chore(deps): bump the cargo-patch-and-minor group with 4 updates

[dependabot]

Bumps the cargo-patch-and-minor group with 4 updates: rand, rmcp, sha3 and tower-http.

Updates rand from 0.8.6 to 0.8.8

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

• Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

[0.8.7] - 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1804)

#1804: rust-random/rand#1804

Commits

• 572d3b0 v0.8: fix no-std + serde1 build (#1825)
• 229f547 Prepare 0.8.8
• 1ad885e Add test + fix for feature serde1 without std
• 90ff85e rand v0.8.7: backport #1790 (#1804)
• See full diff in compare view

Updates rmcp from 1.7.0 to 1.8.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v1.8.0

Added

• deprecate roots, sampling, and logging (SEP-2577) (#884)

Fixed

• strip and validate tool outputSchema and inputSchema (#860)
• remove unnecessary fields from tools' inputSchema (#856)

Other

• refine mcpmate listing copy (#885)
• added jilebi-mcp to the list of built with rmcp (#861)

rmcp-v1.8.0

[!WARNING]

⚠️ Breaking Changes

Despite being a minor version bump, this release contains a source-breaking API change (it should have been 2.0.0). If you depend on rmcp = "1.7", Cargo will resolve to 1.8.0 automatically and your build may fail. Pin to =1.7.x if you are not ready to migrate.

Peer::peer_info() return type changed (#862):

- pub fn peer_info(&self) -> Option<&R::PeerInfo>
+ pub fn peer_info(&self) -> Option<Arc<R::PeerInfo>>

This was needed so peer info can be re-set on a duplicate initialize (it now lives behind an RwLock), which is why a borrow can no longer be returned.

Migration: field access still works through Arc's Deref. If you need the old &InitializeResult (e.g. you bound the type explicitly), use .as_deref():

// Before (1.7.x): info is &InitializeResult
let info: Option<&InitializeResult> = client.peer_info();
// After (1.8.0): info is Arc<InitializeResult>
let info: Option<Arc<InitializeResult>> = client.peer_info();
// To recover the old reference type:
let info: Option<&InitializeResult> = client.peer_info().as_deref();

Added

• standardize resource-not-found error code (SEP-2164) (#899)
• validate OAuth authorization response issuer (#896)
• specify OIDC application_type during dynamic client registration (SEP-837) (#883)
• deprecate roots, sampling, and logging (SEP-2577) (#884)

... (truncated)

Commits

• 2522036 chore: release v1.8.0 (#850)
• 6d020c9 fix(auth): preserve configured reqwest client (#917)
• de898dd Allow custom HTTP clients for OAuth (#908)
• 3c5ce2b fix(auth): align OAuth metadata discovery ordering (#887)
• 443677c fix: align progress timeout token (#909)
• 4fd4986 fix(elicitation): preserve enumNames through ElicitationSchema serde round-tr...
• bf71eb8 chore(deps): bump actions/checkout from 6 to 7 (#911)
• 5d00e20 Add progress-aware request timeout reset (#858)
• 4b82e41 docs(server): document Err vs Ok(CallToolResult::error) visibility contract o...
• 95a8e96 feat: standardize resource-not-found error code (SEP-2164) (#899)
• Additional commits viewable in compare view

Updates sha3 from 0.10.8 to 0.10.9

Commits

• 1637e89 Release sha3 v0.10.9 (#837)
• 1997abe sha3: backport fix of customized cshake initialization (#836)
• 82c36a4 sha2: add soft-compact backend (backport of #686) (#687)
• c1e85ae ci: remove pre-1.56 jobs and other fixes (#688)
• a667dd9 skein: fix implementation for output sizes not multiple of 8 (#682)
• 62b6ff1 Fix blake2 and ascon-hash CI (#521)
• f3b657c Expose belt_compress to public (#520)
• 9f66cb8 md4: Optimize compress to improve hash performance (#519)
• 70a2b62 Add simpler code snippet to the documentation (#515)
• e3ab257 Update Cargo.lock
• Additional commits viewable in compare view

Updates tower-http from 0.6.8 to 0.6.11

Release notes

Sourced from tower-http's releases.

tower-http-0.6.11

Added

• set-header: add SetMultipleResponseHeadersLayer and SetMultipleResponseHeader for setting multiple response headers at once. Supports overriding, appending, and if_not_present modes. Header values can be fixed or computed dynamically via closures (#672)

  use http::{Response, header::{self, HeaderValue}};
  use http_body::Body as _;
  use tower_http::set_header::response::SetMultipleResponseHeadersLayer;
  let layer = SetMultipleResponseHeadersLayer::overriding(vec![
  (header::X_FRAME_OPTIONS, HeaderValue::from_static("DENY")).into(),
  (header::CONTENT_LENGTH, |res: &Response<MyBody>| {
  res.body().size_hint().exact()
  .map(|size| HeaderValue::from_str(&size.to_string()).unwrap())
  }).into(),
  ]);

• set-header: add SetMultipleRequestHeadersLayer and SetMultipleRequestHeaders for setting multiple request headers at once, mirroring the response-side API (#677)

• classify: add From<i32> and From<NonZeroI32> impls for GrpcCode. Unrecognized status codes map to GrpcCode::Unknown (#506)

Changed

• compression: compress application/grpc-web responses. Previously all application/grpc* content types were excluded from compression; now only application/grpc (non-web) is excluded (#408)

Fixed

• fs: fix ServeDir returning 500 instead of 405 for non-GET/HEAD requests when call_fallback_on_method_not_allowed is enabled but no fallback service is configured (#587)
• fs: remove duplicate cfg attribute on is_reserved_dos_name (#675)

#408: tower-rs/tower-http#408 #506: tower-rs/tower-http#506 #587: tower-rs/tower-http#587 #672: tower-rs/tower-http#672 #675: tower-rs/tower-http#675 #677: tower-rs/tower-http#677

All PRs

• ci: fix flaky encoding test, add nightly stress test job by @​jlizen in tower-rs/tower-http#670

... (truncated)

Commits

• 1d082ef v0.6.11
• 9c3117d feat: set multiple request header (#677)
• 667e7c7 Remove duplicate cfg attribute for is_reserved_dos_name (#675)
• 7551a9b feat(set_header): refactor and improve multiple header middleware (#672)
• 991e9ee add From<i32> impl for GrpcCode (#506)
• 3962dba Do compress grpc-web responses (#408)
• f0b3bb6 Fix serve_dir method not allowed handling when no fallback is configured (#587)
• d1a571b ci: use static timeout in stress-test workflow (#671)
• 309555a ci: fix flaky encoding test, add nightly stress test job (#670)
• 4532fc2 v0.6.10
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ff4f9a11-3743-42c8-bf83-f7206f11ac66

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[broomva]

Closing: this group carries a breaking 0.x bump (rand::rng is missing/private, so Lint, MSRV and make ci fail). In Cargo, a 0.x minor bump is breaking, but Dependabot labels it 'minor', so the ignore-majors rule from #1819 doesn't catch it. Tracked with the fix options in Linear (life Dependabot 0.x minor bumps); the upgrade is done deliberately with BRO-2830.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml