build(deps): Bump the cargo-minor-patch group across 1 directory with 10 updates

[dependabot]

Bumps the cargo-minor-patch group with 10 updates in the / directory:

Package	From	To
arc-swap	1.9.1	1.9.2
aws-lc-rs	1.17.0	1.17.3
bytes	1.12.0	1.12.1
clap	4.6.1	4.6.2
ryu-js	1.0.2	1.0.3
time	0.3.51	0.3.53
tokio	1.52.3	1.53.0
toml	1.1.2+spec-1.1.0	1.1.3+spec-1.1.0
uuid	1.23.4	1.24.0
regex	1.12.4	1.13.1

Updates arc-swap from 1.9.1 to 1.9.2

Changelog

Sourced from arc-swap's changelog.

1.9.2

• Document RefCnt must not panic (#208).

Commits

• See full diff in compare view

Updates aws-lc-rs from 1.17.0 to 1.17.3

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.3

What's Changed

• Add public API to check AWS-LC and FIPS versions by @​prasden in aws/aws-lc-rs#1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @​Mark-Simulacrum in aws/aws-lc-rs#1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @​justsmth in aws/aws-lc-rs#1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @​justsmth in aws/aws-lc-rs#1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- aws/aws-lc-rs#1166
• memcmp probe fails under RPM hardened build flags -- aws/aws-lc-rs#1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- aws/aws-lc-rs#1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @​justsmth in aws/aws-lc-rs#1172
• ci: only run push-triggered workflows on main by @​justsmth in aws/aws-lc-rs#1163
• Prepare aws-lc-sys v0.43.0 by @​justsmth in aws/aws-lc-rs#1176
• Prepare aws-lc-rs v1.17.2 by @​justsmth in aws/aws-lc-rs#1178
• Prepare aws-lc-fips-sys v0.13.16 by @​justsmth in aws/aws-lc-rs#1180
• build(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in aws/aws-lc-rs#1177

New Contributors

• @​Mark-Simulacrum made their first contribution in aws/aws-lc-rs#1174
• @​prasden made their first contribution in aws/aws-lc-rs#1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE] aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

aws-lc-rs v1.17.1

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

• [Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) (static)
• [Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

• In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

• Support linking against a system-installed AWS-LC:

... (truncated)

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• Additional commits viewable in compare view

Updates bytes from 1.12.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

Commits

• 76c0fbb Release bytes v1.12.1 (#838)
• 924c82b Handle unwinding from Box::new (#837)
• See full diff in compare view

Updates clap from 4.6.1 to 4.6.2

Release notes

Sourced from clap's releases.

v4.6.2

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Commits

• 0fe0be3 chore: Release
• 480af9d docs: Update changelog
• 2b3ddd0 Merge pull request #6340 from liskin/fix-completion-escape
• 7ffe739 fix(complete): Do not suggest options after "--"
• d47fc4f test(complete): Options suggested after escape (--)
• See full diff in compare view

Updates ryu-js from 1.0.2 to 1.0.3

Release notes

Sourced from ryu-js's releases.

v1.0.3

Breaking Changes

• Minimum rust version has been bumped from 1.64.0 to 1.71.0.

Bug Fixes

• [BUG #56](boa-dev/ryu-js#2): Fix panic in format64_to_fixed when rounding carries past all integer digits. (@​Ansh-699)

Internal Improvements

• [INTERNAL #57](boa-dev/ryu-js#57): Sync upstream/main. (@​jedel1043)
• [INTERNAL #63](boa-dev/ryu-js#63): Make Cursor store unsigned integer len and index. (@​HalidOdat)

New Contributors

• @​Ansh-699 made their first contribution in boa-dev/ryu-js#56

Full Changelog: boa-dev/ryu-js@v1.0.2...v1.0.3

Changelog

Sourced from ryu-js's changelog.

# 1.0.3 (2026-07-05)

Breaking Changes

• Minimum rust version has been bumped from 1.64.0 to 1.71.0.

