chore(deps)(deps): Bump the prod group across 1 directory with 9 updates

[dependabot]

Bumps the prod group with 9 updates in the / directory:

Package	From	To
clap	4.6.3	4.6.6
thiserror	2.0.19	2.0.20
toml	1.1.3+spec-1.1.0	1.1.4+spec-1.1.0
http	1.4.2	1.5.0
schemars	1.2.1	1.2.2
rmcp	2.2.0	3.1.2
async-trait	0.1.91	0.1.92
open	5.4.0	5.4.1
jsonschema	0.48.1	0.49.4

Updates clap from 4.6.3 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Commits

• 348cff3 chore: Release
• d478377 docs: Update changelog
• 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
• 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
• f90a966 fix(complete): Use spaces for indentation in fish
• dd4997b fix(complete): Don't glob-expand bash positionals
• 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
• 8141e11 chore(deps): Update compatible (dev) (#6398)
• 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
• 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
• Additional commits viewable in compare view

Updates thiserror from 2.0.19 to 2.0.20

Release notes

Sourced from thiserror's releases.

2.0.20

• Suppress redundant_field_names clippy lint in generated code (#454)

Commits

• b1d5db5 Release 2.0.20
• c4c3ebd Merge pull request #454 from dtolnay/clippy
• 2266152 Suppress redundant_field_names clippy lint
• 2901cfd Raise minimum tested compiler to rust 1.88
• aa9d91f Update ui tests for version 2.0.19
• See full diff in compare view

Updates toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits

• beee9fe chore: Release
• 16e2ac1 docs: Update changelog
• 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
• 534039c fix(serde): Deserialize Value datetimes into typed targets
• 6e45cef test(serde): Reproduce Value datetime deserialization error
• 4ec099f chore: Release
• 5a47a51 docs: Update changelog
• da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
• 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
• ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
• Additional commits viewable in compare view

Updates http from 1.4.2 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

• feat(method): add QUERY method by @​seanmonstar in hyperium/http#798
• fix(uri): allow empty paths in uri::Builder by @​seanmonstar in hyperium/http#853
• perf(header,uri): faster value validation, URI parse/format, map inserts by @​geeknoid in hyperium/http#852
• fix(uri): enforce max length in PathAndQuery by @​seanmonstar in hyperium/http#856

New Contributors

• @​geeknoid made their first contribution in hyperium/http#852

Full Changelog: hyperium/http@v1.4.2...v1.5.0

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

Commits

• 16fc9a7 v1.5.0
• e559023 fix(uri): enforce max length in PathAndQuery (#856)
• 2178e17 perf(header,uri): faster value validation, URI parse/format, map inserts (#852)
• 03c8cd7 fix(uri): allow empty paths in uri::Builder (#853)
• bb8705b feat(method): add QUERY method (#798)
• See full diff in compare view

Updates schemars from 1.2.1 to 1.2.2

Release notes

Sourced from schemars's releases.

v1.2.2

• Update to syn 3 in schemars_derive

Changelog

Sourced from schemars's changelog.

[1.2.2] - 2026-07-27

• Update to syn 3 in schemars_derive

Commits

• ed61863 v1.2.2
• ae618c3 Update syn to v3 (#528)
• c072ea0 docs: add missing attributes to table of contents (#517)
• 015272f Clippy fix (#512)
• 944f727 Bump bytes from 1.10.1 to 1.11.1 (#507)
• See full diff in compare view

Updates rmcp from 2.2.0 to 3.1.2

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.1.2

Fixed

• emit cache hints from handler macros (#1120)

Other

• upgrade darling and syn (#1138)

rmcp-v3.1.2

Fixed

• (auth) map 401/403 challenges on the SSE GET stream (#1152)
• (sse) loop instead of recursing when skipping SSE events (#1146)
• (auth) preserve issuer trailing slash during discovery (#1145)

rmcp-macros-v3.1.1

Fixed

• emit cache hints from handler macros (#1120)

Other

• upgrade darling and syn (#1138)

rmcp-v3.1.1

Fixed

• emit cache hints from handler macros (#1120)
• expose MRTR state to tool handlers (#1104)
• disambiguate input-required results (#1103)

Other

• make async-trait optional (#1119)

rmcp-macros-v3.1.0

Added

• add strict stateless protocol metadata validation (#1091)

Other

• document the ping utility with examples (#1106)
• complete Tier 1 feature docs and finalize roadmap (#1101)
• (conformance) meeting requirements for tier 1 (#1087)

rmcp-v3.1.0

Added

... (truncated)

Commits

• 02c62ae chore: release v3.1.2 (#1148)
• c345078 fix(auth): map 401/403 challenges on the SSE GET stream (#1152)
• f8e6382 chore(deps): bump taiki-e/install-action from 2.85.7 to 2.85.8 (#1153)
• 8fb3e04 chore(deps): bump github/codeql-action from 4.37.4 to 4.37.6 (#1154)
• 3c8fb2a fix(sse): loop instead of recursing when skipping SSE events (#1146)
• e150d4f fix(auth): preserve issuer trailing slash during discovery (#1145)
• 9a3168a chore(deps): bump taiki-e/install-action from 2.85.6 to 2.85.7 (#1139)
• baac607 chore: release v3.1.1 (#1115)
• f57d585 chore: upgrade darling and syn (#1138)
• 07bcda2 fix: emit cache hints from handler macros (#1120)
• Additional commits viewable in compare view

Updates async-trait from 0.1.91 to 0.1.92

Release notes

Sourced from async-trait's releases.

0.1.92

• Resolve double_must_use clippy lint in generated code (#303)

Commits

• 82e7e9e Release 0.1.92
• 9a35cb8 Merge pull request #303 from dtolnay/mustuse
• 875ceec Resolve double_must_use clippy lint
• 62993a5 Raise minimum tested compiler to rust 1.88
• See full diff in compare view

Updates open from 5.4.0 to 5.4.1

Release notes

Sourced from open's releases.

v5.4.1

Bug Fixes

• Forward WSL targets to PowerShell to make open actually work there

  Opening a URL from WSL failed because the Windows process did not receive OPEN_RS_TARGET, even though it was present in the Linux command environment. The failure reproduces with cargo run -- https://google.com on Ubuntu under WSL, where Start-Process receives a null FilePath and exits unsuccessfully.

  Add OPEN_RS_TARGET to WSLENV so WSL interop forwards the target into the PowerShell environment. Preserve existing WSLENV entries and their flags, while keeping the PowerShell command fixed so targets remain data rather than shell code.

  Validated with focused WSL tests, the all-features test suite, rustfmt, Clippy with warnings denied, and an end-to-end cargo run from WSL.

Commit Statistics

• 1 commit contributed to the release.
• 24 days passed between releases.
• 1 commit was understood as conventional.
• 1 unique issue was worked on: #128

Commit Details

• #128
  • Forward WSL targets to PowerShell to make open actually work there (96fa673)

Changelog

Sourced from open's changelog.

5.4.1 (2026-08-05)

Bug Fixes

• Forward WSL targets to PowerShell to make open actually work there

  Opening a URL from WSL failed because the Windows process did not receive OPEN_RS_TARGET, even though it was present in the Linux command environment. The failure reproduces with cargo run -- https://google.com on Ubuntu under WSL, where Start-Process receives a null FilePath and exits unsuccessfully.

  Add OPEN_RS_TARGET to WSLENV so WSL interop forwards the target into the PowerShell environment. Preserve existing WSLENV entries and their flags, while keeping the PowerShell command fixed so targets remain data rather than shell code.

  Validated with focused WSL tests, the all-features test suite, rustfmt, Clippy with warnings denied, and an end-to-end cargo run from WSL.

Commit Statistics

• 1 commit contributed to the release.
• 24 days passed between releases.
• 1 commit was understood as conventional.
• 1 unique issue was worked on: #128

Commit Details

• #128
  • Forward WSL targets to PowerShell to make open actually work there (96fa673)

Commits

• e548a4e Release open v5.4.1
• 96fa673 fix: Forward WSL targets to PowerShell to make open actually work there (#128)
• See full diff in compare view

Updates jsonschema from 0.48.1 to 0.49.4

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.49.4

Added

• Canonicalization of not a string format, which the string leaf carries as barred formats.
• Canonicalization of not an existential demand, which an array fails exactly when no element matches.
• Canonicalization of not a string value set, which the string leaf carries as excluded values.
• Canonicalization of unevaluatedItems beside contains, where the elements it matches are evaluated and the tail admits either.
• Canonicalization of unevaluated* beside anyOf or oneOf, where every branch evaluating the same keys or indexes pins what is left over.
• Canonicalization of not an array element schema, which an array fails exactly when one element violates it.
• CanonicalSchema.intersect, the values both schemas admit.
• CanonicalSchema.negate, the values a schema rejects.
• CanonicalSchema.definition, one reference target by URI.

Fixed

• An integer past i64 admitted by a fractional bound f64 rounds it onto, such as -10000000000000000000000000 under {"maximum": -10000000000000000000000000.1}.
• An integer past 2^53 admitted by a bound f64 rounds onto it, such as 9007199254740992 under {"minimum": 9007199254740993}.
• A contains subschema beside both minContains and maxContains overwriting a sibling keyword of the same name, such as items.

Performance

• CanonicalSchema hashing and equality cost the node instead of the whole document.

[Ruby] Release 0.49.4

[0.49.4] - 2026-08-04

Added

• Canonicalization of not a string format, which the string leaf carries as barred formats.
• Canonicalization of not an existential demand, which an array fails exactly when no element matches.
• Canonicalization of not a string value set, which the string leaf carries as excluded values.
• Canonicalization of unevaluatedItems beside contains, where the elements it matches are evaluated and the tail admits either.
• Canonicalization of unevaluated* beside anyOf or oneOf, where every branch evaluating the same keys or indexes pins what is left over.
• Canonicalization of not an array element schema, which an array fails exactly when one element violates it.
• CanonicalSchema#intersect, the values both schemas admit.
• CanonicalSchema#negate, the values a schema rejects.
• CanonicalSchema#definition, one reference target by URI.

Fixed

• An integer past i64 admitted by a fractional bound f64 rounds it onto, such as -10000000000000000000000000 under {"maximum": -10000000000000000000000000.1}.
• An integer past 2^53 admitted by a bound f64 rounds onto it, such as 9007199254740992 under {"minimum": 9007199254740993}.
• A contains subschema beside both minContains and maxContains overwriting a sibling keyword of the same name, such as items.

Performance

• CanonicalSchema hashing and equality cost the node instead of the whole document.

[Rust] Release 0.49.4

Added

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.49.4] - 2026-08-04

Added

• Canonicalization of not a string format, which the string leaf carries as barred formats.
• Canonicalization of not an existential demand, which an array fails exactly when no element matches.
• Canonicalization of not a string value set, which the string leaf carries as excluded values.
• Canonicalization of unevaluatedItems beside contains, where the elements it matches are evaluated and the tail admits either.
• Canonicalization of unevaluated* beside anyOf or oneOf, where every branch evaluating the same keys or indexes pins what is left over.
• Canonicalization of not an array element schema, which an array fails exactly when one element violates it.
• CanonicalSchema::intersect, the values both schemas admit.
• CanonicalSchema::negate, the values a schema rejects.
• CanonicalSchema::definition, one reference target by URI.

Fixed

• An integer past i64 admitted by a fractional bound f64 rounds it onto, such as -10000000000000000000000000 under {"maximum": -10000000000000000000000000.1}.
• An integer past 2^53 admitted by a bound f64 rounds onto it, such as 9007199254740992 under {"minimum": 9007199254740993}.
• A contains subschema beside both minContains and maxContains overwriting a sibling keyword of the same name, such as items.

Performance

• CanonicalSchema hashing and equality cost the node instead of the whole document.

[0.49.3] - 2026-08-02

Added

• Canonicalization of a recursive schema with no finite witness, which now folds to false.
• Canonicalization of $dynamicRef and $recursiveRef, which resolve through the dynamic scope and stay symbolic like any other reference. A dangling $dynamicRef errors rather than staying Raw.
• Canonicalization of minContains under uniqueItems, where a demand asking for more matches than its own schema has distinct values now folds to false.
• Canonicalization of a Draft 4 patternProperties coverage closed by additionalProperties: false, spelled as the closed map it was parsed from.
• Canonicalization of a oneOf whose branches repeat, where a repeated branch can never contribute exactly one match.
• Canonicalization of a $ref whose target is an empty schema, which now folds to false.
• Canonicalization of unevaluatedItems beside allOf, where every branch must pass and so the indexes they evaluate are known without the instance.
• Canonicalization of unevaluatedProperties beside allOf, where every branch must pass and so what they evaluate is known without the instance.
• Canonicalization of a Draft 4 type list holding integer beside other types with enum, which previously modeled only when spelled as an allOf.
• Canonicalization of patternProperties patterns matching finitely many keys, such as ^a$ and ^(a|b)$.
• Canonicalization of unevaluatedProperties and unevaluatedItems when no in-place applicator sits beside them.

Fixed

• additionalItems values that are not schemas silently ignored beside an array-form items (they should fail the build like additionalProperties).
• additionalItems beside a boolean items rejecting every instance, such as {"additionalItems": false, "items": false}.
• additionalItems beside a non-array items value failing schema compilation with an error blaming additionalItems (the keyword should be ignored).
• Draft 4 rejecting a size bound at or past 2^64, such as {"maxItems": 18446744073709551616}.
• An integer past the f64 range admitted by a fractional bound it exceeds, such as 1e400 under {"exclusiveMaximum": 0.1}.
• A $ref at the root of an $id-bearing subresource dropped as a self-reference when its pointer matched the one that reached that subresource.
• Canonicalization reusing one definition's body for a same-named definition in another resource, when the name spells a canonical URI.
• unevaluatedItems counting prefixItems as evaluating elements before Draft 2020-12, where it is not a keyword.

... (truncated)

Commits

• 89db44b chore(ruby): Release 0.49.4
• 6e2bc14 chore(python): Release 0.49.4
• 796a27e chore(rust): Release 0.49.4
• a35cc7e feat: Canonicalization of not a string format, which the string leaf carrie...
• b1d7f1a chore: Misc canonicalization improvements
• c8f7cc7 fix: An integer past 2^53 admitted by a bound f64 rounds onto it
• bc47249 perf: Cache intersections
• 5dd6483 feat: Canonicalization of not an existential demand, which an array fails e...
• 433adcd feat: Canonicalization of not a string value set, which the string leaf car...
• 4f0e406 test: Add fuzzing for canonicalization
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

PR Summary

Medium Risk
Major rmcp bump touches MCP OAuth/auth and proxy transport with possible API or behavior changes, despite no app code edits. Remaining bumps are mostly patch/minor.

Overview
Bumps production Rust dependencies in trg, most notably a major upgrade of rmcp 2.2.0 → 3.1.2 (MCP client/auth/transport) and jsonschema 0.48 → 0.49.

Also includes smaller updates to clap, http, schemars, thiserror, toml, async-trait, and open. Lockfile-only transitive churn accompanies the bumps; no application source changes.

^{Reviewed by Cursor Bugbot for commit aac568f. Bugbot is set up for automated code reviews on this repo. Configure here.}