chore(deps): update rust deps

Author: renovate[bot]

Cargo.lock

@@ -76,97 +76,97 @@ tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git",
 tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.74.0" }
 
 # Web framework
-axum = { version = "0.8", features = ["macros", "ws"] }
-tower = "0.5"
-tower-http = { version = "0.7", features = [
+axum = { version = "0.8.9", features = ["macros", "ws"] }
+tower = "0.5.3"
+tower-http = { version = "0.7.1", features = [
     "cors", "trace", "compression-gzip", "request-id",
     "limit", "timeout", "catch-panic", "sensitive-headers", "set-header",
 ] }
-tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync", "io-util", "signal"] }
+tokio = { version = "1.53.3", features = ["rt-multi-thread", "macros", "net", "time", "sync", "io-util", "signal"] }
 
 # Database
 sqlx = { version = "0.9", features = ["runtime-tokio", "postgres", "uuid", "chrono", "json", "migrate", "rust_decimal"] }
-rust_decimal = { version = "1", features = ["serde", "serde-with-str"] }
-clickhouse = { version = "0.15", features = ["time", "chrono"] }
+rust_decimal = { version = "1.43.0", features = ["serde", "serde-with-str"] }
+clickhouse = { version = "0.15.3", features = ["time", "chrono"] }
 
 # Redis
 # `enable-rustls` gives fred its rustls connector, for `rediss://` URLs.
 # The connector itself is built in `think_watch_common::redis_config`
 # with the same TLS stack the HTTP client uses (below): rustls on
 # aws-lc-rs, the platform's roots through rustls-platform-verifier. No
 # OpenSSL anywhere, so the static musl image needs nothing new.
-fred = { version = "10", features = ["subscriber-client", "i-scripts", "enable-rustls"] }
-rustls = { version = "0.23", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
-rustls-platform-verifier = "0.7"
+fred = { version = "10.1.0", features = ["subscriber-client", "i-scripts", "enable-rustls"] }
+rustls = { version = "0.23.45", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
+rustls-platform-verifier = "0.7.1"
 
 # Auth
 # Crypto-critical crates are pinned with `=` so a silent minor-release
 # change (e.g. a JWT lib's validation-default flip) can't sneak in via
 # `cargo update`. Bumps are deliberate and reviewed.
 jsonwebtoken = { version = "=11.1.0", features = ["rust_crypto"] }
 argon2 = "=0.6.0"
-openidconnect = { version = "4", features = ["reqwest"] }
+openidconnect = { version = "4.0.1", features = ["reqwest"] }
 totp-rs = { version = "6", default-features = false, features = ["std", "gen_secret", "otpauth"] }
-data-encoding = "2"
+data-encoding = "2.11.1"
 
 # Serialization
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.154"
 
 # HTTP client (upstream proxy)
-reqwest = { version = "0.13", features = ["stream", "json", "rustls"] }
-hyper = { version = "1", features = ["full"] }
-hyper-util = "0.1"
-http-body-util = "0.1"
-bytes = "1"
+reqwest = { version = "0.13.5", features = ["stream", "json", "rustls"] }
+hyper = { version = "1.12.0", features = ["full"] }
+hyper-util = "0.1.21"
+http-body-util = "0.1.5"
+bytes = "1.12.1"
 
 # Async
-futures = "0.3"
-tokio-stream = "0.1"
-async-stream = "0.3"
+futures = "0.3.34"
+tokio-stream = "0.1.19"
+async-stream = "0.3.6"
 
 sha2 = "=0.11.0"
 sha1 = "=0.11.0"
 hmac = "=0.13.0"
 p256 = { version = "=0.14.0", features = ["ecdsa"] }
 ecdsa = { version = "=0.17.0", features = ["algorithm"] }
-rand = "0.10"
-hex = "0.4"
+rand = "0.10.3"
+hex = "0.4.3"
 # Crypto primitives are pinned exactly so a `cargo update` can never swap
 # a verification default underneath the at-rest envelope.
 aes-gcm = "=0.11.1"
 subtle = "=2.6.1"
-url = "2"
+url = "2.5.8"
 
 # Observability
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
-metrics = "0.24"
-metrics-exporter-prometheus = { version = "0.18", default-features = false }
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.23", features = ["env-filter", "json"] }
+metrics = "0.24.6"
+metrics-exporter-prometheus = { version = "0.18.3", default-features = false }
 
 # Config
-dotenvy = "0.15"
+dotenvy = "0.15.7"
 
 # API documentation
 utoipa = { version = "6", features = ["axum_extras", "uuid", "chrono"] }
-utoipa-swagger-ui = { version = "10", features = ["axum"] }
+utoipa-swagger-ui = { version = "10.0.1", features = ["axum"] }
 
