From 0157ef127f7d2a863c0dfd2d396249f05e2ab653 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:41:10 +0200
Subject: [PATCH 01/94] build(deps): bump sqlalchemy from 2.0.54 to 2.1.0 in
 /test/lang/python in the simple group (#39281)

Bumps the simple group in /test/lang/python with 1 update:
[sqlalchemy](https://github.com/sqlalchemy/sqlalchemy).

Updates `sqlalchemy` from 2.0.54 to 2.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sqlalchemy/sqlalchemy/releases">sqlalchemy's
releases</a>.</em></p>
<blockquote>
<h1>2.1.0</h1>
<p>Released: September 24, 2026</p>
<h2>orm</h2>
<ul>
<li>
<p><strong>[orm] [feature]</strong> Added
<code>_orm.composite.column_template</code> parameter to
<code>_orm.composite()</code>. When the composite class is a dataclass,
this
parameter accepts a string template such as
<code>&quot;person_%s&quot;</code>, containing
exactly one <code>%s</code> placeholder, that's used to generate column
names for
dataclass fields that don't otherwise have an explicit name, rather than
using the bare field name.  This removes the need to hand-write a
<code>_orm.mapped_column()</code> for each field when the same composite
dataclass
is mapped multiple times on the same class with different column-name
prefixes.  Pull request courtesy Leonardo Rosa.</p>
<p>References: <a
href="https://www.sqlalchemy.org/trac/ticket/12575">#12575</a></p>
</li>
<li>
<p><strong>[orm] [bug]</strong> Fixed issue where pickling an ORM object
that had an instance level lazy
loader established, such as when the <code>_orm.raiseload()</code>
option is used,
would emit a spurious warning regarding the loader containing additional
criteria, if the object had itself been unpickled from a previous
serialization.  This would occur for objects that cross more than one
serialization boundary, such as when using multiprocessing.</p>
<p>This change is also <strong>backported</strong> to: 2.0.53</p>
<p>References: <a
href="https://www.sqlalchemy.org/trac/ticket/13574">#13574</a></p>
</li>
<li>
<p><strong>[orm] [bug]</strong> Fixed issue where calling
<code>_orm.aliased()</code> against an existing
<code>_orm.aliased()</code> construct, without passing an explicit
selectable,
would disregard the selectable of the existing construct and produce an
alias of the mapped table instead, if that selectable were anything
other
than a table or a plain subquery, leading to incorrect results and/or
non-working queries.</p>
<p>This includes <code>_orm.aliased()</code> against a
<code>_orm.with_polymorphic()</code>
construct, which would previously produce an alias of the base mapped
class only, discarding the polymorphic selectable and additional
mappers.
The new construct now retains these, so that criteria against subclass
attributes and the <code>innerjoin</code> and <code>selectable</code>
parameters of
<code>_orm.with_polymorphic()</code> take effect, and subclass columns
are loaded
up front.  The SQL rendered for these constructs now includes the
polymorphic selectable.</p>
<p>This change is also <strong>backported</strong> to: 2.0.53</p>
<p>References: <a
href="https://www.sqlalchemy.org/trac/ticket/13583">#13583</a>, <a
href="https://www.sqlalchemy.org/trac/ticket/13584">#13584</a></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/sqlalchemy/sqlalchemy/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sqlalchemy&package-manager=pip&previous-version=2.0.54&new-version=2.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/lang/python/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/lang/python/requirements.txt b/test/lang/python/requirements.txt
index 4f1b86acc565b..f71938206eec1 100644
--- a/test/lang/python/requirements.txt
+++ b/test/lang/python/requirements.txt
@@ -1,4 +1,4 @@
 psycopg==3.3.6
 psycopg-binary==3.3.6
 psycopg2==2.9.13
-SQLAlchemy==2.0.54
+SQLAlchemy==2.1.0

From 4ace44ce378c502a50a96efc7ba2a3a41b4fb29d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:42:11 +0200
Subject: [PATCH 02/94] build(deps): bump the simple2 group across 1 directory
 with 5 updates (#39274)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the simple2 group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [proxy-header](https://github.com/tibordp/proxy-header) | `0.1.2` |
`0.1.3` |
| [sentry](https://github.com/getsentry/sentry-rust) | `0.49.2` |
`0.49.3` |
| [sentry-panic](https://github.com/getsentry/sentry-rust) | `0.49.2` |
`0.49.3` |
| [sentry-tracing](https://github.com/getsentry/sentry-rust) | `0.49.2`
| `0.49.3` |
| [thiserror](https://github.com/dtolnay/thiserror) | `2.0.20` |
`2.0.21` |


Updates `proxy-header` from 0.1.2 to 0.1.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tibordp/proxy-header/releases">proxy-header's
releases</a>.</em></p>
<blockquote>
<h2>v0.1.3</h2>
<h2>What's Changed</h2>
<ul>
<li>chore: Fix clippy lints and tighten CI by <a
href="https://github.com/tibordp"><code>@​tibordp</code></a> in <a
href="https://redirect.github.com/tibordp/proxy-header/pull/6">tibordp/proxy-header#6</a></li>
<li>fix(tokio): Fix AsyncBufRead to not drop bytes from the underlying
stream by <a
href="https://github.com/tibordp"><code>@​tibordp</code></a> in <a
href="https://redirect.github.com/tibordp/proxy-header/pull/5">tibordp/proxy-header#5</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/tibordp/proxy-header/compare/v0.1.2...v0.1.3">https://github.com/tibordp/proxy-header/compare/v0.1.2...v0.1.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tibordp/proxy-header/commit/22935c1ae7a0bc1568d293c120348d117dd4f73a"><code>22935c1</code></a>
chore: Prepare 0.1.3 release</li>
<li><a
href="https://github.com/tibordp/proxy-header/commit/0fad85d2439f55889df8be6de5d564163e03d544"><code>0fad85d</code></a>
fix(tokio): Fix AsyncBufRead to not drop bytes from the underlying
stream (<a
href="https://redirect.github.com/tibordp/proxy-header/issues/5">#5</a>)</li>
<li><a
href="https://github.com/tibordp/proxy-header/commit/f2d9c0ac9a228d40940adc7ade83eefb251ccc89"><code>f2d9c0a</code></a>
chore: Fix clippy lints and tighten CI (<a
href="https://redirect.github.com/tibordp/proxy-header/issues/6">#6</a>)</li>
<li>See full diff in <a
href="https://github.com/tibordp/proxy-header/compare/v0.1.2...v0.1.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `sentry` from 0.49.2 to 0.49.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/releases">sentry's
releases</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md">sentry's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/ad0b3c1e5f1e9caeb028b953ee39adf8e000f99d"><code>ad0b3c1</code></a>
release: 0.49.3</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/31a4c96e507374b6b495bf7de7274f4c8dcb169a"><code>31a4c96</code></a>
meta(changelog): Fix the disabled tracing changelog entry (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1325">#1325</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/5bb564d6e5aa6f8ae71b9ffc07866904a52134b4"><code>5bb564d</code></a>
build(cargo): Bump <code>rustls</code> to <code>0.23.45</code> (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1324">#1324</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/3b6d992877d33481042786c1d2899f58a8228019"><code>3b6d992</code></a>
feat(core): Make transport channel capacity configurable (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/cbed0fa23f6fe3daefb3b56384bd66bbf21f0575"><code>cbed0fa</code></a>
feat(minidump): Add <code>sentry-minidump</code> integration (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1315">#1315</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/715a9ec0eb1cc77491823c47752a433744a6ac06"><code>715a9ec</code></a>
ref(lints): Enforce <code>missing_docs</code> lint globally (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1321">#1321</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/abecd69eaf82cca2a0665bfb1cd545cd746c6b95"><code>abecd69</code></a>
ref(tests): No integration test crate for shared logic (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1320">#1320</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/70a12054f8e19f4c20ce463358ae1a0ff70a8a32"><code>70a1205</code></a>
ref(clippy): Enable <code>impl_trait_in_params</code> lint (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1319">#1319</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/4427186e47634f3ada112aac860f69596e787030"><code>4427186</code></a>
chore(core): Implement disabled tracing semantics (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1286">#1286</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/c0b9a822235879f03d5e27739e34b452679f3408"><code>c0b9a82</code></a>
chore(core): Deprecate <code>is_sampled</code> methods (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `sentry-panic` from 0.49.2 to 0.49.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/releases">sentry-panic's
releases</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md">sentry-panic's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/ad0b3c1e5f1e9caeb028b953ee39adf8e000f99d"><code>ad0b3c1</code></a>
release: 0.49.3</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/31a4c96e507374b6b495bf7de7274f4c8dcb169a"><code>31a4c96</code></a>
meta(changelog): Fix the disabled tracing changelog entry (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1325">#1325</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/5bb564d6e5aa6f8ae71b9ffc07866904a52134b4"><code>5bb564d</code></a>
build(cargo): Bump <code>rustls</code> to <code>0.23.45</code> (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1324">#1324</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/3b6d992877d33481042786c1d2899f58a8228019"><code>3b6d992</code></a>
feat(core): Make transport channel capacity configurable (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/cbed0fa23f6fe3daefb3b56384bd66bbf21f0575"><code>cbed0fa</code></a>
feat(minidump): Add <code>sentry-minidump</code> integration (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1315">#1315</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/715a9ec0eb1cc77491823c47752a433744a6ac06"><code>715a9ec</code></a>
ref(lints): Enforce <code>missing_docs</code> lint globally (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1321">#1321</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/abecd69eaf82cca2a0665bfb1cd545cd746c6b95"><code>abecd69</code></a>
ref(tests): No integration test crate for shared logic (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1320">#1320</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/70a12054f8e19f4c20ce463358ae1a0ff70a8a32"><code>70a1205</code></a>
ref(clippy): Enable <code>impl_trait_in_params</code> lint (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1319">#1319</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/4427186e47634f3ada112aac860f69596e787030"><code>4427186</code></a>
chore(core): Implement disabled tracing semantics (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1286">#1286</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/c0b9a822235879f03d5e27739e34b452679f3408"><code>c0b9a82</code></a>
chore(core): Deprecate <code>is_sampled</code> methods (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `sentry-tracing` from 0.49.2 to 0.49.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/releases">sentry-tracing's
releases</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md">sentry-tracing's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/ad0b3c1e5f1e9caeb028b953ee39adf8e000f99d"><code>ad0b3c1</code></a>
release: 0.49.3</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/31a4c96e507374b6b495bf7de7274f4c8dcb169a"><code>31a4c96</code></a>
meta(changelog): Fix the disabled tracing changelog entry (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1325">#1325</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/5bb564d6e5aa6f8ae71b9ffc07866904a52134b4"><code>5bb564d</code></a>
build(cargo): Bump <code>rustls</code> to <code>0.23.45</code> (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1324">#1324</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/3b6d992877d33481042786c1d2899f58a8228019"><code>3b6d992</code></a>
feat(core): Make transport channel capacity configurable (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/cbed0fa23f6fe3daefb3b56384bd66bbf21f0575"><code>cbed0fa</code></a>
feat(minidump): Add <code>sentry-minidump</code> integration (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1315">#1315</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/715a9ec0eb1cc77491823c47752a433744a6ac06"><code>715a9ec</code></a>
ref(lints): Enforce <code>missing_docs</code> lint globally (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1321">#1321</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/abecd69eaf82cca2a0665bfb1cd545cd746c6b95"><code>abecd69</code></a>
ref(tests): No integration test crate for shared logic (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1320">#1320</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/70a12054f8e19f4c20ce463358ae1a0ff70a8a32"><code>70a1205</code></a>
ref(clippy): Enable <code>impl_trait_in_params</code> lint (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1319">#1319</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/4427186e47634f3ada112aac860f69596e787030"><code>4427186</code></a>
chore(core): Implement disabled tracing semantics (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1286">#1286</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/c0b9a822235879f03d5e27739e34b452679f3408"><code>c0b9a82</code></a>
chore(core): Deprecate <code>is_sampled</code> methods (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `thiserror` from 2.0.20 to 2.0.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dtolnay/thiserror/releases">thiserror's
releases</a>.</em></p>
<blockquote>
<h2>2.0.21</h2>
<ul>
<li>Fix parsing of generic unit variants in display expressions (<a
href="https://redirect.github.com/dtolnay/thiserror/issues/459">#459</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dtolnay/thiserror/commit/b1827ee06f81a7d7f954e676771e19a97f9f8e3b"><code>b1827ee</code></a>
Release 2.0.21</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/58037b575a2a5543d0d54a49360554325b49f55a"><code>58037b5</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/thiserror/issues/459">#459</a>
from dtolnay/turbofish</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/f82a0cf8f06c71263c2caa26e759f337d2778153"><code>f82a0cf</code></a>
Keep track of nested turbofish depth</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/72ea49262d6412ccbc08f1696dda8626409e657d"><code>72ea492</code></a>
Raise required compiler to Rust 1.77</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/72eea0d4ddb17ff9fa873aa74469de850021b22e"><code>72eea0d</code></a>
Resolve io_other_error clippy lint in tests</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/07f09a2ec934df58508ce4fa5e7fbf27cca552c2"><code>07f09a2</code></a>
Raise required compiler to Rust 1.74</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/2715388e8cc5787b3643251f7a7a637e89376688"><code>2715388</code></a>
Update ui test suite to nightly-2026-09-22</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/5a306c7d0a8588caaaaa6a7567aeb25c1c10719b"><code>5a306c7</code></a>
Update ui test suite to nightly-2026-09-05</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/ef9383b37d7c96b01e10df35d3e9e313c7b98b5a"><code>ef9383b</code></a>
Update ui test suite to nightly-2026-08-22</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/8336b8407fbfe69177c504cdbc379db20cf6f131"><code>8336b84</code></a>
Update ui tests for version 2.0.20</li>
<li>See full diff in <a
href="https://github.com/dtolnay/thiserror/compare/2.0.20...2.0.21">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 178 ++++++++++++++++++++++++++---------------------------
 1 file changed, 89 insertions(+), 89 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 19a6fad634970..c0db478b57d66 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -240,7 +240,7 @@ dependencies = [
  "snap",
  "strum",
  "strum_macros",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "uuid",
  "zstd",
 ]
@@ -1364,7 +1364,7 @@ dependencies = [
  "regex-lite",
  "roxmltree",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -3257,7 +3257,7 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
 dependencies = [
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -3998,7 +3998,7 @@ dependencies = [
  "serde_json",
  "sha2 0.10.9",
  "socket2 0.6.5",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-postgres",
  "tokio-stream",
@@ -4253,7 +4253,7 @@ dependencies = [
  "rustls-pki-types",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
  "tracing-futures",
@@ -4625,7 +4625,7 @@ dependencies = [
  "ipnet",
  "jni",
  "rand 0.10.2",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tinyvec",
  "tokio",
  "tracing",
@@ -4646,7 +4646,7 @@ dependencies = [
  "prefix-trie",
  "rand 0.10.2",
  "ring",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tinyvec",
  "tracing",
  "url",
@@ -4673,7 +4673,7 @@ dependencies = [
  "resolv-conf",
  "smallvec",
  "system-configuration",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
 ]
@@ -5191,7 +5191,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
+ "hashbrown 0.15.3",
  "serde",
  "serde_core",
 ]
@@ -5443,7 +5443,7 @@ dependencies = [
  "jni-sys",
  "log",
  "simd_cesu8",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "walkdir",
  "windows-link 0.2.1",
 ]
@@ -5523,7 +5523,7 @@ dependencies = [
  "pest_derive",
  "regex",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -5579,7 +5579,7 @@ dependencies = [
  "rand 0.9.4",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
 ]
@@ -5646,7 +5646,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-util",
  "tower 0.5.3",
@@ -5670,7 +5670,7 @@ dependencies = [
  "serde",
  "serde-value",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -5708,7 +5708,7 @@ dependencies = [
  "pin-project",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-util",
  "tracing",
@@ -5758,7 +5758,7 @@ dependencies = [
  "rand 0.9.4",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-stream",
  "uuid",
@@ -6310,7 +6310,7 @@ dependencies = [
  "serde",
  "serde_json",
  "socket2 0.5.10",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-native-tls",
  "tokio-util",
@@ -6343,7 +6343,7 @@ dependencies = [
  "serde_json",
  "sha1 0.10.6",
  "sha2 0.10.9",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "uuid",
  "zstd",
 ]
@@ -6379,7 +6379,7 @@ dependencies = [
  "tabled",
  "tempfile",
  "termcolor",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
  "tokio",
  "toml",
@@ -6475,7 +6475,7 @@ dependencies = [
  "sha2 0.10.9",
  "smallvec",
  "static_assertions",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio",
  "tokio-postgres",
@@ -6617,7 +6617,7 @@ dependencies = [
  "aws-smithy-mocks",
  "aws-types",
  "mz-ore",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "uuid",
 ]
@@ -6655,7 +6655,7 @@ dependencies = [
  "hyper-tls 0.5.0",
  "mz-ore",
  "pin-project",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tower-service",
  "uuid",
@@ -6703,7 +6703,7 @@ dependencies = [
  "rustls",
  "semver",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-metrics",
  "tokio-openssl",
@@ -6790,7 +6790,7 @@ dependencies = [
  "serde_plain",
  "sha2 0.10.9",
  "static_assertions",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio",
  "tracing",
@@ -6882,7 +6882,7 @@ dependencies = [
  "mz-frontegg-client",
  "reqwest 0.12.28",
  "serde",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "url",
 ]
@@ -7081,7 +7081,7 @@ dependencies = [
  "scopeguard",
  "serde",
  "smallvec",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio",
  "tracing",
@@ -7118,7 +7118,7 @@ dependencies = [
  "prometheus",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio",
  "tracing",
@@ -7267,7 +7267,7 @@ dependencies = [
  "strsim",
  "supports-color 3.0.2",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
  "tokio",
  "tokio-postgres",
@@ -7457,7 +7457,7 @@ dependencies = [
  "similar-asserts",
  "sysctl",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio",
  "tokio-metrics",
@@ -7592,7 +7592,7 @@ dependencies = [
  "reqwest-retry",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
  "uuid",
@@ -7606,7 +7606,7 @@ dependencies = [
  "mz-frontegg-auth",
  "reqwest 0.12.28",
  "serde",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "url",
  "uuid",
@@ -7718,7 +7718,7 @@ dependencies = [
  "rdkafka",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
  "url",
@@ -7786,7 +7786,7 @@ dependencies = [
  "nix 0.31.3",
  "paste",
  "prometheus",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
 ]
@@ -7834,7 +7834,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
  "url",
@@ -7993,7 +7993,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.9",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tower-http",
  "tracing",
@@ -8054,7 +8054,7 @@ dependencies = [
  "smallvec",
  "stacker",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-native-tls",
  "tokio-openssl",
@@ -8381,7 +8381,7 @@ dependencies = [
  "prost",
  "prost-build",
  "serde",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-postgres",
  "tracing",
@@ -8523,7 +8523,7 @@ dependencies = [
  "smallvec",
  "static_assertions",
  "strsim",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio-postgres",
  "tracing",
@@ -8547,7 +8547,7 @@ dependencies = [
  "rocksdb",
  "serde",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
 ]
@@ -8738,7 +8738,7 @@ dependencies = [
  "serde",
  "serde_json",
  "static_assertions",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-postgres",
  "tracing",
@@ -8787,7 +8787,7 @@ dependencies = [
  "mz-walkabout",
  "serde",
  "smallvec",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tracing",
  "unicode-width 0.2.2",
 ]
@@ -8802,7 +8802,7 @@ dependencies = [
  "mz-sql-lexer",
  "mz-sql-parser",
  "pretty",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -8834,7 +8834,7 @@ dependencies = [
  "serde",
  "smallvec",
  "static_assertions",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tiberius",
  "timely",
  "tokio",
@@ -8990,7 +8990,7 @@ dependencies = [
  "sha2 0.10.9",
  "sqlparser",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tiberius",
  "timely",
  "tokio",
@@ -9114,7 +9114,7 @@ dependencies = [
  "sentry",
  "serde",
  "smallvec",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "timely",
  "tokio",
  "tokio-util",
@@ -9193,7 +9193,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tiberius",
  "timely",
  "tokio",
@@ -9352,7 +9352,7 @@ dependencies = [
  "mz-ore",
  "openssl",
  "postgres-openssl",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio-postgres",
 ]
 
@@ -10079,7 +10079,7 @@ dependencies = [
  "openssh-mux-client",
  "shell-escape",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
 ]
 
@@ -10108,7 +10108,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9879168afb48a235200e30d93df320b7191568cda8621df02f145c1c0f1af95a"
 dependencies = [
  "ssh_format_error",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -10174,7 +10174,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tracing",
 ]
 
@@ -10204,7 +10204,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prost",
  "reqwest 0.13.5",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tonic",
  "tonic-types",
@@ -10236,7 +10236,7 @@ dependencies = [
  "percent-encoding",
  "portable-atomic",
  "rand 0.9.4",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-stream",
 ]
@@ -10957,7 +10957,7 @@ dependencies = [
  "spin 0.10.1",
  "symbolic-demangle",
  "tempfile",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -11151,7 +11151,7 @@ dependencies = [
  "memchr",
  "parking_lot",
  "protobuf",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -11289,9 +11289,9 @@ dependencies = [
 
 [[package]]
 name = "proxy-header"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1493f63ddddfba840c3169e997c2905d09538ace72d64e84af6324c6e0e065"
+checksum = "accf7ba1ae5e4f5b6acfb2d88d3cf68d03c333fca0260b06fb9aafcfcf22e2f5"
 
 [[package]]
 name = "psl-types"
@@ -11432,7 +11432,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2 0.6.5",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
  "web-time",
@@ -11455,7 +11455,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tinyvec",
  "tracing",
  "web-time",
@@ -11773,7 +11773,7 @@ checksum = "dd6f9d3d47bdd2ad6945c5015a226ec6155d0bcdfd8f7cd29f86b71f8de99d2b"
 dependencies = [
  "getrandom 0.2.16",
  "libredox",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -12072,7 +12072,7 @@ dependencies = [
  "reqwest 0.12.28",
  "reqwest-middleware",
  "retry-policies",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tracing",
  "wasmtimer",
@@ -12590,7 +12590,7 @@ dependencies = [
  "reqwest 0.12.28",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
 ]
 
@@ -12616,9 +12616,9 @@ dependencies = [
 
 [[package]]
 name = "sentry"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a88b65feb368d9dde5d531a2b59b25016e36fd6e4978432371a3ee77746ca2"
+checksum = "9fa951f4e644464ebfd2347a7ab03b0828c512d2448a76262cad2607b343dff4"
 dependencies = [
  "cfg_aliases",
  "httpdate",
@@ -12635,9 +12635,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-backtrace"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c51511d67ed670266a93afeaa26a08019b04ad1420cb9191da30f2338d22c48"
+checksum = "f4f27cf048aa63ccd5bc94c29989133eabb82e9c6bf7441b58e9d4a95837a105"
 dependencies = [
  "backtrace",
  "regex",
@@ -12646,9 +12646,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-contexts"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b757ac1f335856e8d7f5062a1fd9bc07a05a7eb3cc48247db79bf2618a490bd"
+checksum = "c5ed680585dbdacdf9859c2b4dc53358ff02bd256766882e22e343836db36b22"
 dependencies = [
  "hostname",
  "libc",
@@ -12660,11 +12660,11 @@ dependencies = [
 
 [[package]]
 name = "sentry-core"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d889520a375e5b93efb0a66def1630d21d168b0251eb55b286b03fa940ccfc84"
+checksum = "c3ed398494bb8fc412a11a182c1883a10ae147587b8f6314abd222d1d626f31b"
 dependencies = [
- "rand 0.9.4",
+ "rand 0.10.2",
  "sentry-types",
  "serde",
  "serde_json",
@@ -12673,9 +12673,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-debug-images"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "656487fd5f7b7c0105b2e82171982aac64489e0cb679436038febf070f2f76d6"
+checksum = "55854bb40681e84ffd2a69578ad4ef9bfaf5bf2bf1380a745578b591fa24af22"
 dependencies = [
  "findshlibs",
  "sentry-core",
@@ -12683,9 +12683,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-panic"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e0fe456a7380e9df875a1ef4df1e468d35b19b9051599845fab9d8f0c71c4ae"
+checksum = "b7153e68642b761ed3aa62c022795c11b2facc728b2db7484084492373c944f9"
 dependencies = [
  "sentry-backtrace",
  "sentry-core",
@@ -12693,9 +12693,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-tracing"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77796d14eedbef22c2fe78e9c69fb09f14c7ad607e624d48dce92eedc17a136e"
+checksum = "e7e7db1aefdf623f4e48e21ec9e4af535024187aeafb2a4cc7e29d035def5a13"
 dependencies = [
  "bitflags 2.11.0",
  "sentry-backtrace",
@@ -12706,16 +12706,16 @@ dependencies = [
 
 [[package]]
 name = "sentry-types"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc71f5ca55942d9b2901af95d5df5c5d65c164134c22a83682cac3d0b6c7ef2d"
+checksum = "1c18bf7b159bdfc7c8f97816f476b4947a1937fb6bea9d38d3479e58631614ac"
 dependencies = [
  "debugid",
  "hex",
- "rand 0.9.4",
+ "rand 0.10.2",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
  "url",
  "uuid",
@@ -13442,7 +13442,7 @@ dependencies = [
  "byteorder",
  "enum-as-inner",
  "libc",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "walkdir",
 ]
 
@@ -13536,7 +13536,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand 2.3.0",
- "getrandom 0.4.3",
+ "getrandom 0.3.3",
  "once_cell",
  "rustix 1.1.4",
  "windows-sys 0.61.1",
@@ -13587,11 +13587,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "thiserror-impl 2.0.20",
+ "thiserror-impl 2.0.21",
 ]
 
 [[package]]
@@ -13607,9 +13607,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -14262,7 +14262,7 @@ dependencies = [
  "rand 0.9.4",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
  "tokio",
  "tracing",
@@ -14429,7 +14429,7 @@ dependencies = [
  "log",
  "rand 0.9.4",
  "sha1 0.10.6",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]

From 08eaa37ff777262c4ce8205fe896cf1c8b1fe0e1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:42:27 +0200
Subject: [PATCH 03/94] build(deps): bump
 materialize_instance::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/gcp-temporary (#39271)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[materialize_instance::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_instance::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=materialize_instance::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index d1b28d73807c5..00c0de13199a6 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -259,7 +259,7 @@ module "operator" {
 
 # 7. Deploy Materialize instance with configured backend connections
 module "materialize_instance" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.12.1"
 
   instance_name        = local.materialize_instance_name
   instance_namespace   = local.materialize_instance_namespace

From b58c2a71d714ffc079bd02c48682362f0f561ab2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:42:43 +0200
Subject: [PATCH 04/94] build(deps): bump
 operator::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/gcp-temporary (#39270)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[operator::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">operator::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=operator::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index 00c0de13199a6..95c7a119d2dd2 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -227,7 +227,7 @@ module "self_signed_cluster_issuer" {
 
 # 6. Install Materialize Kubernetes operator for managing Materialize instances
 module "operator" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/operator?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/operator?ref=v13.12.1"
 
   name_prefix = var.name_prefix
   region      = var.region

From 4828f7cfe478347ddccda198d47e13b3a832f192 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:42:58 +0200
Subject: [PATCH 05/94] build(deps): bump
 cert_manager::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/gcp-temporary (#39269)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[cert_manager::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">cert_manager::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cert_manager::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index 95c7a119d2dd2..4dd68fea459c8 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -205,7 +205,7 @@ module "storage" {
 
 # 5. Install cert-manager for SSL certificate management and create cluster issuer
 module "cert_manager" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.12.1"
 
   node_selector = local.generic_node_labels
 

From b54c73fffe1f00069a5fc61d38a5941cf094781e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:43:15 +0200
Subject: [PATCH 06/94] build(deps): bump
 storage::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/gcp-temporary (#39268)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[storage::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">storage::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=storage::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index 4dd68fea459c8..fbe544d0c8371 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -191,7 +191,7 @@ module "database" {
 
 # 4. Create Google Cloud Storage bucket for Materialize persistent data storage
 module "storage" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/storage?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/storage?ref=v13.12.1"
 
   project_id      = var.project_id
   region          = var.region

From c40253c6112150748925b92b773cf5c9388175ad Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:43:31 +0200
Subject: [PATCH 07/94] build(deps): bump
 networking::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/gcp-temporary (#39267)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[networking::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">networking::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=networking::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index fbe544d0c8371..beb02ee09c3c5 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -99,7 +99,7 @@ locals {
 
 # 1. Configure networking infrastructure including VPC, subnets, and CIDR blocks
 module "networking" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/networking?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/networking?ref=v13.12.1"
 
   project_id = var.project_id
   region     = var.region

From 9213b813b9c3f663ecc5e67f9cd0cfcd6049a9cf Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:43:45 +0200
Subject: [PATCH 08/94] build(deps): bump
 database::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/gcp-temporary (#39266)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[database::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">database::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=database::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index beb02ee09c3c5..37fbea368f018 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -170,7 +170,7 @@ module "materialize_nodepool" {
 
 # 3. Set up PostgreSQL database instance for Materialize metadata storage
 module "database" {
-  source     = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/database?ref=v13.10.0"
+  source     = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/database?ref=v13.12.1"
   depends_on = [module.networking]
 
   databases = [local.database_config.database]

From 27ef64c250b9f11e74c52994b629951aed774c6d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:44:01 +0200
Subject: [PATCH 09/94] build(deps): bump
 self_signed_cluster_issuer::materialize-terraform-self-managed from 13.10.0
 to 13.12.1 in /test/terraform/gcp-temporary (#39265)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[self_signed_cluster_issuer::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">self_signed_cluster_issuer::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=self_signed_cluster_issuer::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/gcp-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index 37fbea368f018..d930f5b8fef14 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -216,7 +216,7 @@ module "cert_manager" {
 }
 
 module "self_signed_cluster_issuer" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.12.1"
 
   name_prefix = var.name_prefix
 

From 8a3573065fb5bd89443ad7e6c2c61f10cdb4058b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:44:17 +0200
Subject: [PATCH 10/94] build(deps): bump
 materialize_instance::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/azure-temporary (#39264)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[materialize_instance::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_instance::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=materialize_instance::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index 8ec8654779585..fb9957b03c628 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -301,7 +301,7 @@ module "operator" {
 
 # 8. Deploy Materialize instance
 module "materialize_instance" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.12.1"
 
   instance_name        = local.materialize_instance_name
   instance_namespace   = local.materialize_instance_namespace

From 1e8e91d361a995efe96be0bbb7a826fab710ce9f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:44:34 +0200
Subject: [PATCH 11/94] build(deps): bump
 operator::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/azure-temporary (#39262)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[operator::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">operator::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=operator::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index fb9957b03c628..4b46db98fb5ca 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -261,7 +261,7 @@ module "self_signed_cluster_issuer" {
 
 # 7. Install Materialize Operator
 module "operator" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/operator?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/operator?ref=v13.12.1"
 
   name_prefix = var.name_prefix
   location    = var.location

From 6895e7d0b566a388192ced440e153011cc7d616c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:44:48 +0200
Subject: [PATCH 12/94] build(deps): bump
 database::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/azure-temporary (#39260)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[database::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">database::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=database::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index 4b46db98fb5ca..6c5ff7e25c4b2 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -183,7 +183,7 @@ module "materialize_nodepool" {
 
 # 4. Create PostgreSQL database
 module "database" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/database?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/database?ref=v13.12.1"
 
   depends_on = [module.networking]
 

From 6f865adc9089b7ca9da5e53b0ae9050b592b184b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:45:05 +0200
Subject: [PATCH 13/94] build(deps): bump
 self_signed_cluster_issuer::materialize-terraform-self-managed from 13.10.0
 to 13.12.1 in /test/terraform/azure-temporary (#39259)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[self_signed_cluster_issuer::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">self_signed_cluster_issuer::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=self_signed_cluster_issuer::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index 6c5ff7e25c4b2..73d560b300bb0 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -250,7 +250,7 @@ module "cert_manager" {
 }
 
 module "self_signed_cluster_issuer" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.12.1"
 
   name_prefix = var.name_prefix
 

From 1492c9cba7fc3c4720f332ec44e8bbd6079ae393 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:45:21 +0200
Subject: [PATCH 14/94] build(deps): bump
 cert_manager::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/azure-temporary (#39258)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[cert_manager::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">cert_manager::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cert_manager::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index 73d560b300bb0..0d40bc47a629b 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -240,7 +240,7 @@ module "storage" {
 
 # 6. Install cert-manager for TLS
 module "cert_manager" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.12.1"
 
   node_selector = local.generic_node_labels
 

From 6fc1f517a3fba2620964c86893e06f054b9135d4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:45:40 +0200
Subject: [PATCH 15/94] build(deps): bump
 networking::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/azure-temporary (#39257)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[networking::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">networking::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=networking::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index 0d40bc47a629b..b9e63c3f19379 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -102,7 +102,7 @@ resource "azurerm_resource_group" "materialize" {
 
 # 2. Create networking infrastructure
 module "networking" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/networking?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/networking?ref=v13.12.1"
 
   resource_group_name                = azurerm_resource_group.materialize.name
   location                           = var.location

From 6312fde6c592bb1e9f1ea9f480be2de479959253 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:46:21 +0200
Subject: [PATCH 16/94] build(deps): bump
 storage::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/azure-temporary (#39256)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[storage::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">storage::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=storage::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index b9e63c3f19379..06ed5c8797e64 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -218,7 +218,7 @@ module "database" {
 
 # 5. Create Azure Blob Storage
 module "storage" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/storage?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/storage?ref=v13.12.1"
 
   resource_group_name            = azurerm_resource_group.materialize.name
   location                       = var.location

From 4fa3d08179feb7bd93524aa5dc28360b694e0bfd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:46:35 +0200
Subject: [PATCH 17/94] build(deps): bump
 nodepool_generic::materialize-terraform-self-managed from 13.10.0 to 13.12.1
 in /test/terraform/aws-upgrade (#39254)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[nodepool_generic::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">nodepool_generic::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodepool_generic::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index a77d11691bce0..763aeface8680 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -158,7 +158,7 @@ module "ec2nodeclass_generic" {
 }
 
 module "nodepool_generic" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.12.1"
 
   name            = local.nodeclass_name_generic
   nodeclass_name  = local.nodeclass_name_generic

From 981a0afd0414506521f50ef92ad4bd9a26056cba Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:46:50 +0200
Subject: [PATCH 18/94] build(deps): bump
 operator::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39253)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[operator::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">operator::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=operator::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 763aeface8680..03ce296d90f79 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -311,7 +311,7 @@ module "storage" {
 
 # 7. Install Materialize Operator
 module "operator" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/operator?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/operator?ref=v13.12.1"
 
   name_prefix    = var.name_prefix
   aws_region     = var.aws_region

From a1dd23b4027d0ef0bd9a023283e47dbe6e8ed6bb Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:47:06 +0200
Subject: [PATCH 19/94] build(deps): bump
 nodepool_materialize::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-upgrade (#39252)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[nodepool_materialize::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">nodepool_materialize::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodepool_materialize::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 03ce296d90f79..41003d3df1722 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -192,7 +192,7 @@ module "ec2nodeclass_materialize" {
 }
 
 module "nodepool_materialize" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.12.1"
 
   name            = local.nodeclass_name_materialize
   nodeclass_name  = local.nodeclass_name_materialize

From b727ab1ca07b8ae797d82c54da098fbd51bd023c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:47:35 +0200
Subject: [PATCH 20/94] build(deps): bump
 karpenter::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39251)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[karpenter::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">karpenter::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=karpenter::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 41003d3df1722..1d6b74b0105e4 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -121,7 +121,7 @@ module "coredns" {
 }
 
 module "karpenter" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter?ref=v13.12.1"
 
   name_prefix             = var.name_prefix
   cluster_name            = module.eks.cluster_name

From 4fad22099dc378240d3b89b46406f3d648ed92f1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:47:50 +0200
Subject: [PATCH 21/94] build(deps): bump
 vpc_cni::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39250)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[vpc_cni::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">vpc_cni::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vpc_cni::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 1d6b74b0105e4..c22d3b171fb4e 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -50,7 +50,7 @@ module "eks" {
 # nodes cannot become Ready without one, so it must be installed before any
 # node group.
 module "vpc_cni" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/vpc-cni?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/vpc-cni?ref=v13.12.1"
 
   name_prefix       = var.name_prefix
   oidc_provider_arn = module.eks.oidc_provider_arn

From 40017c0a99fe07224eef1bf3e897b4cdee531c6b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:48:16 +0200
Subject: [PATCH 22/94] build(deps): bump
 ec2nodeclass_materialize::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-upgrade (#39249)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[ec2nodeclass_materialize::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">ec2nodeclass_materialize::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ec2nodeclass_materialize::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index c22d3b171fb4e..147414796f7e5 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -175,7 +175,7 @@ module "nodepool_generic" {
 
 # Create a dedicated nodeclass and nodepool for Materialize pods
 module "ec2nodeclass_materialize" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.12.1"
 
   name               = local.nodeclass_name_materialize
   ami_selector_terms = local.ami_selector_terms

From 4846fd00d98d7aad8c3557d2e260aabc89687514 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:50:47 +0200
Subject: [PATCH 23/94] build(deps): bump
 networking::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39247)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[networking::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">networking::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=networking::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 147414796f7e5..38d194f031f74 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -15,7 +15,7 @@ resource "random_password" "db_password" {
 
 # 1. Create network infrastructure
 module "networking" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/networking?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/networking?ref=v13.12.1"
 
   name_prefix          = var.name_prefix
   vpc_cidr             = "10.0.0.0/16"

From c0b590de61d2250724a25236260dc4da7f1715c1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:51:09 +0200
Subject: [PATCH 24/94] build(deps): bump
 aws_lbc::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39246)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[aws_lbc::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">aws_lbc::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aws_lbc::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 38d194f031f74..98d2263ce409b 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -210,7 +210,7 @@ module "nodepool_materialize" {
 
 # 3. Install AWS Load Balancer Controller
 module "aws_lbc" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/aws-lbc?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/aws-lbc?ref=v13.12.1"
 
   name_prefix       = var.name_prefix
   eks_cluster_name  = module.eks.cluster_name

From fb8906ca65dd8a46e75238c5ad15446ac518c53a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:51:27 +0200
Subject: [PATCH 25/94] build(deps): bump
 cert_manager::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39244)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[cert_manager::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">cert_manager::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cert_manager::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 98d2263ce409b..4cd32013ddc47 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -230,7 +230,7 @@ module "aws_lbc" {
 
 # 4. Install Certificate Manager for TLS
 module "cert_manager" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.12.1"
 
   node_selector = local.generic_node_labels
 

From 351471b9050146c583213ff48cddb271b05c930a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:51:53 +0200
Subject: [PATCH 26/94] build(deps): bump nginxinc/nginx-unprivileged from
 `c3fed64` to `6a23acd` in /console/misc/docker (#39243)

Bumps nginxinc/nginx-unprivileged from `c3fed64` to `6a23acd`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nginxinc/nginx-unprivileged&package-manager=docker&previous-version=alpine&new-version=alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 console/misc/docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/console/misc/docker/Dockerfile b/console/misc/docker/Dockerfile
index 1d62bb0d7ae17..539ce9f4a351c 100644
--- a/console/misc/docker/Dockerfile
+++ b/console/misc/docker/Dockerfile
@@ -38,7 +38,7 @@ RUN yarn build
 
 # Pinned by rolling tag + multi-arch index digest so dependabot refreshes the
 # digest for security fixes.
-FROM nginxinc/nginx-unprivileged:alpine@sha256:c3fed6436b61d2bf2201ec032c35c000871f7ed062dea5d586bc6bf4d0fdd140
+FROM nginxinc/nginx-unprivileged:alpine@sha256:6a23acdfca2b9cfbcec61419e3f1426bcbedb91362f2f19306a8567423bb4612
 
 # Add labels
 LABEL maintainer="support@materialize.com" \

From 14043356aa54f3d18ea20ced502e2bf62f72bb37 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:56:13 +0200
Subject: [PATCH 27/94] build(deps): bump
 base_node_group::materialize-terraform-self-managed from 13.10.0 to 13.12.1
 in /test/terraform/aws-upgrade (#39242)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[base_node_group::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">base_node_group::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=base_node_group::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 4cd32013ddc47..df33ee43ef71f 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -74,7 +74,7 @@ module "vpc_cni" {
 }
 
 module "base_node_group" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks-node-group?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks-node-group?ref=v13.12.1"
 
   cluster_name                      = module.eks.cluster_name
   aws_region                        = var.aws_region

From 89a2ec40e188c95973c5a18585304263e5d9b81c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:56:29 +0200
Subject: [PATCH 28/94] build(deps): bump
 ec2nodeclass_generic::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-upgrade (#39241)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[ec2nodeclass_generic::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">ec2nodeclass_generic::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ec2nodeclass_generic::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index df33ee43ef71f..a71707618b34a 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -140,7 +140,7 @@ module "karpenter" {
 
 # Create a generic nodeclass and nodepool for system workloads
 module "ec2nodeclass_generic" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.12.1"
 
   name               = local.nodeclass_name_generic
   ami_selector_terms = local.ami_selector_terms

From 0f91c859e2c152452d1b48a4ce5d424bcf924bd1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:57:17 +0200
Subject: [PATCH 29/94] build(deps): bump
 database::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39240)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[database::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">database::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=database::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index a71707618b34a..917aed28000ea 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -254,7 +254,7 @@ module "self_signed_cluster_issuer" {
 
 # 5. Setup dedicated database instance for Materialize
 module "database" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/database?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/database?ref=v13.12.1"
 
   name_prefix               = var.name_prefix
   postgres_version          = "15"

From 054bc5bfec3be3c9d4e76a5766a171ac789fe330 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:57:33 +0200
Subject: [PATCH 30/94] build(deps): bump
 eks::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39239)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[eks::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">eks::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eks::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 917aed28000ea..8c5ad4d3e51d1 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -28,7 +28,7 @@ module "networking" {
 
 # 2. Create EKS cluster
 module "eks" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks?ref=v13.12.1"
 
   name_prefix                              = var.name_prefix
   cluster_version                          = "1.34"

From 52bfde4b3b02a45f84edd5d4ef6b0c7868b90006 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:57:58 +0200
Subject: [PATCH 31/94] build(deps): bump the simple group in /misc/wasm with 4
 updates (#39238)

Bumps the simple group in /misc/wasm with 4 updates:
[hyper-util](https://github.com/hyperium/hyper-util),
[sentry](https://github.com/getsentry/sentry-rust),
[sentry-tracing](https://github.com/getsentry/sentry-rust) and
[thiserror](https://github.com/dtolnay/thiserror).

