deps: bump the rust-dependencies group across 1 directory with 14 updates

[dependabot]

Bumps the rust-dependencies group with 14 updates in the / directory:

Package	From	To
tower-http	0.6.9	0.6.10
tokio	1.52.2	1.52.3
opentelemetry	0.31.0	0.32.0
opentelemetry_sdk	0.31.0	0.32.0
opentelemetry-otlp	0.31.1	0.32.0
bcrypt	0.19.0	0.19.1
hmac	0.12.1	0.13.0
sha2	0.10.9	0.11.0
jsonwebtoken	10.3.0	10.4.0
tonic	0.14.5	0.14.6
tonic-prost	0.14.5	0.14.6
tonic-health	0.14.5	0.14.6
tonic-reflection	0.14.5	0.14.6
tonic-prost-build	0.14.5	0.14.6

Updates tower-http from 0.6.9 to 0.6.10

Release notes

Sourced from tower-http's releases.

tower-http-0.6.10

Added

• follow-redirect: expose Attempt::method() and Attempt::previous_method() so redirect policies can react to method changes across redirects (e.g. POST to GET on 301/303) (#559)

Fixed

• Restore tokio and async-compression as no-op features. These will be removed next breaking release (#667)

#559: tower-rs/tower-http#559 #667: tower-rs/tower-http#667

What's Changed

• fix: restore tokio and async-compression as no-op features by @​jlizen in tower-rs/tower-http#667
• fix gate-ing of atomic64 in tests by @​alexanderkjall in tower-rs/tower-http#607
• follow_redirect: expose previous and next request methods by @​lucab in tower-rs/tower-http#559
• chore: release tower-http 0.6.10 by @​jlizen in tower-rs/tower-http#669

New Contributors

• @​lucab made their first contribution in tower-rs/tower-http#559

Full Changelog: tower-rs/tower-http@tower-http-0.6.9...tower-http-0.6.10

Commits

• 4532fc2 v0.6.10
• 8508cb2 follow_redirect: expose previous and next request methods (#559)
• 890f66a fix gate-ing of atomic64 in tests (#607)
• 578c2b2 fix: restore tokio and async-compression as no-op features (#667)
• See full diff in compare view

Updates tokio from 1.52.2 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• sync: require that an RwLock has max_readers != 0 (#8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Commits

• d875691 chore: prepare Tokio v1.52.3 (#8130)
• e1aebb0 Merge 'tokio-1.51.3' into 'tokio-1.52.x' (#8129)
• fd63094 chore: prepare Tokio v1.51.3 (#8127)
• 8c600d0 Merge 'tokio-1.47.5' into 'tokio-1.51.x' (#8123)
• 11bfc13 chore: prepare Tokio v1.47.5 (#8122)
• f085b62 sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• 30d25cc sync: require that an RwLock has max_readers != 0 (#8076)
• 9fccf53 sync: return Empty from try_recv() when mpsc is closed with outstanding p...
• ebf61b4 sync: fix underflow in mpsc channel len() (#8062)
• See full diff in compare view

Updates opentelemetry from 0.31.0 to 0.32.0

Release notes

Sourced from opentelemetry's releases.

0.32.0

See release notes: https://github.com/open-telemetry/opentelemetry-rust/blob/main/docs/release_0.32.md

opentelemetry-otlp 0.31.1

What's Changed

• feat(OTLP): add tls-ring, tls-aws-lc, and tls-provider-agnostic feature flags [patch release v0.31.1] by @​lalitb in open-telemetry/opentelemetry-rust#3426

Full Changelog: open-telemetry/opentelemetry-rust@v0.31.0...opentelemetry-otlp-0.31.1

Changelog

Sourced from opentelemetry's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits

• ec289cb chore: Prepare for release v0.32.0 (#3508)
• 3ddb386 fix(metrics): reject usize::MAX as cardinality limit (#3506)
• bad0a1b feat(appender-tracing): re-gate span attribute enrichment behind experimental...
• f744509 docs: update README status table and remove deprecated crates (#3502)
• 81d5a06 chore(prometheus): restore crate to workspace (#3500)
• 5a07ce1 ci: close stale pull requests (#3499)
• cc87dd9 feat(appender-tracing): stabilize span attribute propagation (#3482)
• f290595 docs(metrics): document experimental bound instruments (#3495)
• a79eb76 fix(sdk): suppress telemetry in SimpleSpanProcessor during export (#3494)
• aa3bda3 chore(zipkin): deprecate opentelemetry-zipkin crate (#3492)
• Additional commits viewable in compare view

Updates opentelemetry_sdk from 0.31.0 to 0.32.0

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits

• ec289cb chore: Prepare for release v0.32.0 (#3508)
• 3ddb386 fix(metrics): reject usize::MAX as cardinality limit (#3506)
• bad0a1b feat(appender-tracing): re-gate span attribute enrichment behind experimental...
• f744509 docs: update README status table and remove deprecated crates (#3502)
• 81d5a06 chore(prometheus): restore crate to workspace (#3500)
• 5a07ce1 ci: close stale pull requests (#3499)
• cc87dd9 feat(appender-tracing): stabilize span attribute propagation (#3482)
• f290595 docs(metrics): document experimental bound instruments (#3495)
• a79eb76 fix(sdk): suppress telemetry in SimpleSpanProcessor during export (#3494)
• aa3bda3 chore(zipkin): deprecate opentelemetry-zipkin crate (#3492)
• Additional commits viewable in compare view

Updates opentelemetry-otlp from 0.31.1 to 0.32.0

Changelog

Sourced from opentelemetry-otlp's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits

• ec289cb chore: Prepare for release v0.32.0 (#3508)
• 3ddb386 fix(metrics): reject usize::MAX as cardinality limit (#3506)
• bad0a1b feat(appender-tracing): re-gate span attribute enrichment behind experimental...
• f744509 docs: update README status table and remove deprecated crates (#3502)
• 81d5a06 chore(prometheus): restore crate to workspace (#3500)
• 5a07ce1 ci: close stale pull requests (#3499)
• cc87dd9 feat(appender-tracing): stabilize span attribute propagation (#3482)
• f290595 docs(metrics): document experimental bound instruments (#3495)
• a79eb76 fix(sdk): suppress telemetry in SimpleSpanProcessor during export (#3494)
• aa3bda3 chore(zipkin): deprecate opentelemetry-zipkin crate (#3492)
• Additional commits viewable in compare view

Updates bcrypt from 0.19.0 to 0.19.1

Commits

• 4aed95a New version
• 66b6192 Update blowfish dependency version to 0.10 (#102)
• c420fca chore: Update build status badge (#99)
• 3a6d31d docs: Fix bare URL to clickable link (#98)
• See full diff in compare view

Updates hmac from 0.12.1 to 0.13.0

Commits

• 0236c8e hmac v0.13.0 (#263)
• b895e50 Migrate tests to the new blobby format (#264)
• 3d1440b Workspace-level lint configuration (#261)
• 11d4f36 hmac: use release versions of dev-dependencies (#260)
• c40b82b hmac: bump sha2 dev-dependency to v0.11 (#259)
• 1fa0781 Cut rc.5 prereleases (#258)
• a008265 hmac v0.13.0-rc.6 (#256)
• da485cd Use (Reset)MacTraits (#254)
• 2c51e3b hmac: derive Clone instead of relying on (Reset)MacTraits (#253)
• 669d805 Relax Clone bounds (#250)
• Additional commits viewable in compare view

Updates sha2 from 0.10.9 to 0.11.0

Commits

• ffe0939 Release sha2 0.11.0 (#806)
• 8991b65 Use the standard order of the [package] section fields (#807)
• 3d2bc57 sha2: refactor backends (#802)
• faa55fb sha3: bump keccak to v0.2 (#803)
• d3e6489 sha3 v0.11.0-rc.9 (#801)
• bbf6f51 sha2: tweak backend docs (#800)
• 155dbbf sha3: add default value for the DS generic parameter on TurboShake128/256...
• ed514f2 Use published version of keccak v0.2 (#799)
• 702bcd8 Migrate to closure-based keccak (#796)
• 827c043 sha3 v0.11.0-rc.8 (#794)
• Additional commits viewable in compare view

Updates jsonwebtoken from 10.3.0 to 10.4.0

Changelog

Sourced from jsonwebtoken's changelog.

10.4.0 (2026-05-11)

• Fix incorrect encoding for Ed25519 JWK thumbprints
• Make Algorithm.family public and add Validation.new_for_family
• EncodingKey and DecodingKey are now partially zeroized on drop (the intermediate PemEncodedKey isn't so far)

Commits

• 69a8fbf v10.4.0
• d18e40f Update changelog for 10.4.0 (#507)
• ddd2389 security: zeroize encoding and decoding keys (#483)
• 991e89a Fix more clippy complaints (#503)
• 75f2113 algorithms: expose AlgorithmFamily (#466)
• 0c5931a Fixup typo in the DecodingKey::from_ec_der method (#501)
• 8a80349 Small fixes (#498)
• 9934c7f Fix formatting in Ed25519 key serialization (#485)
• See full diff in compare view

Updates tonic from 0.14.5 to 0.14.6

Release notes

Sourced from tonic's releases.

tonic-build-v0.14.6

Other

• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-health-v0.14.6

Other

• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-prost-build-v0.14.6

Other

• Support well known types resolved by prost to their rust counterparts (#2544)
• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-prost-v0.14.6

Other

• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-reflection-v0.14.6

Other

• fix panic when client drops connection early (#2596)
• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-types-v0.14.6

Other

• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-v0.14.6

Added

• (transport/channel) expose ServerCertVerifier API (#2612)

Fixed

• map no trailers ok status to unknown (#2543)

Other

• add max_frame_size to client Endpoint (#2592)
• Allow setting the HTTP/2 client header table size (#2582)
• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-web-v0.14.6

Other

... (truncated)

