From b52c264ae1c827b74a4c2f3b5b1d84afa49f7804 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 00:01:00 +0000
Subject: [PATCH] chore(deps): Update rust-dependencies

---
 Cargo.toml | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index cd3570e..ebd258a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -254,11 +254,11 @@ serde_json = { version = ">=1.0.149, <2", optional = true }
 uuid = { version = ">=1.10, <2", features = ["v4"], optional = true }
 
 # Git operations (for directory-config-git)
-git2 = { version = ">=0.20.0, <0.21", optional = true }
+git2 = { version = ">=0.20.0, <0.22", optional = true }
 
 # CEL expression evaluation
 # Renamed from cel-interpreter — same project, same maintainers, near-identical API.
-cel = { version = ">=0.13, <0.14", features = ["json"], optional = true }
+cel = { version = ">=0.13, <0.15", features = ["json"], optional = true }
 
 # CLI framework
 clap = { version = ">=4.5, <5", features = ["derive", "env"], optional = true }
@@ -273,10 +273,10 @@ tracing-throttle = { version = ">=0.4.2, <0.5", default-features = false, option
 # Held at 0.31 because tracing-opentelemetry 0.32.1 (latest) only supports
 # otel 0.31. Bump once tracing-opentelemetry ships a release compatible
 # with otel 0.32+.
-opentelemetry = { version = ">=0.31.0, <0.32", optional = true }
+opentelemetry = { version = ">=0.31.0, <0.33", optional = true }
 opentelemetry_sdk = { version = ">=0.31.0, <0.32", features = ["rt-tokio"], optional = true }
-opentelemetry-otlp = { version = ">=0.31.0, <0.32", features = ["grpc-tonic", "http-proto", "metrics", "logs"], optional = true }
-tracing-opentelemetry = { version = ">=0.32.1, <0.33", optional = true }
+opentelemetry-otlp = { version = ">=0.31.0, <0.33", features = ["grpc-tonic", "http-proto", "metrics", "logs"], optional = true }
+tracing-opentelemetry = { version = ">=0.32.1, <0.34", optional = true }
 
 # Metrics (Prometheus-native)
 metrics = { version = ">=0.24.5, <0.25", optional = true }
@@ -326,7 +326,7 @@ moka = { version = ">=0.12, <0.13", features = ["future"], optional = true }
 # HTTP server (axum)
 axum = { version = ">=0.8.8, <0.9", optional = true }
 tower = { version = ">=0.5.3, <0.6", features = ["limit"], optional = true }
-tower-http = { version = ">=0.6.8, <0.7", features = ["timeout", "trace"], optional = true }
+tower-http = { version = ">=0.6.8, <0.8", features = ["timeout", "trace"], optional = true }
 
 # Async (for transport)
 chrono = { version = ">=0.4.43, <0.5", optional = true }
@@ -370,7 +370,7 @@ yaque = { version = ">=0.6.6, <0.7", optional = true }
 zstd = { version = ">=0.13.3, <0.14", optional = true }
 
 # TieredSink compression codecs
-lz4_flex = { version = ">=0.11, <0.14", optional = true }
+lz4_flex = { version = ">=0.11, <0.15", optional = true }
 snap = { version = ">=1.1.1, <2", optional = true }
 
 # SIMD JSON (BatchEngine — 2-4x faster than serde_json)
@@ -387,24 +387,24 @@ memchr = { version = ">=2.7", optional = true }
 async-trait = { version = ">=0.1.88, <0.2", optional = true }
 
 # PostgreSQL (for config-postgres)
-sqlx = { version = ">=0.8, <0.9", features = ["runtime-tokio", "tls-rustls-ring-webpki", "postgres", "json"], optional = true }
+sqlx = { version = ">=0.8, <0.10", features = ["runtime-tokio", "tls-rustls-ring-webpki", "postgres", "json"], optional = true }
 
 # Secrets management
 parking_lot = { version = ">=0.12.3, <0.13", optional = true }
 
 # Data parallelism (CPU-bound work distribution for worker pool)
 rayon = { version = ">=1.10, <2", optional = true }
-base64 = { version = ">=0.22, <0.23", optional = true }
+base64 = { version = ">=0.22, <0.24", optional = true }
 
 # AEAD for at-rest encryption of the secrets disk cache. Gated by
 # the `secrets` feature; consumers without it pay nothing. AES-256-
 # GCM picked because AES-NI gives sub-microsecond seal/open on
 # modern x86, and the RustCrypto AEAD traits are well-vetted +
 # FIPS-friendly.
-aes-gcm = { version = "0.10", optional = true }
-hkdf = { version = "0.12", optional = true }
-sha2 = { version = "0.10", optional = true }
-rand_core = { version = "0.6", features = ["std"], optional = true }
+aes-gcm = { version = "0.11", optional = true }
+hkdf = { version = "0.13", optional = true }
+sha2 = { version = "0.11", optional = true }
+rand_core = { version = "0.10", features = ["std"], optional = true }
 
 # Zero-copy byte buffers (BatchEngine)
 bytes = { version = ">=1.10, <2", optional = true }
@@ -440,7 +440,7 @@ criterion = { version = ">=0.5, <0.9", features = ["html_reports"] }
 pretty_assertions = ">=1.4.1, <2"
 temp-env = ">=0.3.6, <0.4"
 async-trait = ">=0.1.88, <0.2"
-git2 = ">=0.20.0, <0.21"
+git2 = ">=0.20.0, <0.22"
 # Generate self-signed certs in-process for the `tls` module's unit tests
 # (no checked-in PEM fixtures to rot). Web-checked 2026-06-03.
 rcgen = ">=0.14.7, <0.15"