[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
anyhow	build-dependencies	patch	1.0.100 → 1.0.104
async-trait	dependencies	patch	0.1.89 → 0.1.92
axum	dependencies	patch	0.8.8 → 0.8.9
axum-tracing-opentelemetry (source)	dependencies	minor	0.39.1 → 0.42.0
config	dependencies	patch	0.15.19 → 0.15.27
futures (source)	dev-dependencies	patch	0.3.31 → 0.3.34
futures (source)	dependencies	patch	0.3.31 → 0.3.34
gcp_auth	dependencies	patch	0.12.6 → 0.12.7
opentelemetry (source)	dependencies	minor	0.32.0 → 0.33.0
opentelemetry-prometheus (source)	dependencies	minor	0.32 → 0.33
opentelemetry_sdk (source)	dependencies	minor	0.32.1 → 0.33.0
regex	dev-dependencies	minor	1.12.2 → 1.13.1
rust-telemetry	dependencies	patch	1.4.0 → 1.4.1
serde (source)	dependencies	patch	1.0.228 → 1.0.229
serde_json	dependencies	patch	1.0.149 → 1.0.154
time (source)	dependencies	patch	0.3.47 → 0.3.55
tokio (source)	dependencies	minor	1.49.0 → 1.54.1
tower	dev-dependencies	patch	0.5.2 → 0.5.3
tower	dependencies	patch	0.5.2 → 0.5.3
tower-http	dependencies	minor	0.6.6 → 0.7.0
tracing-subscriber (source)	dependencies	patch	0.3.22 → 0.3.23
uuid	dependencies	minor	1.23.1 → 1.29.0

---

Release Notes

dtolnay/anyhow (anyhow)

v1.0.104

Compare Source

• Update syn dev-dependency to version 3

v1.0.103

Compare Source

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#​451, #​452)

v1.0.102

Compare Source

• Remove backtrace dependency (#​438, #​439, #​440, #​441, #​442)

v1.0.101

Compare Source

• Add #[inline] to anyhow::Ok helper (#​437, thanks @​Ibitier)

dtolnay/async-trait (async-trait)

v0.1.92

Compare Source

• Resolve double_must_use clippy lint in generated code (#​303)

v0.1.91

Compare Source

• Update to syn 3 (#​299)
• Fix mutability for by-reference receivers (#​301)

v0.1.90

Compare Source

(yanked)

tokio-rs/axum (axum)

v0.8.9

Compare Source

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#​3597)
• changed: Update minimum rust version to 1.80 (#​3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#​3656)
• fixed: Return specific error message when multipart body limit is exceeded (#​3611)

davidB/tracing-opentelemetry-instrumentation-sdk (axum-tracing-opentelemetry)

v0.42.1

Compare Source

v0.42.0

Compare Source

rust-cli/config-rs (config)

v0.15.27

Compare Source

Performance

• (toml) Reduced parsing overhead

v0.15.26

Compare Source

Compatibility

• Bump MSRV to 1.88

Internal

• Upgrade json5 to 1.3

v0.15.25

Compare Source

Fixes

• (ron) Support u64, and not just i64

v0.15.24

Compare Source

Fixes

• (json) Support u64, and not just i64

v0.15.23

Compare Source

Fixes

• Environment::convert_case: correctly apply casing to each key segment

v0.15.22

Compare Source

Documentation

• Polish examples

Internal

• Update winnow

v0.15.21

Compare Source

Compatibility

• Bump MSRV to 1.85

v0.15.20

Compare Source

Fixes

• Serialize the full u64 range

Internal

• (toml) Update to 1.0

rust-lang/futures-rs (futures)

v0.3.34

Compare Source

• Preserve cloned waker identity. (#​3032)
• Updato syn to 3. (#​3028)

v0.3.33

Compare Source

• Fix ReadLine's soundness issue regarding to exception safety. (#​3020)
• Fix unsound Send impl for IterPinRef and Iter. (#​3003)
• Fix stacked borrows violation in compat01as03 implementation. (#​3012)
• Fix memory leak in FuturesUnordered::IntoIter. (#​3005)
• Add portable-atomic-alloc feature and use it in FuturesUnordered. (#​3007)
• Re-export alloc::task::Wake. (#​3010)
• Update spin to 0.12. (#​3014)

v0.3.32

Compare Source

• Bump MSRV of utility crates to 1.71. (#​2989)
• Soft-deprecate ready! macro in favor of std::task::ready! added in Rust 1.64 (#​2925)
• Soft-deprecate pin_mut! macro in favor of std::pin::pin! added in Rust 1.68 (#​2929)
• Add FuturesOrdered::clear (#​2927)
• Add mpsc::*Receiver::recv (#​2947)
• Add mpsc::*Receiver::try_recv and deprecate mpsc::*Receiver::::try_next (#​2944)
• Implement FusedStream for sink::With (#​2948)
• Add no_std support for shared (#​2868)
• Make Mutex::new() const (#​2956)
• Add #[clippy::has_significant_drop] to guards (#​2967)
• Remove dependency to pin-utils (#​2929)
• Remove dependency on num_cpus (#​2946)
• Performance improvements (#​2983)
• Documentation improvements (#​2925, #​2926, #​2940, #​2971)

djc/gcp_auth (gcp_auth)

v0.12.7

Compare Source

What's Changed

• Update dependencies by @​djc in #​165
• Make the ring dependency optional by @​a-kenji in #​173
• Prepare 0.12.7 by @​djc in #​177

open-telemetry/opentelemetry-rust (opentelemetry)

v0.33.1

Compare Source

Released 2026-Oct-08

• Fix a panic when a value stored with Context::with_value() calls
  Context::current() from its Drop implementation.
• Expand tracing documentation on async context propagation and child spans
  (#​828).
• Document the panic contract for observable metric callbacks (Callback and
  AsyncInstrumentBuilder::with_callback).
  (#​3640)
• Fix TraceState::from_str rejecting valid optional whitespace around list members.
  (#​3757)
• Breaking TraceState now validates list-members exactly as the
  W3C Trace Context Level 2
  specification requires. from_str, from_key_value and insert return an Err for:
  • empty keys and empty or whitespace-only values (e.g. =x, a=),
  • values containing characters outside printable ASCII (e.g. tabs), , or =;
    repeated equals signs (e.g. a==b) are no longer silently removed,
  • values with trailing spaces passed to from_key_value or insert (trailing
    spaces in a parsed header are still treated as optional whitespace),
  • duplicate keys, reported via the new TraceStateError::DuplicateKey variant.
    TraceState::delete now returns TraceState instead of Result<TraceState, TraceStateError>
TraceState's Debug output changed from TraceState(None) / TraceState(Some([..])) to TraceState([]) / TraceState([("key", "value")]).
    (#​3778)

v0.33.0

Compare Source

Released 2026-Sep-18

• Fix TraceState accepting more than the 32 list-members the W3C trace-context
  specification allows. from_str, from_key_value and insert now keep at most
  32, dropping members from the end of the list as the specification prescribes, so
  neither a parsed nor a locally built tracestate can exceed the limit.
• Added experimental support for a global context event observer. A
  ContextObserver can be registered via GlobalContextObserver::set to be
  notified of context transitions through the on_context_enter and
  on_context_exit callbacks. This feature is primarily intended to publish a
  different view of the current context (the ObserverContextView) through
  alternative channels that let external readers (e.g. an eBPF profiler) track
  the current context. See the associated
  OTEP.
  Gated behind the experimental_context_observer feature flag.
• otel_info!, otel_warn!, otel_debug!, and otel_error! macros now accept quoted-key fields
  (e.g. "otel.component.type" = "value") for dotted attribute names.
• Added BoundGauge<T> and BoundUpDownCounter<T> types (and the
  corresponding Gauge::bind() / UpDownCounter::bind() methods), completing
  the experimental bound-instrument API across all sync instruments
  (Counter, UpDownCounter, Histogram, Gauge). Gated behind the
  experimental_metrics_bound_instruments feature flag.

