()) to opt out, or provide a custom RetryPolicy.

Users of the experimental retry feature flags (experimental-grpc-retry and experimental-http-retry) should remove them from Cargo.toml. The retry and retry_classification modules are now crate-private; replace opentelemetry_otlp::retry imports with opentelemetry_otlp::RetryPolicy and use its with_* methods instead of struct literals.

Stabilisation cleanups

• Breaking for callers matching or constructing removed build-error variants: ExporterBuildError now has two exhaustive variants, InvalidConfiguration(String) and InternalFailure(String). Update uses of removed variants. Normal exporter builder calls and propagation of build errors with ? need no changes. See the OTLP changelog for migration examples.
• Breaking Protocol and Compression are now #[non_exhaustive]. Exhaustive matches must add a wildcard arm.
• Breaking Protocol::from_env() is now crate-private. Builders resolve OTEL_EXPORTER_OTLP_PROTOCOL automatically; read the env var directly if needed.
• Invalid OTLP endpoint environment variables (HTTP and gRPC) now produce a

... (truncated)

Commits

• 1983384 docs: clarify OTLP 0.33 migration guidance (#3747)
• dacfeda chore: Prepare for release v0.33.0 (RC) (#3712)
• 996ac1e refactor(http)!: make ResponseBodyTooLarge extensible (#3736)
• d328c65 fix(proto): preserve scope metadata when grouping OTLP logs (#3740)
• e652efd refactor(otlp): finalize exporter build error API (#3692)
• 8809c42 refactor(otlp)!: separate configuration parsing errors (#3742)
• cc1c374 feat(otlp): Allow to provide http client wrapped in Arc for user (#3468)
• e085c61 ci: use supported Debian image for benchmarks (#3744)
• 6c5fd58 fix(proto): accept omitted partial success fields (#3739)
• 51b36a7 fix(otlp): handle enum environment values consistently (#3730)
• Additional commits viewable in compare view

Updates tracing-opentelemetry from 0.33.0 to 0.34.0

Changelog

Sourced from tracing-opentelemetry's changelog.

0.34.0 - 2026-09-20

Other

• Upgrade to OpenTelemetry 0.33, see upstream changelog for details (#268)

Commits

• See full diff in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates slatedb from 0.15.0 to 0.17.0

Release notes

Sourced from slatedb's releases.

v0.17.0

What's Changed

• Scale SsTableView::estimate_size by the visible_range fraction by @​geeknarrator in slatedb/slatedb#2043
• RFC-0033: Rewrite CachedObjectStore by @​criccomini in slatedb/slatedb#2031
• docs: renumber local object mirroring RFC to 0034 by @​criccomini in slatedb/slatedb#2062
• refactor(sst): remove WAL-specific table handling by @​rodesai in slatedb/slatedb#2058
• feat(compactor): configure checkpoint lifetime by @​criccomini in slatedb/slatedb#2063
• chore(foyer): bump to foyer v0.22.4 by @​geeknarrator in slatedb/slatedb#2066
• Add Triplox to the list of adopters by @​FiV0 in slatedb/slatedb#2075
• feat(uniffi): expose with_db_cache and with_db_cache_disabled on DbReaderBuilder by @​flexorRegev in slatedb/slatedb#2070
• add tracing spans slatedb.read and slatedb.read.memtable by @​cadonna in slatedb/slatedb#2048
• Add per-Db block-cache evacuation to disk for shared Foyer hybrid caches by @​geeknarrator in slatedb/slatedb#2034
• Add repository-wide Simple English guidance by @​criccomini in slatedb/slatedb#2077
• Add ObjectStoreBuilder in Uniffi Binding by @​LGouellec in slatedb/slatedb#2068
• Add AI disclosure and enum guidance by @​criccomini in slatedb/slatedb#2078
• Probe point-lookup sources concurrently instead of one at a time by @​hawkaa in slatedb/slatedb#2039
• feat: tag object store calls with segments by @​criccomini in slatedb/slatedb#2074
• feat(manifest): enforce the L0 ULID cutoff invariant by @​geeknarrator in slatedb/slatedb#2079
• [2021] Add DbBuilder::with_write_runtime to place the batch-writer on the caller's runtime by @​1996fanrui in slatedb/slatedb#2082
• Enable filters in range scans by @​yiming-fang in slatedb/slatedb#2076
• Return cache hit or miss results from DbCache fetch methods by @​cadonna in slatedb/slatedb#2083
• Stream L0 flush blocks instead of building the whole SST in memory by @​geeknarrator in slatedb/slatedb#2064
• chore(foyer): bump to foyer v0.22.6 by @​yiming-fang in slatedb/slatedb#2087
• Fix pause ordering in writer fencing test by @​criccomini in slatedb/slatedb#2088
• fix clippy issues when no cache feature enabled by @​cadonna in slatedb/slatedb#2090
• add tracing spans slatedb.read.read_filters and slatedb.read.evaluate_filters by @​cadonna in slatedb/slatedb#2054
• perf(wal): pipeline replay reads with shared limits by @​rodesai in slatedb/slatedb#2059
• Fix descending scan behavior in the sorted run iterator by @​nomiero in slatedb/slatedb#2067
• feat(compactions): enforce RFC 0029 ULID invariants by @​geeknarrator in slatedb/slatedb#2081
• Retry multipart parts with object_store 0.14.2 by @​criccomini in slatedb/slatedb#2094
• Snapshot DST filesystem listings before yielding by @​criccomini in slatedb/slatedb#2095
• Let applications evict the cache entries of retired SSTs by @​yiming-fang in slatedb/slatedb#2092
• add tracing spans slatedb.read.read_index by @​cadonna in slatedb/slatedb#2093
• Raise the key size limit to u32::MAX by @​agavra in slatedb/slatedb#2099
• fix: refresh GC version gauges before boundary updates by @​RanaPriyansh in slatedb/slatedb#2100
• Fix clock inheritance in union clones by @​geeknarrator in slatedb/slatedb#2107
• Add Tasklet to adopters by @​rockwotj in slatedb/slatedb#2114
• fix(clone): don't carry inherited external dbs that hold no SSTs by @​sinbad-io in slatedb/slatedb#2113
• feat(uniffi): expose Admin::delete_db by @​sinbad-io in slatedb/slatedb#2116
• Add an optional sorted-run count trigger for compaction by @​geeknarrator in slatedb/slatedb#2108