Updates `hyper-util` from 0.1.20 to 0.1.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hyperium/hyper-util/releases">hyper-util's
releases</a>.</em></p>
<blockquote>
<h2>v0.1.21</h2>
<h2>Additions</h2>
<ul>
<li>Add crate-level documentation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/327">#327</a>)</li>
<li>Add <code>client::legacy::Builder::http2_header_table_size()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_concurrent_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_local_error_reset_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/277">#277</a>)</li>
<li>Add <code>client::legacy::connect::HttpConnector::set_mark()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/303">#303</a>)</li>
<li>Add <code>rt::tracing::WithSpanExecutor&lt;E&gt;</code>,
<code>hyper_util::rt::tracing::CurrentSpanExecutor&lt;E&gt;</code>, and
<code>hyper_util::rt::tracing::MkSpanExecutor&lt;E, F&gt;</code>
executors. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/323">#323</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>Fix <code>client::legacy::Client</code> so that it properly
validates CONNECT responses. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/315">#315</a>)</li>
<li>Fix <code>client::legacy::Client</code> to cancel the idle interval
once its pool empties. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/292">#292</a>)</li>
<li>Fix <code>client::legacy::Client</code> to properly handle IPv6
addresses when using a SOCKS proxy. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)</li>
<li>Fix <code>client::pool::cache</code> to preserve readiness with
clones. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/297">#297</a>)</li>
<li>Fix <code>client::pool::cache</code> to wake its waiters in FIFO
order. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/298">#298</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to properly
handle cancellation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/299">#299</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to share errors
with all waiters. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/296">#296</a>)</li>
<li>Fix <code>client::proxy::matcher</code> handling for IP wildcards.
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/309">#309</a>)</li>
<li>The <code>tokio/net</code> feature is narrowed to the
<code>client-legacy</code> feature flag, from the <code>client</code>
feature flag. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/276">#276</a>)</li>
<li>Various fixes to the <code>client::legacy::Client</code>'s SOCKS
proxying. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/307">#307</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/308">#308</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/310">#310</a>)</li>
</ul>
<h2>Changes</h2>
<p>This release contains a minor behavioral change for users of the
<code>tracing</code>
feature flag to be aware of.</p>
<p>This feature flag was introduced in v0.1.11. When enabled,
<code>rt::TokioExecutor&lt;E&gt;</code> began propagating the currently
active <code>tracing::Span</code>
to spawned tasks when <code>hyper::rt::Executor::execute()</code> is
called. This caused
issues for some users, due to background tasks keeping a span open for
the
duration of a long-lived connection.</p>
<p>This behavior has now been removed from
<code>rt::TokioExecutor&lt;E&gt;</code>
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/322">#322</a>)
by default. A
collection of executor wrappers have been added to a new
<code>rt::tracing</code>
submodule, to provide facilities for instrumenting a client or server's
spawned
tasks. See the module-level documentation of <code>rt::tracing</code>
for more
information.</p>
<p>To temporarily preserve the previous
<code>rt::TokioExecutor&lt;E&gt;</code> span propagation
behavior, enable the <code>rt-tracing-exec-force</code> feature. Note
that this feature
flag will be removed in a future release.</p>
<p>This release bumps the minimal supported Rust version (MSRV) from
1.64 to 1.85.</p>
<p>This release bumps the rust edition from 2021 to 2024.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperium/hyper-util/blob/master/CHANGELOG.md">hyper-util's
changelog</a>.</em></p>
<blockquote>
<h1>0.1.21 (2026-09-24)</h1>
<p>This release bumps the minimal supported Rust version (MSRV) from
1.64 to 1.85.</p>
<p>This release bumps the rust edition from 2021 to 2024.</p>
<h2>Additions</h2>
<ul>
<li>Add crate-level documentation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/327">#327</a>)</li>
<li>Add <code>client::legacy::Builder::http2_header_table_size()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_concurrent_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_local_error_reset_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/277">#277</a>)</li>
<li>Add <code>client::legacy::connect::HttpConnector::set_mark()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/303">#303</a>)</li>
<li>Add <code>rt::tracing::WithSpanExecutor&lt;E&gt;</code>,
<code>hyper_util::rt::tracing::CurrentSpanExecutor&lt;E&gt;</code>, and
<code>hyper_util::rt::tracing::MkSpanExecutor&lt;E, F&gt;</code>
executors. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/323">#323</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>Fix <code>client::legacy::Client</code> so that it properly
validates CONNECT responses. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/315">#315</a>)</li>
<li>Fix <code>client::legacy::Client</code> to cancel the idle interval
once its pool empties. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/292">#292</a>)</li>
<li>Fix <code>client::legacy::Client</code> to properly handle IPv6
addresses when using a SOCKS proxy. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)</li>
<li>Fix <code>client::pool::cache</code> to preserve readiness with
clones. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/297">#297</a>)</li>
<li>Fix <code>client::pool::cache</code> to wake its waiters in FIFO
order. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/298">#298</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to properly
handle cancellation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/299">#299</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to share errors
with all waiters. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/296">#296</a>)</li>
<li>Fix <code>client::proxy::matcher</code> handling for IP wildcards.
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/309">#309</a>)</li>
<li>The <code>tokio/net</code> feature is narrowed to the
<code>client-legacy</code> feature flag, from the <code>client</code>
feature flag. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/276">#276</a>)</li>
<li>Various fixes to the <code>client::legacy::Client</code>'s SOCKS
proxying. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/307">#307</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/308">#308</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/310">#310</a>)</li>
</ul>
<h2>Changes</h2>
<p>This release contains a minor behavioral change for users of the
<code>tracing</code>
feature flag to be aware of.</p>
<p>This feature flag was introduced in v0.1.11. When enabled,
<code>rt::TokioExecutor&lt;E&gt;</code> began propagating the currently
active <code>tracing::Span</code>
to spawned tasks when <code>hyper::rt::Executor::execute()</code> is
called. This caused
issues for some users, due to background tasks keeping a span open for
the
duration of a long-lived connection.</p>
<p>This behavior has now been removed from
<code>rt::TokioExecutor&lt;E&gt;</code>
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/322">#322</a>)
by default. A
collection of executor wrappers have been added to a new
<code>rt::tracing</code>
submodule, to provide facilities for instrumenting a client or server's
spawned
tasks. See the module-level documentation of <code>rt::tracing</code>
for more
information.</p>
<p>To temporarily preserve the previous
<code>rt::TokioExecutor&lt;E&gt;</code> span propagation
behavior, enable the <code>rt-tracing-exec-force</code> feature. Note
that this feature
flag will be removed in a future release.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperium/hyper-util/commit/23a868965964c1d6bb1b94f30ba4c420a4bebe7c"><code>23a8689</code></a>
v0.1.21</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/cdb2346fed0af8283d5358d1d3fd5f5064db41d7"><code>cdb2346</code></a>
doc(client/pool): add <code>broken_intra_doc_links</code> allowance (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/326">#326</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/13b61105d417524c2c5b4738d6907a7534dda858"><code>13b6110</code></a>
chore(error): remove disabled <code>hyper_util::error</code> submodule
(<a
href="https://redirect.github.com/hyperium/hyper-util/issues/325">#325</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/b9ee45111645900e0557aecd9f19cfb5fd01d77f"><code>b9ee451</code></a>
docs(lib): add crate-level documentation (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/327">#327</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/d6b7d7e6a0fc568a1485a8199254305be50dde26"><code>d6b7d7e</code></a>
feat(rt/tracing): introduce tracing executors (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/323">#323</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/f2da9150f081a6a74e40bd82b0b51f91216fa23b"><code>f2da915</code></a>
feat(client): add HttpConnector::set_mark for SO_MARK (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/303">#303</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/4dbd4945f566e2b2a40d247c4281164258bbe1a5"><code>4dbd494</code></a>
feat(rt): change <code>TokioExecutor</code> to not trace, add
rt-tracing-exec-force feat...</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/d480d9f802c7062cb0aeece9ee0020ecce840521"><code>d480d9f</code></a>
fix(client): parse proxy CONNECT response with httparse (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/315">#315</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/7e0958bb537fb8b7901bae60d43a322c8f9a8a63"><code>7e0958b</code></a>
chore(ci): simplify msrv check (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/317">#317</a>)</li>
<li><a
href="https://github.com/hyperium/hyper-util/commit/07345689c815e115e616ce78a6a02c5df6c7081f"><code>0734568</code></a>
chore(ci): update to actions/checkout@v7 (<a
href="https://redirect.github.com/hyperium/hyper-util/issues/316">#316</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/hyperium/hyper-util/compare/v0.1.20...v0.1.21">compare
view</a></li>
</ul>
</details>
<br />

Updates `sentry` from 0.49.2 to 0.49.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/releases">sentry's
releases</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md">sentry's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/ad0b3c1e5f1e9caeb028b953ee39adf8e000f99d"><code>ad0b3c1</code></a>
release: 0.49.3</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/31a4c96e507374b6b495bf7de7274f4c8dcb169a"><code>31a4c96</code></a>
meta(changelog): Fix the disabled tracing changelog entry (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1325">#1325</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/5bb564d6e5aa6f8ae71b9ffc07866904a52134b4"><code>5bb564d</code></a>
build(cargo): Bump <code>rustls</code> to <code>0.23.45</code> (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1324">#1324</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/3b6d992877d33481042786c1d2899f58a8228019"><code>3b6d992</code></a>
feat(core): Make transport channel capacity configurable (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/cbed0fa23f6fe3daefb3b56384bd66bbf21f0575"><code>cbed0fa</code></a>
feat(minidump): Add <code>sentry-minidump</code> integration (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1315">#1315</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/715a9ec0eb1cc77491823c47752a433744a6ac06"><code>715a9ec</code></a>
ref(lints): Enforce <code>missing_docs</code> lint globally (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1321">#1321</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/abecd69eaf82cca2a0665bfb1cd545cd746c6b95"><code>abecd69</code></a>
ref(tests): No integration test crate for shared logic (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1320">#1320</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/70a12054f8e19f4c20ce463358ae1a0ff70a8a32"><code>70a1205</code></a>
ref(clippy): Enable <code>impl_trait_in_params</code> lint (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1319">#1319</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/4427186e47634f3ada112aac860f69596e787030"><code>4427186</code></a>
chore(core): Implement disabled tracing semantics (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1286">#1286</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/c0b9a822235879f03d5e27739e34b452679f3408"><code>c0b9a82</code></a>
chore(core): Deprecate <code>is_sampled</code> methods (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `sentry-tracing` from 0.49.2 to 0.49.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/releases">sentry-tracing's
releases</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/getsentry/sentry-rust/blob/master/CHANGELOG.md">sentry-tracing's
changelog</a>.</em></p>
<blockquote>
<h2>0.49.3</h2>
<h3>Features</h3>
<ul>
<li>Added the <code>sentry-minidump</code> integration, which captures
native crashes as minidumps in a separate process and sends them to
Sentry as attachments. Enable it with the <code>minidump</code> feature
on <code>sentry</code>. Linux, macOS and Windows only (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1315">#1315</a>).</li>
<li>Added a <code>transport_channel_capacity</code> option to <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.ClientOptions.html"><code>ClientOptions</code></a>,
making the transport's channel capacity configurable. The <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.StdTransportThreadOptions.html#method.with_channel_capacity"><code>StdTransportThreadOptions::with_channel_capacity</code></a>
and <a
href="https://docs.rs/sentry/0.49.3/sentry/transports/struct.TokioTransportThreadOptions.html#method.with_channel_capacity"><code>TokioTransportThreadOptions::with_channel_capacity</code></a>
methods provide the same configuration when constructing transport
threads. When unset, each transport uses its own default (currently
<code>30</code>), which is subject to change (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>).</li>
<li>The Tower integration's <a
href="https://docs.rs/sentry-tower/0.49.3/sentry_tower/struct.SentryHttpLayer.html"><code>SentryHttpLayer</code></a>
now records the <a
href="https://getsentry.github.io/sentry-conventions/attributes/http/"><code>http.response.status_code</code></a>
attribute on transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1253">#1253</a>).</li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Deprecated <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Transaction.html#method.is_sampled"><code>Transaction::is_sampled</code></a>,
<a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/struct.Span.html#method.is_sampled"><code>Span::is_sampled</code></a>,
and <a
href="https://docs.rs/sentry-core/0.49.3/sentry_core/enum.TransactionOrSpan.html#method.is_sampled"><code>TransactionOrSpan::is_sampled</code></a>.
These methods cannot distinguish between an unsampled transaction or
span and a deferred sampling decision when tracing is disabled (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1293">#1293</a>).</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Corrected disabled tracing behavior: transactions and spans are
ignored without generating discarded-data client reports, and locally
started traces leave the sampling decision unset rather than marking the
trace as unsampled. Incoming sampling decisions are preserved in
outgoing <code>sentry-trace</code> headers without enabling local
capture. An explicit <code>0.0</code> trace sample rate remains distinct
from disabled tracing and continues to generate client reports for
locally unsampled transactions (<a
href="https://redirect.github.com/getsentry/sentry-rust/pull/1286">#1286</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/ad0b3c1e5f1e9caeb028b953ee39adf8e000f99d"><code>ad0b3c1</code></a>
release: 0.49.3</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/31a4c96e507374b6b495bf7de7274f4c8dcb169a"><code>31a4c96</code></a>
meta(changelog): Fix the disabled tracing changelog entry (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1325">#1325</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/5bb564d6e5aa6f8ae71b9ffc07866904a52134b4"><code>5bb564d</code></a>
build(cargo): Bump <code>rustls</code> to <code>0.23.45</code> (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1324">#1324</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/3b6d992877d33481042786c1d2899f58a8228019"><code>3b6d992</code></a>
feat(core): Make transport channel capacity configurable (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1311">#1311</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/cbed0fa23f6fe3daefb3b56384bd66bbf21f0575"><code>cbed0fa</code></a>
feat(minidump): Add <code>sentry-minidump</code> integration (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1315">#1315</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/715a9ec0eb1cc77491823c47752a433744a6ac06"><code>715a9ec</code></a>
ref(lints): Enforce <code>missing_docs</code> lint globally (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1321">#1321</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/abecd69eaf82cca2a0665bfb1cd545cd746c6b95"><code>abecd69</code></a>
ref(tests): No integration test crate for shared logic (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1320">#1320</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/70a12054f8e19f4c20ce463358ae1a0ff70a8a32"><code>70a1205</code></a>
ref(clippy): Enable <code>impl_trait_in_params</code> lint (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1319">#1319</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/4427186e47634f3ada112aac860f69596e787030"><code>4427186</code></a>
chore(core): Implement disabled tracing semantics (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1286">#1286</a>)</li>
<li><a
href="https://github.com/getsentry/sentry-rust/commit/c0b9a822235879f03d5e27739e34b452679f3408"><code>c0b9a82</code></a>
chore(core): Deprecate <code>is_sampled</code> methods (<a
href="https://redirect.github.com/getsentry/sentry-rust/issues/1293">#1293</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/getsentry/sentry-rust/compare/0.49.2...0.49.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `thiserror` from 2.0.20 to 2.0.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dtolnay/thiserror/releases">thiserror's
releases</a>.</em></p>
<blockquote>
<h2>2.0.21</h2>
<ul>
<li>Fix parsing of generic unit variants in display expressions (<a
href="https://redirect.github.com/dtolnay/thiserror/issues/459">#459</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dtolnay/thiserror/commit/b1827ee06f81a7d7f954e676771e19a97f9f8e3b"><code>b1827ee</code></a>
Release 2.0.21</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/58037b575a2a5543d0d54a49360554325b49f55a"><code>58037b5</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/thiserror/issues/459">#459</a>
from dtolnay/turbofish</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/f82a0cf8f06c71263c2caa26e759f337d2778153"><code>f82a0cf</code></a>
Keep track of nested turbofish depth</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/72ea49262d6412ccbc08f1696dda8626409e657d"><code>72ea492</code></a>
Raise required compiler to Rust 1.77</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/72eea0d4ddb17ff9fa873aa74469de850021b22e"><code>72eea0d</code></a>
Resolve io_other_error clippy lint in tests</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/07f09a2ec934df58508ce4fa5e7fbf27cca552c2"><code>07f09a2</code></a>
Raise required compiler to Rust 1.74</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/2715388e8cc5787b3643251f7a7a637e89376688"><code>2715388</code></a>
Update ui test suite to nightly-2026-09-22</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/5a306c7d0a8588caaaaa6a7567aeb25c1c10719b"><code>5a306c7</code></a>
Update ui test suite to nightly-2026-09-05</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/ef9383b37d7c96b01e10df35d3e9e313c7b98b5a"><code>ef9383b</code></a>
Update ui test suite to nightly-2026-08-22</li>
<li><a
href="https://github.com/dtolnay/thiserror/commit/8336b8407fbfe69177c504cdbc379db20cf6f131"><code>8336b84</code></a>
Update ui tests for version 2.0.20</li>
<li>See full diff in <a
href="https://github.com/dtolnay/thiserror/compare/2.0.20...2.0.21">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 misc/wasm/Cargo.lock | 159 +++++++++++++++++++++++++++++--------------
 1 file changed, 107 insertions(+), 52 deletions(-)

diff --git a/misc/wasm/Cargo.lock b/misc/wasm/Cargo.lock
index 9d7018742b32f..a65996ba041c6 100644
--- a/misc/wasm/Cargo.lock
+++ b/misc/wasm/Cargo.lock
@@ -134,6 +134,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -186,6 +192,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -202,6 +219,15 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -447,10 +473,22 @@ checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 5.2.0",
  "wasi 0.14.2+wasi-0.2.4",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "gimli"
 version = "0.31.1"
@@ -459,9 +497,9 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "h2"
-version = "0.4.10"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -546,9 +584,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.8.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -561,7 +599,6 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "pin-utils",
  "smallvec",
  "tokio",
  "want",
@@ -598,16 +635,17 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http",
  "http-body",
+ "httparse",
  "hyper",
  "ipnet",
  "libc",
@@ -946,7 +984,7 @@ dependencies = [
  "sentry-tracing",
  "serde",
  "stacker",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio-native-tls",
  "tonic",
  "tracing",
@@ -1007,7 +1045,7 @@ dependencies = [
  "mz-walkabout",
  "serde",
  "smallvec",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tracing",
 ]
 
@@ -1028,7 +1066,7 @@ dependencies = [
  "itertools",
  "mz-sql-parser",
  "pretty",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -1233,7 +1271,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tracing",
 ]
 
@@ -1263,7 +1301,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prost",
  "reqwest",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "tokio",
  "tonic",
  "tonic-types",
@@ -1294,8 +1332,8 @@ dependencies = [
  "opentelemetry",
  "percent-encoding",
  "portable-atomic",
- "rand",
- "thiserror 2.0.20",
+ "rand 0.9.5",
+ "thiserror 2.0.21",
  "tokio",
  "tokio-stream",
 ]
@@ -1436,12 +1474,6 @@ version = "0.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
 
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
-
 [[package]]
 name = "pkg-config"
 version = "0.3.32"
@@ -1501,7 +1533,7 @@ dependencies = [
  "memchr",
  "parking_lot",
  "protobuf",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
 ]
 
 [[package]]
@@ -1581,6 +1613,12 @@ version = "5.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.9.5"
@@ -1588,7 +1626,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha",
- "rand_core",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1598,7 +1647,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.3",
 ]
 
 [[package]]
@@ -1607,9 +1656,15 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom",
+ "getrandom 0.3.3",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.12"
@@ -1654,7 +1709,7 @@ version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -1780,9 +1835,9 @@ checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 
 [[package]]
 name = "sentry"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a88b65feb368d9dde5d531a2b59b25016e36fd6e4978432371a3ee77746ca2"
+checksum = "9fa951f4e644464ebfd2347a7ab03b0828c512d2448a76262cad2607b343dff4"
 dependencies = [
  "cfg_aliases",
  "httpdate",
@@ -1799,9 +1854,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-backtrace"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c51511d67ed670266a93afeaa26a08019b04ad1420cb9191da30f2338d22c48"
+checksum = "f4f27cf048aa63ccd5bc94c29989133eabb82e9c6bf7441b58e9d4a95837a105"
 dependencies = [
  "backtrace",
  "regex",
@@ -1810,9 +1865,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-contexts"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b757ac1f335856e8d7f5062a1fd9bc07a05a7eb3cc48247db79bf2618a490bd"
+checksum = "c5ed680585dbdacdf9859c2b4dc53358ff02bd256766882e22e343836db36b22"
 dependencies = [
  "hostname",
  "libc",
@@ -1824,11 +1879,11 @@ dependencies = [
 
 [[package]]
 name = "sentry-core"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d889520a375e5b93efb0a66def1630d21d168b0251eb55b286b03fa940ccfc84"
+checksum = "c3ed398494bb8fc412a11a182c1883a10ae147587b8f6314abd222d1d626f31b"
 dependencies = [
- "rand",
+ "rand 0.10.3",
  "sentry-types",
  "serde",
  "serde_json",
@@ -1837,9 +1892,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-debug-images"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "656487fd5f7b7c0105b2e82171982aac64489e0cb679436038febf070f2f76d6"
+checksum = "55854bb40681e84ffd2a69578ad4ef9bfaf5bf2bf1380a745578b591fa24af22"
 dependencies = [
  "findshlibs",
  "sentry-core",
@@ -1847,9 +1902,9 @@ dependencies = [
 
 [[package]]
 name = "sentry-tracing"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77796d14eedbef22c2fe78e9c69fb09f14c7ad607e624d48dce92eedc17a136e"
+checksum = "e7e7db1aefdf623f4e48e21ec9e4af535024187aeafb2a4cc7e29d035def5a13"
 dependencies = [
  "bitflags",
  "sentry-backtrace",
@@ -1860,16 +1915,16 @@ dependencies = [
 
 [[package]]
 name = "sentry-types"
-version = "0.49.2"
+version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc71f5ca55942d9b2901af95d5df5c5d65c164134c22a83682cac3d0b6c7ef2d"
+checksum = "1c18bf7b159bdfc7c8f97816f476b4947a1937fb6bea9d38d3479e58631614ac"
 dependencies = [
  "debugid",
  "hex",
- "rand",
+ "rand 0.10.3",
  "serde",
  "serde_json",
- "thiserror 2.0.20",
+ "thiserror 2.0.21",
  "time",
  "url",
  "uuid",
@@ -2082,11 +2137,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "thiserror-impl 2.0.20",
+ "thiserror-impl 2.0.21",
 ]
 
 [[package]]
@@ -2102,9 +2157,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2230,7 +2285,7 @@ checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
  "axum",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "flate2",
  "h2",
@@ -2461,7 +2516,7 @@ version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdc97a28575b85cfedf2a7e7d3cc64b3e11bd8ac766666318003abbacc7a21fc"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "der",
  "log",
  "native-tls",
@@ -2478,7 +2533,7 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d81f9efa9df032be5934a46a068815a10a042b494b6a58cb0a1a97bb5467ed6f"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "http",
  "httparse",
  "log",

From 7b2a312efb21225e0764bf33b8dce08faceb9d1d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:58:13 +0200
Subject: [PATCH 32/94] build(deps): bump
 storage::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39237)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[storage::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">storage::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=storage::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 8c5ad4d3e51d1..c1fbf3f73f23a 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -286,7 +286,7 @@ module "database" {
 
 # 6. Setup S3 bucket for Materialize
 module "storage" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/storage?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/storage?ref=v13.12.1"
 
   name_prefix            = var.name_prefix
   bucket_lifecycle_rules = []

From 17eddad1debaf4c82ead66dbc316b787e8960a5e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:58:38 +0200
Subject: [PATCH 33/94] build(deps): bump
 self_signed_cluster_issuer::materialize-terraform-self-managed from 13.10.0
 to 13.12.1 in /test/terraform/aws-upgrade (#39236)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[self_signed_cluster_issuer::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">self_signed_cluster_issuer::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=self_signed_cluster_issuer::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index c1fbf3f73f23a..6c70e5abc1393 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -243,7 +243,7 @@ module "cert_manager" {
 }
 
 module "self_signed_cluster_issuer" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.12.1"
 
   name_prefix = var.name_prefix
 

From c0fadb19b437d96ba32b7ccf02979685a8fe0555 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:58:52 +0200
Subject: [PATCH 34/94] build(deps): bump
 materialize_instance::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-upgrade (#39234)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[materialize_instance::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_instance::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=materialize_instance::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index 6c70e5abc1393..fa217447c78b9 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -354,7 +354,7 @@ module "operator" {
 
 # 8. Setup Materialize instance
 module "materialize_instance" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.12.1"
 
   instance_name        = local.materialize_instance_name
   instance_namespace   = local.materialize_instance_namespace

From 6db40b87a9101efb7b7da9612b0b3c43b179c03e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:59:08 +0200
Subject: [PATCH 35/94] build(deps): bump
 coredns::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-upgrade (#39233)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[coredns::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">coredns::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coredns::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-upgrade/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-upgrade/main.tf b/test/terraform/aws-upgrade/main.tf
index fa217447c78b9..b6efd1efd902c 100644
--- a/test/terraform/aws-upgrade/main.tf
+++ b/test/terraform/aws-upgrade/main.tf
@@ -102,7 +102,7 @@ module "base_node_group" {
 # v21 clusters do not bootstrap CoreDNS either, so the deployment, its service
 # account and the kube-dns Service are created here.
 module "coredns" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/coredns?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/coredns?ref=v13.12.1"
 
   node_selector                      = local.base_node_labels
   disable_default_coredns_autoscaler = false

From 9849703893120dfa63429af5d9a0037401be3695 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:59:25 +0200
Subject: [PATCH 36/94] build(deps): bump
 base_node_group::materialize-terraform-self-managed from 13.10.0 to 13.12.1
 in /test/terraform/aws-temporary (#39232)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[base_node_group::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">base_node_group::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=base_node_group::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index a77d11691bce0..3ed0b231a3924 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -74,7 +74,7 @@ module "vpc_cni" {
 }
 
 module "base_node_group" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks-node-group?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks-node-group?ref=v13.12.1"
 
   cluster_name                      = module.eks.cluster_name
   aws_region                        = var.aws_region

From 69302b011295628e7c8f03dc828a3a4c87dd5653 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:59:38 +0200
Subject: [PATCH 37/94] build(deps): bump
 nodepool_generic::materialize-terraform-self-managed from 13.10.0 to 13.12.1
 in /test/terraform/aws-temporary (#39230)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[nodepool_generic::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">nodepool_generic::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodepool_generic::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 3ed0b231a3924..f8a9a11a6e561 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -158,7 +158,7 @@ module "ec2nodeclass_generic" {
 }
 
 module "nodepool_generic" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.12.1"
 
   name            = local.nodeclass_name_generic
   nodeclass_name  = local.nodeclass_name_generic

From a1d1aaf49ed1002a15f380cbb9a7612be64083ee Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:00:08 +0200
Subject: [PATCH 38/94] build(deps): bump
 eks::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39219)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[eks::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">eks::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eks::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index f8a9a11a6e561..dd2d53e8601bf 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -28,7 +28,7 @@ module "networking" {
 
 # 2. Create EKS cluster
 module "eks" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks?ref=v13.12.1"
 
   name_prefix                              = var.name_prefix
   cluster_version                          = "1.34"

From 9a2fe1e52e64bbe7a81efe90e8df063eccc2433d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:00:20 +0200
Subject: [PATCH 39/94] build(deps): bump
 aws_lbc::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39220)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[aws_lbc::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">aws_lbc::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aws_lbc::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index dd2d53e8601bf..96f3153f537f3 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -210,7 +210,7 @@ module "nodepool_materialize" {
 
 # 3. Install AWS Load Balancer Controller
 module "aws_lbc" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/aws-lbc?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/aws-lbc?ref=v13.12.1"
 
   name_prefix       = var.name_prefix
   eks_cluster_name  = module.eks.cluster_name

From e61630da171b7ae30d54952e20d5d1ce923a462e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:00:34 +0200
Subject: [PATCH 40/94] build(deps): bump
 ec2nodeclass_materialize::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-temporary (#39221)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[ec2nodeclass_materialize::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">ec2nodeclass_materialize::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ec2nodeclass_materialize::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 96f3153f537f3..abcc83b749e70 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -175,7 +175,7 @@ module "nodepool_generic" {
 
 # Create a dedicated nodeclass and nodepool for Materialize pods
 module "ec2nodeclass_materialize" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.12.1"
 
   name               = local.nodeclass_name_materialize
   ami_selector_terms = local.ami_selector_terms

From d1133903045c145e0677cfffa9baad07ab099328 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:00:47 +0200
Subject: [PATCH 41/94] build(deps): bump
 storage::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39222)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[storage::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">storage::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=storage::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index abcc83b749e70..bf329a6552e91 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -286,7 +286,7 @@ module "database" {
 
 # 6. Setup S3 bucket for Materialize
 module "storage" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/storage?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/storage?ref=v13.12.1"
 
   name_prefix            = var.name_prefix
   bucket_lifecycle_rules = []

From 437ad2e830d890d4e41b7ff21b26ef69ae7b5ab3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:01:15 +0200
Subject: [PATCH 42/94] build(deps): bump
 networking::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39223)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[networking::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">networking::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=networking::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index bf329a6552e91..ea83c8a55e6d1 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -15,7 +15,7 @@ resource "random_password" "db_password" {
 
 # 1. Create network infrastructure
 module "networking" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/networking?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/networking?ref=v13.12.1"
 
   name_prefix          = var.name_prefix
   vpc_cidr             = "10.0.0.0/16"

From 5c9ffb14f9fa3445e20e698658203fc717ad42c1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:01:30 +0200
Subject: [PATCH 43/94] build(deps): bump
 coredns::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39224)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[coredns::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">coredns::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coredns::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index ea83c8a55e6d1..2254d7146128f 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -102,7 +102,7 @@ module "base_node_group" {
 # v21 clusters do not bootstrap CoreDNS either, so the deployment, its service
 # account and the kube-dns Service are created here.
 module "coredns" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/coredns?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/coredns?ref=v13.12.1"
 
   node_selector                      = local.base_node_labels
   disable_default_coredns_autoscaler = false

From 2292c4bc45245e4036bec38ef12cb4706452b043 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:01:44 +0200
Subject: [PATCH 44/94] build(deps): bump
 self_signed_cluster_issuer::materialize-terraform-self-managed from 13.10.0
 to 13.12.1 in /test/terraform/aws-temporary (#39225)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[self_signed_cluster_issuer::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">self_signed_cluster_issuer::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=self_signed_cluster_issuer::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 2254d7146128f..cffa0259bd0e2 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -243,7 +243,7 @@ module "cert_manager" {
 }
 
 module "self_signed_cluster_issuer" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.12.1"
 
   name_prefix = var.name_prefix
 

From b1a3284b01da99c5ac546254cb957eb3232678b7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:01:59 +0200
Subject: [PATCH 45/94] build(deps): bump
 vpc_cni::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39226)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[vpc_cni::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">vpc_cni::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vpc_cni::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index cffa0259bd0e2..39342c8d05411 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -50,7 +50,7 @@ module "eks" {
 # nodes cannot become Ready without one, so it must be installed before any
 # node group.
 module "vpc_cni" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/vpc-cni?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/vpc-cni?ref=v13.12.1"
 
   name_prefix       = var.name_prefix
   oidc_provider_arn = module.eks.oidc_provider_arn

From 0ffa01e233aa7a4a68b62e95c72fcd4494d3a81f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:02:12 +0200
Subject: [PATCH 46/94] build(deps): bump
 ec2nodeclass_generic::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-temporary (#39227)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[ec2nodeclass_generic::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">ec2nodeclass_generic::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ec2nodeclass_generic::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 39342c8d05411..fb4dbdfc33cf7 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -140,7 +140,7 @@ module "karpenter" {
 
 # Create a generic nodeclass and nodepool for system workloads
 module "ec2nodeclass_generic" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.12.1"
 
   name               = local.nodeclass_name_generic
   ami_selector_terms = local.ami_selector_terms

From 1c93ecba8a47a96232153e917ad4b256200cb8a8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:02:28 +0200
Subject: [PATCH 47/94] build(deps): bump
 database::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39228)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[database::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">database::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=database::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index fb4dbdfc33cf7..00bb8e100da75 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -254,7 +254,7 @@ module "self_signed_cluster_issuer" {
 
 # 5. Setup dedicated database instance for Materialize
 module "database" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/database?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/database?ref=v13.12.1"
 
   name_prefix               = var.name_prefix
   postgres_version          = "15"

From dc992259bbf063ebb27d8f69957a69eccd548920 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:02:43 +0200
Subject: [PATCH 48/94] build(deps): bump
 materialize_instance::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-temporary (#39229)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[materialize_instance::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_instance::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=materialize_instance::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 00bb8e100da75..173c269db2a3b 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -354,7 +354,7 @@ module "operator" {
 
 # 8. Setup Materialize instance
 module "materialize_instance" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.12.1"
 
   instance_name        = local.materialize_instance_name
   instance_namespace   = local.materialize_instance_namespace

From 8ac99efcffa206483aed211343c6faffb5b0f846 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:03:09 +0200
Subject: [PATCH 49/94] build(deps): bump
 karpenter::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39218)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[karpenter::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">karpenter::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=karpenter::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 173c269db2a3b..56c0e5796c7a4 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -121,7 +121,7 @@ module "coredns" {
 }
 
 module "karpenter" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter?ref=v13.12.1"
 
   name_prefix             = var.name_prefix
   cluster_name            = module.eks.cluster_name

From 1a5e6b3afed624425655adcdfe21652b6ed68088 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:03:34 +0200
Subject: [PATCH 50/94] build(deps): bump
 cert_manager::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39217)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[cert_manager::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">cert_manager::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cert_manager::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 56c0e5796c7a4..486a71cdf9a37 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -230,7 +230,7 @@ module "aws_lbc" {
 
 # 4. Install Certificate Manager for TLS
 module "cert_manager" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.12.1"
 
   node_selector = local.generic_node_labels
 

From 0ad44d0def7fb349f7400d36665946b04fb61748 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:03:47 +0200
Subject: [PATCH 51/94] build(deps): bump
 operator::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-temporary (#39216)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[operator::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">operator::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=operator::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index 486a71cdf9a37..f28de518a815a 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -311,7 +311,7 @@ module "storage" {
 
 # 7. Install Materialize Operator
 module "operator" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/operator?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/operator?ref=v13.12.1"
 
   name_prefix    = var.name_prefix
   aws_region     = var.aws_region

From 231ade674b9f6852de190bcd62c2f136b0da5059 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:04:00 +0200
Subject: [PATCH 52/94] build(deps): bump
 nodepool_materialize::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-temporary (#39215)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[nodepool_materialize::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">nodepool_materialize::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodepool_materialize::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-temporary/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-temporary/main.tf b/test/terraform/aws-temporary/main.tf
index f28de518a815a..b6efd1efd902c 100644
--- a/test/terraform/aws-temporary/main.tf
+++ b/test/terraform/aws-temporary/main.tf
@@ -192,7 +192,7 @@ module "ec2nodeclass_materialize" {
 }
 
 module "nodepool_materialize" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.12.1"
 
   name            = local.nodeclass_name_materialize
   nodeclass_name  = local.nodeclass_name_materialize

From 574f6816c673a2eb8d03967e54ca06f313054cba Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:04:14 +0200
Subject: [PATCH 53/94] build(deps): bump
 aws_lbc::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39214)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[aws_lbc::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">aws_lbc::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aws_lbc::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 28c80ab42459e..766a94a7695ff 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -210,7 +210,7 @@ module "nodepool_materialize" {
 
 # 3. Install AWS Load Balancer Controller
 module "aws_lbc" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/aws-lbc?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/aws-lbc?ref=v13.12.1"
 
   name_prefix       = var.name_prefix
   eks_cluster_name  = module.eks.cluster_name

From 7b8168aad605d0fbfa6be7822d07444b41f710b1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:04:30 +0200
Subject: [PATCH 54/94] build(deps): bump
 karpenter::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39213)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[karpenter::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">karpenter::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=karpenter::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 766a94a7695ff..3eafc2df82513 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -121,7 +121,7 @@ module "coredns" {
 }
 
 module "karpenter" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter?ref=v13.12.1"
 
   name_prefix             = var.name_prefix
   cluster_name            = module.eks.cluster_name

From 9ee560b17438b0cdb901d37b65fd2e84dbaa7230 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:04:43 +0200
Subject: [PATCH 55/94] build(deps): bump
 database::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39212)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[database::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">database::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=database::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 3eafc2df82513..961db4ab4d45d 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -254,7 +254,7 @@ module "self_signed_cluster_issuer" {
 
 # 5. Setup dedicated database instance for Materialize
 module "database" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/database?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/database?ref=v13.12.1"
 
   name_prefix               = var.name_prefix
   postgres_version          = "15"

From 50cf98dd6a8b5f77c833e3de41068b9d1ef8bd95 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:04:58 +0200
Subject: [PATCH 56/94] build(deps): bump
 coredns::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39211)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[coredns::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">coredns::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coredns::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 961db4ab4d45d..7dc0db21fc643 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -102,7 +102,7 @@ module "base_node_group" {
 # v21 clusters do not bootstrap CoreDNS either, so the deployment, its service
 # account and the kube-dns Service are created here.
 module "coredns" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/coredns?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/coredns?ref=v13.12.1"
 
   node_selector                      = local.base_node_labels
   disable_default_coredns_autoscaler = false

From 95de8c1cf782831394b034093c1d6888ed06ae2a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:05:13 +0200
Subject: [PATCH 57/94] build(deps): bump
 networking::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39210)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[networking::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">networking::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=networking::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 7dc0db21fc643..29cca848b5133 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -15,7 +15,7 @@ resource "random_password" "db_password" {
 
 # 1. Create network infrastructure
 module "networking" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/networking?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/networking?ref=v13.12.1"
 
   name_prefix          = var.name_prefix
   vpc_cidr             = "10.0.0.0/16"

From 51088f277541165450e6882d672a049c87931848 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:05:46 +0200
Subject: [PATCH 58/94] build(deps): bump
 materialize_instance::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-persistent (#39209)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[materialize_instance::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_instance::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=materialize_instance::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 29cca848b5133..135fa92a47eda 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -348,7 +348,7 @@ module "operator" {
 
 # 8. Setup Materialize instance
 module "materialize_instance" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/materialize-instance?ref=v13.12.1"
 
   instance_name        = local.materialize_instance_name
   instance_namespace   = local.materialize_instance_namespace

From 1416cf3df3979a59b398a4562c8bb1c5ab41293c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:06:00 +0200
Subject: [PATCH 59/94] build(deps): bump
 operator::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39208)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[operator::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">operator::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=operator::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 135fa92a47eda..06b2f2c91ade7 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -305,7 +305,7 @@ module "storage" {
 
 # 7. Install Materialize Operator
 module "operator" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/operator?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/operator?ref=v13.12.1"
 
   name_prefix    = var.name_prefix
   aws_region     = var.aws_region

From 138156bc20343002156c74953c4a1a679c1db526 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:06:13 +0200
Subject: [PATCH 60/94] build(deps): bump
 nodepool_generic::materialize-terraform-self-managed from 13.10.0 to 13.12.1
 in /test/terraform/aws-persistent (#39207)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[nodepool_generic::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">nodepool_generic::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodepool_generic::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 06b2f2c91ade7..33834234788e6 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -158,7 +158,7 @@ module "ec2nodeclass_generic" {
 }
 
 module "nodepool_generic" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.12.1"
 
   name            = local.nodeclass_name_generic
   nodeclass_name  = local.nodeclass_name_generic

From 0d9e5521647172801b356c78d5f35bb15d243c4d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:06:28 +0200
Subject: [PATCH 61/94] build(deps): bump
 base_node_group::materialize-terraform-self-managed from 13.10.0 to 13.12.1
 in /test/terraform/aws-persistent (#39206)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[base_node_group::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">base_node_group::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=base_node_group::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 33834234788e6..cf96bd7facef3 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -74,7 +74,7 @@ module "vpc_cni" {
 }
 
 module "base_node_group" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks-node-group?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks-node-group?ref=v13.12.1"
 
   cluster_name                      = module.eks.cluster_name
   aws_region                        = var.aws_region

From 0eae824a7220bc79d2ea7f623bc436f6c40e7634 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:06:41 +0200
Subject: [PATCH 62/94] build(deps): bump
 vpc_cni::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39205)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[vpc_cni::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">vpc_cni::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vpc_cni::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index cf96bd7facef3..a58aa7559dc28 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -50,7 +50,7 @@ module "eks" {
 # nodes cannot become Ready without one, so it must be installed before any
 # node group.
 module "vpc_cni" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/vpc-cni?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/vpc-cni?ref=v13.12.1"
 
   name_prefix       = var.name_prefix
   oidc_provider_arn = module.eks.oidc_provider_arn

From 830dfb86bd3901962b5b329a1f228b9d086d4264 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:06:56 +0200
Subject: [PATCH 63/94] build(deps): bump
 ec2nodeclass_generic::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-persistent (#39204)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[ec2nodeclass_generic::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">ec2nodeclass_generic::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ec2nodeclass_generic::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index a58aa7559dc28..81372cdba9a55 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -140,7 +140,7 @@ module "karpenter" {
 
 # Create a generic nodeclass and nodepool for system workloads
 module "ec2nodeclass_generic" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.12.1"
 
   name               = local.nodeclass_name_generic
   ami_selector_terms = local.ami_selector_terms

From 54d4e01bc1f3ec89d87dee64aa6da6ca9cba4b75 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:07:12 +0200
Subject: [PATCH 64/94] build(deps): bump
 ec2nodeclass_materialize::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-persistent (#39203)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[ec2nodeclass_materialize::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">ec2nodeclass_materialize::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ec2nodeclass_materialize::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 81372cdba9a55..cf2ce285c8b5e 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -175,7 +175,7 @@ module "nodepool_generic" {
 
 # Create a dedicated nodeclass and nodepool for Materialize pods
 module "ec2nodeclass_materialize" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-ec2nodeclass?ref=v13.12.1"
 
   name               = local.nodeclass_name_materialize
   ami_selector_terms = local.ami_selector_terms

From eb2124102a78b04e03c21cffc7437389e3655c7a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:08:07 +0200
Subject: [PATCH 65/94] build(deps): bump
 eks::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39202)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[eks::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">eks::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=eks::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index cf2ce285c8b5e..68a5cbaec7078 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -28,7 +28,7 @@ module "networking" {
 
 # 2. Create EKS cluster
 module "eks" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/eks?ref=v13.12.1"
 
   name_prefix                              = var.name_prefix
   cluster_version                          = "1.32"

From 3dac47e648e46dfd150bceac1b41c0984b98773d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:08:22 +0200
Subject: [PATCH 66/94] build(deps): bump
 nodepool_materialize::materialize-terraform-self-managed from 13.10.0 to
 13.12.1 in /test/terraform/aws-persistent (#39201)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[nodepool_materialize::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">nodepool_materialize::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodepool_materialize::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 68a5cbaec7078..3e2aacab1c741 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -192,7 +192,7 @@ module "ec2nodeclass_materialize" {
 }
 
 module "nodepool_materialize" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/karpenter-nodepool?ref=v13.12.1"
 
   name            = local.nodeclass_name_materialize
   nodeclass_name  = local.nodeclass_name_materialize

From 4d84e037ab4540daa438f375187359055a155e4a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:08:37 +0200
Subject: [PATCH 67/94] build(deps): bump
 self_signed_cluster_issuer::materialize-terraform-self-managed from 13.10.0
 to 13.12.1 in /test/terraform/aws-persistent (#39200)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[self_signed_cluster_issuer::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">self_signed_cluster_issuer::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=self_signed_cluster_issuer::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 3e2aacab1c741..c2e05b177d590 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -243,7 +243,7 @@ module "cert_manager" {
 }
 
 module "self_signed_cluster_issuer" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/self-signed-cluster-issuer?ref=v13.12.1"
 
   name_prefix = var.name_prefix
 

From 2322fc7509faad664774cfff3332af55dc777511 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:09:03 +0200
Subject: [PATCH 68/94] build(deps): bump the simple group across 1 directory
 with 8 updates (#39272)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the simple group with 8 updates in the /ci/builder directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.88` | `1.43.102` |
| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.6.3` |
`4.6.4` |
| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.11.1` |
`3.11.2` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.0` |
| [pymysql](https://github.com/PyMySQL/PyMySQL) | `1.2.0` | `1.2.3` |
| [semver](https://github.com/python-semver/python-semver) | `3.0.4` |
`3.1.0` |
| [build](https://github.com/pypa/build) | `1.6.0` | `1.6.1` |
| [hatchling](https://github.com/pypa/hatch) | `1.32.0` | `1.32.4` |


Updates `boto3` from 1.43.88 to 1.43.102
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/boto/boto3/commit/da00dd2d4b31a8fa77d8a10aff153f42175404bf"><code>da00dd2</code></a>
Merge branch 'release-1.43.102'</li>
<li><a
href="https://github.com/boto/boto3/commit/551d660d2c3ef8fedeb0eb40973094c995776857"><code>551d660</code></a>
Bumping version to 1.43.102</li>
<li><a
href="https://github.com/boto/boto3/commit/f63e52e1baa89630baac4975fa46057388cab6f0"><code>f63e52e</code></a>
Add changelog entries from botocore</li>
<li><a
href="https://github.com/boto/boto3/commit/a1acf79e6beaf80ae73eff47fbe81b052b9c14f8"><code>a1acf79</code></a>
Merge branch 'release-1.43.101'</li>
<li><a
href="https://github.com/boto/boto3/commit/931d5a2314056f6e3eefbe0d1ce2e3e19ee18c43"><code>931d5a2</code></a>
Merge branch 'release-1.43.101' into develop</li>
<li><a
href="https://github.com/boto/boto3/commit/8c719efadb1fb3bc606ebd849a70610416ad0121"><code>8c719ef</code></a>
Bumping version to 1.43.101</li>
<li><a
href="https://github.com/boto/boto3/commit/7a0087dd65a461194743ccb1c9bfb378e7256042"><code>7a0087d</code></a>
Add changelog entries from botocore</li>
<li><a
href="https://github.com/boto/boto3/commit/50dcfb23f7007694067549bff55036292db1cdc1"><code>50dcfb2</code></a>
Bump the github-actions group across 1 directory with 4 updates (<a
href="https://redirect.github.com/boto/boto3/issues/4853">#4853</a>)</li>
<li><a
href="https://github.com/boto/boto3/commit/b9fcb1869fe9907a77aa024dba34019fcd828da4"><code>b9fcb18</code></a>
Bump <a
href="https://github.com/astral-sh/ruff-pre-commit">https://github.com/astral-sh/ruff-pre-commit</a>
(<a
href="https://redirect.github.com/boto/boto3/issues/4849">#4849</a>)</li>
<li><a
href="https://github.com/boto/boto3/commit/2b8c4ed93e6894617dd47fbd6d7957ff75e60403"><code>2b8c4ed</code></a>
Merge branch 'release-1.43.100'</li>
<li>Additional commits viewable in <a
href="https://github.com/boto/boto3/compare/1.43.88...1.43.102">compare
view</a></li>
</ul>
</details>
<br />

Updates `jupyterlab` from 4.6.3 to 4.6.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jupyterlab/jupyterlab/releases">jupyterlab's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.4</h2>
<h2>4.6.4</h2>
<p>(<a
href="https://github.com/jupyterlab/jupyterlab/compare/v4.6.3...1f9dbe334e7d21e4855c9a32c7cd642544ac20c4">Full
Changelog</a>)</p>
<h3>Security fixes</h3>
<ul>
<li>GHSA-3325-v43h-43rv - moderate</li>
<li>GHSA-6966-vjj6-99xv - high</li>
<li>GHSA-jwrc-gm9j-263p - moderate</li>
<li>GHSA-3jqq-pw4j-pqcj - moderate</li>
</ul>
<h3>Bugs fixed</h3>
<ul>
<li>Backport of security patches on 4.6.x branch <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19793">#19793</a>
(<a href="https://github.com/krassowski"><code>@​krassowski</code></a>,
<a href="https://github.com/MUFFANUJ"><code>@​MUFFANUJ</code></a>)</li>
<li>Cache and throttle path resolution to avoid requests storm <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19726">#19726</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Fix race when starting the search - keep correct filter <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19765">#19765</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Fix PyPI extension manager <code>package.json</code> inspection for
<code>tar.gz</code> archives <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19613">#19613</a>
(<a href="https://github.com/MUFFANUJ"><code>@​MUFFANUJ</code></a>)</li>
<li>Fix resizing optimization for larger notebooks <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19620">#19620</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Preserve kernelspec metadata when spec is unavailable <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19247">#19247</a>
(<a
href="https://github.com/tomatotomata"><code>@​tomatotomata</code></a>)</li>
<li>Fix respecting <code>commsOverSubshells</code> option in
<code>connectTo()</code> <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19734">#19734</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Show context actions for all images, not only SVGs <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19618">#19618</a>
(<a href="https://github.com/fly1d"><code>@​fly1d</code></a>)</li>
<li>Save sidebar section expansion state from the hidden flag <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19415">#19415</a>
(<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li>
<li>Fix memory leak when Property Inspector is open and other issues
exposed by new linter rules <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19318">#19318</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
</ul>
<h3>Maintenance and upkeep improvements</h3>
<ul>
<li>Update links to <code>jupyter-ydoc</code> API after docs pages moved
<a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19790">#19790</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>CI: align Yarn cache configuration <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19737">#19737</a>
(<a href="https://github.com/zihjiang"><code>@​zihjiang</code></a>)</li>
<li>Use Galata filebrowser helpers in tests <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19645">#19645</a>
(<a
href="https://github.com/Darshan808"><code>@​Darshan808</code></a>)</li>
<li>Disable subshell usage in comm example <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19725">#19725</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Remove pin to old ipykernel v7 pre-release in UI tests <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19672">#19672</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Update Altair snapshot <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19488">#19488</a>
(<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li>
<li>Use <code>ui-test-report-comment</code> action from
<code>maintainer-tools</code> <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19290">#19290</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Backport PR <a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19307">#19307</a>:
Update <code>@jupyter/eslint-plugin</code> to v1.1, adopt ne… <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19315">#19315</a>
(<a
href="https://github.com/krassowski"><code>@​krassowski</code></a>)</li>
<li>Update the copyright year to 2026 <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19308">#19308</a>
(<a
href="https://github.com/JussiRoos"><code>@​JussiRoos</code></a>)</li>
</ul>
<h3>Documentation improvements</h3>
<ul>
<li>Fix the IPython display link in the json-extension README <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19732">#19732</a>
(<a href="https://github.com/jtpio"><code>@​jtpio</code></a>)</li>
<li>Update announcement banner to point to jupyter-wide announcement
banner <a
href="https://redirect.github.com/jupyterlab/jupyterlab/pull/19189">#19189</a>
(<a
href="https://github.com/jasongrout"><code>@​jasongrout</code></a>)</li>
</ul>
<h3>Contributors to this release</h3>
<p>The following people contributed discussions, new ideas, code and
documentation contributions, and review.
See <a
href="https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports">our
definition of contributors</a>.</p>
<p>(<a
href="https://github.com/jupyterlab/jupyterlab/graphs/contributors?from=2026-08-10&amp;to=2026-09-21&amp;type=c">GitHub
contributors page for this release</a>)</p>
<p><a href="https://github.com/Darshan808"><code>@​Darshan808</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3ADarshan808+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/fly1d"><code>@​fly1d</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Afly1d+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/jasongrout"><code>@​jasongrout</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Ajasongrout+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/jtpio"><code>@​jtpio</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Ajtpio+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/JussiRoos"><code>@​JussiRoos</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3AJussiRoos+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/krassowski"><code>@​krassowski</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Akrassowski+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/MUFFANUJ"><code>@​MUFFANUJ</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3AMUFFANUJ+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a
href="https://github.com/tomatotomata"><code>@​tomatotomata</code></a>
(<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Atomatotomata+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)
| <a href="https://github.com/zihjiang"><code>@​zihjiang</code></a> (<a
href="https://github.com/search?q=repo%3Ajupyterlab%2Fjupyterlab+involves%3Azihjiang+updated%3A2026-08-10..2026-09-21&amp;type=Issues">activity</a>)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/384bff3af6598b3a6348df58fe34450914b49c41"><code>384bff3</code></a>
[ci skip] Publish 4.6.4</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/1f9dbe334e7d21e4855c9a32c7cd642544ac20c4"><code>1f9dbe3</code></a>
Merge pull request <a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19793">#19793</a>
from krassowski/security-patches-4.6.x</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/de324ae91346c713c4f5e5485f97b6e914e0f774"><code>de324ae</code></a>
Fix for GHSA-3jqq-pw4j-pqcj</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/f7e5f9803fdf2aaaa0e9bfb9cc73386a8cc5f0b2"><code>f7e5f98</code></a>
Fix for GHSA-jwrc-gm9j-263p</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/cf6e89a8d315c4134cefa50c220bca296da466a7"><code>cf6e89a</code></a>
Fix for GHSA-6966-vjj6-99xv</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/e277bc958e737130ac47b6c5078d08b29298828f"><code>e277bc9</code></a>
Fix for GHSA-3325-v43h-43rv</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/cd569945bc976caaf0018365fe1947f4f69db9e2"><code>cd56994</code></a>
Backport PR <a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19790">#19790</a>
on branch 4.6.x (Update links to <code>jupyter-ydoc</code> API after
...</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/bbadd0225a351ffcaa01dcbe7a5d9a364d244150"><code>bbadd02</code></a>
Backport PR <a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19726">#19726</a>
on branch 4.6.x (Cache and throttle path resolution to avo...</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/4ccae660976c055d4e2a3f44b1c5fa86e6416ac4"><code>4ccae66</code></a>
Backport PR <a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19765">#19765</a>
on branch 4.6.x (Fix race when starting the search - keep ...</li>
<li><a
href="https://github.com/jupyterlab/jupyterlab/commit/6c0f66433831a889e29fa87639315be1f2f57b6d"><code>6c0f664</code></a>
Backport PR <a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19737">#19737</a>
on branch 4.6.x (CI: align Yarn cache configuration) (<a
href="https://redirect.github.com/jupyterlab/jupyterlab/issues/19766">#19766</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.6.3...@jupyterlab/lsp@4.6.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `matplotlib` from 3.11.1 to 3.11.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/matplotlib/matplotlib/releases">matplotlib's
releases</a>.</em></p>
<blockquote>
<h2>REL: v3.11.2</h2>
<p>This is the second bugfix release of the 3.11.x series.</p>
<p>This release contains several bug-fixes and adjustments:</p>
<ul>
<li>Speed up RGBA-stage image resampling</li>
<li>Fix <code>hexbin</code> clipping in PDF output</li>
<li>Fix <code>\text</code> with internal braces</li>
<li>Fix some crashes and make some checks more robust to unlikely
cases</li>
<li>Fix frame skew when saving GIF animations with
<code>PillowWriter</code></li>
<li>Fix HiDPI handling in Qt toolbar and WebAgg embeddings</li>
<li>Fix <code>ResizeEvent</code> handling for <code>TextBox</code></li>
<li>Fix bug with PGF hatch linewidth and color</li>
<li>Fix a bug with drawing an empty Collection</li>
<li>Fix incorrect glyphs in Cairo backends</li>
<li>Improve build system to prevent conflicts between wheels and system
libraries</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/d3ca9172e392048ec242b90e8423e88d1a3000b2"><code>d3ca917</code></a>
REL: v3.11.2</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/b76fea990aa10afdba9225ee0f058d942cfcb770"><code>b76fea9</code></a>
DOC: Set current version to 3.11.2</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/39c7f0678af763abe850b41a71cd2724e326157c"><code>39c7f06</code></a>
DOC: Prepare GitHub stats for 3.11.2</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/5dd13e39ceadb89af6e17c64cb0c71a2c3ddc94e"><code>5dd13e3</code></a>
Merge branch 'v3.11.1-doc' into release-3.11.2</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/aa484be97e65ffa1c7e2770864dc44a219625180"><code>aa484be</code></a>
Merge branch 'v3.11.0-doc' into v3.11.1-doc</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/0e10f83000d7993160feb264f84150b5a4cacfff"><code>0e10f83</code></a>
Merge pull request <a
href="https://redirect.github.com/matplotlib/matplotlib/issues/32330">#32330</a>
from meeseeksmachine/auto-backport-of-pr-32324-on-v...</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/ebe947bd694df95e189fb93b63060051a6b55f3d"><code>ebe947b</code></a>
Backport PR <a
href="https://redirect.github.com/matplotlib/matplotlib/issues/32324">#32324</a>:
Don't force any diagnostics to be errors in bundled Harfbuzz</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/8f4b7c53b228dceded120488f569ff936d91844c"><code>8f4b7c5</code></a>
Merge pull request <a
href="https://redirect.github.com/matplotlib/matplotlib/issues/32322">#32322</a>
from meeseeksmachine/auto-backport-of-pr-32321-on-v...</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/93278ade075ca4b6483afac10f9a2d1e775a5f36"><code>93278ad</code></a>
Backport PR <a
href="https://redirect.github.com/matplotlib/matplotlib/issues/32321">#32321</a>:
DOC: correct note about PyOS_InputHook</li>
<li><a
href="https://github.com/matplotlib/matplotlib/commit/b0aee786396e59de7ea5a1cec646cbc889250b57"><code>b0aee78</code></a>
Merge pull request <a
href="https://redirect.github.com/matplotlib/matplotlib/issues/32319">#32319</a>
from meeseeksmachine/auto-backport-of-pr-32305-on-v...</li>
<li>Additional commits viewable in <a
href="https://github.com/matplotlib/matplotlib/compare/v3.11.1...v3.11.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `pyjwt` from 2.13.0 to 2.15.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/releases">pyjwt's
releases</a>.</em></p>
<blockquote>
<h2>2.15.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.15.0/CHANGELOG.rst">2.15.0
changelog</a> for complete release details.</p>
<h2>2.14.0</h2>
<p>See the <a
href="https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst">2.14.0
changelog</a> for the complete release details and related security
advisories.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst">pyjwt's
changelog</a>.</em></p>
<blockquote>
<h2><code>v2.15.0
&lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;</code>__</h2>
<p>Security</p>
<pre><code>
- Wrap recursion errors from deeply nested JWT payloads in
``DecodeError``
  instead of exposing a raw ``RecursionError``.
<p>Added</p>
<pre><code>
- Support Python 3.15 by @kytta in
`[#1202](https://github.com/jpadilla/pyjwt/issues/1202)
&amp;lt;https://github.com/jpadilla/pyjwt/pull/1202&amp;gt;`__

Changed
</code></pre>
<ul>
<li><code>JWKSetCache</code> now stores the parsed <code>PyJWKSet</code>
rather than the raw JWKS
payload, so a cache hit no longer re-parses every key.
<code>JWKSetCache.put()</code>
accepts either form and raises <code>PyJWKSetError</code> for anything
else. As a
result, <code>PyJWKClient.get_jwk_set()</code> returns the same
<code>PyJWKSet</code> instance
for as long as it stays cached, rather than a freshly built one per call
in
<code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208)
&amp;lt;https://github.com/jpadilla/pyjwt/pull/1208&amp;gt;</code>__</li>
<li><code>PyJWKClient.fetch_data()</code> now raises
<code>PyJWKClientError(&amp;quot;The JWKS endpoint did not return a JSON
object&amp;quot;)</code> when
the endpoint response is not a JSON object, instead of returning it for
<code>get_jwk_set()</code> to reject. Callers reaching the JWKS through
<code>get_jwk_set()</code> see the same error as before in
<code>[#1208](https://github.com/jpadilla/pyjwt/issues/1208)
&amp;lt;https://github.com/jpadilla/pyjwt/pull/1208&amp;gt;</code>__</li>
</ul>
<p>Fixed</p>
<pre><code>
- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()``
instead
of raising ``PyJWKClientError(&amp;quot;The JWKS endpoint did not return
a JSON
object&amp;quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the
cached value,
so callers pre-populating the cache to avoid a network round-trip could
not
read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914)
&amp;lt;https://github.com/jpadilla/pyjwt/issues/914&amp;gt;`__ and
`[#1208](https://github.com/jpadilla/pyjwt/issues/1208)
&amp;lt;https://github.com/jpadilla/pyjwt/pull/1208&amp;gt;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
``fetch_data()`` override that filters or transforms the JWKS is no
longer
  undone by the next cache hit in
`[#1208](https://github.com/jpadilla/pyjwt/issues/1208)
&amp;lt;https://github.com/jpadilla/pyjwt/pull/1208&amp;gt;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that
is not
&amp;lt;/tr&amp;gt;&amp;lt;/table&amp;gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/blockquote&gt;
&lt;p&gt;... (truncated)&lt;/p&gt;
&lt;/details&gt;
&lt;details&gt;
&lt;summary&gt;Commits&lt;/summary&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a&gt;
chore: prepare 2.15.0 release&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a&gt;
fix: make recursive payload tests deterministic&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a&gt;
fix: normalize recursive JWT payload errors&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a&gt;
utils: mention bytes in force_bytes type error (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a&gt;
docs/conf: drop duplicate 'and' from read() docstring (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a&gt;
Add support for Python 3.15 (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a&gt;
Catch http.client.HTTPException in PyJWKClient.fetch_data (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a&gt;
fix: correct docstring typo in _validate_jti (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a&gt;
docs: clarify JWK certificate member handling (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a
href=&quot;https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a&gt;
[pre-commit.ci] pre-commit autoupdate (&lt;a
href=&quot;https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;Additional commits viewable in &lt;a
href=&quot;https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0&quot;&gt;compare
view&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;/details&gt;

