deps: Bump vgi-rpc from 0.21.0 to 0.21.1

[dependabot]

Bumps vgi-rpc from 0.21.0 to 0.21.1.

Release notes

Sourced from vgi-rpc's releases.

v0.21.1

Changed

• The logo is transparent. Both copies of the mark — assets/vgi-logo.png, which the crate READMEs link, and the data: URI inlined in the landing page vgi-rpc serves — were the old export on a white background with no alpha, so both wore a white rectangle wherever the page behind them was not white. Both are now cut from a committed master by scripts/regenerate_logo_assets.py. The inlined copy is palettized to 256 colours, which for flat artwork is visually indistinguishable from truecolour and holds the base64 compiled into every dependent binary at 20 KiB rather than 99 KiB.

No API or wire change; this is a patch.

Changelog

Sourced from vgi-rpc's changelog.

[0.21.1] — 2026-08-13

Changed

• The logo is transparent. Both copies of the mark — assets/vgi-logo.png, which the crate READMEs link, and the data: URI inlined in the landing page vgi-rpc serves — were the old export on a white background with no alpha, so both wore a white rectangle wherever the page behind them was not white. Both are now cut from a committed master by scripts/regenerate_logo_assets.py. The inlined copy is palettized to 256 colours, which for flat artwork is visually indistinguishable from truecolour and holds the base64 compiled into every dependent binary at 20 KiB rather than 99 KiB.

No API or wire change; this is a patch.

[0.20.0] — 2026-08-05

Added

• Access log: trace correlation. Records carry trace_id / span_id as W3C hex when a valid span is current. request_id only joins records within one service, so without these a log line and the span describing the same call cannot be matched. The ids are read from whatever span is current, via a provider installed with access_log::set_trace_context_provider, so an application-opened span correlates as readily as a framework-opened one — and so the core keeps no OpenTelemetry dependency (the otel feature is tracing-only). Ids that are not 32 / 16 lowercase hex, or are all zeroes, are dropped rather than emitted, and the pair is always emitted together or not at all.
• Access log: sampling. AccessLogHook::with_sample_rate(rate). Errors are never sampled — a rate below 1 exists because successes repeat, which failures do not. The decision is deterministic and keyed on stream_id, then request_id, so every record of one stream shares its init's fate rather than being shredded into fragments indistinguishable from data loss. Every kept record carries sample_rate, because a consumer scaling counts has to divide by it. An out-of-range rate is an error at construction, not at the first request.
• Access log: egress accounting. request_bytes (on-wire, before decompression), response_bytes (on-wire, after compression) and externalized_bytes (uploaded to external storage). Distinct from input_bytes / output_bytes, which measure logical Arrow buffers and can differ by a factor of a thousand on a compressible body. response_bytes cannot be measured where the others are — compression runs after the handler — so emission is deferred through a hooks::AccessSink that the HTTP post-processing middleware drains once the final body exists. A transport that installs no sink keeps logging inline.
• Access log: claim redaction. claims are now emitted, redacted by key (credentials plus the standard OIDC personal-data claims). Values are replaced rather than dropped, so which claims a credential carried stays answerable. AccessLogHook::with_claim_redactor replaces the policy;

... (truncated)

Commits

• a44c493 release: 0.21.1 — the logo is transparent
• 798d78b brand: reroll the logo from the new transparent master
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)