open-telemetry/opentelemetry-rust (opentelemetry-prometheus)

v0.33.1

Compare Source

Released 2026-Oct-08

• Fix resource labels selected via with_resource_selector being dropped from metric points when scope_info_enabled(false) is set. #​2858

v0.33.0

Compare Source

Released 2026-Sep-18

• Replace without_scope_info with scope_info_enabled to configure Prometheus instrumentation scope labels, inverting the option from disabling scope info to enabling it. Before this change, the exporter emitted an otel_scope_info metric and only added otel_scope_name/otel_scope_version labels to metric points. Now scope info is enabled by default on metric points with otel_scope_name, otel_scope_version, otel_scope_schema_url, and scope attributes prefixed with otel_scope_; setting scope_info_enabled(false) suppresses those labels. #​3503

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

v0.33.1

Compare Source

Released 2026-Oct-08

• Emit a one-time internal error diagnostic when the default PeriodicReader
  worker thread panics (such as from an observable metric callback), and document
  the callback panic contract.
  (#​3640)
• Added Sampler::parent_based(root), returning a ParentBasedSampler that lets
  all 5 branches of the ParentBased sampler spec be configured independently
  (root, and remote/local parent that is/isn't sampled) via with_remote_parent_sampled,
  with_remote_parent_not_sampled, with_local_parent_sampled, and
  with_local_parent_not_sampled. Previously Sampler::ParentBased only let you
  override the root case; the other 4 were fixed to the spec defaults. Unset
  branches keep those same defaults, so this is purely additive.
  (#​3657)
• Fixed Histogram, Sum, LastValue, and PrecomputedSum aggregators (and
  their bound-instrument handles) silently accepting NaN/Infinity
  measurements. For Histogram and Sum, a single NaN measurement
  permanently corrupted the cumulative sum/total for the rest of the
  process's lifetime (x + NaN == NaN); LastValue and PrecomputedSum
  self-healed on the next valid measurement but still exported one bad value
  in the meantime, and PrecomputedSum under delta temporality corrupted two
  export cycles. Non-finite measurements are now dropped before recording,
  matching ExponentialHistogram's existing behavior.
  (#​3656)
• Fixed SdkTracer inheriting an invalid parent span context (e.g. a context
  carrying an invalid active span context). Such a parent is now treated as no
  parent: the span gets a freshly generated trace id instead of the parent's
  all-zero one, and is not recorded as a child of it.
  (#​3657)
• Log metric export failures at ERROR level in PeriodicReader, making
  failures such as an unreachable collector visible without enabling DEBUG
  logging.
  (#​3754)
• TraceContextPropagator now follows the W3C Trace Context Level 2 tracestate rules.
  Multiple tracestate header fields are combined into a single list, tracestate is
  only parsed once traceparent is known to be valid, an invalid tracestate (see
  the stricter TraceState parsing in opentelemetry) is discarded without
  affecting traceparent and an empty tracestate header is no longer injected.
  (#​3778)