&lt;br /&gt;</code></pre>

Updates `pymysql` from 1.2.0 to 1.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/PyMySQL/PyMySQL/releases">pymysql's
releases</a>.</em></p>
<blockquote>
<h2>v1.2.3</h2>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.2...v1.2.3">https://github.com/PyMySQL/PyMySQL/compare/v1.2.2...v1.2.3</a></p>
<h2>v1.2.2</h2>
<p>Restored the ability to import
<code>pymysql.converters.escape_dict</code> for
compatibility with aiomysql.
This function does not escape dictionaries and is entirely unnecessary.
Unless you use aiomysql, there is no need to upgrade from v1.2.1.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.1...v1.2.2">https://github.com/PyMySQL/PyMySQL/compare/v1.2.1...v1.2.2</a></p>
<h2>v1.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump codecov/codecov-action from 6 to 7 in the all-dependencies
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1250">PyMySQL/PyMySQL#1250</a></li>
<li>Bump actions/checkout from 6 to 7 in the all-dependencies group by
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1253">PyMySQL/PyMySQL#1253</a></li>
<li>Bump the all-dependencies group with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1254">PyMySQL/PyMySQL#1254</a></li>
<li>Bump astral-sh/ruff-action from 4.0.0 to 4.1.0 in the
all-dependencies group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1255">PyMySQL/PyMySQL#1255</a></li>
<li>Fix typos in comments: charaset -&gt; charset by <a
href="https://github.com/maxtaran2010"><code>@​maxtaran2010</code></a>
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1256">PyMySQL/PyMySQL#1256</a></li>
<li>Bump the all-dependencies group with 3 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1258">PyMySQL/PyMySQL#1258</a></li>
<li>Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the
all-dependencies group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1261">PyMySQL/PyMySQL#1261</a></li>
<li>Fix escape_timedelta for negative values by <a
href="https://github.com/dngr2"><code>@​dngr2</code></a> in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1262">PyMySQL/PyMySQL#1262</a></li>
<li>fix ruff errors by <a
href="https://github.com/methane"><code>@​methane</code></a> in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1263">PyMySQL/PyMySQL#1263</a></li>
<li>Refactor LOAD LOCAL INFILE handling by <a
href="https://github.com/methane"><code>@​methane</code></a> in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1264">PyMySQL/PyMySQL#1264</a></li>
<li>perf: optimize packet reading and parsing by <a
href="https://github.com/methane"><code>@​methane</code></a> in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1268">PyMySQL/PyMySQL#1268</a></li>
<li>agent: document local MySQL test setup by <a
href="https://github.com/methane"><code>@​methane</code></a> in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1270">PyMySQL/PyMySQL#1270</a></li>
<li>fix pymysql authentication state machine issue by <a
href="https://github.com/methane"><code>@​methane</code></a> in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1271">PyMySQL/PyMySQL#1271</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/maxtaran2010"><code>@​maxtaran2010</code></a>
made their first contribution in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1256">PyMySQL/PyMySQL#1256</a></li>
<li><a href="https://github.com/dngr2"><code>@​dngr2</code></a> made
their first contribution in <a
href="https://redirect.github.com/PyMySQL/PyMySQL/pull/1262">PyMySQL/PyMySQL#1262</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.0...v1.2.1">https://github.com/PyMySQL/PyMySQL/compare/v1.2.0...v1.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md">pymysql's
changelog</a>.</em></p>
<blockquote>
<h2>v1.2.3</h2>
<p>Release date: 2026-09-17</p>
<p>Restored the ability to import
<code>pymysql.converters.escape_bytes_prefixed</code> for
compatibility with aiomysql.</p>
<p>Use <code>pymysql.converters</code> at your own risk.
It's internal functions. No backward compatibility are guaranteed.</p>
<h2>v1.2.2</h2>
<p>Release date: 2026-09-17</p>
<p>Restored the ability to import
<code>pymysql.converters.escape_dict</code> for
compatibility with aiomysql.
This function does not escape dictionaries and is entirely unnecessary.
Unless you use aiomysql, there is no need to upgrade from v1.2.1.</p>
<h2>v1.2.1 (security fix)</h2>
<p>Release date: 2026-09-17</p>
<p>Fixed a SQL injection vulnerability caused by incorrect escaping of
<code>bytes</code>
parameters when using the big5, gbk, sjis, cp932, or gb18030 character
sets.
This vulnerability also occurs when strings decoded from
<code>bytes</code> using
<code>surrogateescape</code> are passed as query parameters.</p>
<p>See also: <a
href="https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9">https://github.com/PyMySQL/PyMySQL/security/advisories/GHSA-x4f8-9hx9-hpp9</a></p>
<ul>
<li>
<p>Queries are now encoded using the <code>strict</code> error handler
instead of
<code>surrogateescape</code>.
Queries that cannot be encoded using the connection encoding can no
longer be sent.</p>
</li>
<li>
<p><code>bytes</code> parameters are now always sent as hexadecimal
literals, such as
<code>X'636174'</code>. Note that this increases the number of bytes
sent.</p>
</li>
<li>
<p>The <code>binary_prefix</code> parameter of <code>connect()</code> is
deprecated. The <code>_binary</code>
prefix is no longer sent.</p>
</li>
</ul>
<p>These changes address the confirmed SQL injection vulnerabilities
related to
character encoding.
However, we strongly recommend using UTF-8 (<code>utf8mb4</code>).
Other character sets are not thoroughly tested, and their limited use
means
that problems may go unreported. In the 2020s, encodings other than
UTF-8
should be considered legacy.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/c990e86083c26493f3285b1e047902994c4b1811"><code>c990e86</code></a>
v1.2.3</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/c93fd977ae6ff210a431e89a2e13ab2870b3c9e0"><code>c93fd97</code></a>
add escape_bytes_prefixed. do not use it.</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/dea8954dd3fe79461e98467be748ac0d024304d5"><code>dea8954</code></a>
release v1.2.2</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/4f953ba1d30190006361ce549b6e78b8d269ea44"><code>4f953ba</code></a>
fix: add escape_dict alias for aiomysql compatibility</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/e13a28f0a66db89d191fdd347a602448fc431f97"><code>e13a28f</code></a>
ruff format</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/26a031dbd56c0e3575bf251ff787b15fd7b1795a"><code>26a031d</code></a>
Prepare 1.2.1 security release</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/a1547f580c070732386177851beaebb4a3a6ec20"><code>a1547f5</code></a>
Merge commit from fork</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/10739bc7781fb85bb9df3d21c2465ba9c3988a2c"><code>10739bc</code></a>
fix pymysql authentication state machine issue (<a
href="https://redirect.github.com/PyMySQL/PyMySQL/issues/1271">#1271</a>)</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/0fa39e9865a4f6dbdeef70dc5ee5e051c3053559"><code>0fa39e9</code></a>
agent: document local MySQL test setup (<a
href="https://redirect.github.com/PyMySQL/PyMySQL/issues/1270">#1270</a>)</li>
<li><a
href="https://github.com/PyMySQL/PyMySQL/commit/55c604c95b308d8f67ef0def415f44a8d75426f2"><code>55c604c</code></a>
perf: optimize packet reading and parsing (<a
href="https://redirect.github.com/PyMySQL/PyMySQL/issues/1268">#1268</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/PyMySQL/PyMySQL/compare/v1.2.0...v1.2.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `semver` from 3.0.4 to 3.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/python-semver/python-semver/releases">semver's
releases</a>.</em></p>
<blockquote>
<h2>3.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix <a
href="https://redirect.github.com/python-semver/python-semver/issues/463">#463</a>:
Remove duplicate code Version.bump_build by <a
href="https://github.com/tomschr"><code>@​tomschr</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/464">python-semver/python-semver#464</a></li>
<li>Fix <a
href="https://redirect.github.com/python-semver/python-semver/issues/460">#460</a>
Improve bump_prerelease to alway get a newer version by <a
href="https://github.com/Learloj"><code>@​Learloj</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/462">python-semver/python-semver#462</a></li>
<li>441 update pydantic section of docs by <a
href="https://github.com/jbkroner"><code>@​jbkroner</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/442">python-semver/python-semver#442</a></li>
<li>Fix <a
href="https://redirect.github.com/python-semver/python-semver/issues/448">#448</a>:
Remove Python 3.7-3.9 (EOL) by <a
href="https://github.com/tomschr"><code>@​tomschr</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/470">python-semver/python-semver#470</a></li>
<li>fix: replace semver.parse() with semver.Version.parse() in
docstrings by <a
href="https://github.com/koteshyelamati"><code>@​koteshyelamati</code></a>
in <a
href="https://redirect.github.com/python-semver/python-semver/pull/471">python-semver/python-semver#471</a></li>
<li>fix: next_version should bump version for build-only versions by <a
href="https://github.com/binggao1230"><code>@​binggao1230</code></a> in
<a
href="https://redirect.github.com/python-semver/python-semver/pull/469">python-semver/python-semver#469</a></li>
<li>fix(next_version): reset prerelease when token changes (<a
href="https://redirect.github.com/python-semver/python-semver/issues/339">#339</a>)
by <a href="https://github.com/Mukller"><code>@​Mukller</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/472">python-semver/python-semver#472</a></li>
<li>Bump cryptography from 49.0.0 to 50.0.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/python-semver/python-semver/pull/473">python-semver/python-semver#473</a></li>
<li>Declare support for Python 3.15 by <a
href="https://github.com/edgarrmondragon"><code>@​edgarrmondragon</code></a>
in <a
href="https://redirect.github.com/python-semver/python-semver/pull/475">python-semver/python-semver#475</a></li>
<li>Add optional native parser backend (minimal adapter) by <a
href="https://github.com/lowmiaq-gmail"><code>@​lowmiaq-gmail</code></a>
in <a
href="https://redirect.github.com/python-semver/python-semver/pull/476">python-semver/python-semver#476</a></li>
<li>Reject non-ASCII digits and trailing newlines in version parsing by
<a href="https://github.com/Str0k"><code>@​Str0k</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/478">python-semver/python-semver#478</a></li>
<li>Fix bump_build() silently returning an unchanged version for
digitless build metadata by <a
href="https://github.com/Str0k"><code>@​Str0k</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/480">python-semver/python-semver#480</a></li>
<li>Handle malformed collection operands in Version comparisons by <a
href="https://github.com/Str0k"><code>@​Str0k</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/479">python-semver/python-semver#479</a></li>
<li>Change version to 3.1.0 by <a
href="https://github.com/tomschr"><code>@​tomschr</code></a> in <a
href="https://redirect.github.com/python-semver/python-semver/pull/481">python-semver/python-semver#481</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Learloj"><code>@​Learloj</code></a> made
their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/462">python-semver/python-semver#462</a></li>
<li><a href="https://github.com/jbkroner"><code>@​jbkroner</code></a>
made their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/442">python-semver/python-semver#442</a></li>
<li><a
href="https://github.com/koteshyelamati"><code>@​koteshyelamati</code></a>
made their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/471">python-semver/python-semver#471</a></li>
<li><a
href="https://github.com/binggao1230"><code>@​binggao1230</code></a>
made their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/469">python-semver/python-semver#469</a></li>
<li><a href="https://github.com/Mukller"><code>@​Mukller</code></a> made
their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/472">python-semver/python-semver#472</a></li>
<li><a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
made their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/473">python-semver/python-semver#473</a></li>
<li><a
href="https://github.com/edgarrmondragon"><code>@​edgarrmondragon</code></a>
made their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/475">python-semver/python-semver#475</a></li>
<li><a
href="https://github.com/lowmiaq-gmail"><code>@​lowmiaq-gmail</code></a>
made their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/476">python-semver/python-semver#476</a></li>
<li><a href="https://github.com/Str0k"><code>@​Str0k</code></a> made
their first contribution in <a
href="https://redirect.github.com/python-semver/python-semver/pull/478">python-semver/python-semver#478</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/python-semver/python-semver/compare/3.0.4...3.1.0">https://github.com/python-semver/python-semver/compare/3.0.4...3.1.0</a>
<strong>Documentation</strong>: <a
href="https://python-semver.readthedocs.io/en/latest/">https://python-semver.readthedocs.io/en/latest/</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/python-semver/python-semver/blob/master/CHANGELOG.rst">semver's
changelog</a>.</em></p>
<blockquote>
<h1>Version 3.1.0</h1>
<p>:Released: 2026-09-12
:Maintainer: Tom Schraitle</p>
<h2>Bug Fixes</h2>
<ul>
<li>
<p>:pr:<code>478</code>: <code>Version.parse()</code> and
<code>Version.is_valid()</code> now reject non-ASCII digits and
trailing newlines, in accordance with the SemVer grammar. Optional minor
and
patch parsing applies the same character restrictions.</p>
</li>
<li>
<p>:pr:<code>479</code>: Comparing a :class:<code>~semver.Version</code>
with a <code>dict</code>, <code>tuple</code>, or <code>list</code> that
cannot construct a valid version (for example, an empty collection,
wrong number of parts, non-numeric parts, or unknown keys) no longer
raises internal errors from <code>Version.__init__</code>. The
comparison operators now return :py:const:<code>NotImplemented</code>
for such operands, following the general rule for invalid comparison
operand types: equality evaluates to <code>False</code> and ordering
raises Python's standard :py:exc:<code>TypeError</code> (for example,
<code>'&gt;' not supported between instances of 'Version' and
'dict'</code>).</p>
</li>
<li>
<p>:pr:<code>480</code>:
(:meth:<code>~semver.version.Version.bump_build</code>) will now add
<code>.0</code> to an existing build when the last segment of the
current build metadata, split by dots (<code>.</code>), is not numeric.
This is to ensure the bumped version contains a raised build instead of
silently returning an unchanged version. For example,
<code>1.2.3+alpha</code> is bumped to <code>1.2.3+alpha.0</code>. This
mirrors the corresponding fix for the prerelease part
(:gh:<code>460</code>). Related to :gh:<code>466</code>.</p>
</li>
<li>
<p>:gh:<code>460</code>:
:meth:<code>~semver.version.Version.bump_prerelease</code> will now add
<code>.0</code> to an
existing prerelease when the last segment of the current prerelease,
split by
dots (<code>.</code>), is not numeric. This is to ensure the new
prerelease is considered
higher than the previous one.</p>
<p>:meth:<code>~semver.version.Version.bump_prerelease</code> now also
support an argument
<code>bump_when_empty</code> which will bump the patch version if there
is no existing
prerelease, to ensure the resulting version is considered a higher
version than
the previous one.</p>
</li>
</ul>
<h2>Features</h2>
<ul>
<li>:pr:<code>476</code>: Added optional <code>[native]</code> extra to
accelerate parsing on CPython via the
<code>fast-semver-rs-backend</code> package. The pure-Python parser
remains the default;
the native backend is opt-in and only available on CPython.</li>
</ul>
<h2>Internal Changes</h2>
<p>: Update GitHub Actions for astral-sh/setup-uv (version 0.10.1),
github/codeql-action (version 4)</p>
<h2>Trivial Changes</h2>
<ul>
<li>:gh:<code>463</code>: Remove double code in
:meth:<code>Version.bump_build</code></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python-semver/python-semver/commit/642d1bc8949d38cca7922df478d0f2c06513f99d"><code>642d1bc</code></a>
Change version to 3.1.0 (<a
href="https://redirect.github.com/python-semver/python-semver/issues/481">#481</a>)</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/2a2cf632f9b6c6b5731db85284db129e0d07837d"><code>2a2cf63</code></a>
Suppress deprecation warnings in test suite</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/a62477b6113791ed046e71936754e285892fd1ed"><code>a62477b</code></a>
Improve comparisons and fix test coverage.</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/0aa17a3447958cfe13634b0c3917e7aa4eee3334"><code>0aa17a3</code></a>
Handle malformed collection operands in Version comparisons (<a
href="https://redirect.github.com/python-semver/python-semver/issues/479">#479</a>)</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/1b7350c1a7cacea983ab10b345990fee78761d44"><code>1b7350c</code></a>
Improve test coverage to 100% (Rust backend)</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/ea2524a51767cefab58a9b3bb6bcf38e5cdc7d54"><code>ea2524a</code></a>
Fix bump_build() silently returning an unchanged version for digitless
build ...</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/1e8757912f633684e1a65d9d7c7e2270c3c79928"><code>1e87579</code></a>
Reject non-ASCII digits and trailing newlines in version parsing (<a
href="https://redirect.github.com/python-semver/python-semver/issues/478">#478</a>)</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/0f18aa0b1e0cabba65ee1b506e637faabcdf5d05"><code>0f18aa0</code></a>
Add optional native parser backend (minimal adapter) (<a
href="https://redirect.github.com/python-semver/python-semver/issues/476">#476</a>)</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/873a6750f22e82f72fb7c8c4a1ebe958beaa2f1a"><code>873a675</code></a>
Declare support for Python 3.15 (<a
href="https://redirect.github.com/python-semver/python-semver/issues/475">#475</a>)</li>
<li><a
href="https://github.com/python-semver/python-semver/commit/99d2032c8f7ef4895df25053ddcdcb85d5460326"><code>99d2032</code></a>
Bump cryptography from 49.0.0 to 50.0.0 (<a
href="https://redirect.github.com/python-semver/python-semver/issues/473">#473</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/python-semver/python-semver/compare/3.0.4...3.1.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `build` from 1.6.0 to 1.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/build/releases">build's
releases</a>.</em></p>
<blockquote>
<h2>1.6.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<ul>
<li>chore[v1]: prepare for v1.6.1 by <a
href="https://github.com/henryiii"><code>@​henryiii</code></a> in <a
href="https://redirect.github.com/pypa/build/pull/1181">pypa/build#1181</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/pypa/build/compare/1.6.0...1.6.1">https://github.com/pypa/build/compare/1.6.0...1.6.1</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/build/blob/main/CHANGELOG.rst">build's
changelog</a>.</em></p>
<blockquote>
<p>####################
1.6.1 (2026-09-10)
####################</p>
<hr />
<p>Bugfixes</p>
<hr />
<ul>
<li>Avoid trying to detect symlinks on Windows, regression in 1.6.0 - by
:user:<code>henryiii</code> (:issue:<code>1175</code>)
(:issue:<code>1175</code>)</li>
</ul>
<hr />
<p>Documentation</p>
<hr />
<ul>
<li>Fix doubled backslashes in the Windows pip config path
(<code>%APPDATA%\pip\pip.ini</code>) in the docs - by
:user:<code>aroh3006</code>
(:issue:<code>1149</code>)</li>
</ul>
<hr />
<p>Miscellaneous</p>
<hr />
<ul>
<li>:issue:<code>1168</code>, :issue:<code>1170</code>,
:issue:<code>1178</code></li>
</ul>
<p>####################
1.6.0 (2026-08-27)
####################</p>
<hr />
<p>Features</p>
<hr />
<ul>
<li>Add <code>--report=PATH</code> to write a machine-readable JSON
report of built artifacts; <code>--metadata</code> now also accepts
<code>.whl</code> files - by :user:<code>gaborbernat</code>
(:issue:<code>198</code>)</li>
<li>The <code>srcdir</code> argument now accepts <code>.tar.gz</code>
source distributions, extracting and building from them - by
:user:<code>gaborbernat</code> (:issue:<code>311</code>)</li>
<li>The &quot;Unmet dependencies&quot; error from
<code>--no-isolation</code> builds now shows the wanted version, found
version, and
interpreter - by :user:<code>gaborbernat</code>
(:issue:<code>504</code>)</li>
<li>Add <code>--sdist-extract-dir</code> to extract the intermediate
sdist into a persistent directory, enabling compiler cache
reuse across rebuilds - by :user:<code>gaborbernat</code>
(:issue:<code>614</code>)</li>
<li>Add <code>--env-dir</code> to place the isolated build environment
at a fixed path, enabling compiler cache reuse across builds
<ul>
<li>by :user:<code>gaborbernat</code> (:issue:<code>655</code>)</li>
</ul>
</li>
<li>Print a summary of resolved dependency versions
(<code>name==version</code>) after installing them in isolated builds -
by
:user:<code>gaborbernat</code> (:issue:<code>959</code>)</li>
<li>On build failure, print a tip pointing to <code>--env-dir</code> and
<code>--sdist-extract-dir</code> for debugging and link to the
&quot;Debug a failed build&quot; how-to - reported by
:user:<code>dimpase</code>, implemented by
:user:<code>gaborbernat</code> (:issue:<code>966</code>)</li>
</ul>
<hr />
<p>Bugfixes</p>
<hr />
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/build/commit/89cccef40df9011f03bec18cf52c53d1096ed6ee"><code>89cccef</code></a>
chore: prepare for 1.6.1</li>
<li><a
href="https://github.com/pypa/build/commit/a6f707a75fc8548d7707645e97c7903197387849"><code>a6f707a</code></a>
ci: support releases from v* branches (<a
href="https://redirect.github.com/pypa/build/issues/1178">#1178</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/77851610de5d3894fa8a88e06e0232901cf93758"><code>7785161</code></a>
docs: fix doubled backslashes in Windows pip config path (<a
href="https://redirect.github.com/pypa/build/issues/1149">#1149</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/244b250c3219070eebb29764f7709262d48afd41"><code>244b250</code></a>
fix: always use copies for the isolated venv on Windows (<a
href="https://redirect.github.com/pypa/build/issues/1176">#1176</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/c93ca6f6d252e4d8df7fda4a61f8f9ed8a55a411"><code>c93ca6f</code></a>
build(deps): bump re-actors/alls-green from 1.2.2 to 1.3.0 in the
github-acti...</li>
<li><a
href="https://github.com/pypa/build/commit/e02ffd32241aec2e306d90869417c1e900c0adb4"><code>e02ffd3</code></a>
pre-commit: bump repositories (<a
href="https://redirect.github.com/pypa/build/issues/1173">#1173</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/aad39a800e3d81bf907018ebe2fab135717da59b"><code>aad39a8</code></a>
docs: fix changelog page heading levels and sidebar (<a
href="https://redirect.github.com/pypa/build/issues/1171">#1171</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/5c3fd46b5c38c7caea5dd95ce365971104a734aa"><code>5c3fd46</code></a>
docs: use PyPI ref directly (<a
href="https://redirect.github.com/pypa/build/issues/1172">#1172</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/1c5bd6c21cbd33c1816978d45219d48fb4c2b269"><code>1c5bd6c</code></a>
🐛 fix(release): format generated changelog (<a
href="https://redirect.github.com/pypa/build/issues/1170">#1170</a>)</li>
<li><a
href="https://github.com/pypa/build/commit/7f0cc7ed19969558c7daeaa3652ce2ffc81599c1"><code>7f0cc7e</code></a>
🔧 build(type): replace mypy with pyrefly (<a
href="https://redirect.github.com/pypa/build/issues/1168">#1168</a>)</li>
<li>See full diff in <a
href="https://github.com/pypa/build/compare/1.6.0...1.6.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `hatchling` from 1.32.0 to 1.32.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/hatch/releases">hatchling's
releases</a>.</em></p>
<blockquote>
<h2>Hatchling v1.32.4</h2>
<p><em><strong>Fixed:</strong></em></p>
<ul>
<li>Revert the extra type parameter added to
<code>BuildHookInterface</code> in 1.32.3, which broke plugins that
subscripted the interface with a single argument (e.g.
<code>BuildHookInterface[MyConfig]</code>) by raising
<code>TypeError</code> at import time. <code>BuilderConfig</code> is
likewise no longer generic, restoring the pre-1.32.3 plugin
interface.</li>
<li>Strip spaces around version metadata when using original input for
CalVer to keep leading zeroes.</li>
</ul>
<h2>Hatchling v1.32.3</h2>
<p><em><strong>Fixed:</strong></em></p>
<ul>
<li>Preserve the version string exactly as written in core metadata, so
stylized versions such as CalVer <code>2026.08.10</code> are no longer
stripped of leading zeros. Distribution file names and
<code>.dist-info</code> directories continue to use the PEP 440
normalized form.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/hatch/commit/c4abc454f908bb4fc2a92452a82cb33dac14abf3"><code>c4abc45</code></a>
release Hatchling v1.32.4 (<a
href="https://redirect.github.com/pypa/hatch/issues/2441">#2441</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/cd57f6890dd0929165ebbcb2effa171a8d9defdd"><code>cd57f68</code></a>
Revert type changes for BuildHookInterface (<a
href="https://redirect.github.com/pypa/hatch/issues/2440">#2440</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/5c6dc6c67ff91998bedc61b12787c13ac973bca0"><code>5c6dc6c</code></a>
Strip surrounding whitespace from version metadata (<a
href="https://redirect.github.com/pypa/hatch/issues/2438">#2438</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/0941887cd24b8585c30761d0396d9357e9d9effe"><code>0941887</code></a>
release Hatchling v1.32.3 (<a
href="https://redirect.github.com/pypa/hatch/issues/2436">#2436</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/6a2b14f466a27e833a2e398eeed7c40867efee6c"><code>6a2b14f</code></a>
release Hatchling v1.32.2 (<a
href="https://redirect.github.com/pypa/hatch/issues/2434">#2434</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/081013fad3dcf306cff3f42edd7ab1912ea8b687"><code>081013f</code></a>
Hatchling 1.32.2 release (<a
href="https://redirect.github.com/pypa/hatch/issues/2433">#2433</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/248141c335525f4a2ca36bbd396d6fc5a5627c80"><code>248141c</code></a>
Use hatchling plugin manager (<a
href="https://redirect.github.com/pypa/hatch/issues/2432">#2432</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/4b17561f822b1b416403a61855374892ecbe11de"><code>4b17561</code></a>
release Hatch v1.18.1 (<a
href="https://redirect.github.com/pypa/hatch/issues/2426">#2426</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/b6aaa1a3cac6be652ac90c8c79612bddcca733ea"><code>b6aaa1a</code></a>
release Hatchling v1.32.1 (<a
href="https://redirect.github.com/pypa/hatch/issues/2425">#2425</a>)</li>
<li><a
href="https://github.com/pypa/hatch/commit/47f333a98228c326786d3919f346bd7b74d9cf8f"><code>47f333a</code></a>
Prepare for hatch and hatchling releases (<a
href="https://redirect.github.com/pypa/hatch/issues/2424">#2424</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/hatch/compare/hatchling-v1.32.0...hatchling-v1.32.4">compare
view</a></li>
</ul>
</details>
<br />

<details>
<summary>Most Recent Ignore Conditions Applied to This Pull
Request</summary>

| Dependency Name | Ignore Conditions |
| --- | --- |
| boto3 | [>= 1.42.dev0, < 1.43] |
</details>


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 ci/builder/requirements.txt | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/ci/builder/requirements.txt b/ci/builder/requirements.txt
index 3785e40802fb1..13551427210c7 100644
--- a/ci/builder/requirements.txt
+++ b/ci/builder/requirements.txt
@@ -15,7 +15,7 @@ aiohttp==3.14.3
 black==26.3.1
 # Pulls in dependencies that make launchdarkly/cloud tests fail, keep for now
 boto3-stubs[ec2,iam,kinesis,s3,sqs,ssm,sts,s3tables]==1.41.5
-boto3==1.43.88
+boto3==1.43.102
 click==8.1.3
 cryptography==50.0.1
 colored==2.3.2
@@ -27,14 +27,14 @@ ipympl==0.10.0
 ipywidgets==8.1.9
 junit-xml==1.9
 junitparser==5.0.3
-jupyterlab==4.6.3
+jupyterlab==4.6.4
 jupyter-black==0.4.0
 kubernetes==25.3.0
 kubernetes-stubs==22.6.0.post1
 launchdarkly-api==17.2.0
 # NOTE matplotlib 3.10.9 is required for Python 3.10 compatibility
 matplotlib==3.10.9; python_version < "3.11"
-matplotlib==3.11.1; python_version >= "3.11"
+matplotlib==3.11.2; python_version >= "3.11"
 matplotlib-stubs==0.3.4
 # Keep on 3.4.2 for Python 3.10 compatibility
 networkx==3.4.2
@@ -54,8 +54,8 @@ psycopg==3.3.3
 psycopg-binary==3.3.3
 pydantic==2.12.5
 pyelftools==0.33
-pyjwt==2.13.0
-PyMySQL==1.2.0
+pyjwt==2.15.0
+PyMySQL==1.2.3
 pytest==9.0.3
 pytest-split==0.11.0
 pyyaml==6.0.3
@@ -66,7 +66,7 @@ ruff==0.0.292
 scipy==1.15.3; python_version < "3.11"
 scipy==1.17.1; python_version >= "3.11"
 scipy-stubs==1.15.3.0
-semver==3.0.4
+semver==3.1.0
 shtab==1.12.1
 sqlparse==0.6.0
 toml==0.10.2
@@ -91,5 +91,5 @@ pyarrow-stubs==20.0.0.20251215
 pyarrow==23.0.1
 minio==7.2.15
 zstandard==0.25.0
-build==1.6.0
-hatchling==1.32.0
+build==1.6.1
+hatchling==1.32.4

From 90c3f13865648d10f07515a1f437384f4e3155ad Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:09:27 +0200
Subject: [PATCH 69/94] build(deps): bump
 storage::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39198)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[storage::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">storage::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=storage::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index c2e05b177d590..54107839f9f1b 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -280,7 +280,7 @@ module "database" {
 
 # 6. Setup S3 bucket for Materialize
 module "storage" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/storage?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//aws/modules/storage?ref=v13.12.1"
 
   name_prefix            = var.name_prefix
   bucket_lifecycle_rules = []

From 6fcadf8f4705d4a308032b779c90233379143f07 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:09:40 +0200
Subject: [PATCH 70/94] build(deps): bump
 cert_manager::materialize-terraform-self-managed from 13.10.0 to 13.12.1 in
 /test/terraform/aws-persistent (#39199)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[cert_manager::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
from 13.10.0 to 13.12.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">cert_manager::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li>See full diff in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cert_manager::github::MaterializeInc/materialize-terraform-self-managed::v13.10.0&package-manager=terraform&previous-version=13.10.0&new-version=13.12.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/aws-persistent/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/terraform/aws-persistent/main.tf b/test/terraform/aws-persistent/main.tf
index 54107839f9f1b..9a967f78ff36f 100644
--- a/test/terraform/aws-persistent/main.tf
+++ b/test/terraform/aws-persistent/main.tf
@@ -230,7 +230,7 @@ module "aws_lbc" {
 
 # 4. Install Certificate Manager for TLS
 module "cert_manager" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.10.0"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//kubernetes/modules/cert-manager?ref=v13.12.1"
 
   node_selector = local.generic_node_labels
 

From 579e5158d47b2aefff78a941735b80859ecf6749 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:31:59 +0200
Subject: [PATCH 71/94] build(deps): bump utoipa from 5.5.0 to 6.0.0 (#39276)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [utoipa](https://github.com/juhaku/utoipa) from 5.5.0 to 6.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/juhaku/utoipa/releases">utoipa's
releases</a>.</em></p>
<blockquote>
<h2>utoipa-rapidoc-6.0.0</h2>
<h2>What's New :gem: :new: :tada:</h2>
<ul>
<li>(88a5842) Update utoipa openapi tools, re-release of 5.0.1 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1295">#1295</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
</ul>
<h4>Full <a
href="https://github.com/juhaku/utoipa/compare/utoipa-rapidoc-5.0.1...utoipa-rapidoc-6.0.0">change
log</a></h4>
<h2>utoipa-redoc-6.0.0</h2>
<h2>What's New :gem: :new: :tada:</h2>
<ul>
<li>(88a5842) Update utoipa openapi tools, re-release of 5.0.1 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1295">#1295</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
</ul>
<h4>Full <a
href="https://github.com/juhaku/utoipa/compare/utoipa-redoc-5.0.1...utoipa-redoc-6.0.0">change
log</a></h4>
<h2>utoipa-6.0.0</h2>
<h2>What's New :gem: :new: :tada:</h2>
<ul>
<li>(baa4d04) Remove support for expression ignore in
<code>ToSchema</code> and <code>IntoParams</code> (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1619">#1619</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
<li>(14e2a90) Update next release versions (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1618">#1618</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
<li>(58632b1) docs: add examples and changelog for PR-1555 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1590">#1590</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(5b25257) Add OpenAPI 3.2 support (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1555">#1555</a>)
<a
href="https://github.com/pjankiewicz"><code>@​pjankiewicz</code></a></li>
<li>(205fe71) fix: emit vec![] instead of array literals to avoid large
stack arrays (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1580">#1580</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(4939e8c) feat!: remove serde_norway, make yaml feature use
yaml_serde (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1567">#1567</a>)
<a
href="https://github.com/MarkusZoppelt"><code>@​MarkusZoppelt</code></a></li>
<li>(3906028) feat: bigdecimal support (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1487">#1487</a>)
<a href="https://github.com/hdbg"><code>@​hdbg</code></a></li>
<li>(ec9d584) Add yaml_serde feature for yaml deserialization (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1559">#1559</a>)
<a
href="https://github.com/BjarneSeger"><code>@​BjarneSeger</code></a></li>
<li>(6247e64) Upgrade MSRV to 1.88 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1562">#1562</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
<li>(dcdf087) feat: expand header struct (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1556">#1556</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(b07340e) feat: readonly and writeonly dropped on ref fields (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1550">#1550</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(92f9b01) Option + nullable = false + default expands to a
degenerate oneOf (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1380">#1380</a>)
<a href="https://github.com/JMLX42"><code>@​JMLX42</code></a></li>
<li>(bbbd2ce) Fix type in CHANGELOG.md <a
href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
</ul>
<h4>Full <a
href="https://github.com/juhaku/utoipa/compare/utoipa-5.5.0...utoipa-6.0.0">change
log</a></h4>
<h2>utoipa-gen-6.0.0</h2>
<h2>What's New :gem: :new: :tada:</h2>
<ul>
<li>(baa4d04) Remove support for expression ignore in
<code>ToSchema</code> and <code>IntoParams</code> (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1619">#1619</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
<li>(14e2a90) Update next release versions (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1618">#1618</a>)
<a href="https://github.com/juhaku"><code>@​juhaku</code></a></li>
<li>(69af040) Re-enable actix auto_into_responses Result test (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1603">#1603</a>)
<a href="https://github.com/snaggen"><code>@​snaggen</code></a></li>
<li>(0f601fe) feature: support extensions in utoipa::ToSchema named
structs (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1593">#1593</a>)
<a
href="https://github.com/TilBlechschmidt"><code>@​TilBlechschmidt</code></a></li>
<li>(fbe6639) Upgrade utoipa-gen to syn 3 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1597">#1597</a>)
<a
href="https://github.com/jakobhellermann"><code>@​jakobhellermann</code></a></li>
<li>(0a5951b) chore: Update CHANGELOG.md (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1596">#1596</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(e8a26bb) Recursively discover flattened fields in maps (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1582">#1582</a>)
<a
href="https://github.com/nipunn1313"><code>@​nipunn1313</code></a></li>
<li>(b66879a) feat(gen): support item_schema attribute for streaming/SSE
response types (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1592">#1592</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(e092565) feat(gen): allow opting into OpenAPI 3.2 output via the
version attribute (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1591">#1591</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(c607078) feat: support generic types with <code>IntoParams</code>
(<a
href="https://redirect.github.com/juhaku/utoipa/issues/1588">#1588</a>)
<a
href="https://github.com/jack-ullery"><code>@​jack-ullery</code></a></li>
<li>(58632b1) docs: add examples and changelog for PR-1555 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1590">#1590</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(5b25257) Add OpenAPI 3.2 support (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1555">#1555</a>)
<a
href="https://github.com/pjankiewicz"><code>@​pjankiewicz</code></a></li>
<li>(205fe71) fix: emit vec![] instead of array literals to avoid large
stack arrays (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1580">#1580</a>)
<a href="https://github.com/Drifter-J"><code>@​Drifter-J</code></a></li>
<li>(fb812a1) fix: workaround time/cookie incompatibility (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1577">#1577</a>)
<a href="https://github.com/jayvdb"><code>@​jayvdb</code></a></li>
<li>(640ef44) fix: simplify utoipa-gen feature gates to fix jiff_0_2 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1575">#1575</a>)
<a href="https://github.com/siku2"><code>@​siku2</code></a></li>
<li>(4939e8c) feat!: remove serde_norway, make yaml feature use
yaml_serde (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1567">#1567</a>)
<a
href="https://github.com/MarkusZoppelt"><code>@​MarkusZoppelt</code></a></li>
<li>(3906028) feat: bigdecimal support (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1487">#1487</a>)
<a href="https://github.com/hdbg"><code>@​hdbg</code></a></li>
<li>(aecd7f7) Use pastey instead of unmaintained paste and fix some
clippy warnings (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1452">#1452</a>)
<a
href="https://github.com/petersimonsson"><code>@​petersimonsson</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/juhaku/utoipa/blob/master/utoipa-rapidoc/CHANGELOG.md">utoipa's
changelog</a>.</em></p>
<blockquote>
<h2>6.0.0 - Thu 16 2025</h2>
<h3>Changed</h3>
<ul>
<li>Upgrade to Rust MSRV to 1.88 (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1526">juhaku/utoipa#1526</a>)</li>
<li>Re-release 5.0.1 since axum upgrade is a breaking change (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1295">juhaku/utoipa#1295</a>)</li>
</ul>
<h2>5.0.1 - Jan 6 2025</h2>
<h3>Changed</h3>
<ul>
<li>Update axum to v0.8 (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1269">juhaku/utoipa#1269</a>)</li>
</ul>
<h2>5.0.0 - Oct 14 2024</h2>
<h3>Added</h3>
<ul>
<li>Add macros feature flag (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1015">juhaku/utoipa#1015</a>)</li>
<li>Add nest <code>OpenApi</code> support (<a
href="https://redirect.github.com/juhaku/utoipa/pull/930">juhaku/utoipa#930</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix testing without explicit features (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1041">juhaku/utoipa#1041</a>)</li>
<li>Fix building utoipa-rapidoc &amp; utoipa-scalar (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1039">juhaku/utoipa#1039</a>)</li>
<li>Fix RapiDoc with empty URL panic on axum (<a
href="https://redirect.github.com/juhaku/utoipa/pull/997">juhaku/utoipa#997</a>)</li>
<li>Fix samples in documentation when with_openapi is used (<a
href="https://redirect.github.com/juhaku/utoipa/pull/988">juhaku/utoipa#988</a>)</li>
<li>Fix openapi serialized twice when served with Rocket (<a
href="https://redirect.github.com/juhaku/utoipa/pull/987">juhaku/utoipa#987</a>)</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Remove commit commit id from changelogs (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1077">juhaku/utoipa#1077</a>)</li>
<li>Update to rc version</li>
<li>Disable unused default features of rust_decimal (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1029">juhaku/utoipa#1029</a>)</li>
<li>Update next beta versions</li>
<li>Chore update docs and relax <code>url</code> version (<a
href="https://redirect.github.com/juhaku/utoipa/pull/1001">juhaku/utoipa#1001</a>)</li>
<li>Bump up versions (<a
href="https://redirect.github.com/juhaku/utoipa/pull/998">juhaku/utoipa#998</a>)</li>
<li>Update versions</li>
<li>Update min Rust version and utoipa-swagger-ui version</li>
</ul>
<h2>4.0.0 - May 5 2024</h2>
<h3>Added</h3>
<ul>
<li>Add <code>default-features = false</code> to the optional axum
dependency to avoid pulling in tokio in non-tokio environments (<a
href="https://redirect.github.com/juhaku/utoipa/pull/874">juhaku/utoipa#874</a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fix spelling (<a
href="https://redirect.github.com/juhaku/utoipa/pull/846">juhaku/utoipa#846</a>)</li>
</ul>
<h3>Changed</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/juhaku/utoipa/commit/baa4d04c78fdcc86622e1a2775039fc1621157c0"><code>baa4d04</code></a>
Remove support for expression ignore in <code>ToSchema</code> and
<code>IntoParams</code> (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1619">#1619</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/14e2a905331af18cc5387900e3136aa6eba7e0c1"><code>14e2a90</code></a>
Update next release versions (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1618">#1618</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/69af0403df8ee5ac00fc530f0fbac32348a39ada"><code>69af040</code></a>
Re-enable actix auto_into_responses Result test (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1603">#1603</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/0f601fef4b72f114be3a4fe97943022bfe171003"><code>0f601fe</code></a>
feature: support extensions in utoipa::ToSchema named structs (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1593">#1593</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/fbe663958f6a5b834b1fb7c15bbc6fabe4722b40"><code>fbe6639</code></a>
Upgrade utoipa-gen to syn 3 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1597">#1597</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/1436f789a0ec3f18ad422efca4027938673bb0f6"><code>1436f78</code></a>
Bump base64 from 22.1 to 23.1 (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1595">#1595</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/0a5951b936c2e99ff94964da949b333a776689a7"><code>0a5951b</code></a>
chore: Update CHANGELOG.md (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1596">#1596</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/5db2ccbe9a16bcac8c03c5853fc4612f0eec5126"><code>5db2ccb</code></a>
Refactor documentation in lib.rs (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1581">#1581</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/e8a26bb74f66fa2eaaa88d40999b9c519e41fc60"><code>e8a26bb</code></a>
Recursively discover flattened fields in maps (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1582">#1582</a>)</li>
<li><a
href="https://github.com/juhaku/utoipa/commit/b66879abc4ae14e4d2b185ec314570a7cdfb2fed"><code>b66879a</code></a>
feat(gen): support item_schema attribute for streaming/SSE response
types (<a
href="https://redirect.github.com/juhaku/utoipa/issues/1">#1</a>...</li>
<li>Additional commits viewable in <a
href="https://github.com/juhaku/utoipa/compare/utoipa-5.5.0...utoipa-6.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=utoipa&package-manager=cargo&previous-version=5.5.0&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 10 +++++-----
 Cargo.toml |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c0db478b57d66..b80c2a66b6ff6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -14730,9 +14730,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "utoipa"
-version = "5.5.0"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bde15df68e80b16c7d16b9616e80770ad158988daa56a27dccd1e55558b0160"
+checksum = "8765fe27aeff71012a3f90fa474cf1df863a7d0dd81ed25de4e63fff2544994f"
 dependencies = [
  "indexmap 2.11.4",
  "serde",
@@ -14742,13 +14742,13 @@ dependencies = [
 
 [[package]]
 name = "utoipa-gen"
-version = "5.5.0"
+version = "6.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba0b99ee52df3028635d93840c797102da61f8a7bb3cf751032455895b52ef8"
+checksum = "d935f1c83fdf8b88f09bbe050d0cea78ea4afee6d7b0317403228c1200b2c8ab"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index b29e8efb7ed1d..1d5e579ec8994 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -561,7 +561,7 @@ unicode-normalization = "0.1.25"
 unicode-width = "0.2.2"
 url = "2.5.8"
 urlencoding = "2.1.3"
-utoipa = "5.4.0"
+utoipa = "6.0.0"
 uuid = "1.19.0"
 version-compare = "0.2.1"
 walkdir = "2.5.0"

From cf0fb4bb8dd60d3ab6ae0114d4ae93475b391d4e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:32:56 +0200
Subject: [PATCH 72/94] build(deps): bump types-requests from 2.33.0.20260712
 to 2.33.0.20260906 in /ci/builder (#38946)

Bumps [types-requests](https://github.com/python/typeshed) from
2.33.0.20260712 to 2.33.0.20260906.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 ci/builder/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/builder/requirements.txt b/ci/builder/requirements.txt
index 13551427210c7..e7deac4d520cd 100644
--- a/ci/builder/requirements.txt
+++ b/ci/builder/requirements.txt
@@ -76,7 +76,7 @@ types-prettytable==3.4.2.6
 types-psutil==7.2.2.20260827
 types-PyMYSQL==1.2.0.20260807
 types-PyYAML==6.0.12.20260815
-types-requests==2.33.0.20260712
+types-requests==2.33.0.20260906
 types-setuptools==84.0.0.20260812
 types-toml==0.10.8.20260518
 typing-extensions==4.16.0

From 0355d9735d3d0daddb6b5f854f2dda934277c15e Mon Sep 17 00:00:00 2001
From: Moritz Hoffmann <antiguru@gmail.com>
Date: Mon, 28 Sep 2026 09:48:15 +0200
Subject: [PATCH 73/94] dependabot: group terraform module updates into one PR
 (#39282)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dependabot treats each Terraform `module` block as its own dependency,
so the 13.10.0 to 13.12.1 release of
`materialize-terraform-self-managed` arrived as one PR per module
(#39240 through #39246). This groups all Terraform version updates,
including major ones, so a release lands as a single PR that moves every
module together.

