[wchwawa]

TLDR

Six Dependabot updates were open, and two of them could not merge on their own. etcd-client 0.21 broke the Linux wheel and Docker image builds, and pyo3 0.30 failed the deny-warnings build. This PR takes all six together with the build fixes they need.

Problem

This is a dependency chore, so it has no issue; the template exempts dependency chores. It supersedes #537, #538, #539, #540, #541, and #542, which I will close once this merges. main requires an up-to-date branch and eight passing checks, so merging them one at a time would cost a rebase and a full CI run each.

Two of the updates also fail by themselves:

• etcd-client 0.21 compiles proto3 files that use optional fields and import the protobuf well-known types. The manylinux build installs AlmaLinux 8's protoc 3.5, which rejects both. The Docker image installs Debian's protobuf-compiler without the well-known .proto files.
• pyo3 0.30 makes #[pyclass(skip_from_py_object)] the default and deprecates the option. The workspace denies warnings.

Consequences

Taking etcd-client 0.21 without the build fixes would break the required manylinux wheel builds and installs check, the Python SDK release workflow, and the Docker image. Leaving the updates open keeps six stale PRs in the queue, and each new main commit makes them rebase again.

Example

Before: the wheel job of #542 stops with "Explicit 'optional' labels are disallowed in the Proto3 syntax" and "google/protobuf/descriptor.proto: File not found".

After: the wheel build installs protoc 36.2 and compiles etcd-client 0.21.1.

Solution

Dependency	From	To	Notes
serde_json	1.0.151	1.0.154	lockfile only
sha2	0.11.0	0.11.1	lockfile only
tokio	1.53.2	1.53.3	lockfile only
etcd-client	0.20.0	0.21.1	needs a newer protoc in the wheel and image builds
pyo3	0.29.3	0.30.1	the two pyclasses drop the deprecated skip_from_py_object, whose behavior is now the default
actions/create-github-app-token	3.2.0	3.3.0	Homebrew tap PR step, pinned by commit

Both manylinux builds, the PR gate and the release, now download the official protoc 36.2 release and check it against a pinned SHA-256. They no longer install AlmaLinux 8's package, which also drops the EPEL mirror that failed the wheel job of #537. The Docker image adds libprotobuf-dev, which ships the well-known .proto files for Debian's protoc 3.21.

Gain

main takes six pending updates in one CI run. The wheel builds no longer depend on the distribution's protoc version or on the EPEL mirror.

Tradeoffs

The wheel builds download protoc from GitHub releases. Because the version and checksums are pinned, a protoc upgrade edits two workflows. opendal (#530 and #536) is not included, because it needs a code migration; it lands separately.

Validation

• Command and result: with Rust 1.99.1, cargo fmt --all -- --check is clean and cargo clippy --locked --workspace --all-targets -- -D warnings passes, so no pyo3 0.30 deprecation is left.
• Command and result: cargo test --locked -p nokv-control -p nokv-python: 82 passed, 0 failed, 10 ignored. The ignored tests need a live etcd or object store.
• Command and result: the pinned protoc-36.2-linux-x86_64.zip matches the SHA-256 in the workflows and contains bin/protoc plus the 19 well-known .proto files, including the descriptor.proto and struct.proto that etcd-client 0.21 imports.
• Command and result: python3 scripts/ci/pr_description.py --pull-request-json on this title and body passes.
• Not run locally: the full workspace tests, the manylinux wheel build with its pytest run, the Docker image, and actionlint (not installed here). CI runs the first three on this PR; the image job is not a required check.