v0.33.0

Released 2026-Sep-18

• Publicly export the OTEL_*/OTEL_*_DEFAULT environment variable name and
  default value constants for BatchSpanProcessor (opentelemetry_sdk::trace),
  BatchLogProcessor (opentelemetry_sdk::logs), and PeriodicReader
  (opentelemetry_sdk::metrics), so downstream configuration systems can read
  the SDK's spec-defined defaults programmatically instead of duplicating
  them. As part of this, PeriodicReader's previously-private
  DEFAULT_INTERVAL/METRIC_EXPORT_INTERVAL_NAME constants were renamed
  to OTEL_METRIC_EXPORT_INTERVAL_DEFAULT/OTEL_METRIC_EXPORT_INTERVAL to
  match the naming convention already used elsewhere.
  (#​3623)
• Added SDK self-observability metrics, feature-gated behind
  experimental_metrics_bound_instruments: otel.sdk.log.created counts log
  records submitted to the SDK; otel.sdk.processor.log.processed and
  otel.sdk.processor.span.processed count records and spans submitted to an
  exporter by batch and simple processors, with error.type reporting items
  dropped before submission; and otel.sdk.processor.log.queue.capacity
  reports the configured BatchLogProcessor queue capacity.
  (#​3514,
  #​3608,
  #​3609,
  #​3611)
• Made futures-channel, futures-executor, futures-util, and thiserror
  optional, enabling a minimal SDK build. With default-features = false, the
  SDK's only dependency is the opentelemetry API crate.
  (#​3593)
• Bound instruments are now available for Gauge and UpDownCounter via the
  new BoundGauge<T> and BoundUpDownCounter<T> types exposed by the
  opentelemetry crate. Requires the experimental_metrics_bound_instruments
  feature.
• Fixed a race in BatchSpanProcessor and BatchLogProcessor where a
  span/log enqueued just before force_flush() or shutdown() could be
  missed by the flush and dropped at shutdown: the pending-item counter is
  now incremented before enqueueing (and reverted if the queue is full), so
  the worker's counter snapshot can no longer under-count items already in
  the queue (#​3453).
• Default SDK Resource construction now falls back to unknown_service under
  Miri instead of calling std::env::current_exe(), avoiding an abort in Miri
  isolation mode while preserving the normal
  unknown_service:<process.executable.name> fallback outside Miri.
• Fixed asynchronous counters (ObservableCounter, ObservableUpDownCounter)
  using delta temporality reporting incorrect deltas when observed attributes
  were recorded in an unsorted key order.
• Breaking SpanProcessor::on_end now takes FinishedSpan<'_> by value instead of SpanData.
  • Completed spans are inspected via FinishedSpan::span_data(&self) -> &SpanData.
  • Processors taking ownership call FinishedSpan::into_owned(self) -> SpanData. The last registered processor receives an owned wrapper and can move the data by calling into_owned(); earlier processors receive a borrowed wrapper and clone on into_owned().
  • Live Span instances provide clone-free inherent read methods (parent_span_id, span_kind, name, start_time, attributes, dropped_attributes_count, events, dropped_events_count, links, dropped_links_count, status, instrumentation_scope), while context is accessed via Span::span_context().
  • Custom span processors should update on_end(&self, span: FinishedSpan<'_>), use span.span_data() for read-only access, and call span.into_owned() only when they need an owned SpanData.
    Supersedes #​2962.
    Relates to #​2940,
    #​2726,
    #​2939.
• Fix Span::end_with_timestamp preserving explicit end times even when equal to start time,
  instead of silently overwriting with the current time.

rust-lang/regex (regex)

v1.13.1

Compare Source

===================
This is a release that fixes a bug where incorrect regex match offsets could be
reported. Note that this doesn't impact whether a match occurs or not, just
where it occurs. The match offsets are still valid for slicing, they just may
not refer to the correct leftmost-first match. See
#​1364 for (many) more details.

Bug fixes:

• #​1354:
  Fixes previously unsound reverse suffix and inner optimizations.

v1.13.0

Compare Source

===================
This release includes a new API, a regex! macro, for lazy compilation of
a regex from a string literal. If you use regexes a lot, it's likely you've
already written one exactly like it. The new macro can be used like this:

use regex::regex;

fn is_match(line: &str) -> bool {
    // The regex will be compiled approximately once and reused automatically.
    // This avoids the footgun of using `Regex::new` here, which would
    // guarantee that it would be compiled every time this routine is called.
    // This would likely make this routine much slower than it needs to be.
    regex!(r"bar|baz").is_match(line)
}

let hay = "\
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";

let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #​709:
  Add a new regex! macro for efficient and automatic reuse of a compiled regex.

v1.12.4

Compare Source

===================
This release includes a performance optimization for compilation of regexes
with very large character classes.