*Posted by Claude Code.*

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/dependabot.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 402ebb9e45f63..d47050bb6efc6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -92,6 +92,15 @@ updates:
     default-days: 3
   open-pull-requests-limit: 50
   labels: [A-dependencies]
+  # Each `module` block is its own dependency, so without a group every module
+  # sourced from the same repository gets a separate PR. The modules of one
+  # release must move together, so group all updates, including major ones,
+  # across all roots into a single PR.
+  groups:
+    terraform:
+      applies-to: version-updates
+      patterns:
+        - "*"
 - package-ecosystem: pip
   directory: /misc/dbt-materialize
   schedule:

From 14387fec5edd210004de99d00db52af6cd2e45d3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 08:20:09 +0000
Subject: [PATCH 74/94] build(deps): bump opentelemetry, opentelemetry_sdk,
 opentelemetry-otlp to 0.33.0 and tracing-opentelemetry to 0.34.0 (#39278)

Bumps
[opentelemetry](https://github.com/open-telemetry/opentelemetry-rust)
from 0.32.0 to 0.33.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-rust/releases">opentelemetry's
releases</a>.</em></p>
<blockquote>
<h2>0.33.0</h2>
<p>See the <a
href="https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry-0.33.0/docs/release_0.33.md">0.33.0
release notes and migration guidance</a>.</p>
<p>The OTLP exporters for Logs and Metrics remain release candidates. We
plan to declare them stable in 0.33.1 after approximately two weeks of
validation, provided no issues requiring breaking API changes arise. The
Logs and Metrics API and SDK remain stable; Distributed Tracing remains
pre-stable.</p>
<h2>opentelemetry-semantic-conventions-0.32.1</h2>
<p>See the <a
href="https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry-semantic-conventions-0.32.1/opentelemetry-semantic-conventions/CHANGELOG.md">CHANGELOG</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry-0.33.0/docs/release_0.33.md">opentelemetry's
changelog</a>.</em></p>
<blockquote>
<h1>Release Notes 0.33</h1>
<p>The OTLP exporters for Logs and Metrics remain in release-candidate
(RC) status
in OpenTelemetry Rust 0.33.0. We intend to declare them stable in
0.33.1,
approximately two weeks after this release, provided the RC period does
not
uncover any issues requiring breaking API changes. During this period,
we expect
only compatible fixes, documentation updates, and low-risk internal
optimisations.</p>
<p>OpenTelemetry Rust 0.33.0 brings OTLP retries on by default and
completes the
stabilisation cleanups that began in 0.32. The Logs and Metrics API and
SDK
remain stable with no breaking changes. The Distributed Tracing API,
SDK, and
OTLP exporter remain pre-stable, and this release includes intentional
breaking changes in that area
to continue preparing it for stabilisation.</p>
<p>For detailed changelogs of individual crates, refer to their
respective
changelog files. This document summarises the key changes.</p>
<h2>Key Changes</h2>
<h3>OTLP Exporters for Logs and Metrics (RC)</h3>
<p>Version 0.33.0 keeps the OTLP exporters for Logs and Metrics in RC
for a final
validation period. If no issues requiring breaking API changes are
identified,
we intend to declare them stable in 0.33.1 approximately two weeks after
this
release.</p>
<h4>Retries enabled by default</h4>
<p>OTLP/HTTP and OTLP/gRPC retries are now enabled by default with
exponential
backoff, jitter, and up to 3 retries (4 attempts total). Use
<code>.with_retry_policy(RetryPolicy::disabled())</code> to opt out, or
provide a custom
<code>RetryPolicy</code>.</p>
<p>Users of the experimental retry feature flags
(<code>experimental-grpc-retry</code> and
<code>experimental-http-retry</code>) should remove them from
<code>Cargo.toml</code>. The <code>retry</code> and
<code>retry_classification</code> modules are now
crate-private; replace <code>opentelemetry_otlp::retry</code> imports
with
<code>opentelemetry_otlp::RetryPolicy</code> and use its
<code>with_*</code> methods instead of
struct literals.</p>
<h4>Stabilisation cleanups</h4>
<ul>
<li><strong>Breaking for callers matching or constructing removed
build-error variants:</strong> <code>ExporterBuildError</code> now has
two exhaustive variants, <code>InvalidConfiguration(String)</code> and
<code>InternalFailure(String)</code>. Update uses of removed variants.
Normal exporter builder calls and propagation of build errors with
<code>?</code> need no changes. See the <a
href="https://github.com/open-telemetry/opentelemetry-rust/blob/opentelemetry-0.33.0/opentelemetry-otlp/CHANGELOG.md#0330">OTLP
changelog</a> for migration examples.</li>
<li><strong>Breaking</strong> <code>Protocol</code> and
<code>Compression</code> are now <code>#[non_exhaustive]</code>.
Exhaustive matches must add a wildcard arm.</li>
<li><strong>Breaking</strong> <code>Protocol::from_env()</code> is now
crate-private. Builders resolve
<code>OTEL_EXPORTER_OTLP_PROTOCOL</code> automatically; read the env var
directly if
needed.</li>
<li>Invalid OTLP endpoint environment variables (HTTP and gRPC) now
produce a</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/19833847cab86c8464c1dfb6d28b1de9c0b50038"><code>1983384</code></a>
docs: clarify OTLP 0.33 migration guidance (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3747">#3747</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/dacfeda67b765a9049a84fac686bf77b9d730b40"><code>dacfeda</code></a>
chore: Prepare for release v0.33.0 (RC) (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3712">#3712</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/996ac1e398ca2a75bc787a18204c37fa1ff6a8b4"><code>996ac1e</code></a>
refactor(http)!: make ResponseBodyTooLarge extensible (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3736">#3736</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/d328c659c626b7853715b02f04275d62a1ebcc53"><code>d328c65</code></a>
fix(proto): preserve scope metadata when grouping OTLP logs (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3740">#3740</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/e652efdb4b8bddfb6cb488558a44c2c6f877dfa2"><code>e652efd</code></a>
refactor(otlp): finalize exporter build error API (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3692">#3692</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/8809c428e08978a361a0c4284459c876fdc46b60"><code>8809c42</code></a>
refactor(otlp)!: separate configuration parsing errors (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3742">#3742</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/cc1c374259f5f57de3371f59c68062d1be7567c2"><code>cc1c374</code></a>
feat(otlp): Allow to provide http client wrapped in Arc for user (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3468">#3468</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/e085c6184ad71d38217d4394a4ef2894a446f55d"><code>e085c61</code></a>
ci: use supported Debian image for benchmarks (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3744">#3744</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/6c5fd583b2805166393e59b48a827c3a44345a82"><code>6c5fd58</code></a>
fix(proto): accept omitted partial success fields (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3739">#3739</a>)</li>
<li><a
href="https://github.com/open-telemetry/opentelemetry-rust/commit/51b36a72d299e4a6e2b5fdfadaae1f4e8688b127"><code>51b36a7</code></a>
fix(otlp): handle enum environment values consistently (<a
href="https://redirect.github.com/open-telemetry/opentelemetry-rust/issues/3730">#3730</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-telemetry/opentelemetry-rust/compare/opentelemetry-0.32.0...opentelemetry-0.33.0">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock           | 33 +++++++++++++++++----------------
 Cargo.toml           |  8 ++++----
 misc/wasm/Cargo.lock | 25 +++++++++++++------------
 3 files changed, 34 insertions(+), 32 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index b80c2a66b6ff6..bd9c07c09682d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4790,9 +4790,9 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpdate"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
@@ -5191,7 +5191,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.3",
+ "hashbrown 0.16.1",
  "serde",
  "serde_core",
 ]
@@ -10166,9 +10166,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682"
+checksum = "6cdb0b1b267eb9db3331b434ed9ddab10d50e280a9adf9d13e5233e2002b61b5"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -10180,9 +10180,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
+checksum = "ee2c3625b8aa04209f7e01e513bc8044da9687fa38a9eacf59628ca5f3b87300"
 dependencies = [
  "async-trait",
  "bytes",
@@ -10193,11 +10193,12 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
+checksum = "699a67345e21962a231955b9059a157e428b219fa5df8efe11f08346fb23a344"
 dependencies = [
  "http 1.4.2",
+ "httpdate",
  "opentelemetry",
  "opentelemetry-http",
  "opentelemetry-proto",
@@ -10212,9 +10213,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638"
+checksum = "25da1ac11a0aeccf38d7f77ee0348715adaf8340f65ad46c94a02c6b20e2f65d"
 dependencies = [
  "opentelemetry",
  "opentelemetry_sdk",
@@ -10225,9 +10226,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry_sdk"
-version = "0.32.1"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
+checksum = "cb39533d9d1c912123efd7d41d7e0c29d16917b60ce15b4c8d87cb1af7f67520"
 dependencies = [
  "futures-channel",
  "futures-executor",
@@ -13536,7 +13537,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand 2.3.0",
- "getrandom 0.3.3",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
  "windows-sys 0.61.1",
@@ -14349,9 +14350,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-opentelemetry"
-version = "0.33.0"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adbc64cba7137545b8044cb1fe9814f7aacf3c6b5f9b45be8bb5db538befdb26"
+checksum = "0a904802a1b902f43638b677ff2a650847e3b4404101b6c586d648e8c1e3e8fe"
 dependencies = [
  "js-sys",
  "opentelemetry",
diff --git a/Cargo.toml b/Cargo.toml
index 1d5e579ec8994..da013a54c9c30 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -425,9 +425,9 @@ openssh-mux-client = "0.17.9"
 openssl = { version = "0.10.80", features = ["vendored"] }
 openssl-probe = "0.2.1"
 openssl-sys = { version = "0.9.108", features = ["vendored"] }
-opentelemetry = { version = "0.32.0", features = ["trace"] }
-opentelemetry-otlp = { version = "0.32.0", features = ["grpc-tonic"] }
-opentelemetry_sdk = { version = "0.32.1", features = ["experimental_trace_batch_span_processor_with_async_runtime", "rt-tokio"] }
+opentelemetry = { version = "0.33.0", features = ["trace"] }
+opentelemetry-otlp = { version = "0.33.0", features = ["grpc-tonic"] }
+opentelemetry_sdk = { version = "0.33.0", features = ["experimental_trace_batch_span_processor_with_async_runtime", "rt-tokio"] }
 ordered-float = { version = "5.1.0", features = ["serde"] }
 os_info = "3.11.0"
 owo-colors = "4.3.0"
@@ -547,7 +547,7 @@ tower-sessions-memory-store = "0.14.0"
 tracing = "0.1.44"
 tracing-capture = "0.1.0"
 tracing-core = "0.1.35"
-tracing-opentelemetry = "0.33.0"
+tracing-opentelemetry = "0.34.0"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt", "json", "tracing-log"] }
 # Held back: must match the `tungstenite` that `axum`'s `ws` feature pulls in
 # via `tokio-tungstenite`, else the two versions coexist in the dependency
diff --git a/misc/wasm/Cargo.lock b/misc/wasm/Cargo.lock
index a65996ba041c6..f0301d890ec27 100644
--- a/misc/wasm/Cargo.lock
+++ b/misc/wasm/Cargo.lock
@@ -1263,9 +1263,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0142c63252a9e054e68a4c61a5778f7b14f576274d593f8ce883d191a099682"
+checksum = "6cdb0b1b267eb9db3331b434ed9ddab10d50e280a9adf9d13e5233e2002b61b5"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1277,9 +1277,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-http"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5683015d09e2df236ef005b17f6f196f0d5f6313c4fa43a7b6a53b52776e4331"
+checksum = "ee2c3625b8aa04209f7e01e513bc8044da9687fa38a9eacf59628ca5f3b87300"
 dependencies = [
  "async-trait",
  "bytes",
@@ -1290,11 +1290,12 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-otlp"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
+checksum = "699a67345e21962a231955b9059a157e428b219fa5df8efe11f08346fb23a344"
 dependencies = [
  "http",
+ "httpdate",
  "opentelemetry",
  "opentelemetry-http",
  "opentelemetry-proto",
@@ -1309,9 +1310,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry-proto"
-version = "0.32.0"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56d658ba1faf63f7b9c492cfbe6e0ec365440a16132d3270c1065f7b33f1b638"
+checksum = "25da1ac11a0aeccf38d7f77ee0348715adaf8340f65ad46c94a02c6b20e2f65d"
 dependencies = [
  "opentelemetry",
  "opentelemetry_sdk",
@@ -1322,9 +1323,9 @@ dependencies = [
 
 [[package]]
 name = "opentelemetry_sdk"
-version = "0.32.1"
+version = "0.33.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
+checksum = "cb39533d9d1c912123efd7d41d7e0c29d16917b60ce15b4c8d87cb1af7f67520"
 dependencies = [
  "futures-channel",
  "futures-executor",
@@ -2423,9 +2424,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-opentelemetry"
-version = "0.33.0"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adbc64cba7137545b8044cb1fe9814f7aacf3c6b5f9b45be8bb5db538befdb26"
+checksum = "0a904802a1b902f43638b677ff2a650847e3b4404101b6c586d648e8c1e3e8fe"
 dependencies = [
  "js-sys",
  "opentelemetry",

From dad26feab6e7fa0e2448391c6cefa6a088810a64 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 10:41:22 +0200
Subject: [PATCH 75/94] build(deps): bump tower-http from 0.6.11 to 0.7.1
 (#39015)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [tower-http](https://github.com/tower-rs/tower-http) from 0.6.11
to 0.7.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tower-rs/tower-http/releases">tower-http's
releases</a>.</em></p>
<blockquote>
<h2>tower-http-0.7.1</h2>
<h2>Added</h2>
<ul>
<li><code>fs</code>: add
<code>ServeDir::redirect_to_trailing_slash()</code> to serve directory
indexes directly instead of first redirecting to the trailing-slash
path. The redirect remains the default (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/728">#728</a>)</li>
<li><code>fs</code>: add <code>ignore_multi_range_requests()</code> to
<code>ServeDir</code> and <code>ServeFile</code>, serving the full
representation when a request asks for multiple byte ranges. The
existing <code>416 Range Not Satisfiable</code> response remains the
default (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/727">#727</a>)</li>
<li><code>request-id</code>: the constructors and accessors on the
request-id layers, services, and <code>RequestId</code> are now
<code>const fn</code>, so they can be used in const context (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/716">#716</a>)</li>
</ul>
<h2>Changed</h2>
<ul>
<li><code>fs</code>: the minimum <code>http-range-header</code>
requirement is now 0.4.2 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/661">#661</a>)</li>
</ul>
<h2>Fixed</h2>
<ul>
<li><strong>behavioral change:</strong> <code>fs</code>: make
<code>ServeDir::try_call</code> propagate expected filesystem
I/O errors when no fallback is configured, as documented, instead of
converting
them to <code>404 Not Found</code> responses (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/718">#718</a>)</li>
<li><code>decompression</code>: don't end the body when a data frame
with no remaining bytes
arrives after the decompressor reports end-of-stream. Trailers following
such a
frame were dropped and could not be recovered (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/722">#722</a>)</li>
<li><code>decompression</code>: return a body error when a data frame
with remaining bytes
arrives after the decompressor reports end-of-stream, rather than
silently
truncating. This regressed in 0.7.0 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/712">#712</a>)</li>
<li><code>fs</code>: multipart range requests are now rejected before
range validation, so
they consistently return <code>416 Range Not Satisfiable</code> with a
<code>Cannot serve multipart range requests</code> body instead of a
generic
unsatisfiable-range response (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/661">#661</a>)</li>
<li><code>fs</code>: range error responses no longer carry
representation headers such as
<code>Content-Type</code> and <code>Content-Encoding</code> (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/727">#727</a>)</li>
<li><code>set-header</code>:
<code>SetMultipleResponseHeadersLayer</code> and
<code>SetMultipleResponseHeader</code>
are now <code>Clone</code> regardless of the response body type,
matching the fix applied
to the request-side types in 0.7.0 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/714">#714</a>)</li>
</ul>
<p><a
href="https://redirect.github.com/tower-rs/tower-http/issues/661">#661</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/661">tower-rs/tower-http#661</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/712">#712</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/712">tower-rs/tower-http#712</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/714">#714</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/714">tower-rs/tower-http#714</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/716">#716</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/716">tower-rs/tower-http#716</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/718">#718</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/718">tower-rs/tower-http#718</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/722">#722</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/722">tower-rs/tower-http#722</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/727">#727</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/727">tower-rs/tower-http#727</a>
<a
href="https://redirect.github.com/tower-rs/tower-http/issues/728">#728</a>:
<a
href="https://redirect.github.com/tower-rs/tower-http/pull/728">tower-rs/tower-http#728</a></p>
<h2>All the changes</h2>
<ul>
<li>chore(deps): bump actions/checkout from 6 to 7 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/708">tower-rs/tower-http#708</a></li>
<li>fix(compression): reject non-empty data frames after codec is EOF by
<a href="https://github.com/seanmonstar"><code>@​seanmonstar</code></a>
in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/712">tower-rs/tower-http#712</a></li>
<li>Remove Clone derivations from SetMultipleResponseHeader* types by <a
href="https://github.com/skeet70"><code>@​skeet70</code></a> in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/714">tower-rs/tower-http#714</a></li>
<li>feat(request-id): Allow request-id constructor in const context by
<a href="https://github.com/tottoto"><code>@​tottoto</code></a> in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/716">tower-rs/tower-http#716</a></li>
<li>fs: Avoid unnecessary conversions between SystemTime and HttpDate by
<a href="https://github.com/tottoto"><code>@​tottoto</code></a> in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/717">tower-rs/tower-http#717</a></li>
<li>fs: Use HeaderValue::is_empty to check for empty values by <a
href="https://github.com/tottoto"><code>@​tottoto</code></a> in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/720">tower-rs/tower-http#720</a></li>
<li>fs: Use HeaderValue::to_str for date headers by <a
href="https://github.com/tottoto"><code>@​tottoto</code></a> in <a
href="https://redirect.github.com/tower-rs/tower-http/pull/721">tower-rs/tower-http#721</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tower-rs/tower-http/commit/c9414514a421b07b6520e040a3fd6a579b0c5e1b"><code>c941451</code></a>
chore(release): prepare 0.7.1 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/729">#729</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/9697702412f50dba61962d06d0436376a1e5a435"><code>9697702</code></a>
chore(deps): bump taiki-e/install-action from 2.86.3 to 2.86.8 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/730">#730</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/e2582e2fde4ef768caedc1377d07169480d07cc4"><code>e2582e2</code></a>
Allow ignoring multi-range requests (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/727">#727</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/888f7fe6c6f9ee006a6d882723b1cba26601dbc3"><code>888f7fe</code></a>
feat(services): configure directory redirects (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/728">#728</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/5ad76544ce0eb15cd8ac185bef846eb4a80233a4"><code>5ad7654</code></a>
chore(deps): bump taiki-e/install-action from 2.85.12 to 2.86.3 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/726">#726</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/d154adbace6abc98162620ea1b56d88629b40c91"><code>d154adb</code></a>
fix: reject multipart ranges before validation (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/661">#661</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/d9e5c8a38d072e49f32b5602f5cca0b8d1402e05"><code>d9e5c8a</code></a>
ci: Update to cargo-check-external-types 0.5.0 (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/724">#724</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/90c072b50eba4a47fe6b696416086c7e269bb3e9"><code>90c072b</code></a>
Propagate ServeDir::try_call I/O errors (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/718">#718</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/860922e81da98f0813928816634b30a74cbbbb83"><code>860922e</code></a>
fix(decompression): don't end the body on an empty data frame (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/722">#722</a>)</li>
<li><a
href="https://github.com/tower-rs/tower-http/commit/85322522af352a09a21ddc9dd147b4bfc122d979"><code>8532252</code></a>
docs(example)/custom future with multiple bodies (<a
href="https://redirect.github.com/tower-rs/tower-http/issues/711">#711</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/tower-rs/tower-http/compare/tower-http-0.6.11...tower-http-0.7.1">compare
view</a></li>
</ul>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 38 +++++++++++++++++++++++++++++---------
 Cargo.toml |  2 +-
 deny.toml  |  2 ++
 3 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bd9c07c09682d..fb0fdeef9f999 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5650,7 +5650,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.6.11",
  "tracing",
 ]
 
@@ -7464,7 +7464,7 @@ dependencies = [
  "tokio-postgres",
  "tokio-stream",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.7.1",
  "tower-sessions",
  "tracing",
  "tracing-capture",
@@ -7654,7 +7654,7 @@ dependencies = [
  "serde_json",
  "tokio",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.7.1",
  "tracing",
  "tracing-subscriber",
 ]
@@ -7995,7 +7995,7 @@ dependencies = [
  "sha2 0.10.9",
  "thiserror 2.0.21",
  "tokio",
- "tower-http",
+ "tower-http 0.7.1",
  "tracing",
  "uuid",
 ]
@@ -8890,7 +8890,7 @@ dependencies = [
  "tokio",
  "tokio-postgres",
  "tokio-stream",
- "tower-http",
+ "tower-http 0.7.1",
  "tracing",
  "uuid",
  "walkdir",
@@ -11990,7 +11990,7 @@ dependencies = [
  "tokio-native-tls",
  "tokio-util",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -12034,7 +12034,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-util",
  "tower 0.5.3",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -14163,17 +14163,38 @@ name = "tower-http"
 version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "base64 0.22.1",
+ "bitflags 2.11.0",
+ "bytes",
+ "futures-util",
+ "http 1.4.2",
+ "http-body 1.0.1",
+ "mime",
+ "pin-project-lite",
+ "tower 0.5.3",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
 dependencies = [
  "async-compression",
  "base64 0.22.1",
  "bitflags 2.11.0",
  "bytes",
  "futures-core",
- "futures-util",
  "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
+ "percent-encoding",
  "pin-project-lite",
  "tokio",
  "tokio-util",
@@ -14181,7 +14202,6 @@ dependencies = [
  "tower-layer",
  "tower-service",
  "tracing",
- "url",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index da013a54c9c30..88d41f3c99c07 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -540,7 +540,7 @@ tonic = { version = "0.14.6", features = ["gzip", "transport"] }
 tonic-prost = "0.14.6"
 tonic-prost-build = "0.14.6"
 tower = { version = "0.5.3", features = ["balance", "buffer", "filter", "limit", "load-shed", "retry", "timeout", "util"] }
-tower-http = { version = "0.6.11", features = ["auth", "cors", "decompression-br", "decompression-deflate", "decompression-gzip", "decompression-zstd", "map-response-body", "trace", "util"] }
+tower-http = { version = "0.7.1", features = ["auth", "cors", "decompression-br", "decompression-deflate", "decompression-gzip", "decompression-zstd", "map-response-body", "trace", "util"] }
 tower-lsp = { version = "0.20.0", features = ["proposed"] }
 tower-sessions = "0.15.0"
 tower-sessions-memory-store = "0.14.0"
diff --git a/deny.toml b/deny.toml
index 962b38741f960..2669c99a1f9f3 100644
--- a/deny.toml
+++ b/deny.toml
@@ -106,6 +106,8 @@ skip = [
     { name = "nix", version = "0.26.4" },
     # Held back by mysql_async `v0.36.1`
     { name = "socket2", version = "0.5.10" },
+    # kube-client and reqwest still pull 0.6.
+    { name = "tower-http", version = "0.6.11" },
     # Used by azure_core
     { name = "quick-xml", version = "0.31.0" },
     # reqsign-aws (via iceberg) is ahead of opendal, which pulls 0.39.

From e16b64c178ccbeefb845721b9633d4ef5c4305e2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:19:26 +0200
Subject: [PATCH 76/94] build(deps): bump tungstenite from 0.29.0 to 0.30.0
 (#38293)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [tungstenite](https://github.com/snapview/tungstenite-rs) from
0.29.0 to 0.30.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/snapview/tungstenite-rs/blob/master/CHANGELOG.md">tungstenite's
changelog</a>.</em></p>
<blockquote>
<h1>0.30.0</h1>
<ul>
<li>Reject non-compliant clients (incorrect
<code>Sec-WebSocket-Key</code> length/format) on the server side.</li>
<li>Update <code>rand</code> and <code>sha</code> dependencies and raise
MSRV to 1.85.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/snapview/tungstenite-rs/commit/7f4aeaf0944992c5664c8fb8e0d54577c7e18020"><code>7f4aeaf</code></a>
Bump version to 0.30.0</li>
<li><a
href="https://github.com/snapview/tungstenite-rs/commit/172280ff2e2babbc14a582fad6187766eafd8b75"><code>172280f</code></a>
Update <code>rand</code> and <code>sha</code> as well as raise the
MSRV</li>
<li><a
href="https://github.com/snapview/tungstenite-rs/commit/16ca0fc87e0a39f66548e24a08ab0961e592324f"><code>16ca0fc</code></a>
check frame length against max_size before narrowing to usize (<a
href="https://redirect.github.com/snapview/tungstenite-rs/issues/545">#545</a>)</li>
<li><a
href="https://github.com/snapview/tungstenite-rs/commit/85853704af157911447417d89ee6363bc1fab808"><code>8585370</code></a>
Fix <a
href="https://redirect.github.com/snapview/tungstenite-rs/issues/377">#377</a></li>
<li><a
href="https://github.com/snapview/tungstenite-rs/commit/d3e4e91faac3c80b24804c1fdcfdc60a16df384c"><code>d3e4e91</code></a>
Validate Sec-WebSocket-Key length per RFC 6455 §4.2.1.5 (<a
href="https://redirect.github.com/snapview/tungstenite-rs/issues/543">#543</a>)</li>
<li>See full diff in <a
href="https://github.com/snapview/tungstenite-rs/compare/v0.29.0...v0.30.0">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 20 ++++++++++++++++++--
 Cargo.toml |  2 +-
 deny.toml  |  2 ++
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index fb0fdeef9f999..bb1d8342773b9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7470,7 +7470,7 @@ dependencies = [
  "tracing-capture",
  "tracing-opentelemetry",
  "tracing-subscriber",
- "tungstenite",
+ "tungstenite 0.30.0",
  "url",
  "uuid",
 ]
@@ -13957,7 +13957,7 @@ dependencies = [
  "futures-util",
  "log",
  "tokio",
- "tungstenite",
+ "tungstenite 0.29.0",
 ]
 
 [[package]]
@@ -14453,6 +14453,22 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http 1.4.2",
+ "httparse",
+ "log",
+ "rand 0.10.2",
+ "sha1 0.11.0",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "turmoil"
 version = "0.7.2"
diff --git a/Cargo.toml b/Cargo.toml
index 88d41f3c99c07..f4ec75ca8e67e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -554,7 +554,7 @@ tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt", "jso
 # graph. `axum` 0.8.9 is on `tokio-tungstenite` 0.29, which pins this to 0.29.
 # 0.30 additionally moves to `sha1` 0.11, duplicating the whole RustCrypto
 # hashing stack.
-tungstenite = "0.29.0"
+tungstenite = "0.30.0"
 turmoil = "0.7.2"
 uncased = "0.9.10"
 unicode-normalization = "0.1.25"
diff --git a/deny.toml b/deny.toml
index 2669c99a1f9f3..dc5d0f85c563a 100644
--- a/deny.toml
+++ b/deny.toml
@@ -108,6 +108,8 @@ skip = [
     { name = "socket2", version = "0.5.10" },
     # kube-client and reqwest still pull 0.6.
     { name = "tower-http", version = "0.6.11" },
+    # tokio-tungstenite still pulls 0.29.
+    { name = "tungstenite", version = "0.29.0" },
     # Used by azure_core
     { name = "quick-xml", version = "0.31.0" },
     # reqsign-aws (via iceberg) is ahead of opendal, which pulls 0.39.

From 4c017fdba89e97a59186abc1ac7c55e8a562068c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 09:23:59 +0000
Subject: [PATCH 77/94] build(deps): bump rusqlite from 0.32.1 to 0.40.2
 (#38300)

Bumps [rusqlite](https://github.com/rusqlite/rusqlite) from 0.32.1 to
0.40.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rusqlite/rusqlite/releases">rusqlite's
releases</a>.</em></p>
<blockquote>
<h2>0.40.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Lower MSRV to 1.88.0</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rusqlite/rusqlite/compare/v0.40.1...v0.40.2">https://github.com/rusqlite/rusqlite/compare/v0.40.1...v0.40.2</a></p>
<h2>0.40.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix clippy warnings <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1852">#1852</a></li>
<li>Bump bundled SQLite version to 3.53.2 <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1853">#1853</a></li>
<li>Bump hashlink version <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1855">#1855</a></li>
<li>Fix SQL injection when SAVEPOINT name is tainted <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1854">#1854</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rusqlite/rusqlite/compare/v0.40.0...v0.40.1">https://github.com/rusqlite/rusqlite/compare/v0.40.0...v0.40.1</a></p>
<h2>0.40.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Breaking changes: Replace VTab macros by constructors <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1823">#1823</a></li>
<li>Breaking changes: Fix VTab::best_index <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1824">#1824</a></li>
<li>Asserts on VTab::connect aux and args <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1825">#1825</a></li>
<li>Breaking changes: Fix VTab::connect / create <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1826">#1826</a></li>
<li>Breaking changes: Allow opting out of using sqlite-wasm-rs on
wasm32-unknown-unknown <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1828">#1828</a>,
<a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1829">#1829</a></li>
<li>Derive Default for SeriesTabCursor/ArrayTabCursor <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1830">#1830</a></li>
<li>Update link to pre-update hook <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1831">#1831</a></li>
<li>Breaking changes: Fix VTab::connect <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1832">#1832</a></li>
<li>impl From<!-- raw HTML omitted --> for FromSqlError <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1833">#1833</a></li>
<li>Breaking changes: Fix vtab::dequote <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1835">#1835</a></li>
<li>Bump bundled SQLCipher to version 4.14.0 <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1837">#1837</a></li>
<li>sqlite3_set_errmsg <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1752">#1752</a></li>
<li>Bump sqlite3-parser version <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1838">#1838</a></li>
<li>Fix UB in ToSqlOutput::from_rc <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1839">#1839</a></li>
<li>Ensure miri doesn't complain <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1840">#1840</a></li>
<li>Bump to actions/checkout@v6 <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1842">#1842</a></li>
<li>Add support to UtcDateTime <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1843">#1843</a>,
<a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1844">#1844</a></li>
<li>Bump bundled SQLite version to 3.53.1 <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1848">#1848</a></li>
<li>Replace some cfg(not by cfg_select <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1850">#1850</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rusqlite/rusqlite/compare/v0.39.0...v0.40.0">https://github.com/rusqlite/rusqlite/compare/v0.39.0...v0.40.0</a></p>
<h2>0.39.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix constraints on VTab Aux data <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1778">#1778</a>,
<a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1771">#1771</a></li>
<li>Fix docs.rs generation <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1779">#1779</a></li>
<li>Fix a small typo in <code>rollback_hook</code> docstring <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1780">#1780</a></li>
<li>Fix some warnings from Intellij <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1781">#1781</a></li>
<li>Minimal doc for features <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1783">#1783</a></li>
<li>Clear hooks only for owning connections <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1785">#1785</a>,
<a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1784">#1784</a></li>
<li>Fix link to SQLite C Interface, Prepare Flags <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1787">#1787</a></li>
<li>Comment functions which are not usable from a loadable extension <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1789">#1789</a></li>
<li>Factorize code <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1792">#1792</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/e88f112bef7899234a497baed5cc3c3d553deeb8"><code>e88f112</code></a>
Prepare release</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/d11c76e7d7e20eb8e22ede9250407187bd3f22e3"><code>d11c76e</code></a>
Update main.yml</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/c922ca5b716b5a226df6eba9eea84c6320c60311"><code>c922ca5</code></a>
Lower MSRV to 1.88.0</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/6d3c282dc5531a57eb4e22ece3207f00c95d0fb0"><code>6d3c282</code></a>
Merge pull request <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1856">#1856</a>
from gwenn/0.40.1</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/2ba28b7469acc41c528ad1963327815d63b9cab9"><code>2ba28b7</code></a>
Prepare next release</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/a021dc730d4207212906e77c39bc2ed66b23f1aa"><code>a021dc7</code></a>
Merge pull request <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1854">#1854</a>
from gwenn/savepoint</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/534a149f8dbb55bba9beb45b279a4f13e20b13a8"><code>534a149</code></a>
Merge pull request <a
href="https://redirect.github.com/rusqlite/rusqlite/issues/1855">#1855</a>
from gwenn/hashlink</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/6d9764f26920f54db54b0f24f3f026f6a2c24a7c"><code>6d9764f</code></a>
Bump hashlink version</li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/fa574ebb1ca4586a5d4d4a7175b0aa447628532e"><code>fa574eb</code></a>
Use <code>sqlite3_keyword_check</code></li>
<li><a
href="https://github.com/rusqlite/rusqlite/commit/15385cc046364b68c9d7e65d2644dc86c0980f25"><code>15385cc</code></a>
Fix SQL injection when SAVEPOINT name is tainted</li>
<li>Additional commits viewable in <a
href="https://github.com/rusqlite/rusqlite/compare/v0.32.1...v0.40.2">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 51 +++++++++++++++++++++++++++++++++++++--------------
 Cargo.toml |  2 +-
 deny.toml  |  4 ++--
 3 files changed, 40 insertions(+), 17 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index bb1d8342773b9..4f4ee5d867d87 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4490,9 +4490,6 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash 0.8.12",
-]
 
 [[package]]
 name = "hashbrown"
@@ -4519,23 +4516,26 @@ name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "hashlink"
-version = "0.9.1"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
 dependencies = [
- "hashbrown 0.14.5",
+ "hashbrown 0.15.3",
 ]
 
 [[package]]
 name = "hashlink"
-version = "0.10.0"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
 dependencies = [
- "hashbrown 0.15.3",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -5960,9 +5960,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -12233,6 +12233,16 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "rsqlite-vfs"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c51c9ae4df8a7fba42103df5c621fa3c37eccf3a3c650879e90fc48b11cc192c"
+dependencies = [
+ "hashbrown 0.16.1",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "rtoolbox"
 version = "0.0.1"
@@ -12245,16 +12255,17 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.32.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.11.0",
  "fallible-iterator 0.3.0",
  "fallible-streaming-iterator",
- "hashlink 0.9.1",
+ "hashlink 0.12.2",
  "libsqlite3-sys",
  "smallvec",
+ "sqlite-wasm-rs",
 ]
 
 [[package]]
@@ -13196,6 +13207,18 @@ dependencies = [
  "der",
 ]
 
+[[package]]
+name = "sqlite-wasm-rs"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc3efc0da82635d7e1ced0053bbbfa8c7ab9645d0bf36ceb4f7127bb85315d75"
+dependencies = [
+ "cc",
+ "js-sys",
+ "rsqlite-vfs",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "sqlparser"
 version = "0.63.0"
diff --git a/Cargo.toml b/Cargo.toml
index f4ec75ca8e67e..19d7ba32729aa 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -479,7 +479,7 @@ rocksdb = { version = "0.24.0", default-features = false, features = ["lz4", "sn
 ropey = "1.6.1"
 rustls = "0.23.38"
 rpassword = "7.5.1"
-rusqlite = { version = "0.32.1", features = ["bundled"] }
+rusqlite = { version = "0.40.2", features = ["bundled"] }
 ryu = "1.0.23"
 schemars = { version = "1.2.1", features = ["uuid1"] }
 scopeguard = "1.2.0"
diff --git a/deny.toml b/deny.toml
index dc5d0f85c563a..0603f52756520 100644
--- a/deny.toml
+++ b/deny.toml
@@ -183,8 +183,8 @@ skip = [
     # held back by tower-lsp 0.20 (mz-deploy LSP server)
     { name = "dashmap", version = "5.5.3" },
     { name = "tower", version = "0.4.13" },
-    # held back by rusqlite 0.32 (mz-deploy build cache)
-    { name = "hashlink", version = "0.9.1" },
+    # held back by duckdb 1.4 (rusqlite in mz-deploy's build cache is on 0.12)
+    { name = "hashlink", version = "0.10.0" },
     # held back by owo-colors 4.3 (mz-deploy terminal styling)
     { name = "supports-color", version = "2.1.0" },
 

From c0c364c6e5d30e1bfb542890d5a85747cf814c56 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:19:07 +0200
Subject: [PATCH 78/94] build(deps): bump smallvec from 1.16.1 to 1.16.2 in
 /misc/wasm in the simple group across 1 directory (#39286)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the simple group with 1 update in the /misc/wasm directory:
[smallvec](https://github.com/servo/rust-smallvec).