Bug Fixes

• [BUG #56](boa-dev/ryu-js#2): Fix panic in format64_to_fixed when rounding carries past all integer digits. (@​Ansh-699)

Internal Improvements

• [INTERNAL #57](boa-dev/ryu-js#57): Sync upstream/main. (@​jedel1043)
• [INTERNAL #63](boa-dev/ryu-js#63): Make Cursor store unsigned integer len and index. (@​HalidOdat)

Commits

• f8d6626 Release v1.0.3 (#64)
• 9a936cb Make Cursor store unsigned integer len and index (#63)
• 97e8180 Bump actions/cache from 4 to 6 (#62)
• 4beec89 Fix panic in format64_to_fixed when rounding carries past all integer digits ...
• 03bf0f3 Sync upstream/main (#57)
• See full diff in compare view

Updates time from 0.3.51 to 0.3.53

Release notes

Sourced from time's releases.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

• Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result in a loss of precision and even invalid values.
• The date! macro could previously create an invalid value that would then panic at compile time. The macro now emits a proper error instead.
• When parsing an invalid format description, an edge case would inadvertently panic. This now returns an error as intended.

Added

• Support default values when parsing

Commits

• 0ae2f84 v0.3.53 release
• cea8c96 Avoid issue with cookie crate temporarily
• 55e1f2b Require private type to properly seal traits
• 7cf4780 v0.3.52 release
• 0e5b04f Fix trusted publishing workflow
• 6e4140a Support default values when parsing
• 10ac36a Add more doctests to Timestamp
• 6b0d468 Restore lexer depth on the unclosed-bracket error path
• 0abc06d Add trusted publishing
• 43cf0c0 Preferentially group shards by target
• Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.53.0

Release notes

Sourced from tokio's releases.

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

• fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
• metrics: add task schedule latency metric (#7986)
• net: add SocketAddr methods to Unix sockets (#8144)

Changed

• io: add #[inline] to IO trait impls for in-memory types (#8242)
• net: implement UCred::pid on FreeBSD (#8086)
• net: support Nuttx target os (#8259)
• signal: refactor global variables on Windows (#8231)
• sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
• taskdump: support taskdumps on s390x (#8192)
• time: add #[track_caller] to timeout_at() (#8077)
• time: consolidate mutex locks on spurious poll (#8124)
• time: defer waker clone on spurious poll (#8107)
• time: move lazy-registration state into Sleep (#8132)
• tracing: remove unnecessary span clone (#8126)

Fixed

• io: do not treat zero-length reads as EOF in Chain (#8251)
• net: use getpeereid for QNX peer credentials (#8270)
• runtime: avoid illegal state in FastRand (#8078)
• sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
• taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
• time: avoid stack overflow in runtime constructor (#8093)
• time (alt timer): ensure timers stay in the same runtime after .reset() (#8169)

IO uring (unstable)

• fs: use io-uring for fs::try_exists (#8080)
• fs: use io-uring for renaming files (#7800)
• rt: flush io-uring CQE in case of CQE overflow (#8277)

Documented

• docs: clarify cancel safety wording (#8181)
• fs: clarify create_dir_all succeeds if path exists (#8149)
• io: add warning about stdout reordering with multiple handles (#8276)
• net: document pipe try_read*/try_write* readiness behavior (#8032)
• runtime: document interaction with fork() (#8202)
• sync: clarify broadcast lagging semantics (#8239)
• sync: document memory ordering guarantees for Semaphore (#8119)
• task: explain why yield_now defers its waker (#8254)
• time: add panic docs to timeout_at() (#8077)

... (truncated)

Commits

• be689a3 chore: prepare Tokio v1.53.0 (#8294)
• 50f76c7 chore: prepare tokio-macros v2.7.1 (#8295)
• f61fcca Merge 'tokio-1.52.4' into 'master' (#8290)
• efdba5f chore: prepare Tokio v1.52.4 (#8289)
• b0ba02e Merge 'tokio-1.51.4' into 'tokio-1.52.x' (#8288)
• 7bcd2d3 taskdump: remove crate disambiguators from output (#8288)
• f84b209 chore: prepare Tokio v1.51.4 (#8286)
• eacb98e runtime: don't skip the driver when before_park schedules work (#8222)
• 5e16ee0 task: avoid replacing the JoinQueue waker in try_join_next (#8279)
• 88212ab sync: document memory ordering guarantees for Semaphore (#8119)
• Additional commits viewable in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

• eb25160 chore: Release
• f36fb52 docs: Update changelog
• 3adbbb7 fix(writer): Don't overflow (#1189)
• fb0c1b3 fix(writer): Don't overflow
• 5e70a70 test(writer): Add overflow test
• 771a975 chore: Upgrade toml-test (#1186)
• 28f6c9c chore: Upgrade toml-test
• 30d75ca chore(deps): Update Prek to v0.4.9 (#1185)
• 17efe57 chore(deps): Update Rust Stable to v1.97 (#1184)
• c9d0d54 style: Make clippy happy
• Additional commits viewable in compare view