Improvements:

• #​1308:
  Avoid re-canonicalizing the entire interval set when pushing new class ranges.

v1.12.3

Compare Source

===================
This release excludes some unnecessary things from the archive published to
crates.io. Specifically, fuzzing data and various shell scripts are now
excluded. If you run into problems, please file an issue.

Improvements:

• #​1319:
  Switch from a Cargo exclude list to an include list, and exclude some
  unnecessary stuff.

famedly/rust-telemetry (rust-telemetry)

v1.4.1

Compare Source

Documentation

• Fix typo in README

Miscellaneous Tasks

• Bump engineering-standards
• Update webpki root certs for VUL-29

Refactor

• Use typed interfaces for generating EnvFilters from config

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

serde-rs/json (serde_json)

v1.0.154

Compare Source

• Support preserve_order in no_std builds (#​1333, thanks @​razmser)

v1.0.153

Compare Source

• Report invalid UTF-8 at the first bad byte (#​1345, thanks @​00200200)

v1.0.152

Compare Source

• Preserve sign of -0 in arbitrary_precision mode (#​1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#​1347, thanks @​yuxi-liu-wired)

v1.0.151

Compare Source

• Add RawValue::from_string_unchecked (#​1331, thanks @​WonderLawrence)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

time-rs/time (time)

v0.3.55

Compare Source

Fixed

• Avoid underflow in DateIter::nth, ensuring correct behavior.
• Avoid overflow when deserializing timestamps.
• Handle out-of-bounds data when deserializing.
• Don't assume that the format being deserialized was generated by the serializer; this previously
  led to some valid values being parsed incorrectly and others being rejected.
• No longer silence errors when deserializing UtcOffset.
• OffsetDateTime::from_unix_timestamp_nanos and UtcDateTime::from_unix_timestamp_nanos correctly
  return None for all out-of-range values, rather than unexpectedly panicking in some situations.
• OffsetDateTime::checked_to_offset and UtcDateTime::checked_to_offset correctly return None
  for all out-of-range values, rather than unexpectedly panicking in some situations.

v0.3.54

Compare Source

Added

• PrimitiveDateTime has been renamed to PlainDateTime.
• Duration has been renamed to SignedDuration.
• Iteration is now possible over Date, Month, and Weekday. Relevant iterator methods have been
  overridden to ensure maximum performance.

For both PlainDateTime and SignedDuration, a non-deprecated type alias has been added for
backwards compatibility. The new names should be preferred.

Changed

• The associated metadata type (for powerfmt implementations) for various types has been changed
  to () and made public. This guarantees that no additional metadata will be present.

Performance

• More gains when parsing RFC 2822.

v0.3.53

Compare Source

There are no publicly-facing changes in this release. It solely works around the cookie crate
relying on an implementation detail of time that was never part of the public API (and thus
subject to semver guarantees). The internal API has been reverted to the extent necessary for
cookie to compile. This measure is temporary; the internal change will be re-applied in an
yet-to-be-determined future release.

v0.3.52

Compare Source

Fixed

• Subsecond values in the time! macro are parsed using the textual representation, ensuring
  accuracy. Previously, they were parsed using the floating point representation, which could result
  in a loss of precision and even invalid values.
• The date! macro could previously create an invalid value that would then panic at compile time.
  The macro now emits a proper error instead.
• When parsing an invalid format description, an edge case would inadvertently panic. This now
  returns an error as intended.

Added

• Support default values when parsing

v0.3.51

Compare Source

Fixed

• time compiles with macros enabled. This version is otherwise identical to v0.3.50.

v0.3.50

Compare Source

Fixed

• time compiles with macros enabled. This version is otherwise identical to v0.3.50.

v0.3.49

Compare Source

Fixed

• Due to a long-standing bug in the Rust compiler, v0.3.48 caused a number of crates to stop
  compiling. A patch has been added that avoids triggering the bug.

v0.3.48

Compare Source

This version was yanked due to a bug in the Rust compiler.

Security

• The number of digits parsed by [subsecond digits:1+] is capped at 32 to avoid parsing unbounded
  user input. Digits after the 9^th have no semantic meaning.
• Explicitly specify #[repr] for Weekday. The value of the variants is relied upon in multiple
  locations for soundness. The practical effect of this change is nothing, as Rust has always mapped
  C-like enums to 0..N in memory.

Compatibility

• Non-UTF-8 formatting and parsing is deprecated without replacement. It is recommended to only
  format and parse valid UTF-8.
• format_description::parse is deprecated. It is recommended to use
  format_description::parse_borrowed::<3> or format_description::parse_owned::<3>.

Added

• All types in the unit module have a generic parameter, though this is currently not used for
  much. Usage will be expanded in the future.
• Comparisons between types in the unit module and the generic Unit type are permitted.
• Support for rand 0.10
• Version 3 format descriptions
  • Only UTF-8 is supported. As a side effect of this, [ignore] requires that the remaining input
    not begin mid-codepoint.
  • Representation is deliberately opaque to allow for arbitrary changes going forward.
  • format:false is supported on [optional] components. This is not possible in version 1 and
    version 2 format descriptions due to API compatibility.
  • The time::serde::format_description! macro uses a new, clearer syntax for version 3.
    • time::serde::format_description!(mod foo [Date] = "[year]-[month]-[day]");
    • Unlike version 1 and version 2 format descriptions, the type is not automatically brought into
      scope. You must import it yourself.
  • Nonsensical combinations of modifiers are rejected. For example, you cannot specify
    case-sensitivity when parsing a numerical month.
  • [year] defaults to range:standard
  • Components and modifiers are case sensitive (and always lowercase).

Changed

• The convert module has been renamed to unit.

Fixed

• Macro hygiene has been improved by specifying re-exports.
• Fix handling of T in ISO 8601
• Support parsing the full range of UTC offset hours
• Version 1 nested format descriptions may now start with a component. Previously, a lexer bug
  unintentionally prohibited this.
• Error when ISO week date overflows the max year. This would previously panic.
• Error when padding is specified in strftime format descriptions but the component is not. This
  would previously panic.

Performance

Huge performance gains across multiple areas, including:

• optimizing equality checks for Duration
• optimizing Display impls for all major types
• optimizing the formatting of components and well-known formats
• precomputing metadata when formatting, reducing allocations
• adding fast path for typical RFC 2822 usage
• optimizing strftime parsing
• refactoring format description parsing

Depending on the area, gains range from 3× to even 11×.

tokio-rs/tokio (tokio)

v1.54.1: Tokio v1.54.1

Compare Source

1.54.1 (October 21st, 2026)

Fixed

• time: revert "remove the runtime handle from timers" (#​8692)

v1.54.0: Tokio v1.54.0

Compare Source

1.54.0 (October 19th, 2026)

The 1.54.0 release includes all changes up to 1.53.3.

The MSRV is increased to 1.85. (#​8514)

Added

• fs: add File::set_times, File::set_modified, and fs::FileTimes (#​8504)
• net: implement Default for named_pipe::{ClientOptions, ServerOptions} (#​8378)
• runtime: add Builder::max_io_events_per_busy_tick (#​8410)
• runtime: stabilize tokio::runtime::worker_index() (#​8431)
• sync: add SemaphorePermit::semaphore() (#​8482)
• sync: add blocking_acquire methods to Semaphore (#​8269)
• sync: add watch::Receiver::is_closed (#​8481)
• wasm: support JSPI for Emscripten target (#​8285, #​8627)
• wasm: support the wasm32-unknown-emscripten target (#​8281, #​8422, #​8528, #​8628)