Updates `smallvec` from 1.16.1 to 1.16.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/servo/rust-smallvec/releases">smallvec's
releases</a>.</em></p>
<blockquote>
<h2>v1.16.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Backport v2’s retain implementation to v1 by <a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a>
in <a
href="https://redirect.github.com/servo/rust-smallvec/pull/596">servo/rust-smallvec#596</a></li>
<li>Fix element ownership tracking with may_dangle by <a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a>
in <a
href="https://redirect.github.com/servo/rust-smallvec/pull/594">servo/rust-smallvec#594</a></li>
<li>Fix Cargo manual_readme warning by <a
href="https://github.com/Rayan-and-beyond"><code>@​Rayan-and-beyond</code></a>
in <a
href="https://redirect.github.com/servo/rust-smallvec/pull/608">servo/rust-smallvec#608</a></li>
<li>chore: bump version by <a
href="https://github.com/alejandro-vaz"><code>@​alejandro-vaz</code></a>
in <a
href="https://redirect.github.com/servo/rust-smallvec/pull/617">servo/rust-smallvec#617</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/Rayan-and-beyond"><code>@​Rayan-and-beyond</code></a>
made their first contribution in <a
href="https://redirect.github.com/servo/rust-smallvec/pull/608">servo/rust-smallvec#608</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/servo/rust-smallvec/compare/v1.16.1...v1.16.2">https://github.com/servo/rust-smallvec/compare/v1.16.1...v1.16.2</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/servo/rust-smallvec/commit/ccf5fc71044d491c46a3d79e7ed53948e6da1590"><code>ccf5fc7</code></a>
chore: bump version (<a
href="https://redirect.github.com/servo/rust-smallvec/issues/617">#617</a>)</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/af207ccb68496e112f3d7366a66c07c6107ef04a"><code>af207cc</code></a>
Merge pull request <a
href="https://redirect.github.com/servo/rust-smallvec/issues/608">#608</a>
from Rayan-and-beyond/fix/manual-readme-warning-606</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/cda4b73506acb35823a8147ef4397375f7063b82"><code>cda4b73</code></a>
Merge pull request <a
href="https://redirect.github.com/servo/rust-smallvec/issues/594">#594</a>
from astral-sh/charlie/codex-fix-may-dangle</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/d0556cb8e33b02b434074896f753f5f03b20c278"><code>d0556cb</code></a>
Merge pull request <a
href="https://redirect.github.com/servo/rust-smallvec/issues/596">#596</a>
from astral-sh/charlie/codex-v1-compact</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/f73914cf4b523741b9af5d13a98e77d59c54bc13"><code>f73914c</code></a>
Flatten retain tests into the unit test module</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/954d599e41b074282857e97c44211f0f797e6597"><code>954d599</code></a>
Move retain tests into the unit test module</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/8d936338dbcefa380b4dd596379b57582ed5d616"><code>8d93633</code></a>
Remove added retain benchmark harness</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/88c6bfabd610f34f4f1f9d530f58fb8a74b9a807"><code>88c6bfa</code></a>
Limit compaction optimization to retain</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/b9ef17da33c19cb1d11190e0c7c29e459297cd6a"><code>b9ef17d</code></a>
Fix element ownership tracking with may_dangle</li>
<li><a
href="https://github.com/servo/rust-smallvec/commit/42029c27c9243d8a178a0d64464185547b3a7d6f"><code>42029c2</code></a>
Compact retained elements directly in retain and dedup_by</li>
<li>See full diff in <a
href="https://github.com/servo/rust-smallvec/compare/v1.16.1...v1.16.2">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 misc/wasm/Cargo.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/misc/wasm/Cargo.lock b/misc/wasm/Cargo.lock
index f0301d890ec27..d1d58bea8c7e9 100644
--- a/misc/wasm/Cargo.lock
+++ b/misc/wasm/Cargo.lock
@@ -2010,9 +2010,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.16.1"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"
+checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
 
 [[package]]
 name = "socket2"

From 7b2d7e5cdbfaf68f2b545ed6ec02e9a6320aa42b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:19:22 +0200
Subject: [PATCH 79/94] build(deps): bump types-pymysql from 1.2.0.20260807 to
 1.2.0.20260923 in /ci/builder (#39285)

Bumps [types-pymysql](https://github.com/python/typeshed) from
1.2.0.20260807 to 1.2.0.20260923.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=types-pymysql&package-manager=pip&previous-version=1.2.0.20260807&new-version=1.2.0.20260923)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 ci/builder/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/builder/requirements.txt b/ci/builder/requirements.txt
index e7deac4d520cd..34dd93f96203f 100644
--- a/ci/builder/requirements.txt
+++ b/ci/builder/requirements.txt
@@ -74,7 +74,7 @@ twine==7.0.0
 types-Markdown==3.10.2.20260712
 types-prettytable==3.4.2.6
 types-psutil==7.2.2.20260827
-types-PyMYSQL==1.2.0.20260807
+types-PyMYSQL==1.2.0.20260923
 types-PyYAML==6.0.12.20260815
 types-requests==2.33.0.20260906
 types-setuptools==84.0.0.20260812

From f6c5bd7f9bc2ba10eeb8d5aa4e52f2c4364fb238 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:19:44 +0200
Subject: [PATCH 80/94] build(deps): bump the terraform group across 2
 directories with 5 updates (#39284)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the terraform group with 3 updates in the
/test/terraform/azure-temporary directory:
[aks::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed),
[hashicorp/azurerm](https://github.com/hashicorp/terraform-provider-azurerm)
and
[materialize_nodepool::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed).
Bumps the terraform group with 3 updates in the
/test/terraform/gcp-temporary directory:
[materialize_nodepool::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed),
[generic_nodepool::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed)
and
[gke::materialize-terraform-self-managed](https://github.com/MaterializeInc/materialize-terraform-self-managed).

Updates `aks::materialize-terraform-self-managed` from 13.2.1 to 13.12.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">aks::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
<h2>v13.10.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>examples: rename the SAML metadata file to idp-metadata.xml by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/425">MaterializeInc/materialize-terraform-self-managed#425</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/b9252af87e417f591fe48a0ec6e5b4d264325762"><code>b9252af</code></a>
examples: use idp-metadata.xml for the SAML IdP metadata file so the
name is ...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2611621fbdea2027cce0b67a7b0d80bfce194dee"><code>2611621</code></a>
ory-stack: support a reserved loadBalancerIP per LB via
lb_overrides.load_bal...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/99e4cac0e940fc5fef807281d2cf69d74078aebc"><code>99e4cac</code></a>
ory-stack: internal Polis service for Kratos-Polis split-horizon (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/437">#437</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2679d648bdbd75e5d4036a192e68fc1f62ad588f"><code>2679d64</code></a>
ory-stack: allow extra SANs on the Polis cert (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/442">#442</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.2.1...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `hashicorp/azurerm` from 5.6.0 to 5.7.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/terraform-provider-azurerm/releases">hashicorp/azurerm's
releases</a>.</em></p>
<blockquote>
<h2>v5.7.0</h2>
<h2>5.7.0 (September 24, 2026)</h2>
<p>FEATURES:</p>
<ul>
<li><strong>New List Resource</strong>:
<code>azurerm_private_dns_resolver_forwarding_rule</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33313">#33313</a>)</li>
<li><strong>New List Resource</strong>:
<code>azurerm_windows_virtual_machine</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33332">#33332</a>)</li>
</ul>
<p>ENHANCEMENTS:</p>
<ul>
<li>dependencies: <code>go-azure-sdk</code> - update to
<code>v0.20260917.1142820</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33495">#33495</a>)</li>
<li>dependencies: <code>network</code> - update API version to
<code>2025-07-01</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33441">#33441</a>)</li>
<li>Data Source: <code>azurerm_linux_web_app</code> - export the
<code>virtual_network_image_pull_enabled</code> property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33316">#33316</a>)</li>
<li>Data Source: <code>azurerm_network_interface</code> - export the
<code>auxiliary_mode</code>, <code>auxiliary_sku</code>,
<code>edge_zone</code>, and <code>internal_domain_name_suffix</code>
properties (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33204">#33204</a>)</li>
<li>Data Source: <code>azurerm_public_ip</code> - export the
<code>domain_name_label_scope</code>, <code>edge_zone</code>,
<code>public_ip_prefix_id</code>, and <code>sku_tier</code> properties
(<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33193">#33193</a>)</li>
<li>Data Source: <code>azurerm_service_plan</code> - export the
<code>premium_plan_auto_scale_enabled</code> property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33300">#33300</a>)</li>
<li>Data Source: <code>azurerm_storage_blob</code> - export the
<code>cache_control</code> and <code>source_uri</code> properties (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33318">#33318</a>)</li>
<li>Data Source: <code>azurerm_traffic_manager_profile</code> - export
the <code>maximum_return</code> property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33346">#33346</a>)</li>
<li>Data Source: <code>azurerm_web_pubsub</code> - export the
<code>live_trace</code> and <code>identity</code> properties (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33373">#33373</a>)</li>
<li><code>azurerm_kubernetes_cluster_node_pool</code> - add
<code>Windows2025</code> as a valid value for the <code>os_sku</code>
property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33463">#33463</a>)</li>
<li><code>azurerm_kubernetes_cluster</code> - add
<code>Windows2025</code> as a valid value for the <code>os_sku</code>
property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33463">#33463</a>)</li>
</ul>
<p>BUG FIXES:</p>
<ul>
<li>Data Source: <code>azurerm_kubernetes_cluster</code> - fix a panic
caused by a nil pointer dereference while flattening
<code>agent_pool_profile</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33488">#33488</a>)</li>
<li><code>azurerm_postgresql_flexible_server</code> - fix
<code>cluster</code> block read for replica <code>create_mode</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33082">#33082</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hashicorp/terraform-provider-azurerm/blob/main/CHANGELOG.md">hashicorp/azurerm's
changelog</a>.</em></p>
<blockquote>
<h2>v5.7.0 (September 24, 2026)</h2>
<p>FEATURES:</p>
<ul>
<li><strong>New List Resource</strong>:
<code>azurerm_private_dns_resolver_forwarding_rule</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33313">#33313</a>)</li>
<li><strong>New List Resource</strong>:
<code>azurerm_windows_virtual_machine</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33332">#33332</a>)</li>
</ul>
<p>ENHANCEMENTS:</p>
<ul>
<li>dependencies: <code>go-azure-sdk</code> - update to
<code>v0.20260917.1142820</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33495">#33495</a>)</li>
<li>dependencies: <code>network</code> - update API version to
<code>2025-07-01</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33441">#33441</a>)</li>
<li>Data Source: <code>azurerm_linux_web_app</code> - export the
<code>virtual_network_image_pull_enabled</code> property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33316">#33316</a>)</li>
<li>Data Source: <code>azurerm_network_interface</code> - export the
<code>auxiliary_mode</code>, <code>auxiliary_sku</code>,
<code>edge_zone</code>, and <code>internal_domain_name_suffix</code>
properties (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33204">#33204</a>)</li>
<li>Data Source: <code>azurerm_public_ip</code> - export the
<code>domain_name_label_scope</code>, <code>edge_zone</code>,
<code>public_ip_prefix_id</code>, and <code>sku_tier</code> properties
(<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33193">#33193</a>)</li>
<li>Data Source: <code>azurerm_service_plan</code> - export the
<code>premium_plan_auto_scale_enabled</code> property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33300">#33300</a>)</li>
<li>Data Source: <code>azurerm_storage_blob</code> - export the
<code>cache_control</code> and <code>source_uri</code> properties (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33318">#33318</a>)</li>
<li>Data Source: <code>azurerm_traffic_manager_profile</code> - export
the <code>maximum_return</code> property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33346">#33346</a>)</li>
<li>Data Source: <code>azurerm_web_pubsub</code> - export the
<code>live_trace</code> and <code>identity</code> properties (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33373">#33373</a>)</li>
<li><code>azurerm_kubernetes_cluster_node_pool</code> - add
<code>Windows2025</code> as a valid value for the <code>os_sku</code>
property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33463">#33463</a>)</li>
<li><code>azurerm_kubernetes_cluster</code> - add
<code>Windows2025</code> as a valid value for the <code>os_sku</code>
property (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33463">#33463</a>)</li>
</ul>
<p>BUG FIXES:</p>
<ul>
<li>Data Source: <code>azurerm_kubernetes_cluster</code> - fix a panic
caused by a nil pointer dereference while flattening
<code>agent_pool_profile</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33488">#33488</a>)</li>
<li><code>azurerm_postgresql_flexible_server</code> - fix
<code>cluster</code> block read for replica <code>create_mode</code> (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33082">#33082</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/10b74261a89246a0c8f24a9e2ba5d3722cffaa78"><code>10b7426</code></a>
5.7.0 release changelog (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33509">#33509</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/b6ac0f2a5872432e5d87c56f9ca55d72a403fa7e"><code>b6ac0f2</code></a>
fix 5.0 upgrade guide (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33508">#33508</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/0f50c7a23ade5923a8adb6f888637b6f8c52f85f"><code>0f50c7a</code></a>
postgresql_flexible_server: fix perpetual replace of replica caused by
cluste...</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/b4c3634d1a3b211ef779f46c0c7011bccb4a6e56"><code>b4c3634</code></a>
<code>CI</code> - update terraform core version to <code>1.16</code> for
latest actions feature sup...</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/6735d45bc3ecc6e02071c91a3bc79fe991eb619c"><code>6735d45</code></a>
update network sdk API version to 2025-07-01: <code>containers</code>,
<code>datafactory</code>, `s...</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/bfc230056c3286f5e4935b38564f7ef813f97ac6"><code>bfc2300</code></a>
update network sdk API version to 2025-07-01: <code>cdn</code>,
<code>mssql</code>, `recoveryservic...</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/c58285755b1f340e7a7bb810aeda2a7e2707c430"><code>c582857</code></a>
<code>private_dns_resolver_forwarding_rule</code> - Add list support (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33313">#33313</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/5e91774e88dea3722cda97e67532341b53262d82"><code>5e91774</code></a>
<code>windows_virtual_machine</code> - add List Resource support (<a
href="https://redirect.github.com/hashicorp/terraform-provider-azurerm/issues/33332">#33332</a>)</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/c1df0f29e1518672cad98c211a60ab18093adfb5"><code>c1df0f2</code></a>
update network sdk API version to 2025-07-01: <code>loadbalancer</code>,
<code>databricks</code> (#...</li>
<li><a
href="https://github.com/hashicorp/terraform-provider-azurerm/commit/fbd5885b65a8f3d1cd9e86e6db9b87a7069f7a2e"><code>fbd5885</code></a>
update network sdk API version to 2025-07-01: <code>appservice</code>,
<code>cognitive</code>, `com...</li>
<li>Additional commits viewable in <a
href="https://github.com/hashicorp/terraform-provider-azurerm/compare/v5.6.0...v5.7.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `materialize_nodepool::materialize-terraform-self-managed` from
13.2.1 to 13.12.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_nodepool::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
<h2>v13.10.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>examples: rename the SAML metadata file to idp-metadata.xml by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/425">MaterializeInc/materialize-terraform-self-managed#425</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/b9252af87e417f591fe48a0ec6e5b4d264325762"><code>b9252af</code></a>
examples: use idp-metadata.xml for the SAML IdP metadata file so the
name is ...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2611621fbdea2027cce0b67a7b0d80bfce194dee"><code>2611621</code></a>
ory-stack: support a reserved loadBalancerIP per LB via
lb_overrides.load_bal...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/99e4cac0e940fc5fef807281d2cf69d74078aebc"><code>99e4cac</code></a>
ory-stack: internal Polis service for Kratos-Polis split-horizon (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/437">#437</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2679d648bdbd75e5d4036a192e68fc1f62ad588f"><code>2679d64</code></a>
ory-stack: allow extra SANs on the Polis cert (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/442">#442</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.2.1...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `materialize_nodepool::materialize-terraform-self-managed` from
13.2.1 to 13.12.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">materialize_nodepool::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
<h2>v13.10.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>examples: rename the SAML metadata file to idp-metadata.xml by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/425">MaterializeInc/materialize-terraform-self-managed#425</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/b9252af87e417f591fe48a0ec6e5b4d264325762"><code>b9252af</code></a>
examples: use idp-metadata.xml for the SAML IdP metadata file so the
name is ...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2611621fbdea2027cce0b67a7b0d80bfce194dee"><code>2611621</code></a>
ory-stack: support a reserved loadBalancerIP per LB via
lb_overrides.load_bal...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/99e4cac0e940fc5fef807281d2cf69d74078aebc"><code>99e4cac</code></a>
ory-stack: internal Polis service for Kratos-Polis split-horizon (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/437">#437</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2679d648bdbd75e5d4036a192e68fc1f62ad588f"><code>2679d64</code></a>
ory-stack: allow extra SANs on the Polis cert (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/442">#442</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.2.1...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `generic_nodepool::materialize-terraform-self-managed` from
13.2.1 to 13.12.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">generic_nodepool::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
<h2>v13.10.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>examples: rename the SAML metadata file to idp-metadata.xml by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/425">MaterializeInc/materialize-terraform-self-managed#425</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/b9252af87e417f591fe48a0ec6e5b4d264325762"><code>b9252af</code></a>
examples: use idp-metadata.xml for the SAML IdP metadata file so the
name is ...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2611621fbdea2027cce0b67a7b0d80bfce194dee"><code>2611621</code></a>
ory-stack: support a reserved loadBalancerIP per LB via
lb_overrides.load_bal...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/99e4cac0e940fc5fef807281d2cf69d74078aebc"><code>99e4cac</code></a>
ory-stack: internal Polis service for Kratos-Polis split-horizon (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/437">#437</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2679d648bdbd75e5d4036a192e68fc1f62ad588f"><code>2679d64</code></a>
ory-stack: allow extra SANs on the Polis cert (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/442">#442</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.2.1...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />

Updates `gke::materialize-terraform-self-managed` from 13.2.1 to 13.12.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/releases">gke::materialize-terraform-self-managed's
releases</a>.</em></p>
<blockquote>
<h2>v13.12.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Update Terraform github.com/MaterializeInc/materialize-monitoring to
materialize-monitoring/v0.23.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/446">MaterializeInc/materialize-terraform-self-managed#446</a></li>
<li>build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo
group by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/449">MaterializeInc/materialize-terraform-self-managed#449</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.12.0...v13.12.1</a></p>
<h2>v13.12.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>ory: make MCP OAuth access tokens carry email/groups + audience by
<a href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in
<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/444">MaterializeInc/materialize-terraform-self-managed#444</a></li>
</ul>
<h3>Dependencies ⬆️</h3>
<ul>
<li>Bump to helm-chart v26.42.0 by <a
href="https://github.com/materialize-bot"><code>@​materialize-bot</code></a>
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/445">MaterializeInc/materialize-terraform-self-managed#445</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.1...v13.12.0</a></p>
<h2>v13.11.1</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>Dependencies ⬆️</h3>
<ul>
<li>build(deps): bump the cargo group across 1 directory with 2 updates
by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/447">MaterializeInc/materialize-terraform-self-managed#447</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.11.0...v13.11.1</a></p>
<h2>v13.11.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>scripts: polis-register SAML-method model + redirect reconcile by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/436">MaterializeInc/materialize-terraform-self-managed#436</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0">https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.10.0...v13.11.0</a></p>
<h2>v13.10.0</h2>
<!-- raw HTML omitted -->
<h2>What's Changed</h2>
<h3>New Features 🎉</h3>
<ul>
<li>examples: rename the SAML metadata file to idp-metadata.xml by <a
href="https://github.com/bobbyiliev"><code>@​bobbyiliev</code></a> in <a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/pull/425">MaterializeInc/materialize-terraform-self-managed#425</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/13689218dd79f7bc52025b4aa39ef87531ff898e"><code>1368921</code></a>
build(deps): bump clap from 4.6.6 to 4.6.7 in /test in the cargo group
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/449">#449</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/8627782ad0d4c4aaf7820208da46bd2063ff0920"><code>8627782</code></a>
Update Terraform github.com/MaterializeInc/materialize-monitoring to
material...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/bf7eebdf119a3a401288c4d6da311d3fe24e3843"><code>bf7eebd</code></a>
ory: put email/groups + audience on the access token so MCP OAuth works
(<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/444">#444</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/3eb48dd99eb78c3ed8e75fb41653cd93f2a05db8"><code>3eb48dd</code></a>
Bump to helm-chart v26.42.0 (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/445">#445</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/9c81778d1331fd0e91a733b1a60e281cfcc7eaa3"><code>9c81778</code></a>
build(deps): bump the cargo group across 1 directory with 2 updates (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/447">#447</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/a6ead79fc92119aed1dd69fa118fe56398fd9699"><code>a6ead79</code></a>
scripts: update polis-register to the SAML-method model and reconcile
stale r...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/b9252af87e417f591fe48a0ec6e5b4d264325762"><code>b9252af</code></a>
examples: use idp-metadata.xml for the SAML IdP metadata file so the
name is ...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2611621fbdea2027cce0b67a7b0d80bfce194dee"><code>2611621</code></a>
ory-stack: support a reserved loadBalancerIP per LB via
lb_overrides.load_bal...</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/99e4cac0e940fc5fef807281d2cf69d74078aebc"><code>99e4cac</code></a>
ory-stack: internal Polis service for Kratos-Polis split-horizon (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/437">#437</a>)</li>
<li><a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/commit/2679d648bdbd75e5d4036a192e68fc1f62ad588f"><code>2679d64</code></a>
ory-stack: allow extra SANs on the Polis cert (<a
href="https://redirect.github.com/MaterializeInc/materialize-terraform-self-managed/issues/442">#442</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/MaterializeInc/materialize-terraform-self-managed/compare/v13.2.1...v13.12.1">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 test/terraform/azure-temporary/main.tf      | 4 ++--
 test/terraform/azure-temporary/providers.tf | 2 +-
 test/terraform/gcp-temporary/main.tf        | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/test/terraform/azure-temporary/main.tf b/test/terraform/azure-temporary/main.tf
index 06ed5c8797e64..e609d02380115 100644
--- a/test/terraform/azure-temporary/main.tf
+++ b/test/terraform/azure-temporary/main.tf
@@ -120,7 +120,7 @@ module "networking" {
 
 # 3. Create AKS cluster with default node pool
 module "aks" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/aks?ref=v13.2.1"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/aks?ref=v13.12.1"
 
   resource_group_name = azurerm_resource_group.materialize.name
   kubernetes_version  = local.aks_config.kubernetes_version
@@ -153,7 +153,7 @@ module "aks" {
 
 # 3.1 Create Materialize-dedicated node pool with taints
 module "materialize_nodepool" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/nodepool?ref=v13.2.1"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//azure/modules/nodepool?ref=v13.12.1"
 
   prefix     = var.name_prefix
   cluster_id = module.aks.cluster_id
diff --git a/test/terraform/azure-temporary/providers.tf b/test/terraform/azure-temporary/providers.tf
index 5d1f099c771f2..9d3ebf22191b7 100644
--- a/test/terraform/azure-temporary/providers.tf
+++ b/test/terraform/azure-temporary/providers.tf
@@ -13,7 +13,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "5.6.0"
+      version = "5.7.0"
     }
     kubernetes = {
       source  = "hashicorp/kubernetes"
diff --git a/test/terraform/gcp-temporary/main.tf b/test/terraform/gcp-temporary/main.tf
index d930f5b8fef14..f35e22ceefe94 100644
--- a/test/terraform/gcp-temporary/main.tf
+++ b/test/terraform/gcp-temporary/main.tf
@@ -110,7 +110,7 @@ module "networking" {
 
 # 2. Set up Google Kubernetes Engine (GKE) cluster
 module "gke" {
-  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/gke?ref=v13.2.1"
+  source = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/gke?ref=v13.12.1"
 
   depends_on = [module.networking]
 
@@ -127,7 +127,7 @@ module "gke" {
 
 # 2.1 Create generic node pool for system workloads
 module "generic_nodepool" {
-  source     = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/nodepool?ref=v13.2.1"
+  source     = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/nodepool?ref=v13.12.1"
   depends_on = [module.gke]
 
   prefix                = "${var.name_prefix}-generic"
@@ -147,7 +147,7 @@ module "generic_nodepool" {
 
 # 2.2 Create Materialize-dedicated node pool with taints
 module "materialize_nodepool" {
-  source     = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/nodepool?ref=v13.2.1"
+  source     = "git::https://github.com/MaterializeInc/materialize-terraform-self-managed.git//gcp/modules/nodepool?ref=v13.12.1"
   depends_on = [module.gke]
 
   prefix                = "${var.name_prefix}-mz"

From b55087c1c0b9baebeec1c122abbdcba00a114f48 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:27:03 +0200
Subject: [PATCH 81/94] build(deps): bump serde-reflection from 0.5.2 to 0.6.0
 (#39020)

Bumps [serde-reflection](https://github.com/zefchain/serde-reflection)
from 0.5.2 to 0.6.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/zefchain/serde-reflection/commits">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 4 ++--
 Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4f4ee5d867d87..aae84d748743d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -12778,9 +12778,9 @@ dependencies = [
 
 [[package]]
 name = "serde-reflection"
-version = "0.5.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68fb2363ca88876b3e16442b02dde5305646fd50df297c79a4b54fc5f5cf51d4"
+checksum = "af0fdf9c543af37502581e3d6cf4e6cd1628d6616d6a1f8f4ca88aae3a405f5c"
 dependencies = [
  "erased-discriminant",
  "once_cell",
diff --git a/Cargo.toml b/Cargo.toml
index 19d7ba32729aa..c30ea6276af44 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -491,7 +491,7 @@ sentry-panic = "0.49.1"
 sentry-tracing = "0.49.1"
 serde = { version = "1.0.219", features = ["derive"] }
 serde-aux = "4.7.0"
-serde-reflection = "0.5.0"
+serde-reflection = "0.6.0"
 serde_bytes = "0.11.19"
 serde_json = { version = "1.0.150", features = ["raw_value"] }
 serde_plain = "1.0.2"

From 3f758c99c898d924c16bba2d5798b22cec797e01 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:27:41 +0200
Subject: [PATCH 82/94] build(deps): bump rocksdb from 0.24.0 to 0.25.0
 (#39018)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [rocksdb](https://github.com/rust-rocksdb/rust-rocksdb) from
0.24.0 to 0.25.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-rocksdb/rust-rocksdb/releases">rocksdb's
releases</a>.</em></p>
<blockquote>
<h2>v0.25.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/981">#981</a>
with a proper support for <code>CXXSTDLIB</code> by <a
href="https://github.com/Rexagon"><code>@​Rexagon</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1029">rust-rocksdb/rust-rocksdb#1029</a></li>
<li>fix: use correct FFI setter for skip_prepare in RocksDB transaction
options by <a
href="https://github.com/GarmashAlex"><code>@​GarmashAlex</code></a> in
<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1032">rust-rocksdb/rust-rocksdb#1032</a></li>
<li>feat: expose {enable,disable}_file_deletions by <a
href="https://github.com/jszwec"><code>@​jszwec</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1035">rust-rocksdb/rust-rocksdb#1035</a></li>
<li>feat: set_cache_index_and_filter_blocks_with_high_priority by <a
href="https://github.com/ibukanov"><code>@​ibukanov</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1039">rust-rocksdb/rust-rocksdb#1039</a></li>
<li>feat: expose get_options_from_string by <a
href="https://github.com/Oppen"><code>@​Oppen</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1040">rust-rocksdb/rust-rocksdb#1040</a></li>
<li>feat: expose options_set_ttl by <a
href="https://github.com/ibukanov"><code>@​ibukanov</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1041">rust-rocksdb/rust-rocksdb#1041</a></li>
<li>fix: correct ASCII comment to UTF-8 for consistency by <a
href="https://github.com/Galoretka"><code>@​Galoretka</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1036">rust-rocksdb/rust-rocksdb#1036</a></li>
<li>chore: remove extra spaces in the comment by <a
href="https://github.com/vastonus"><code>@​vastonus</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1045">rust-rocksdb/rust-rocksdb#1045</a></li>
<li>Cache::new_hyper_clock_cache: Copy rustdocs from RocksDB by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1047">rust-rocksdb/rust-rocksdb#1047</a></li>
<li>Updated rocksdb version from 10.4.2 to 10.7.5 by <a
href="https://github.com/nsaji-stripe"><code>@​nsaji-stripe</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1054">rust-rocksdb/rust-rocksdb#1054</a></li>
<li>ci: use actions/checkout@v5 by <a
href="https://github.com/MamunC0der"><code>@​MamunC0der</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1043">rust-rocksdb/rust-rocksdb#1043</a></li>
<li>feat: allow user to set checkpoint log size for flush by <a
href="https://github.com/QuantumExplorer"><code>@​QuantumExplorer</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1055">rust-rocksdb/rust-rocksdb#1055</a></li>
<li>chore: minor improvement for docs by <a
href="https://github.com/luohewuyang"><code>@​luohewuyang</code></a> in
<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1056">rust-rocksdb/rust-rocksdb#1056</a></li>
<li>DBOptions.set_comparator(_ts): fix memory leak by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1057">rust-rocksdb/rust-rocksdb#1057</a></li>
<li>DBOptions.set_compaction_filter: fix memory leak by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1058">rust-rocksdb/rust-rocksdb#1058</a></li>
<li>DBOptions.get_options_from_string: Fix leak on error by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1059">rust-rocksdb/rust-rocksdb#1059</a></li>
<li>MemoryUsageBuilder.add_tx_db: free base db (fix leak) by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1060">rust-rocksdb/rust-rocksdb#1060</a></li>
<li>DB.create_cf: Fix memory leak on error by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1063">rust-rocksdb/rust-rocksdb#1063</a></li>
<li>DBCommon.get_column_family_metadata(_cf): Fix memory leak by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1062">rust-rocksdb/rust-rocksdb#1062</a></li>
<li>Proposal: Add feature-gated trait to expose raw C pointers by <a
href="https://github.com/jszwec"><code>@​jszwec</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1044">rust-rocksdb/rust-rocksdb#1044</a></li>
<li>MemoryUsageBuilder: Prevent outliving the DBs/caches by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1061">rust-rocksdb/rust-rocksdb#1061</a></li>
<li>Added custom logging callback functionality by <a
href="https://github.com/ischeinkman"><code>@​ischeinkman</code></a> in
<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1051">rust-rocksdb/rust-rocksdb#1051</a></li>
<li>Add sequence_number method to SnapshotWithThreadMode by <a
href="https://github.com/lucacasonato"><code>@​lucacasonato</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1067">rust-rocksdb/rust-rocksdb#1067</a></li>
<li>Options: Document enable_statistics: stats are shared by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1068">rust-rocksdb/rust-rocksdb#1068</a></li>
<li>build.rs: Pass through -Ctarget-cpu; Set flags for aarch64 CRC32 by
<a href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1070">rust-rocksdb/rust-rocksdb#1070</a></li>
<li>Options.set_info_logger: Reference count to fix memory leak by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1066">rust-rocksdb/rust-rocksdb#1066</a></li>
<li>librocksdb-sys/build.rs: sync defines with RocksDB by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1072">rust-rocksdb/rust-rocksdb#1072</a></li>
<li>Add Iterator::Refresh() bindings by <a
href="https://github.com/flyingsilverfin"><code>@​flyingsilverfin</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1074">rust-rocksdb/rust-rocksdb#1074</a></li>
<li>Add timestamp() to DBRawIterator to retrieve user defined timestamps
by <a
href="https://github.com/dillonhicks"><code>@​dillonhicks</code></a> in
<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1065">rust-rocksdb/rust-rocksdb#1065</a></li>
<li>chore: fix some comments to improve readability by <a
href="https://github.com/caltechustc"><code>@​caltechustc</code></a> in
<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1084">rust-rocksdb/rust-rocksdb#1084</a></li>
<li>librocksdb-sys: use rustflags crate for CARGO_ENCODED_RUSTFLAGS by
<a href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1087">rust-rocksdb/rust-rocksdb#1087</a></li>
<li>feat: add delete_range to SstFileWriter by <a
href="https://github.com/cooronx"><code>@​cooronx</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1083">rust-rocksdb/rust-rocksdb#1083</a></li>
<li>feat: add flush and flush_wal API wrappers for TransactionDB by <a
href="https://github.com/gdorsi"><code>@​gdorsi</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1078">rust-rocksdb/rust-rocksdb#1078</a></li>
<li>chore: fix some comments to improve readability by <a
href="https://github.com/solunolab"><code>@​solunolab</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1090">rust-rocksdb/rust-rocksdb#1090</a></li>
<li>fix cargo clippy cast warnings on linux aarch64 by <a
href="https://github.com/evanj"><code>@​evanj</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1089">rust-rocksdb/rust-rocksdb#1089</a></li>
<li>Add TransactionDB checkpoint support by <a
href="https://github.com/calavera"><code>@​calavera</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1086">rust-rocksdb/rust-rocksdb#1086</a></li>
<li>Add mempurge threshold option by <a
href="https://github.com/0xdeafbeef"><code>@​0xdeafbeef</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1080">rust-rocksdb/rust-rocksdb#1080</a></li>
<li>Add set_cf_paths to allow per column family sst and blob paths by <a
href="https://github.com/crypt0miester"><code>@​crypt0miester</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1092">rust-rocksdb/rust-rocksdb#1092</a></li>
<li>feat: bump rust up to 1.88.0 by <a
href="https://github.com/aleksuss"><code>@​aleksuss</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1099">rust-rocksdb/rust-rocksdb#1099</a></li>
<li>Bump tikv-jemalloc-sys to 0.7 by <a
href="https://github.com/checkraisefold"><code>@​checkraisefold</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1098">rust-rocksdb/rust-rocksdb#1098</a></li>
<li>fix(unix): preserve non-UTF-8 path bytes across FFI by <a
href="https://github.com/grandpig"><code>@​grandpig</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1097">rust-rocksdb/rust-rocksdb#1097</a></li>
<li>Add ReadOptions deadline and IO timeout setters by <a
href="https://github.com/modernzju"><code>@​modernzju</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1091">rust-rocksdb/rust-rocksdb#1091</a></li>
<li>feat: upgrade RocksDB to version 11.8.1 by <a
href="https://github.com/aleksuss"><code>@​aleksuss</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1101">rust-rocksdb/rust-rocksdb#1101</a></li>
<li>Add single delete to WriteBatch by <a
href="https://github.com/0xdeafbeef"><code>@​0xdeafbeef</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1081">rust-rocksdb/rust-rocksdb#1081</a></li>
<li>docs: add comment docs for set_skip_prepare method by <a
href="https://github.com/MozirDmitriy"><code>@​MozirDmitriy</code></a>
in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1020">rust-rocksdb/rust-rocksdb#1020</a></li>
<li>Add missing documentation for set_compression_options parameters by
<a href="https://github.com/progval"><code>@​progval</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1031">rust-rocksdb/rust-rocksdb#1031</a></li>
<li>Release 0.25.0 by <a
href="https://github.com/aleksuss"><code>@​aleksuss</code></a> in <a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/pull/1102">rust-rocksdb/rust-rocksdb#1102</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rust-rocksdb/rust-rocksdb/blob/master/CHANGELOG.md">rocksdb's
changelog</a>.</em></p>
<blockquote>
<h2>0.25.0 (2026-08-16)</h2>
<h3>Features</h3>
<ul>
<li>Add per-column-family SST and blob paths with
<code>set_cf_paths</code> (Cryptomiester)</li>
<li>Add the mempurge threshold option (Vladimir Petrzhikovskii)</li>
<li>Add checkpoint support to <code>TransactionDB</code> (David
Calavera)</li>
<li>Add <code>flush</code> and <code>flush_wal</code> wrappers to
<code>TransactionDB</code> (Guido D'Orsi)</li>
<li>Add <code>delete_range</code> to <code>SstFileWriter</code>
(cooronx)</li>
<li>Add <code>timestamp()</code> to <code>DBRawIterator</code> (Dillon
Hicks)</li>
<li>Add <code>Iterator::Refresh()</code> bindings (Joshua Send)</li>
<li>Add custom logging callbacks (Ilan Scheinkman)</li>
<li>Add <code>sequence_number</code> to
<code>SnapshotWithThreadMode</code> (Luca Casonato)</li>
<li>Add a feature-gated trait for exposing raw C pointers (Jacek
Szwec)</li>
<li>Allow configuring checkpoint log size for flush
(QuantumExplorer)</li>
<li>Expose <code>options_set_ttl</code> (Igor Bukanov)</li>
<li>Expose <code>get_options_from_string</code> (Mario Rugiero)</li>
<li>Expose high-priority cache index and filter blocks (Igor
Bukanov)</li>
<li>Expose file deletion controls (Jacek Szwec)</li>
<li>Add ReadOptions deadline and I/O timeout setters (modernzju)</li>
<li>Add single delete support to <code>WriteBatch</code> (Vladimir)</li>
</ul>
<h3>Improvements</h3>
<ul>
<li>Preserve non-UTF-8 path bytes across the Unix FFI (grandpig)</li>
<li>Pass through <code>-Ctarget-cpu</code> and enable CRC32 flags on
aarch64 (Evan Jones)</li>
<li>Sync build configuration defines with RocksDB (Evan Jones)</li>
<li>Improve documentation for cache and statistics options (Evan
Jones)</li>
<li>Improve comments and readability (solunolab, caltechustc,
luohewuyang, vastonus, Galoretka)</li>
<li>Add <code>CXXSTDLIB</code> support for Unix builds (Ivan
Kalinin)</li>
<li>Update CI to use <code>actions/checkout</code> v5 (Coder)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>Fix a memory leak in <code>Options::set_info_log</code> (Evan
Jones)</li>
<li>Fix memory leaks in column-family metadata, column-family creation,
and memory usage APIs (Evan Jones)</li>
<li>Fix memory leaks in database option error paths and compaction
filters (Evan Jones)</li>
<li>Use the correct FFI setter for <code>skip_prepare</code>
(GarmashAlex)</li>
<li>Fix clippy cast warnings on Linux aarch64 (Evan Jones)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document <code>set_compression_options</code> parameters (Val
Lorentz)</li>
<li>Document <code>set_skip_prepare</code> (MozirDmitriy)</li>
<li>Copy RocksDB documentation for
<code>Cache::new_hyper_clock_cache</code> (Evan Jones)</li>
</ul>
<h3>Dependency Updates</h3>
<ul>
<li>Bump Rust to 1.88.0 (Oleksandr Anyshchenko)</li>
<li>Update to RocksDB 10.7.5 (nsaji-stripe)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/46d7e4f10dd9f8dbb219893592a1cab9bdc109c6"><code>46d7e4f</code></a>
Release 0.25.0 (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1102">#1102</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/2aebd1f2e6d1818233b177b0e3404e00930a6269"><code>2aebd1f</code></a>
Add missing documentation for set_compression_options parameters (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1031">#1031</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/19c37a13f33a5fe6544a67ab48af5c907bc65dee"><code>19c37a1</code></a>
docs: add comment docs for set_skip_prepare method (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1020">#1020</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/f5c37ed0a51f46663b430798faa6ec344dbb1b6c"><code>f5c37ed</code></a>
Add single delete to WriteBatch (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1081">#1081</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/1da97f234c89348df261bc4d160bbcdc7ec1a887"><code>1da97f2</code></a>
feat: upgrade RocksDB to version 11.8.1 (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1101">#1101</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/11de4b68d53798f67befb3450ef79548c444baf1"><code>11de4b6</code></a>
Add ReadOptions deadline and IO timeout setters (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1091">#1091</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/4e34f1d618988b749e17eb8f4315c7e580601382"><code>4e34f1d</code></a>
fix(unix): preserve non-UTF-8 path bytes across FFI (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1097">#1097</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/2f2da93dfffff011a04b81f8aa16b6e0b070aa34"><code>2f2da93</code></a>
Bump tikv-jemalloc-sys to 0.7 (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1098">#1098</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/6138c8eabdfcaa8be4ff0f83bfc5126f7def9ff9"><code>6138c8e</code></a>
feat: bump rust up to 1.88.0 (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1099">#1099</a>)</li>
<li><a
href="https://github.com/rust-rocksdb/rust-rocksdb/commit/50c94dc2c29cc27d8e1214eb56b6bc2d1cd73857"><code>50c94dc</code></a>
add set_cf_paths to allow per column family sst and blob paths (<a
href="https://redirect.github.com/rust-rocksdb/rust-rocksdb/issues/1092">#1092</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/rust-rocksdb/rust-rocksdb/compare/v0.24.0...v0.25.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 15 +++++++++++----
 Cargo.toml |  2 +-
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index aae84d748743d..4ebd34ae27367 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5945,9 +5945,9 @@ dependencies = [
 