New Contributors

• @​LGouellec made their first contribution in slatedb/slatedb#2068
• @​yiming-fang made their first contribution in slatedb/slatedb#2076
• @​RanaPriyansh made their first contribution in slatedb/slatedb#2100
• @​sinbad-io made their first contribution in slatedb/slatedb#2113

Full Changelog: slatedb/slatedb@v0.16.0...v0.17.0

v0.16.0

... (truncated)

Commits

• c1e36fc Bump version to 0.17.0
• 052b1af Add an optional sorted-run count trigger for compaction (#2108)
• c4868b7 feat(uniffi): expose Admin::delete_db (#2116)
• a644322 fix(clone): don't carry inherited external dbs that hold no SSTs (#2113)
• b24c488 Add Tasklet to adopters (#2114)
• 2866a35 Fix clock inheritance in union clones (#2107)
• 0fb3680 fix: refresh GC version gauges before boundary updates (#2100)
• 8519986 Raise the key size limit to u32::MAX (#2099)
• 3c67092 add tracing spans slatedb.read.read_index (#2093)
• a04b941 Let applications evict the cache entries of retired SSTs (#2092)
• Additional commits viewable in compare view

Updates russh from 0.62.6 to 0.64.1

Release notes

Sourced from russh's releases.

v0.64.1

Security fixes

GHSA-4wc5-f2rc-q74m - Unbounded memory allocation in agent protocol server via crafted constraint records

A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message.

v0.64.0

Breaking changes

• 5d9d2b8: drop the legacy ed25519 key parser
  • Dropped the legacy-ed25519-pkcs8-parser feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error.

Security fixes

GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm

Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1

Features

• efa9a03: Add support hostkeys-prove-00@openssh.com support (#767) (@​inureyes) #767

  • Adds client::Handle::hostkeys_prove to ask the server to prove ownership of the host keys it announced via hostkeys-00@openssh.com.