Changed

• fs: reject zero in File::set_max_buf_size (#​8449)
• io: make copy_buf cooperative (#​8459)
• io: panic when BufReader or BufStream is created with zero capacity (#​8494)
• io: panic when in-memory pipe is created with zero capacity (#​8397)
• io: reject zero buffer size in copy_bidirectional_with_sizes (#​8454)
• io: support vectored writes in Sink (#​8663)
• net: start UnixStream::pair and UnixDatagram::pair sockets as writable (#​8444)
• net: start accepted sockets as readable and writable (#​8435)
• net: support UCred on Fuchsia (#​8257)
• process: use mio::unix::pipe for Unix child stdio (#​8603)
• runtime: cache-pad the shared injection queue and idle state (#​8622)
• runtime: decide auto-boxing of spawned futures at monomorphization time (#​8414)
• runtime: make enable_io available whenever rt is enabled (#​8387)
• runtime: move block_in_place setup into a non-generic function (#​8315)
• runtime: move the multi-thread inject queue to its own mutex (#​8382)
• runtime: panic when max_io_events_per_tick is zero (#​8476)
• runtime: suggest .await in nested block_on panic message (#​8501)
• sync: avoid atomic reader count in broadcast slots (#​8357)
• sync: use acquire/release orderings in Notify (#​8325)
• time: remove the runtime handle from timers (#​8458)

Fixed

• fs: restore File internal state when op fails (#​8291)
• io: complete zero-length memory stream operations immediately (#​8323)
• io: flush the writer when the reader stalls in copy_buf (#​8424)
• io: keep the shutdown bit when clearing readiness (#​8435)
• io: preserve the full ScheduledIo tick in readiness events (#​8331)
• io: read lines as bytes so a partial line survives an I/O error (#​8400)
• io: retry on ErrorKind::Interrupted in more I/O operations (#​8417, #​8432, #​8448, #​8453, #​8455, #​8460)
• io: use spawn_mandatory_blocking for stdout and stderr (#​8506)
• io: wait for pending operations before BufReader seeks (#​8599)
• net: close CreateFileW handle on SetNamedPipeHandleState failure (#​8418)
• net: fix peer credentials on NetBSD (#​8589)
• net: saturate TcpSocket and UnixSocket listen backlog (#​8511)
• net: treat ENOTCONN as success in UnixStream::shutdown (#​8526)
• runtime: allow building with --all-features without tokio_unstable (#​8401)
• runtime: avoid overflow in shutdown_timeout() (#​8497)
• runtime: fix spawn_blocking hang when only scheduler workers exist (#​8408)
• runtime: fix misleading signal driver panic message (#​8419)
• sync: preserve FIFO lock order when coop budget is exhausted (#​8371)
• sync: use usize for permit count in SemaphorePermit (#​8405)
• time: avoid interval deadline overflow (#​8385)
• time: handle wrapped top-level timer-wheel slots (#​8334)

Unstable

• fs: fall back when io_uring has no IO driver (#​8165)
• metrics: cap log histogram precision (#​8496)
• runtime: add an opt-in sharded spawn_blocking queue (#​8337)
• runtime: expose schedule latency in task hooks (#​8282)
• taskdump: fix idle bookkeeping when a task dump wakes parked workers (#​8372)
• taskdump: skip non-idle tasks during taskdumps (#​8568)

Documented

• docs: fix stray braces and broken links in rustdoc (#​8605)
• fs: document cancellation behavior of tokio::fs (#​8265)
• net: add Safety docs for named pipe from_raw_handle (#​8378)
• net: document that TcpStream::connect returns only the last error (#​8421)
• runtime: add error documentation for runtime::Builder (#​8297)
• runtime: link available_parallelism in worker count docs (#​8625)
• sync: clarify panic behavior of broadcast::channel() (#​8420)
• sync: fix typo in Semaphore documentation (#​8521)

v1.53.3: Tokio v1.53.3

Compare Source

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#​8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#​8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#​8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#​8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#​8595)
• sync: wake waiters outside the lock when closing a semaphore (#​8529)
• test: fix several flaky tests (#​8196, #​8427, #​8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#​8185)