 # AWS SigV4 for the S3-compatible body store. Bedrock's signing,
 # eventstream unframing and model catalog come from tw-bedrock.
 # NOTE: "hardcoded-credentials" is the AWS SDK feature name for constructing
 # Credentials from explicit access_key/secret_key values (as opposed to the
 # default credential chain). This does NOT embed credentials in the binary —
 # they are loaded at runtime from encrypted configuration.
-aws-sigv4 = "1"
-aws-credential-types = { version = "1", features = ["hardcoded-credentials"] }
+aws-sigv4 = "1.6.0"
+aws-credential-types = { version = "1.3.0", features = ["hardcoded-credentials"] }
 
 # Utils
-arc-swap = "1"
-xxhash-rust = { version = "0.8", features = ["xxh3"] }
-uuid = { version = "1", features = ["v4", "v5", "serde"] }
-chrono = { version = "0.4", features = ["serde"] }
-thiserror = "2"
-anyhow = "1"
+arc-swap = "1.9.2"
+xxhash-rust = { version = "0.8.19", features = ["xxh3"] }
+uuid = { version = "1.28.0", features = ["v4", "v5", "serde"] }
+chrono = { version = "0.4.45", features = ["serde"] }
+thiserror = "2.0.21"
+anyhow = "1.0.104"
 
 # Workspace crates
 think-watch-common = { path = "crates/common" }

Cargo.toml

@@ -24,7 +24,7 @@ axum = { workspace = true }
 sqlx = { workspace = true }
 openidconnect = { workspace = true }
 reqwest = { workspace = true }
-serde_urlencoded = "0.7"
+serde_urlencoded = "0.7.1"
 tokio = { workspace = true }
 totp-rs = { workspace = true }
 data-encoding = { workspace = true }

crates/auth/Cargo.toml

@@ -46,5 +46,5 @@ url = { workspace = true }
 # against any S3-compatible backend including RustFS / MinIO / AWS S3).
 aws-sigv4 = { workspace = true }
 aws-credential-types = { workspace = true }
-http_1x = { package = "http", version = "1" }
-async-trait = "0.1"
+http_1x = { package = "http", version = "1.5.0" }
+async-trait = "0.1.92"

crates/common/Cargo.toml

@@ -15,7 +15,7 @@ reqwest = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }
 http-body-util = { workspace = true }
-bytes = "1"
+bytes = "1.12.1"
 axum = { workspace = true }
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
@@ -31,12 +31,12 @@ tracing = { workspace = true }
 fred = { workspace = true }
 utoipa = { workspace = true }
 # sha2 removed — cache now uses xxhash; HMAC signing uses hmac crate in server
-regex = "1"
+regex = "1.13.1"
 rand = { workspace = true }
 metrics = { workspace = true }
 xxhash-rust = { workspace = true }
 arc-swap = { workspace = true }
 rust_decimal = { workspace = true }
 
 [dev-dependencies]
-http_1x = { package = "http", version = "1" }
+http_1x = { package = "http", version = "1.5.0" }

crates/gateway/Cargo.toml

@@ -13,7 +13,7 @@ tokio = { workspace = true }
 reqwest = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_urlencoded = "0.7"
+serde_urlencoded = "0.7.1"
 uuid = { workspace = true }
 chrono = { workspace = true }
 thiserror = { workspace = true }

crates/mcp-gateway/Cargo.toml

@@ -47,15 +47,15 @@ p256 = { workspace = true }
 ecdsa = { workspace = true }
 rand = { workspace = true }
 data-encoding = { workspace = true }
-serde_urlencoded = "0.7"
+serde_urlencoded = "0.7.1"
 subtle = { workspace = true }
 url = { workspace = true }
 metrics = { workspace = true }
 metrics-exporter-prometheus = { workspace = true }
-regex = "1"
+regex = "1.13.1"
 arc-swap = { workspace = true }
 clickhouse = { workspace = true }
 
 [dev-dependencies]
-wiremock = "0.6"
+wiremock = "0.6.5"
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

crates/server/Cargo.toml

@@ -20,7 +20,7 @@ think-watch-auth = { workspace = true }
 think-watch-gateway = { workspace = true }
 think-watch-mcp-gateway = { workspace = true }
 
-async-trait = "0.1"
+async-trait = "0.1.92"
 axum = { workspace = true }
 tokio = { workspace = true }
 tower = { workspace = true }
@@ -45,8 +45,8 @@ ecdsa = { workspace = true }
 rand = { workspace = true }
 url = { workspace = true }
 clickhouse = { workspace = true }
-once_cell = "1"
-wiremock = "0.6"
+once_cell = "1.21.4"
+wiremock = "0.6.5"
 tokio-tungstenite = "0.30"
 futures = { workspace = true }
 async-stream = { workspace = true }