Commits

• 6cb6056 chore: release v0.14.6 (#2624)
• efde924 grpc: change helloworld example to pass request as a view (#2632)
• d47b001 transport: add max_frame_size to client Endpoint (#2592)
• 02c01c7 Allow setting the HTTP/2 client header table size (#2582)
• 3185354 examples: add grpc version of helloworld (#2630)
• f585303 fix(grpc): Fix grpc-google build (#2628)
• ff7bcbb feat(grpc): Google call credentials (#2610)
• f93037b feat(tonic-xds): make XdsChannelGrpc Sync (#2627)
• d834beb grpc: Update Status to be a Result<> and make StatusErr which holds non-OK co...
• 2392224 grpc: add route_guide example and make minor tweaks to the generated code API...
• Additional commits viewable in compare view

Updates tonic-prost from 0.14.5 to 0.14.6

Release notes

Sourced from tonic-prost's releases.

tonic-prost-build-v0.14.6

Other

• Support well known types resolved by prost to their rust counterparts (#2544)
• update rust edition and version to 2024 and 1.88, respectively (#2525)

tonic-prost-v0.14.6

Other

• update rust edition and version to 2024 and 1.88, respectively (#2525)

Commits

• 6cb6056 chore: release v0.14.6 (#2624)
• efde924 grpc: change helloworld example to pass request as a view (#2632)
• d47b001 transport: add max_frame_size to client Endpoint (#2592)
• 02c01c7 Allow setting the HTTP/2 client header table size (#2582)
• 3185354 examples: add grpc version of helloworld (#2630)
• f585303 fix(grpc): Fix grpc-google build (#2628)
• ff7bcbb feat(grpc): Google call credentials (#2610)
• f93037b feat(tonic-xds): make XdsChannelGrpc Sync (#2627)
• d834beb grpc: Update Status to be a Result<> and make StatusErr which holds non-OK co...
• 2392224 grpc: add route_guide example and make minor tweaks to the generated code API...
• Additional commits viewable in compare view

Updates tonic-health from 0.14.5 to 0.14.6

Release notes

Sourced from tonic-health's releases.

tonic-health-v0.14.6

Other

• update rust edition and version to 2024 and 1.88, respectively (#2525)

Commits

• 6cb6056 chore: release v0.14.6 (#2624)
• efde924 grpc: change helloworld example to pass request as a view (#2632)
• d47b001 transport: add max_frame_size to client Endpoint (#2592)
• 02c01c7 Allow setting the HTTP/2 client header table size (#2582)
• 3185354 examples: add grpc version of helloworld (#2630)
• f585303 fix(grpc): Fix grpc-google build (#2628)
• ff7bcbb feat(grpc): Google call credentials (#2610)
• f93037b feat(tonic-xds): make XdsChannelGrpc Sync (#2627)
• d834beb grpc: Update Status to be a Result<> and make StatusErr which holds non-OK co...
• 2392224 grpc: add route_guide example and make minor tweaks to the generated code API...
• Additional commits viewable in compare view

Updates tonic-reflection from 0.14.5 to 0.14.6

Release notes

Sourced from tonic-reflection's releases.

tonic-reflection-v0.14.6

Other

• fix panic when client drops connection early (#2596)
• update rust edition and version to 2024 and 1.88, respectively (#2525)

Commits

• 6cb6056 chore: release v0.14.6 (#2624)
• efde924 grpc: change helloworld example to pass request as a view (#2632)
• d47b001 transport: add max_frame_size to client Endpoint (#2592)
• 02c01c7 Allow setting the HTTP/2 client header table size (#2582)
• 3185354 examples: add grpc version of helloworld (#2630)
• f585303 fix(grpc): Fix grpc-google build (#2628)
• ff7bcbb feat(grpc): Google call credentials (#2610)
• f93037b feat(tonic-xds): make XdsChannelGrpc Sync (#2627)
• d834beb grpc: Update Status to be a Result<> and make StatusErr which holds non-OK co...
• 2392224 grpc: add route_guide example and make minor tweaks to the generated code API...
• Additional commits viewable in compare view

Updates tonic-prost-build from 0.14.5 to 0.14.6

Release notes

Sourced from tonic-prost-build's releases.

tonic-prost-build-v0.14.6

Other

• Support well known types resolved by prost to their rust counterparts (#2544)
• update rust edition and version to 2024 and 1.88, respectively (#2525)

Commits

• 6cb6056 chore: release v0.14.6 (#2624)
• efde924 grpc: change helloworld example to pass request as a view (#2632)
• d47b001 transport: add max_frame_size to client Endpoint (#2592)
• 02c01c7 Allow setting the HTTP/2 client header table size (#2582)
• 3185354 examples: add grpc version of helloworld (#2630)
• f585303 fix(grpc): Fix grpc-google build (#2628)
• ff7bcbb feat(grpc): Google call credentials (#2610)
• f93037b feat(tonic-xds): make XdsChannelGrpc Sync (#2627)
• d834beb grpc: Update Status to be a Result<> and make StatusErr which holds non-OK co...
• 2392224 grpc: add route_guide example and make minor tweaks to the generated code API...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.