 [[package]]
 name = "librocksdb-sys"
-version = "0.17.3+10.4.2"
+version = "0.19.0+11.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cef2a00ee60fe526157c9023edab23943fae1ce2ab6f4abb2a807c1746835de9"
+checksum = "4f45e86edad8e88efe97dbf384b4e48e1ff0f111eabf154c7b09d7a1e5fb573c"
 dependencies = [
  "bindgen",
  "bzip2-sys",
@@ -5955,6 +5955,7 @@ dependencies = [
  "libc",
  "libz-sys",
  "lz4-sys",
+ "rustflags",
  "zstd-sys",
 ]
 
@@ -12174,9 +12175,9 @@ dependencies = [
 
 [[package]]
 name = "rocksdb"
-version = "0.24.0"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddb7af00d2b17dbd07d82c0063e25411959748ff03e8d4f96134c2ff41fce34f"
+checksum = "d8d90add70d1d420ee487bce4a1449880a8d147451c6051b2ee5f8354553dcbf"
 dependencies = [
  "libc",
  "librocksdb-sys",
@@ -12316,6 +12317,12 @@ dependencies = [
  "semver",
 ]
 
+[[package]]
+name = "rustflags"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a39e0e9135d7a7208ee80aa4e3e4b88f0f5ad7be92153ed70686c38a03db2e63"
+
 [[package]]
 name = "rustix"
 version = "0.38.44"
diff --git a/Cargo.toml b/Cargo.toml
index c30ea6276af44..11ffcbb58c8f5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -475,7 +475,7 @@ reqwest = { version = "0.12.28", features = ["blocking", "charset", "cookies", "
 reqwest-middleware = { version = "0.4.2", features = ["json"] }
 reqwest-retry = "0.8.0"
 rlimit = "0.11.0"
-rocksdb = { version = "0.24.0", default-features = false, features = ["lz4", "snappy", "zstd"] }
+rocksdb = { version = "0.25.0", default-features = false, features = ["lz4", "snappy", "zstd"] }
 ropey = "1.6.1"
 rustls = "0.23.38"
 rpassword = "7.5.1"

From 6f8013de3a21567e61765ce5fb139d7530ecb195 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:28:12 +0200
Subject: [PATCH 83/94] build(deps): bump tabled from 0.21.0 to 0.22.0 (#39017)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [tabled](https://github.com/zhiburt/tabled) from 0.21.0 to 0.22.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/zhiburt/tabled/blob/master/CHANGELOG.md">tabled's
changelog</a>.</em></p>
<blockquote>
<h2>[0.22.0] - 2026-09-05</h2>
<h3>Added</h3>
<ul>
<li>Added <code>CompactTable::skip</code> function (by <a
href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a>).</li>
<li>Added <code>Color</code> text-attribute constants
<code>BLINK</code>, <code>DIMMED</code>, <code>HIDDEN</code>,
<code>INVERT</code>, <code>ITALIC</code>, <code>RESET</code> and
<code>STRIKETHROUGH</code> (by <a
href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a>).</li>
</ul>
<h3>Changed</h3>
<ul>
<li>Replaced proc-macro-error2 with syn::Error in static_table (by <a
href="https://github.com/hex22a"><code>@​hex22a</code></a>)</li>
<li>Replaced proc-macro-error2 with syn::Error in tabled_derive (by <a
href="https://github.com/shrey4796"><code>@​shrey4796</code></a>)</li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Fixed docs.rs build (by <a
href="https://github.com/amorison"><code>@​amorison</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/zhiburt/tabled/commits/v0.22.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 31 ++++---------------------------
 Cargo.toml |  2 +-
 2 files changed, 5 insertions(+), 28 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4ebd34ae27367..4cd9725dbeb64 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -11110,28 +11110,6 @@ dependencies = [
  "toml_edit 0.22.26",
 ]
 
-[[package]]
-name = "proc-macro-error-attr2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
-dependencies = [
- "proc-macro2",
- "quote",
-]
-
-[[package]]
-name = "proc-macro-error2"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
-dependencies = [
- "proc-macro-error-attr2",
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -13515,9 +13493,9 @@ dependencies = [
 
 [[package]]
 name = "tabled"
-version = "0.21.0"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5dc662e6da844ad6e428ad16b57967c9d33c82e16bb1c258326c0c078605dff"
+checksum = "2d2596a104db1900b943f97d793a6c99addca918c4525c999f751a0f17d472eb"
 dependencies = [
  "papergrid",
  "tabled_derive",
@@ -13526,12 +13504,11 @@ dependencies = [
 
 [[package]]
 name = "tabled_derive"
-version = "0.11.0"
+version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea5d1b13ca6cff1f9231ffd62f15eefd72543dab5e468735f1a456728a02846"
+checksum = "7dca1937322a1e892b1a65f6a6736183bb0a29d3b4234d1d53bc436dff9beb76"
 dependencies = [
  "heck",
- "proc-macro-error2",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
diff --git a/Cargo.toml b/Cargo.toml
index 11ffcbb58c8f5..139945fff3f4c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -516,7 +516,7 @@ supports-color = "3.0.2"
 syn = { version = "3.0.5", features = ["extra-traits", "full", "parsing", "printing"] }
 sysctl = "0.7.1"
 sysinfo = "0.29.11"
-tabled = "0.21.0"
+tabled = "0.22.0"
 tar = "0.4.46"
 tempfile = "3.27.0"
 termcolor = "1.4.1"

From 425fef2812869e76b19019d974394541e4d188af Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:31:41 +0200
Subject: [PATCH 84/94] build(deps): bump uuid from 1.24.1 to 1.26.1 (#39019)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [uuid](https://github.com/uuid-rs/uuid) from 1.24.1 to 1.26.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/uuid-rs/uuid/releases">uuid's
releases</a>.</em></p>
<blockquote>
<h2>v1.26.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Seat the v7 counter below the version nibble by <a
href="https://github.com/lenamonj"><code>@​lenamonj</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/907">uuid-rs/uuid#907</a></li>
<li>Don't panic in overflowing Timestamp to SystemTime conversion by <a
href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/909">uuid-rs/uuid#909</a></li>
<li>Prepare for 1.26.1 release by <a
href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/910">uuid-rs/uuid#910</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lenamonj"><code>@​lenamonj</code></a>
made their first contribution in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/907">uuid-rs/uuid#907</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/uuid-rs/uuid/compare/v1.26.0...v1.26.1">https://github.com/uuid-rs/uuid/compare/v1.26.0...v1.26.1</a></p>
<h2>v1.26.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add ContextV7::with_additional_precision_bits by <a
href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/904">uuid-rs/uuid#904</a></li>
<li>Prepare for 1.26.0 release by <a
href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/905">uuid-rs/uuid#905</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/uuid-rs/uuid/compare/1.25.0...v1.26.0">https://github.com/uuid-rs/uuid/compare/1.25.0...v1.26.0</a></p>
<h2>1.25.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Add a serde::bytes module that encodes a Uuid as a byte string by <a
href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/902">uuid-rs/uuid#902</a></li>
<li>Prepare for 1.25.0 release by <a
href="https://github.com/KodrAus"><code>@​KodrAus</code></a> in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/903">uuid-rs/uuid#903</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/ChrisJr404"><code>@​ChrisJr404</code></a> made
their first contribution in <a
href="https://redirect.github.com/uuid-rs/uuid/pull/902">uuid-rs/uuid#902</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/uuid-rs/uuid/compare/v1.24.1...1.25.0">https://github.com/uuid-rs/uuid/compare/v1.24.1...1.25.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/uuid-rs/uuid/commit/9f927126c89892ddfed6cd2f92df16852f3f9aa6"><code>9f92712</code></a>
Merge pull request <a
href="https://redirect.github.com/uuid-rs/uuid/issues/910">#910</a> from
uuid-rs/cargo/v1.26.1</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/d4df8f0cd9f461b4ef493254420052ffa5ce6277"><code>d4df8f0</code></a>
prepare for 1.26.1 release</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/5613f2357c1fc06afc5fffd98e96da2ccf25a608"><code>5613f23</code></a>
Merge pull request <a
href="https://redirect.github.com/uuid-rs/uuid/issues/909">#909</a> from
uuid-rs/fix/ts-conversion-overflow</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/fda00eba938383d242bad33143c8af73227f2a2c"><code>fda00eb</code></a>
don't panic in overflowing Timestamp to SystemTime conversion</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/c82e88ca184e4ab83ce6b4ac0be33d32a0b9c3c4"><code>c82e88c</code></a>
Merge pull request <a
href="https://redirect.github.com/uuid-rs/uuid/issues/907">#907</a> from
lenamonj/v7-counter-placement</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/ac065a6c17389a67dc6e98ef5f9a2e1d7ad4a670"><code>ac065a6</code></a>
Align the counter diagram</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/34ec10208d813672928c299146dfe4c18cedcec7"><code>34ec102</code></a>
Seat the v7 counter below the version nibble</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/cdc96a87bddc38d0eb8f894c764e151d2299b4b3"><code>cdc96a8</code></a>
Merge pull request <a
href="https://redirect.github.com/uuid-rs/uuid/issues/905">#905</a> from
uuid-rs/cargo/v1.26.0</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/34e4f49c0d50c12f1b3021baf98b8fb91f6407bb"><code>34e4f49</code></a>
don't test macros under miri</li>
<li><a
href="https://github.com/uuid-rs/uuid/commit/d9e7242b37755d844d19fa74559a88e1c46c5206"><code>d9e7242</code></a>
update nightly used for miri</li>
<li>Additional commits viewable in <a
href="https://github.com/uuid-rs/uuid/compare/v1.24.1...v1.26.1">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 4cd9725dbeb64..1f6a869d20b56 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -13544,7 +13544,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand 2.3.0",
- "getrandom 0.4.3",
+ "getrandom 0.3.3",
  "once_cell",
  "rustix 1.1.4",
  "windows-sys 0.61.1",
@@ -14797,9 +14797,9 @@ dependencies = [
 
 [[package]]
 name = "uuid"
-version = "1.24.1"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",

From e6421312de7e597c0820fad27c5c2b40d1456aa4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 13:33:03 +0200
Subject: [PATCH 85/94] build(deps): bump owo-colors from 4.3.0 to 4.4.0
 (#39021)

Bumps [owo-colors](https://github.com/owo-colors/owo-colors) from 4.3.0
to 4.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/owo-colors/owo-colors/releases">owo-colors's
releases</a>.</em></p>
<blockquote>
<h2>owo-colors 4.4.0</h2>
<h3>Changed</h3>
<ul>
<li>Updated MSRV to Rust 1.83. Thanks <a
href="https://github.com/Expyron">Expyron</a> for your first
contribution!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/owo-colors/owo-colors/blob/main/CHANGELOG.md">owo-colors's
changelog</a>.</em></p>
<blockquote>
<h2>[4.4.0] - 2026-08-27</h2>
<h3>Changed</h3>
<ul>
<li>Updated MSRV to Rust 1.83. Thanks <a
href="https://github.com/Expyron">Expyron</a> for your first
contribution!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/owo-colors/owo-colors/commit/7392e40d0093a02ec12b3695e388d123817283b8"><code>7392e40</code></a>
[owo-colors] version 4.4.0</li>
<li><a
href="https://github.com/owo-colors/owo-colors/commit/8037325e92238c5a5878fc074fb042b0d4d8a085"><code>8037325</code></a>
[meta] update changelog</li>
<li><a
href="https://github.com/owo-colors/owo-colors/commit/9f8e57e4041b263f473f76f97e746bc996d4bb50"><code>9f8e57e</code></a>
[meta] automate changelog updates via cargo-release (<a
href="https://redirect.github.com/owo-colors/owo-colors/issues/161">#161</a>)</li>
<li><a
href="https://github.com/owo-colors/owo-colors/commit/540fd5100dc102bfc5241bf4845f4465ba9976e2"><code>540fd51</code></a>
Increase MSRV to 1.83 (<a
href="https://redirect.github.com/owo-colors/owo-colors/issues/160">#160</a>)</li>
<li><a
href="https://github.com/owo-colors/owo-colors/commit/367baea2456f01d5a9b793eaf4b5217184c5d099"><code>367baea</code></a>
Remove .claude directory to disincentivize LLM contributions</li>
<li><a
href="https://github.com/owo-colors/owo-colors/commit/f83e6e260b8ee632fab2029db06f7be9135ac929"><code>f83e6e2</code></a>
[release] use trusted publishing</li>
<li>See full diff in <a
href="https://github.com/owo-colors/owo-colors/compare/v4.3.0...v4.4.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 Cargo.lock | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1f6a869d20b56..0f39321a2b547 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3445,7 +3445,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5300,7 +5300,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.61.1",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -10312,9 +10312,9 @@ checksum = "4030760ffd992bef45b0ae3f10ce1aba99e33464c90d14dd7c039884963ddc7a"
 
 [[package]]
 name = "owo-colors"
-version = "4.3.0"
+version = "4.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+checksum = "13c45bb4a6ae1280ec0803b1ef9d3455eb50f01efbbe1447ab020f1d54fba9d8"
 dependencies = [
  "supports-color 2.1.0",
  "supports-color 3.0.2",
@@ -11452,7 +11452,7 @@ dependencies = [
  "once_cell",
  "socket2 0.6.5",
  "tracing",
- "windows-sys 0.61.1",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -12324,7 +12324,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.1",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -12383,7 +12383,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.1",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -13547,7 +13547,7 @@ dependencies = [
  "getrandom 0.3.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.1",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -13566,7 +13566,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]

From 6de1f9d770e6649ec81f46c4ac32e57f7b9fea42 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:51:32 +0000
Subject: [PATCH 86/94] build(deps): bump zip from 6.0.0 to 8.6.0 (#36381)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [zip](https://github.com/zip-rs/zip2) from 6.0.0 to 8.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/zip-rs/zip2/releases">zip's
releases</a>.</em></p>
<blockquote>
<h2>v8.6.0</h2>
<h3><!-- raw HTML omitted -->🚀 Features</h3>
<ul>
<li>add <code>compression not supported</code> as enum error (<a
href="https://redirect.github.com/zip-rs/zip2/pull/774">#774</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🐛 Bug Fixes</h3>
<ul>
<li>allow for <code>[u8]</code> as filename (<a
href="https://redirect.github.com/zip-rs/zip2/pull/775">#775</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>mark <code>ZipFlags</code> as non-exhaustive and add test for
<code>HasZipMetadata</code> (<a
href="https://redirect.github.com/zip-rs/zip2/pull/777">#777</a>)</li>
<li>use and simplify is_dir (<a
href="https://redirect.github.com/zip-rs/zip2/pull/776">#776</a>)</li>
</ul>
<h2>v8.5.1</h2>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>change magic finder to stack buffer (<a
href="https://redirect.github.com/zip-rs/zip2/pull/763">#763</a>)</li>
<li>simplify extra field parsing (<a
href="https://redirect.github.com/zip-rs/zip2/pull/764">#764</a>)</li>
</ul>
<h2>v8.5.0</h2>
<h3><!-- raw HTML omitted -->🐛 Bug Fixes</h3>
<ul>
<li>remove <code>zip64 comment</code> and add <code>zip64 extensible
data sector</code> (<a
href="https://redirect.github.com/zip-rs/zip2/pull/747">#747</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>remove useless magic in struct (<a
href="https://redirect.github.com/zip-rs/zip2/pull/730">#730</a>)</li>
<li>change extra_field from Arc&lt;Vec<!-- raw HTML omitted -->&gt; to
Arc&lt;[u8]&gt; (<a
href="https://redirect.github.com/zip-rs/zip2/pull/741">#741</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h3>
<ul>
<li>cleanup README (<a
href="https://redirect.github.com/zip-rs/zip2/pull/758">#758</a>)</li>
</ul>
<h2>v8.4.0</h2>
<h3><!-- raw HTML omitted -->🚀 Features</h3>
<ul>
<li>add a check for building benches (<a
href="https://redirect.github.com/zip-rs/zip2/pull/748">#748</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>split part of <code>read.rs</code> for code readability (<a
href="https://redirect.github.com/zip-rs/zip2/pull/744">#744</a>)</li>
<li>remove unused allow (<a
href="https://redirect.github.com/zip-rs/zip2/pull/745">#745</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->⚡ Performance</h3>
<ul>
<li>skip BufReader for Stored files in make_reader (<a
href="https://redirect.github.com/zip-rs/zip2/pull/739">#739</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md">zip's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/zip-rs/zip2/compare/v8.5.1...v8.6.0">8.6.0</a>
- 2026-04-25</h2>
<h3><!-- raw HTML omitted -->🚀 Features</h3>
<ul>
<li>add <code>compression not supported</code> as enum error (<a
href="https://redirect.github.com/zip-rs/zip2/pull/774">#774</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🐛 Bug Fixes</h3>
<ul>
<li>allow for <code>[u8]</code> as filename (<a
href="https://redirect.github.com/zip-rs/zip2/pull/775">#775</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>mark <code>ZipFlags</code> as non-exhaustive and add test for
<code>HasZipMetadata</code> (<a
href="https://redirect.github.com/zip-rs/zip2/pull/777">#777</a>)</li>
<li>use and simplify is_dir (<a
href="https://redirect.github.com/zip-rs/zip2/pull/776">#776</a>)</li>
</ul>
<h2><a
href="https://github.com/zip-rs/zip2/compare/v8.5.0...v8.5.1">8.5.1</a>
- 2026-04-06</h2>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>change magic finder to stack buffer (<a
href="https://redirect.github.com/zip-rs/zip2/pull/763">#763</a>)</li>
<li>simplify extra field parsing (<a
href="https://redirect.github.com/zip-rs/zip2/pull/764">#764</a>)</li>
</ul>
<h2><a
href="https://github.com/zip-rs/zip2/compare/v8.4.0...v8.5.0">8.5.0</a>
- 2026-04-01</h2>
<h3><!-- raw HTML omitted -->🐛 Bug Fixes</h3>
<ul>
<li>remove <code>zip64 comment</code> and add <code>zip64 extensible
data sector</code> (<a
href="https://redirect.github.com/zip-rs/zip2/pull/747">#747</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>remove useless magic in struct (<a
href="https://redirect.github.com/zip-rs/zip2/pull/730">#730</a>)</li>
<li>change extra_field from Arc&lt;Vec<!-- raw HTML omitted -->&gt; to
Arc&lt;[u8]&gt; (<a
href="https://redirect.github.com/zip-rs/zip2/pull/741">#741</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h3>
<ul>
<li>cleanup README (<a
href="https://redirect.github.com/zip-rs/zip2/pull/758">#758</a>)</li>
</ul>
<h2><a
href="https://github.com/zip-rs/zip2/compare/v8.3.1...v8.4.0">8.4.0</a>
- 2026-03-23</h2>
<h3><!-- raw HTML omitted -->🚀 Features</h3>
<ul>
<li>add a check for building benches (<a
href="https://redirect.github.com/zip-rs/zip2/pull/748">#748</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->🚜 Refactor</h3>
<ul>
<li>split part of <code>read.rs</code> for code readability (<a
href="https://redirect.github.com/zip-rs/zip2/pull/744">#744</a>)</li>
<li>remove unused allow (<a
href="https://redirect.github.com/zip-rs/zip2/pull/745">#745</a>)</li>
</ul>
<h3><!-- raw HTML omitted -->⚡ Performance</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/zip-rs/zip2/commit/771dfc534d2614158af5497ea3dff4d4208d7db1"><code>771dfc5</code></a>
chore: release v8.6.0 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/781">#781</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/8e480ccb01def04dc4f15e3510ed435276c0df9f"><code>8e480cc</code></a>
chore(deps): update sha1 requirement from 0.10 to 0.11 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/767">#767</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/2513bbe9a669f4d3c71fd6cf63e2c8f7cd63404d"><code>2513bbe</code></a>
chore(deps): update aes requirement from 0.8 to 0.9 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/787">#787</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/957e240eb3e0caca1152bfef114cca260ff7755d"><code>957e240</code></a>
ci(deps): bump actions/cache from 5.0.4 to 5.0.5 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/786">#786</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/0329d9d0b63d2648e52a89d27437315b71343852"><code>0329d9d</code></a>
fix: allow for <code>[u8]</code> as filename (<a
href="https://redirect.github.com/zip-rs/zip2/issues/775">#775</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/ddcf8544c64ce6496b19df9ea84211deefbdd714"><code>ddcf854</code></a>
ci(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/788">#788</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/42323a87ef97bb71f0a0506cfdbf5b4c815dcffc"><code>42323a8</code></a>
ci(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/785">#785</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/901014a1f2123697ea3803140bfc3b4f0565b205"><code>901014a</code></a>
ci(deps): bump crate-ci/typos from 1.45.0 to 1.45.1 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/784">#784</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/07702d4e432ef7a349b81a9dbb88df17a2e7b9d1"><code>07702d4</code></a>
feat: add <code>compression not supported</code> as enum error (<a
href="https://redirect.github.com/zip-rs/zip2/issues/774">#774</a>)</li>
<li><a
href="https://github.com/zip-rs/zip2/commit/2d0c46b7baf11bf7f461b54ac69a681bc8b89557"><code>2d0c46b</code></a>
ci(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a
href="https://redirect.github.com/zip-rs/zip2/issues/783">#783</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/zip-rs/zip2/compare/v6.0.0...v8.6.0">compare
view</a></li>
</ul>
</details>
<br />


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 23 +++++++++++++++++++++--
 Cargo.toml |  2 +-
 deny.toml  |  2 ++
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 0f39321a2b547..3673e121a6e81 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5894,7 +5894,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tar",
- "zip",
+ "zip 6.0.0",
 ]
 
 [[package]]
@@ -7221,7 +7221,7 @@ dependencies = [
  "tracing-subscriber",
  "url",
  "walkdir",
- "zip",
+ "zip 8.6.0",
 ]
 
 [[package]]
@@ -14543,6 +14543,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -15433,6 +15439,19 @@ dependencies = [
  "zopfli",
 ]
 
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap 2.11.4",
+ "memchr",
+ "typed-path",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.0"
diff --git a/Cargo.toml b/Cargo.toml
index 139945fff3f4c..f70c5f35c1be6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -568,7 +568,7 @@ walkdir = "2.5.0"
 which = "8"
 yansi = "1.0.1"
 zeroize = { version = "1.8.2", features = ["derive", "serde"] }
-zip = { version = "6.0.0", default-features = false, features = ["deflate-flate2"] }
+zip = { version = "8.6.0", default-features = false, features = ["deflate-flate2"] }
 
 [profile.dev]
 split-debuginfo = "unpacked"
diff --git a/deny.toml b/deny.toml
index 0603f52756520..1b863b373a06c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -110,6 +110,8 @@ skip = [
     { name = "tower-http", version = "0.6.11" },
     # tokio-tungstenite still pulls 0.29.
     { name = "tungstenite", version = "0.29.0" },
+    # libduckdb-sys still pulls 6.
+    { name = "zip", version = "6.0.0" },
     # Used by azure_core
     { name = "quick-xml", version = "0.31.0" },
     # reqsign-aws (via iceberg) is ahead of opendal, which pulls 0.39.

From 13e7b99627216e774d6c54b02fb8eaf9144bf5ca Mon Sep 17 00:00:00 2001
From: Moritz Hoffmann <antiguru@gmail.com>
Date: Mon, 28 Sep 2026 14:18:51 +0200
Subject: [PATCH 87/94] build(deps): bump AWS SDK crates (#39294)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the AWS SDK crates as one family to their newest releases:
aws-config 1.12.0, aws-sdk-s3 1.150.0, aws-sdk-glue 1.169.0, aws-sdk-kms
1.122.0, aws-sdk-secretsmanager 1.119.0, aws-sdk-sts 1.118.0, aws-sigv4
1.6.0, aws-smithy-runtime 1.15.0, aws-smithy-runtime-api 1.18.0,
aws-smithy-types 1.8.1, aws-smithy-mocks 0.3.0, aws-types 1.6.0, and
aws-credential-types 1.3.0. Dependabot's patch-only groups skip these
minor releases, so the family had fallen 6 to 28 releases behind. No
code changes were needed.

aws-sdk-s3 1.144 and later depend on lru 0.18, while
launchdarkly-server-sdk, mysql_async, and mz-frontegg-auth still use lru
0.16, so `lru` 0.16.3 is exempted from cargo-deny's duplicate check.

*Posted by Claude Code.*

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 193 +++++++++++++++++++++++++++++------------------------
 Cargo.toml |  26 ++++----
 deny.toml  |   2 +
 3 files changed, 120 insertions(+), 101 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3673e121a6e81..866e8b65d53d6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -930,9 +930,9 @@ checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "aws-config"
-version = "1.8.15"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11493b0bad143270fb8ad284a096dd529ba91924c5409adeac856cc1bf047dbc"
+checksum = "b8d7b388a9fc3a6db15a5ec778c38b354eff1364882c94d08e0252f7a47dcaa4"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -944,6 +944,7 @@ dependencies = [
  "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-types",
  "bytes",
@@ -960,9 +961,9 @@ dependencies = [
 
 [[package]]
 name = "aws-credential-types"
-version = "1.2.14"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f20799b373a1be121fe3005fba0c2090af9411573878f224df44b42727fcaf7"
+checksum = "e93964ffdaf57857f544be3666a5f57570bb699e934700f11b49708f61bb556e"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -996,9 +997,9 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.7.2"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fc0651c57e384202e47153c1260b84a9936e19803d747615edf199dc3b98d17"
+checksum = "2b8a9911551b4ea6ca13805ef52ed96f7d2bbb43cc3b4a14cb0776a71f33cfaa"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -1012,9 +1013,7 @@ dependencies = [
  "bytes",
  "bytes-utils",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
- "http-body 0.4.6",
  "http-body 1.0.1",
  "percent-encoding",
  "pin-project-lite",
@@ -1024,10 +1023,11 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-glue"
-version = "1.142.1"
+version = "1.169.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc77647907307c70ffd751db85653804552e4a3c27f054d3af7a0874ef4dfe22"
+checksum = "4356134342723fcfdbc9a90d1ecc70e82c7bb63fcbe948a9d8d392335901c6d1"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
@@ -1036,11 +1036,11 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
  "tracing",
@@ -1048,10 +1048,11 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-kms"
-version = "1.104.0"
+version = "1.122.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c41ae6a33da941457e89075ef8ca5b4870c8009fe4dceeba82fce2f30f313ac6"
+checksum = "ae92186214a60f1316f6e25df2b5bef8f67b5b08b45f8e3eb6e1278b9ddd7b29"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
@@ -1060,11 +1061,11 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
  "tracing",
@@ -1072,10 +1073,11 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "1.129.0"
+version = "1.150.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d4e8410fadbc0ee453145dd77a4958227b18b05bf67c2795d0a8b8596c9aa0f"
+checksum = "2fecaa77c862fa1e9d636d54fa06e0049a19a4f071b0d72ea1b9086887d09359"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-sigv4",
@@ -1087,30 +1089,31 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
  "bytes",
  "fastrand 2.3.0",
  "hex",
- "hmac 0.12.1",
- "http 0.2.12",
+ "hmac 0.13.0",
  "http 1.4.2",
  "http-body 1.0.1",
- "lru",
+ "lru 0.18.5",
  "percent-encoding",
  "regex-lite",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "tracing",
  "url",
 ]
 
 [[package]]
 name = "aws-sdk-secretsmanager"
-version = "1.103.0"
+version = "1.119.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae64963d3d16d8070aaa2fb79c11cd3b13f44d2f13bba3fe8f49dcd2c42f2987"
+checksum = "f28259db7d655b96a6b5748132a9a780361e908ab2d692f767729a4581033a4b"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
@@ -1119,11 +1122,11 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
  "tracing",
@@ -1131,10 +1134,11 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sso"
-version = "1.96.0"
+version = "1.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f64a6eded248c6b453966e915d32aeddb48ea63ad17932682774eb026fbef5b1"
+checksum = "87184f36ade012f46cdc773c7be10031b4545a1aea70a9a22a044e8f36f1e5c5"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
@@ -1143,11 +1147,11 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
  "tracing",
@@ -1155,10 +1159,11 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.98.0"
+version = "1.115.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db96d720d3c622fcbe08bae1c4b04a72ce6257d8b0584cb5418da00ae20a344f"
+checksum = "84edc7495d56e006dff0031cbc9782784902456f7024651c2da902a3d2336262"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
@@ -1167,11 +1172,11 @@ dependencies = [
  "aws-smithy-observability",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-types",
  "bytes",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
  "tracing",
@@ -1179,10 +1184,11 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-sts"
-version = "1.101.0"
+version = "1.118.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab41ad64e4051ecabeea802d6a17845a91e83287e1dd249e6963ea1ba78c428a"
+checksum = "df7572569d018ca72923073494eac3c4671a0daea90b9e3923c2d27a3a02a2c1"
 dependencies = [
+ "arc-swap",
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
@@ -1192,11 +1198,11 @@ dependencies = [
  "aws-smithy-query",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
  "regex-lite",
  "tracing",
@@ -1204,9 +1210,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sigv4"
-version = "1.4.2"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0b660013a6683ab23797778e21f1f854744fdf05f68204b4cca4c8c04b5d1f4"
+checksum = "2312577f088c9fbf4206dfdb884cf1de9407b43e1a923cbed5237775116fc24b"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-eventstream",
@@ -1216,20 +1222,19 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "hex",
- "hmac 0.12.1",
- "http 0.2.12",
+ "hmac 0.13.0",
  "http 1.4.2",
  "percent-encoding",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "time",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.14"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ffcaf626bdda484571968400c326a244598634dc75fd451325a54ad1a59acfc"
+checksum = "f02e407fb3b54891734224b9ffac8a71fdd35f542500fa1af95754a6b2beb316"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -1238,9 +1243,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-checksums"
-version = "0.64.6"
+version = "0.65.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6750f3dd509b0694a4377f0293ed2f9630d710b1cebe281fa8bac8f099f88bc6"
+checksum = "b67ecd999972b58e67cab052f5129906c08c25883bd0788ceefc55ef97d61307"
 dependencies = [
  "aws-smithy-http",
  "aws-smithy-types",
@@ -1250,18 +1255,18 @@ dependencies = [
  "http 1.4.2",
  "http-body 1.0.1",
  "http-body-util",
- "md-5 0.10.6",
+ "md-5 0.11.0",
  "pin-project-lite",
- "sha1 0.10.6",
- "sha2 0.10.9",
+ "sha1 0.11.0",
+ "sha2 0.11.0",
  "tracing",
 ]
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.60.20"
+version = "0.61.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "faf09d74e5e32f76b8762da505a3cd59303e367a664ca67295387baa8c1d7548"
+checksum = "80c2051c2f1016fb8e6548dd07b8bc2ac9c3fe583721444b92f515e856d31609"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -1270,9 +1275,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http"
-version = "0.63.6"
+version = "0.64.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba1ab2dc1c2c3749ead27180d333c42f11be8b0e934058fb4b2258ee8dbe5231"
+checksum = "639b4d8f8555f24a9be649811c3eb0b4d4616f4d61daf0c32e28873bc1ea9af1"
 dependencies = [
  "aws-smithy-eventstream",
  "aws-smithy-runtime-api",
@@ -1292,9 +1297,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.1.12"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a2f165a7feee6f263028b899d0a181987f4fa7179a6411a32a439fba7c5f769"
+checksum = "7bd25384a4e437aa8d8f339afad4b69e786b936a7cb10db668a7aaf66717b1a8"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-protocol-test",
@@ -1318,9 +1323,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-json"
-version = "0.62.6"
+version = "0.63.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "517089205f18ab4adc5a3e02888cb139bbbbb2e168eac9f396216925d1fbeaf5"
+checksum = "3385d469edbe8b60cc72002784652b5efca39178192aa9cc4b44c9875c6bdc18"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-schema",
@@ -1329,9 +1334,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-mocks"
-version = "0.2.6"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d9a9490933f8faa0aeb1eb9fbb8bf4f1c214b3149c61b3a4074b68030b21bd5"
+checksum = "d0922f8ee1ce1f90f0baf9c9036f566161547a7ab9f09571d61d56455ba35598"
 dependencies = [
  "aws-smithy-http-client",
  "aws-smithy-runtime-api",
@@ -1341,18 +1346,18 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-observability"
-version = "0.2.6"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06c2315d173edbf1920da8ba3a7189695827002e4c0fc961973ab1c54abca9c"
+checksum = "8e86338c869539a581bf161247762a6e87f92c5c075060057b5ed6d06632ed0c"
 dependencies = [
  "aws-smithy-runtime-api",
 ]
 
 [[package]]
 name = "aws-smithy-protocol-test"
-version = "0.63.14"
+version = "0.64.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b227aa94af99a8e5ee52551cc7e3ee30a217019ef99207b6f0b7a1527685941"
+checksum = "f76511a0e223ce78deb6a78b8afebda99cb737cfbc8a58d96dcb190f012dd40a"
 dependencies = [
  "assert-json-diff",
  "aws-smithy-runtime-api",
@@ -1369,19 +1374,22 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-query"
-version = "0.60.15"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a56d79744fb3edb5d722ef79d86081e121d3b9422cb209eb03aea6aa4f21ebd"
+checksum = "f1d1d71f6562be974caa85442ecd90194c40fdb5df045f182a6c2e872ce95056"
 dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
  "aws-smithy-types",
+ "aws-smithy-xml",
  "urlencoding",
 ]
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.11.3"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e6f5caf6fea86f8c2206541ab5857cfcda9013426cdbe8fa0098b9e2d32182"
+checksum = "591e0024cdf2a8de8711860f7e1d5cfbca26b800ce13793a9aa2f4f5918e6d95"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -1392,23 +1400,20 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "fastrand 2.3.0",
- "http 0.2.12",
  "http 1.4.2",
- "http-body 0.4.6",
  "http-body 1.0.1",
  "http-body-util",
  "pin-project-lite",
  "pin-utils",
  "tokio",
  "tracing",
- "tracing-subscriber",
 ]
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.12.1"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc117c179ecf39a62a0a3f49f600e9ac26a7ad7dd172177999f83933af776c32"
+checksum = "9bb0deb40a69de59f7809251cfe1ab16de135f42c49d222d1202b4d0ce19720f"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
@@ -1424,9 +1429,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api-macros"
-version = "1.0.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d7396fd9500589e62e460e987ecb671bad374934e55ec3b5f498cc7a8a8a7b7"
+checksum = "221eaa237ddf1ca79b60d1372aad77e47f9c0ea5b3ce5099da8c61d027dc77b3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1435,9 +1440,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-schema"
-version = "0.1.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7442cb268338f0eb8278140a107c046756aa01093d8ef5e99628d34ae09c94f5"
+checksum = "e8f395d93304280b64b7632fea798d177e74897fe7f063416ce627cd6fa24829"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -1446,9 +1451,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.4.8"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "056b66dbce2f81cc0c1e2b05bb402eb58f8a3530479d650efadd5bbae9a4050b"
+checksum = "69bb407740a197147da48238ecc94498493c9e85445732360cec180296ca45f1"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -1472,18 +1477,21 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-xml"
-version = "0.60.15"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce02add1aa3677d022f8adf81dcbe3046a95f17a1b1e8979c145cd21d3d22b3"
+checksum = "0b932c8d6dc127fc980eecd78f8694ae9b9551b69a93a7def2a199c1c0033daf"
 dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-schema",
+ "aws-smithy-types",
  "xmlparser",
 ]
 
 [[package]]
 name = "aws-types"
-version = "1.3.16"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16bf10b03a3c01e6b3b7d47cd964e873ffe9e7d4e80fad16bd4c077cb068531"
+checksum = "209f3a6d82a6e9e5f94abbed94c7a26e1c052341002bf57a5fb5481f625896fc"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-async",
@@ -3445,7 +3453,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -5300,7 +5308,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -5752,7 +5760,7 @@ dependencies = [
  "launchdarkly-sdk-transport",
  "launchdarkly-server-sdk-evaluation",
  "log",
- "lru",
+ "lru 0.16.3",
  "moka",
  "parking_lot",
  "rand 0.9.4",
@@ -6073,6 +6081,15 @@ dependencies = [
  "hashbrown 0.16.1",
 ]
 
+[[package]]
+name = "lru"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef9ac18847474e638e3702b76c65d4eb93428471a74778ef0f1be711717f89b5"
+dependencies = [
+ "hashbrown 0.17.1",
+]
+
 [[package]]
 name = "lru-slab"
 version = "0.1.3"
@@ -6302,7 +6319,7 @@ dependencies = [
  "futures-sink",
  "futures-util",
  "keyed_priority_queue",
- "lru",
+ "lru 0.16.3",
  "mysql_common",
  "native-tls",
  "pem 3.0.6",
@@ -7583,7 +7600,7 @@ dependencies = [
  "derivative",
  "futures",
  "jsonwebtoken",
- "lru",
+ "lru 0.16.3",
  "mz-auth",
  "mz-ore",
  "mz-repr",
@@ -11452,7 +11469,7 @@ dependencies = [
  "once_cell",
  "socket2 0.6.5",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -12324,7 +12341,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -12383,7 +12400,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -13544,10 +13561,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand 2.3.0",
- "getrandom 0.3.3",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
@@ -13566,7 +13583,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.1",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index f70c5f35c1be6..538bf8da78e7b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -283,20 +283,20 @@ assert_cmd = "2.2.2"
 async-compression = { version = "0.4.27", features = ["bzip2-sys", "gzip", "tokio", "xz", "zstd"] }
 async-stream = "0.3.6"
 async-trait = "0.1.89"
-aws-config = { version = "1.8.15", default-features = false, features = ["sso"] }
-aws-credential-types = { version = "1.2.10", features = ["hardcoded-credentials"] }
+aws-config = { version = "1.12.0", default-features = false, features = ["sso"] }
+aws-credential-types = { version = "1.3.0", features = ["hardcoded-credentials"] }
 aws-lc-rs = "1"
-aws-sdk-glue = { version = "1.104.0", default-features = false, features = ["rt-tokio"] }
-aws-sdk-kms = { version = "1.104.0", default-features = false, features = ["rt-tokio"] }
-aws-sdk-s3 = { version = "1.129.0", default-features = false, features = ["rt-tokio"] }
-aws-sdk-secretsmanager = { version = "1.103.0", default-features = false, features = ["rt-tokio"] }
-aws-sdk-sts = { version = "1.41.0", default-features = false, features = ["rt-tokio"] }
-aws-sigv4 = "1.3.6"
-aws-smithy-mocks = "0.2.4"
-aws-smithy-runtime = { version = "1.9.8", features = ["connector-hyper-0-14-x"] }
-aws-smithy-runtime-api = "1.10.0"
-aws-smithy-types = { version = "1.1.8", features = ["byte-stream-poll-next"] }
-aws-types = "1.3.9"
+aws-sdk-glue = { version = "1.169.0", default-features = false, features = ["rt-tokio"] }
+aws-sdk-kms = { version = "1.122.0", default-features = false, features = ["rt-tokio"] }
+aws-sdk-s3 = { version = "1.150.0", default-features = false, features = ["rt-tokio"] }
+aws-sdk-secretsmanager = { version = "1.119.0", default-features = false, features = ["rt-tokio"] }
+aws-sdk-sts = { version = "1.118.0", default-features = false, features = ["rt-tokio"] }
+aws-sigv4 = "1.6.0"
+aws-smithy-mocks = "0.3.0"
+aws-smithy-runtime = { version = "1.15.0", features = ["connector-hyper-0-14-x"] }
+aws-smithy-runtime-api = "1.18.0"
+aws-smithy-types = { version = "1.8.1", features = ["byte-stream-poll-next"] }
+aws-types = "1.6.0"
 axum = { version = "0.8.9", features = ["ws"] }
 axum-extra = { version = "0.12.5", features = ["typed-header"] }
 axum-server = { version = "0.8.0", features = ["tls-rustls"] }
diff --git a/deny.toml b/deny.toml
index 1b863b373a06c..8e7fdb27d523f 100644
--- a/deny.toml
+++ b/deny.toml
@@ -112,6 +112,8 @@ skip = [
     { name = "tungstenite", version = "0.29.0" },
     # libduckdb-sys still pulls 6.
     { name = "zip", version = "6.0.0" },
+    # aws-sdk-s3 is on 0.18, while launchdarkly-server-sdk, mysql_async, and mz-frontegg-auth still use 0.16.
+    { name = "lru", version = "0.16.3" },
     # Used by azure_core
     { name = "quick-xml", version = "0.31.0" },
     # reqsign-aws (via iceberg) is ahead of opendal, which pulls 0.39.