Updates uuid from 1.23.4 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

• feat(fmt): support encoding into MaybeUninit buffers by @​weifanglab in uuid-rs/uuid#892
• Prepare for 1.24.0 release by @​KodrAus in uuid-rs/uuid#896

New Contributors

• @​weifanglab made their first contribution in uuid-rs/uuid#892

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

• doc: Fix broken link by @​frostyplanet in uuid-rs/uuid#891
• perf: Optimize UUID hex parsing and formatting by @​geeknoid in uuid-rs/uuid#894
• Prepare for 1.23.5 release by @​KodrAus in uuid-rs/uuid#895

New Contributors

• @​geeknoid made their first contribution in uuid-rs/uuid#894

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

Commits

• 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
• e6db8ec prepare for 1.24.0 release
• 606f236 Merge pull request #892 from weifanglab/main
• ab848db feat(fmt): support encoding into MaybeUninit buffers
• 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
• 5a7dfe5 prepare for 1.23.5 release
• 9b4bfc8 Merge pull request #894 from geeknoid/main
• 5acc5a5 perf: Optimize UUID hex parsing and formatting
• 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
• 1e5d867 Merge pull request #891 from frostyplanet/doc
• Additional commits viewable in compare view

Updates regex from 1.12.4 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

• #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

Commits

• 2b52759 1.13.1, redux
• 40e9823 1.13.1
• 75fcb96 changelog: 1.13.1
• 64ad0b6 automata: fix bug in reverse suffix/inner optimization
• fa91c31 automata: fix a bug caught by Codex review
• 30390ec automata: formatting tweaks
• 821a8eb automata: refactor reverse suffix/inner search slightly
• 10afd70 automata: expose the extracted literals for inner literal extraction
• 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
• 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
• Additional commits viewable in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe5fae7429

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

The root /workspace/registry-stack/AGENTS.md says “Every commit needs a DCO sign-off: git commit -s,” but git log -1 --format=full 27079afe8d79a89f56af87f0cb43d36bf11e0205 has no Signed-off-by: trailer. In repositories that enforce DCO, this commit cannot merge as-is even though the lockfile change is mechanical, so please recreate or amend it with -s.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add security notes for the AWS-LC bump

The root /workspace/registry-stack/AGENTS.md requires explicit review notes for changes to signing or credential issuance; this lockfile line updates aws-lc-rs, which crates/registry-platform-crypto/src/lib.rs uses for RSA signing and crates/registry-notary-server/src/state_plane/sensitive.rs uses for AEAD/HMAC state protection. The commit body only carries Dependabot release notes, so reviewers lack the required repo-specific security note/validation for the affected crypto paths; please add that note before merging.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 67705826eb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

For this replacement commit, git log -1 --format='%(trailers)' 868cbfc1a63e07678aa2f63e207af2093befb8b5 is empty. I checked .github/workflows/dco.yml, and the PR workflow fails every commit in the PR range that lacks a Signed-off-by: ... <...> trailer, matching the root AGENTS.md DCO rule, so this commit cannot merge until it is recreated with git commit -s or an equivalent trailer.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Record security review for the AWS-LC bump

This bump changes aws-lc-rs/aws-lc-sys; I checked the current call sites and crates/registry-platform-crypto/src/lib.rs uses it for RSA signing/verification while crates/registry-notary-server/src/state_plane/sensitive.rs uses it for AES-GCM/HMAC state protection. The root AGENTS.md requires explicit review notes for signing, credential issuance, and audit-integrity-sensitive changes, but this 868cbfc commit message contains only upstream Dependabot release notes, so reviewers still lack the repo-specific security validation before merging.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Re-run the ryu-js vetting before bumping it

This changes the locked ryu-js version/checksum, but release/notes/dependency-vetting-ryu-js.md explicitly lists that as a review trigger and notes the crate feeds canonical JSON bytes used by crypto, manifests, hashes, signatures, and configuration artifacts. Without updating that vetting evidence or otherwise recording the repeat review against 1.0.3, this lockfile-only bump violates the documented control for a security-sensitive canonicalization dependency.

Useful? React with 👍 / 👎.