• a0ded76: Support sending custom global requests from the client (#759) (@​ChrisJr404) #759

  • Adds client::Handle::send_global_request(name, data, want_reply)

Fixes

• e8b2fd3: Fix enforce rekey read and time limits (#766) (@​inureyes) #766
• bf05d50: honor want_reply = false on server-side global requests
• dddf72c: bug: Fix partial_success clobber (#773) (@​markovejnovic) #773
• 26487fb: fix: auth-agent-req@openssh.com replies on channel (#774) (#775) (@​markovejnovic) #775
• 36fa1bc: fix(pageant): trim username padding and handle empty principals (#779) (@​t8y2) #779

New Contributors

• @​markovejnovic made their first contribution in Eugeny/russh#773
• @​t8y2 made their first contribution in Eugeny/russh#779
• @​ChrisJr404 made their first contribution in Eugeny/russh#759

Full Changelog: Eugeny/russh@v0.63.3...v0.64.0

v0.63.3

Fixes

• c13b259: enforce inactivity timeout even during stalled writes (Eugene)

v0.63.2

Security fixes

GHSA-g4mp-vgx3-xrvm - out-of-bounds read in pageant

... (truncated)

Commits

• e5d80a0 v0.64.1
• 4c30503 handle lifetime constraints correctly
• c0fe3b1 bump pageant
• 4973149 v0.64.0
• bf05d50 cleanup
• a0ded76 Support sending custom global requests from the client (#759)
• e8b2fd3 Fix enforce rekey read and time limits (#766)
• efa9a03 Add support hostkeys-prove-00@openssh.com (#767)
• 36fa1bc fix(pageant): trim username padding and handle empty principals (#779)
• d27ff7e add t8y2 as a contributor for code (#780)
• Additional commits viewable in compare view

Updates gix-features from 0.49.1 to 0.50.0

Release notes

Sourced from gix-features's releases.

gix-revision v0.50.0

Bug Fixes

• stop merge-base walks when one paint side is exhausted Tested with gix merge-base and noticed that even with gix merge-base @ @~800 with first: Sha1(707df3375124b51048233625a7e1c801e8c8a7fd) | others: [Sha1(c9c0543b52d8cfe3a3b15d1e39ab9dbc91be6df4)] this branch implementation is noticably faster, roughly 10.2ms vs 61.2ms.

  The merge-base walk kept following unrelated ancestry while any queued commit remained non-stale, even after one paint color could no longer contribute a merge base. Its termination check also scanned the queue on every iteration.

  Adapt Git's side-exhaustion optimization from 02d7ba092d: count non-stale queued commits carrying each color and stop when either count reaches zero in the topologically ordered region. Candidates contribute to both counts so they are processed before termination. Track queue membership to handle flag changes and duplicate inputs without counting a commit twice.

  Keep the existing stale-only termination for missing, zero, or saturated generations, where date ordering can revive an apparently exhausted color. Continue removing redundant candidates after the paint walk.

  Use existing fixtures to prove that unrelated ancestry is skipped and cover pending candidates, duplicate inputs, graph reuse, and clock skew. The skipped-ancestry regression fails before this change.

Changed (BREAKING)

• raise MSRV to Rust 1.88

  The newly published dua-core 3.3 release used by linked-worktree removal requires Rust 1.88, so raise every workspace crate and the advertised badge together.

  Keep the MSRV checks buildable by selecting the latest sysinfo and rusqlite release lines that support Rust 1.88.

Bug Fixes (BREAKING)

• preserve merge-base lookup failures

  rubber stamp, but checked the diff and asked for fixes to use gix_error::TestResult instead, which for the sake of simplicity is going to happen in a future commit.

  Merge-base traversal replaced object-store and decoding errors with a static

... (truncated)

Changelog

Sourced from gix-features's changelog.

0.50.0 (2026-01-22)

Commit Statistics

• 4 commits contributed to the release over the course of 12 calendar days.
• 22 days passed between releases.
• 0 commits were understood as conventional.
• 0 issues like '(#ID)' were seen in commit messages

Commit Details

• Uncategorized
  • Merge pull request #2374 from GitoxideLabs/gix-error (25233ce)
  • Turn Exn::into_box() to Exn::into_inner(). (939b8fc)
  • Merge pull request #2352 from GitoxideLabs/gix-error (ae23762)
  • Adadpt exn to most pressing needs of gitoxide (abedade)

0.49.0 (2025-12-31)

0.48.0 (2025-12-22)

0.47.0 (2025-11-22)

New Features

• allow credential fill with gix credential fill to run without a repo

Commit Statistics

• 5 commits contributed to the release.
• 31 days passed between releases.
• 2 commits were understood as conventional.
• 1 unique issue was worked on: #2198

Commit Details

... (truncated)

Commits

• 37860b3 Release gix-error v0.4.0, gix-date v0.17.0, gix-actor v0.43.0, gix-trace v0.2...
• 7f69d07 chore: add cargo smart-release incantation to justfile
• e11a4c2 report proofing
• 9f1a6cc report September 2026

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0a5b1ec4-a491-4b00-b85e-6d54c492ebee

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}