v1.53.2: Tokio v1.53.2

Compare Source

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#​8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#​8540)
• process: unregister Windows wait before closing child handle (#​8564)
• rt: drop blocking pool mutex before shutting down rejected task (#​8562)
• sync: fix mpsc index wraparound in block reclamation (#​8546)
• sync: forget mpsc Permit before sending value (#​8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#​8548)
• sync: wake broadcast Sender::closed outside mutex (#​8558)
• task: drop replaced waker outside lock in JoinSet (#​8554)
• time: drop timer lock before dropping waker in clear_entry (#​8552)
• time: expire timers directly on shutdown without rotating wheel (#​8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#​8572)
• rt: ignore current_thread task dumps from other runtimes (#​8544)
• rt: preserve io_uring context if a completion waker panics (#​8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#​8542)
• taskdump: restore deferred leaf wakes during capture (#​8445)
• time: drop stored waker when cancelling alt timer entry (#​8550)

v1.53.1: Tokio v1.53.1

Compare Source

1.53.1 (July 20th, 2026)

Fixed

• signal: restore MSRV by removing OnceLock::wait from the Windows handler ([#​8300])

Fixed (unstable)

• time: fix alt timer cancellation and insertion race (#​8252)

Documented

• runtime: remove dead link definition in Runtime::block_on ([#​8301])

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.13%. Comparing base (2c2d090) to head (a3c87ee).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #202   +/-   ##
=======================================
  Coverage   89.13%   89.13%           
=======================================
  Files           9        9           
  Lines         598      598           
=======================================
  Hits          533      533           
  Misses         65       65           

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2c2d090...a3c87ee. Read the comment docs.

[cursor]

PR Summary

Medium Risk
Moderate risk from OpenTelemetry 0.32 and tower-http 0.7 breaking changes affecting tracing/metrics and HTTP middleware, plus a mixed opentelemetry_sdk 0.31 / opentelemetry 0.32 pairing that should be validated with a full build and integration tests.

Overview
Renovate-driven dependency refresh in Cargo.toml and Cargo.lock, with no application source changes in this diff.

Telemetry / metrics: bumps opentelemetry to 0.32.0 and opentelemetry-prometheus to 0.32, and raises axum-tracing-opentelemetry to 0.38.0 (aligned with OpenTelemetry 0.32). The service still wires OtelAxumLayer, Prometheus metrics, and rust_telemetry::init_otel in src/api.rs / src/main.rs; behavior should match the new OTel stack after compile/test.

HTTP middleware: upgrades tower-http to 0.7.0 while keeping catch-panic and normalize-path (used via CatchPanicLayer and NormalizePathLayer on the Axum router).

Lockfile: large transitive updates (e.g. tokio, futures, reqwest, tonic/prost, tracing-opentelemetry) pulled in by the above and other pinned crates.

^{Reviewed by Cursor Bugbot for commit c4f01b9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Prometheus scope labels expanded

Medium Severity

Issue: opentelemetry-prometheus 0.33 now emits otel_scope_version and otel_scope_schema_url on metric points by default. Scrapes and the exact-match golden files only expect otel_scope_name.
Fix: Call scope_info_enabled(false) on the exporter, or update fixtures and scrape matchers for the new labels.

 

^{Reviewed by Cursor Bugbot for commit 3839bd1. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 817bd6b. Configure here.}

[cursor]

Split OpenTelemetry versions break tracing

Medium Severity

Issue: Bumping axum-tracing-opentelemetry to 0.42 and opentelemetry to 0.33 while leaving rust-telemetry 1.4.0 on OpenTelemetry 0.32 compiles two opentelemetry::global states. OtelAxumLayer stores parent context as a 0.33 Context that init_otel's 0.32 OpenTelemetryLayer cannot downcast, so incoming traceparent headers no longer attach to exported spans.

Fix: Keep these crates on 0.32 until rust-telemetry supports OpenTelemetry 0.33, then upgrade them together.

 

^{Reviewed by Cursor Bugbot for commit 817bd6b. Configure here.}