From 8a2d06b46e7db88b7e619430e2206249002d68d0 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:28:04 +0200
Subject: [PATCH 88/94] build(deps): bump types-pyyaml from 6.0.12.20260815 to
 6.0.12.20260906 in /ci/builder (#38947)

Bumps [types-pyyaml](https://github.com/python/typeshed) from
6.0.12.20260815 to 6.0.12.20260906.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 ci/builder/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/builder/requirements.txt b/ci/builder/requirements.txt
index 34dd93f96203f..3b9bc2aef0d62 100644
--- a/ci/builder/requirements.txt
+++ b/ci/builder/requirements.txt
@@ -75,7 +75,7 @@ types-Markdown==3.10.2.20260712
 types-prettytable==3.4.2.6
 types-psutil==7.2.2.20260827
 types-PyMYSQL==1.2.0.20260923
-types-PyYAML==6.0.12.20260815
+types-PyYAML==6.0.12.20260906
 types-requests==2.33.0.20260906
 types-setuptools==84.0.0.20260812
 types-toml==0.10.8.20260518

From ad37ad9016c5b7869093d2a85bc6d50c1215a056 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:28:24 +0200
Subject: [PATCH 89/94] build(deps): bump types-psutil from 7.2.2.20260827 to
 7.2.2.20260906 in /ci/builder (#38945)

Bumps [types-psutil](https://github.com/python/typeshed) from
7.2.2.20260827 to 7.2.2.20260906.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/python/typeshed/commits">compare view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 ci/builder/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/builder/requirements.txt b/ci/builder/requirements.txt
index 3b9bc2aef0d62..71bdba8494798 100644
--- a/ci/builder/requirements.txt
+++ b/ci/builder/requirements.txt
@@ -73,7 +73,7 @@ toml==0.10.2
 twine==7.0.0
 types-Markdown==3.10.2.20260712
 types-prettytable==3.4.2.6
-types-psutil==7.2.2.20260827
+types-psutil==7.2.2.20260906
 types-PyMYSQL==1.2.0.20260923
 types-PyYAML==6.0.12.20260906
 types-requests==2.33.0.20260906

From d0d06eb601a3a68f5958faae032f61186885d774 Mon Sep 17 00:00:00 2001
From: Moritz Hoffmann <antiguru@gmail.com>
Date: Mon, 28 Sep 2026 14:40:34 +0200
Subject: [PATCH 90/94] kafka-matrix: disable metric sinks until SQL-730 is
 fixed (#39169)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With curated metric sinks on (the CI default), the first catalog status
queries after a restart take minutes on 4-CPU agents, so "Previous Kafka
versions" times out in release qualification. This sets
`enable_metric_sink=false` for the kafka-matrix Materialized service via
`additional_system_parameter_defaults`. It only hides the symptom in
this suite, and
[SQL-730](https://linear.app/materializeinc/issue/SQL-730) stays open
for the actual fix.

Works around [SQL-730](https://linear.app/materializeinc/issue/SQL-730).

Posted by Claude Code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 test/kafka-matrix/mzcompose.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/test/kafka-matrix/mzcompose.py b/test/kafka-matrix/mzcompose.py
index eb0e54a08d1a0..8547fec8f98cf 100644
--- a/test/kafka-matrix/mzcompose.py
+++ b/test/kafka-matrix/mzcompose.py
@@ -56,7 +56,14 @@
 ]
 
 SERVICES = [
-    Materialized(default_replication_factor=2),
+    Materialized(
+        default_replication_factor=2,
+        # Curated metric sinks make the first catalog status queries after a
+        # restart take minutes on 4-CPU agents, which times out this suite.
+        # The flag defaults off in production.
+        # TODO(SQL-730): remove once the post-restart slowdown is fixed.
+        additional_system_parameter_defaults={"enable_metric_sink": "false"},
+    ),
     # Occasional timeouts in CI with 60s timeout
     Testdrive(
         volumes_extra=["../testdrive:/workdir/testdrive"], default_timeout="120s"

From 73eb9da8d3001e59a3a19592904fff85550ca161 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 28 Sep 2026 14:49:31 +0200
Subject: [PATCH 91/94] build(deps): bump the simple1 group across 1 directory
 with 16 updates (#39280)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the simple1 group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.89` |
`0.1.92` |
| [buildid](https://github.com/jmesmon/buildid) | `1.0.4` | `1.0.5` |
| [cfg-if](https://github.com/rust-lang/cfg-if) | `1.0.4` | `1.0.5` |
| [clap](https://github.com/clap-rs/clap) | `4.6.3` | `4.6.7` |
| [clap_complete](https://github.com/clap-rs/clap) | `4.6.9` | `4.6.11`
|
| [columnar](https://github.com/frankmcsherry/columnar) | `0.13.1` |
`0.13.2` |
| [crc32fast](https://github.com/srijs/rust-crc32fast) | `1.5.0` |
`1.5.2` |
| [crossbeam](https://github.com/crossbeam-rs/crossbeam) | `0.8.4` |
`0.8.5` |
| [crossbeam-channel](https://github.com/crossbeam-rs/crossbeam) |
`0.5.16` | `0.5.17` |
| [flate2](https://github.com/rust-lang/flate2-rs) | `1.1.9` | `1.1.10`
|
| [futures](https://github.com/rust-lang/futures-rs) | `0.3.33` |
`0.3.34` |
| [futures-util](https://github.com/rust-lang/futures-rs) | `0.3.33` |
`0.3.34` |
| [headers](https://github.com/hyperium/headers) | `0.4.1` | `0.4.2` |
| [hickory-resolver](https://github.com/hickory-dns/hickory-dns) |
`0.26.1` | `0.26.3` |
| [hyper-util](https://github.com/hyperium/hyper-util) | `0.1.20` |
`0.1.21` |
| [ipnet](https://github.com/krisprice/ipnet) | `2.12.1` | `2.12.2` |


Updates `async-trait` from 0.1.89 to 0.1.92
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/dtolnay/async-trait/releases">async-trait's
releases</a>.</em></p>
<blockquote>
<h2>0.1.92</h2>
<ul>
<li>Resolve double_must_use clippy lint in generated code (<a
href="https://redirect.github.com/dtolnay/async-trait/issues/303">#303</a>)</li>
</ul>
<h2>0.1.91</h2>
<ul>
<li>Update to syn 3 (<a
href="https://redirect.github.com/dtolnay/async-trait/issues/299">#299</a>)</li>
<li>Fix mutability for by-reference receivers (<a
href="https://redirect.github.com/dtolnay/async-trait/issues/301">#301</a>)</li>
</ul>
<h2>0.1.90</h2>
<p><em>(yanked)</em></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/dtolnay/async-trait/commit/82e7e9edd60f622294373a23c0ce9c0077ad0263"><code>82e7e9e</code></a>
Release 0.1.92</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/9a35cb87f9366cd992bbc00d430e1b5fe1aa0cdd"><code>9a35cb8</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/async-trait/issues/303">#303</a>
from dtolnay/mustuse</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/875ceecb100bab2cf369178633b4791336d92b75"><code>875ceec</code></a>
Resolve double_must_use clippy lint</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/62993a57bc6a8d5bd3de23fbae48cede333cb925"><code>62993a5</code></a>
Raise minimum tested compiler to rust 1.88</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/d049ee02a2d50b72e03d07f06311e23bf5b512a8"><code>d049ee0</code></a>
Release 0.1.91</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/7a0961f275432c40cc5e7aa011362e4b50d763b1"><code>7a0961f</code></a>
Merge pull request <a
href="https://redirect.github.com/dtolnay/async-trait/issues/301">#301</a>
from dtolnay/mutability</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/740f86f23d176229011f2389c8a206ef5ba547e7"><code>740f86f</code></a>
Ignore mut_mut pedantic clippy lint in test</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/4699cd320a8aaaf06a2a369cb9e1f2964b14b71c"><code>4699cd3</code></a>
Fix mutability for by-reference receivers</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/6dd3573df95878d34fcfc0ab9c242aeab3140f82"><code>6dd3573</code></a>
Add regression test for issue 300</li>
<li><a
href="https://github.com/dtolnay/async-trait/commit/2371797a3938808bd7e1f4f9abd0eed51bd99634"><code>2371797</code></a>
Release 0.1.90</li>
<li>Additional commits viewable in <a
href="https://github.com/dtolnay/async-trait/compare/0.1.89...0.1.92">compare
view</a></li>
</ul>
</details>
<br />

Updates `buildid` from 1.0.4 to 1.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/jmesmon/buildid/releases">buildid's
releases</a>.</em></p>
<blockquote>
<h2>buildid-v1.0.5</h2>
<h3>Other</h3>
<ul>
<li>Fix macOS feature-powerset build</li>
<li>Fix Windows incremental build IDs (<a
href="https://redirect.github.com/codyps/buildid/pull/17">#17</a>)</li>
</ul>
<h3>New Features</h3>
<ul>
<li>Crate now exists. First release</li>
</ul>
<h3>Commit Statistics</h3>
<!-- raw HTML omitted -->
<ul>
<li>15 commits contributed to the release over the course of 81 calendar
days.</li>
<li>0 commits where understood as <a
href="https://www.conventionalcommits.org">conventional</a>.</li>
<li>0 issues like '(#ID)' where seen in commit messages</li>
</ul>
<h3>Commit Details</h3>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<ul>
<li><strong>Uncategorized</strong>
<ul>
<li>readme (<a
href="https://github.com/jmesmon/buildid/commit/ab0156bc6562b3e58b04df974414fa2515ea9357"><code>ab0156b</code></a>)</li>
<li>add buildid-linker-symbols helper dep (<a
href="https://github.com/jmesmon/buildid/commit/5e6e8928e66950fdfff87d93fa811573a4c13282"><code>5e6e892</code></a>)</li>
<li>test specifics (<a
href="https://github.com/jmesmon/buildid/commit/e2ee35cecce04bd6a522d0245ff30a33e23cd8ed"><code>e2ee35c</code></a>)</li>
<li>clippy (<a
href="https://github.com/jmesmon/buildid/commit/456782a8654bd93c3ba3121577d0b415a42f8edb"><code>456782a</code></a>)</li>
<li>well, it builds for all features. need to test things though (<a
href="https://github.com/jmesmon/buildid/commit/976c7ac97508a1c061ce0b33b16c09b82208951b"><code>976c7ac</code></a>)</li>
<li>no_std and start adding lookup override features (<a
href="https://github.com/jmesmon/buildid/commit/b655ec62ab1ded0f264abf3076b5593caeb84ae1"><code>b655ec6</code></a>)</li>
<li>more clippy (<a
href="https://github.com/jmesmon/buildid/commit/874044cc7f9f0f6fa03a26edc4aa0cdabd6b87b7"><code>874044c</code></a>)</li>
<li>clippy (<a
href="https://github.com/jmesmon/buildid/commit/78e9e7bb774a99604927f47cb1a60c0c53df5097"><code>78e9e7b</code></a>)</li>
<li>delete commented block (<a
href="https://github.com/jmesmon/buildid/commit/f0c05d4c04495cf64e5f34be232039d361f80821"><code>f0c05d4</code></a>)</li>
<li>docs (<a
href="https://github.com/jmesmon/buildid/commit/413ccaf436327b1d67ef33a7252759892eae60c2"><code>413ccaf</code></a>)</li>
<li>windows works (<a
href="https://github.com/jmesmon/buildid/commit/af3d1d37092a796d31193200be4cde8792661e6e"><code>af3d1d3</code></a>)</li>
<li>windows is almost but not quite working (<a
href="https://github.com/jmesmon/buildid/commit/c6e8ea153695cc36a95cd617da52656c90e4aae3"><code>c6e8ea1</code></a>)</li>
<li>GNU_BUILD_ID elf platforms work! (<a
href="https://github.com/jmesmon/buildid/commit/5d648d096249cbe1ef0cbcb93841a2ea55c6a124"><code>5d648d0</code></a>)</li>
<li>fix linux (<a
href="https://github.com/jmesmon/buildid/commit/8fdf703816e12c15f743789f0fbdc69b10750352"><code>8fdf703</code></a>)</li>
<li>initial, only tested on macos (<a
href="https://github.com/jmesmon/buildid/commit/c35aee17c6732e339cf2b235d9a01ab14bae2405"><code>c35aee1</code></a>)</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/codyps/buildid/blob/master/CHANGELOG.md">buildid's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/codyps/buildid/compare/buildid-v1.0.4...buildid-v1.0.5">1.0.5</a>
- 2026-08-17</h2>
<h3>Other</h3>
<ul>
<li>Fix macOS feature-powerset build</li>
<li>Fix Windows incremental build IDs (<a
href="https://redirect.github.com/codyps/buildid/pull/17">#17</a>)</li>
</ul>
<h3>New Features</h3>
<ul>
<li>Crate now exists. First release</li>
</ul>
<h3>Commit Statistics</h3>
<!-- raw HTML omitted -->
<ul>
<li>15 commits contributed to the release over the course of 81 calendar
days.</li>
<li>0 commits where understood as <a
href="https://www.conventionalcommits.org">conventional</a>.</li>
<li>0 issues like '(#ID)' where seen in commit messages</li>
</ul>
<h3>Commit Details</h3>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<ul>
<li><strong>Uncategorized</strong>
<ul>
<li>readme (<a
href="https://github.com/jmesmon/buildid/commit/ab0156bc6562b3e58b04df974414fa2515ea9357"><code>ab0156b</code></a>)</li>
<li>add buildid-linker-symbols helper dep (<a
href="https://github.com/jmesmon/buildid/commit/5e6e8928e66950fdfff87d93fa811573a4c13282"><code>5e6e892</code></a>)</li>
<li>test specifics (<a
href="https://github.com/jmesmon/buildid/commit/e2ee35cecce04bd6a522d0245ff30a33e23cd8ed"><code>e2ee35c</code></a>)</li>
<li>clippy (<a
href="https://github.com/jmesmon/buildid/commit/456782a8654bd93c3ba3121577d0b415a42f8edb"><code>456782a</code></a>)</li>
<li>well, it builds for all features. need to test things though (<a
href="https://github.com/jmesmon/buildid/commit/976c7ac97508a1c061ce0b33b16c09b82208951b"><code>976c7ac</code></a>)</li>
<li>no_std and start adding lookup override features (<a
href="https://github.com/jmesmon/buildid/commit/b655ec62ab1ded0f264abf3076b5593caeb84ae1"><code>b655ec6</code></a>)</li>
<li>more clippy (<a
href="https://github.com/jmesmon/buildid/commit/874044cc7f9f0f6fa03a26edc4aa0cdabd6b87b7"><code>874044c</code></a>)</li>
<li>clippy (<a
href="https://github.com/jmesmon/buildid/commit/78e9e7bb774a99604927f47cb1a60c0c53df5097"><code>78e9e7b</code></a>)</li>
<li>delete commented block (<a
href="https://github.com/jmesmon/buildid/commit/f0c05d4c04495cf64e5f34be232039d361f80821"><code>f0c05d4</code></a>)</li>
<li>docs (<a
href="https://github.com/jmesmon/buildid/commit/413ccaf436327b1d67ef33a7252759892eae60c2"><code>413ccaf</code></a>)</li>
<li>windows works (<a
href="https://github.com/jmesmon/buildid/commit/af3d1d37092a796d31193200be4cde8792661e6e"><code>af3d1d3</code></a>)</li>
<li>windows is almost but not quite working (<a
href="https://github.com/jmesmon/buildid/commit/c6e8ea153695cc36a95cd617da52656c90e4aae3"><code>c6e8ea1</code></a>)</li>
<li>GNU_BUILD_ID elf platforms work! (<a
href="https://github.com/jmesmon/buildid/commit/5d648d096249cbe1ef0cbcb93841a2ea55c6a124"><code>5d648d0</code></a>)</li>
<li>fix linux (<a
href="https://github.com/jmesmon/buildid/commit/8fdf703816e12c15f743789f0fbdc69b10750352"><code>8fdf703</code></a>)</li>
<li>initial, only tested on macos (<a
href="https://github.com/jmesmon/buildid/commit/c35aee17c6732e339cf2b235d9a01ab14bae2405"><code>c35aee1</code></a>)</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/codyps/buildid/commit/19563693b538801250d34c3fb0a5c7930100e473"><code>1956369</code></a>
chore(buildid): release v1.0.5</li>
<li><a
href="https://github.com/codyps/buildid/commit/611b0ae68f26f5e436f3d0dcc936b567eb7c4afd"><code>611b0ae</code></a>
Merge pull request <a
href="https://redirect.github.com/jmesmon/buildid/issues/19">#19</a>
from codyps/chore/release-plz-ci</li>
<li><a
href="https://github.com/codyps/buildid/commit/8cb092b9ebc2d1aa1700507b5e58b351a0adfb67"><code>8cb092b</code></a>
ci: add release-plz automation</li>
<li><a
href="https://github.com/codyps/buildid/commit/178b8bef2af0d15537eb765c1530d9a16b59aac0"><code>178b8be</code></a>
Merge pull request <a
href="https://redirect.github.com/jmesmon/buildid/issues/18">#18</a>
from codyps/fix/issue-17-windows-incremental-build-id</li>
<li><a
href="https://github.com/codyps/buildid/commit/2a365b5c147c70b8bad68529dc0c60a78563eb6a"><code>2a365b5</code></a>
Modernize Nix flake checks</li>
<li><a
href="https://github.com/codyps/buildid/commit/9a393186a8fc0a8a90e8b2357a8d91b7a23fa62c"><code>9a39318</code></a>
Fix Linux Nix build ID tests</li>
<li><a
href="https://github.com/codyps/buildid/commit/a2163688ffef879c5f7bd99fba92bb98d2497032"><code>a216368</code></a>
update nix</li>
<li><a
href="https://github.com/codyps/buildid/commit/4248784420d7743a33238750cefc94d5c7d26844"><code>4248784</code></a>
fix incremental test in ci, disable sccache</li>
<li><a
href="https://github.com/codyps/buildid/commit/3925a0fa13b1dff053aab36583b52b6058d1361b"><code>3925a0f</code></a>
no more bors</li>
<li><a
href="https://github.com/codyps/buildid/commit/1b1b1d4a3ccc6d78a2a5945798328a447995b473"><code>1b1b1d4</code></a>
Update GitHub Actions dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/jmesmon/buildid/compare/buildid-v1.0.4...buildid-v1.0.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `cfg-if` from 1.0.4 to 1.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/cfg-if/releases">cfg-if's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.5</h2>
<ul>
<li>Add a note that this crate is deprecated, suggesting
<code>cfg_select!</code> instead</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/cfg-if/blob/main/CHANGELOG.md">cfg-if's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/rust-lang/cfg-if/compare/v1.0.4...v1.0.5">1.0.5</a>
- 2026-09-16</h2>
<ul>
<li>Add a note that this crate is deprecated, suggesting
<code>cfg_select!</code> instead</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-lang/cfg-if/commit/8b0a2b0fc1fa3b3741b9e72895f390cf499fe36f"><code>8b0a2b0</code></a>
Deprecation notice + crate version bump</li>
<li><a
href="https://github.com/rust-lang/cfg-if/commit/efabe3f520a1a7b75e7e2267abf923ac23762269"><code>efabe3f</code></a>
Add a changelog entry for the upcoming deprecation notice</li>
<li><a
href="https://github.com/rust-lang/cfg-if/commit/a66c2d4d559cdd6b047d1db3290f6bf252773fc9"><code>a66c2d4</code></a>
Bump actions/checkout from 6 to 7</li>
<li><a
href="https://github.com/rust-lang/cfg-if/commit/bda9677a0e8cc55f2a82130cb9c32c1a7335abfe"><code>bda9677</code></a>
Bump actions/checkout from 5 to 6</li>
<li>See full diff in <a
href="https://github.com/rust-lang/cfg-if/compare/v1.0.4...v1.0.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `clap` from 4.6.3 to 4.6.7
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/releases">clap's
releases</a>.</em></p>
<blockquote>
<h2>v4.6.7</h2>
<h2>[4.6.7] - 2026-09-14</h2>
<h3>Features</h3>
<ul>
<li><em>(derive)</em> Add <code>#[command(defer = &lt;bool&gt;)]</code>
attribute to opt-in to lazy initialisation of subcommands</li>
</ul>
<h2>v4.6.6</h2>
<h2>[4.6.6] - 2026-08-06</h2>
<h3>Features</h3>
<ul>
<li>Add <code>Command::get_overridden_usage</code></li>
</ul>
<h2>v4.6.5</h2>
<h2>[4.6.5] - 2026-07-31</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Correctly mark which <code>value_names</code> are
optional with <code>num_args</code></li>
</ul>
<h2>v4.6.4</h2>
<h2>[4.6.4] - 2026-07-21</h2>
<h3>Internal</h3>
<ul>
<li>Update to syn v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/clap-rs/clap/blob/main/CHANGELOG.md">clap's
changelog</a>.</em></p>
<blockquote>
<h2>[4.6.7] - 2026-09-14</h2>
<h3>Features</h3>
<ul>
<li><em>(derive)</em> Add <code>#[command(defer = &lt;bool&gt;)]</code>
attribute to opt-in to lazy initialisation of subcommands</li>
</ul>
<h2>[4.6.6] - 2026-08-06</h2>
<h3>Features</h3>
<ul>
<li>Add <code>Command::get_overridden_usage</code></li>
</ul>
<h2>[4.6.5] - 2026-07-31</h2>
<h3>Fixes</h3>
<ul>
<li><em>(help)</em> Correctly mark which <code>value_names</code> are
optional with <code>num_args</code></li>
</ul>
<h2>[4.6.4] - 2026-07-21</h2>
<h3>Internal</h3>
<ul>
<li>Update to syn v3</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/clap-rs/clap/commit/d3e59a9ab214910b9dad02921b7ef42c6400de9b"><code>d3e59a9</code></a>
chore: Release</li>
<li><a
href="https://github.com/clap-rs/clap/commit/d997f878c484e02b2935d32a7b67afe990e91227"><code>d997f87</code></a>
docs: Update changelog</li>
<li><a
href="https://github.com/clap-rs/clap/commit/fb6058cc38cf6f4b07b8db89c850fc80e059e222"><code>fb6058c</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/6409">#6409</a>
from heaths/pwsh-support</li>
<li><a
href="https://github.com/clap-rs/clap/commit/2310870f7a9fe4c39f5bb5620261a06ac9aaa0b1"><code>2310870</code></a>
test(complete): Add tests for completer_for_path</li>
<li><a
href="https://github.com/clap-rs/clap/commit/5967c17393a09f90112cdc5b2c20a1383f0bd8e4"><code>5967c17</code></a>
refactor(complete): Move shell detection to Shells</li>
<li><a
href="https://github.com/clap-rs/clap/commit/594602bb29f374e49da5029df63e5c740c723ad0"><code>594602b</code></a>
fix(complete): Detect pwsh for PowerShell</li>
<li><a
href="https://github.com/clap-rs/clap/commit/3a4f2d031b5110aaaac40f1cb1d6c0b8ff619df8"><code>3a4f2d0</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/6427">#6427</a>
from clap-rs/renovate/shlex-2.x</li>
<li><a
href="https://github.com/clap-rs/clap/commit/67ebaed4ac95a83d5d7cc22d64ee0fc162ae1db3"><code>67ebaed</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/6426">#6426</a>
from clap-rs/renovate/actions-checkout-7.x</li>
<li><a
href="https://github.com/clap-rs/clap/commit/c968b136d0e6f560c08b06a844a20f2798a00096"><code>c968b13</code></a>
chore(deps): Update Rust crate shlex to v2</li>
<li><a
href="https://github.com/clap-rs/clap/commit/8f247cbf58c582a755ee4dbe62a2390d93b9f8eb"><code>8f247cb</code></a>
chore(deps): Update actions/checkout action to v7</li>
<li>Additional commits viewable in <a
href="https://github.com/clap-rs/clap/compare/clap_complete-v4.6.3...clap_complete-v4.6.7">compare
view</a></li>
</ul>
</details>
<br />

Updates `clap_complete` from 4.6.9 to 4.6.11
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/clap-rs/clap/commit/2cb76fdf385396f86f37af49784504da560b6e47"><code>2cb76fd</code></a>
chore: Release</li>
<li><a
href="https://github.com/clap-rs/clap/commit/0b00b8d330d55fb8731768578ea7247981779254"><code>0b00b8d</code></a>
docs: Update changelog</li>
<li><a
href="https://github.com/clap-rs/clap/commit/34430008f695f43d37364ce47cce5156febb1c52"><code>3443000</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/6526">#6526</a>
from bonnefoa/fix-completion-escape</li>
<li><a
href="https://github.com/clap-rs/clap/commit/a1b6be720e59248d8b783c1dfce76a355e170dd7"><code>a1b6be7</code></a>
fix(clap_complete): Fix value escape in zsh completion</li>
<li><a
href="https://github.com/clap-rs/clap/commit/face9e81df3fdbd432d3d97fb69162b33c06036b"><code>face9e8</code></a>
test(complete): Add completion test without arg's help</li>
<li><a
href="https://github.com/clap-rs/clap/commit/88053ab75fd8576796d9226bcc710d057d42109b"><code>88053ab</code></a>
test(complete): Re-enable complete tests</li>
<li><a
href="https://github.com/clap-rs/clap/commit/e6adcc21a6b4ea285bd646e977884c8d653841b7"><code>e6adcc2</code></a>
chore(release): Simplify replacements</li>
<li><a
href="https://github.com/clap-rs/clap/commit/13f2db5072d600c11d8d6298e4e9ba53ffc6c1ab"><code>13f2db5</code></a>
chore: Release</li>
<li><a
href="https://github.com/clap-rs/clap/commit/3304fead40c107f92f63daccf25af7b4f34ba709"><code>3304fea</code></a>
docs: Update changelog</li>
<li><a
href="https://github.com/clap-rs/clap/commit/7b2ad34cfd8742757ebd9f5b3e9211cbb66f7c2f"><code>7b2ad34</code></a>
Merge pull request <a
href="https://redirect.github.com/clap-rs/clap/issues/6521">#6521</a>
from r-near/feat/derive-deferred-initialization</li>
<li>Additional commits viewable in <a
href="https://github.com/clap-rs/clap/compare/clap_complete-v4.6.9...clap_complete-v4.6.11">compare
view</a></li>
</ul>
</details>
<br />

Updates `columnar` from 0.13.1 to 0.13.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/frankmcsherry/columnar/releases">columnar's
releases</a>.</em></p>
<blockquote>
<h2>columnar-v0.13.2</h2>
<h3>Other</h3>
<ul>
<li>Pin columnar_derive dependency exactly (<a
href="https://redirect.github.com/frankmcsherry/columnar/pull/116">#116</a>)</li>
<li>Implement element_sizes for the remaining FromBytes impls (<a
href="https://redirect.github.com/frankmcsherry/columnar/pull/118">#118</a>)</li>
</ul>
<h2>columnar_derive-v0.13.2</h2>
<h3>Other</h3>
<ul>
<li>Implement element_sizes for the remaining FromBytes impls (<a
href="https://redirect.github.com/frankmcsherry/columnar/pull/118">#118</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/frankmcsherry/columnar/blob/master/CHANGELOG.md">columnar's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/frankmcsherry/columnar/compare/columnar-v0.13.1...columnar-v0.13.2">0.13.2</a>
- 2026-09-09</h2>
<h3>Other</h3>
<ul>
<li>Pin columnar_derive dependency exactly (<a
href="https://redirect.github.com/frankmcsherry/columnar/pull/116">#116</a>)</li>
<li>Implement element_sizes for the remaining FromBytes impls (<a
href="https://redirect.github.com/frankmcsherry/columnar/pull/118">#118</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/frankmcsherry/columnar/commit/0607928adb16fb9619a1bfac23546fb8bc46d69b"><code>0607928</code></a>
chore: release v0.13.2 (<a
href="https://redirect.github.com/frankmcsherry/columnar/issues/119">#119</a>)</li>
<li><a
href="https://github.com/frankmcsherry/columnar/commit/36ae1c8b1f3aaea99b1447de952873c78da1fb66"><code>36ae1c8</code></a>
Pin columnar_derive dependency exactly (<a
href="https://redirect.github.com/frankmcsherry/columnar/issues/116">#116</a>)</li>
<li><a
href="https://github.com/frankmcsherry/columnar/commit/9a863fa65c6a55c33a572441aa60d7531afe506b"><code>9a863fa</code></a>
Implement element_sizes for the remaining FromBytes impls (<a
href="https://redirect.github.com/frankmcsherry/columnar/issues/118">#118</a>)</li>
<li>See full diff in <a
href="https://github.com/frankmcsherry/columnar/compare/columnar-v0.13.1...columnar-v0.13.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `crc32fast` from 1.5.0 to 1.5.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/7eb0b8a2c9b246d27dc4cb5a53d3fc3b43a4bb83"><code>7eb0b8a</code></a>
release 1.5.2</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/927270745b182e686b360ca6b87e71fce33632fb"><code>9272707</code></a>
perf(baseline): fold whole 16-byte blocks in the tail (<a
href="https://redirect.github.com/srijs/rust-crc32fast/issues/61">#61</a>)</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/1e291e6cba1caf6d346d3d2a2f4d621ccf10f1cf"><code>1e291e6</code></a>
ci: add riscv64gc-unknown-linux-gnu to cross-test matrix (<a
href="https://redirect.github.com/srijs/rust-crc32fast/issues/59">#59</a>)</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/9d028706a30a6ae50ba06f2d791965f2f21be67d"><code>9d02870</code></a>
Update license links (<a
href="https://redirect.github.com/srijs/rust-crc32fast/issues/58">#58</a>)</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/a150f65ce810793293d5c9dd815f4510eb6d8e4c"><code>a150f65</code></a>
release 1.5.1</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/f066e8d618506d12b92cc46286b07929d4dd704e"><code>f066e8d</code></a>
perf(simd): widen x86 folds, add ARM 3-way, and speed up small inputs
(<a
href="https://redirect.github.com/srijs/rust-crc32fast/issues/56">#56</a>)</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/d5c123d00d5a0236b92acc56f984a5a8a5c7baf5"><code>d5c123d</code></a>
consolidate dword load in baseline implementation (<a
href="https://redirect.github.com/srijs/rust-crc32fast/issues/55">#55</a>)</li>
<li><a
href="https://github.com/srijs/rust-crc32fast/commit/50e2046cbb5d4f1844931302b9cd9636694d88ec"><code>50e2046</code></a>
downgrade msrv ci run to just cargo build</li>
<li>See full diff in <a
href="https://github.com/srijs/rust-crc32fast/compare/v1.5.0...v1.5.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `crossbeam` from 0.8.4 to 0.8.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/crossbeam-rs/crossbeam/releases">crossbeam's
releases</a>.</em></p>
<blockquote>
<h2>crossbeam-utils 0.8.5</h2>
<ul>
<li>Add <code>AtomicCell::fetch_update</code> (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/704">#704</a>)</li>
<li>Support targets that do not have atomic CAS on stable Rust (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/698">#698</a>)</li>
</ul>
<h2>crossbeam-deque 0.8.5</h2>
<ul>
<li>Remove dependency on <code>cfg-if</code>. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1072">#1072</a>)</li>
</ul>
<h2>crossbeam 0.8.5</h2>
<ul>
<li>Update MSRV policy to support 1 year instead of 6 months to meet
rayon's MSRV policy. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1284">#1284</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/crossbeam-rs/crossbeam/blob/main/CHANGELOG.md">crossbeam's
changelog</a>.</em></p>
<blockquote>
<h1>Version 0.8.5</h1>
<ul>
<li>Update MSRV policy to support 1 year instead of 6 months to meet
rayon's MSRV policy. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1284">#1284</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/2920c984290229ab4e0ca0452ef09e48a82063f3"><code>2920c98</code></a>
Prepare for the next release</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/808b75a4cbbb59eab83a92cf867a3c771795f959"><code>808b75a</code></a>
ci: Update codegen job</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/46774e09313d4601c23f77da0b078c914194c152"><code>46774e0</code></a>
channel: Document that send_timeout sends an available message even if
the ti...</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/89a3fe4025857397a1adfc954957687d4dce9c93"><code>89a3fe4</code></a>
epoch: Make Shared::null const</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/383d74adcda222f99d54b4e80b55cce6bf30f142"><code>383d74a</code></a>
Use *::MAX associated constants</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/a30b825e6de35ecc4762a55656f63b4dbf4ccb8a"><code>a30b825</code></a>
channel,deque,queue: Use AtomicU64/u64 in head/tail index if
available</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/a0e4d2929e4bf670bf05aad548880656e187a51e"><code>a0e4d29</code></a>
Replace iterative capacity growth with <code>next_power_of_two</code>
(<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1216">#1216</a>)</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/94f74d26240f5d49e61d56ac10111e6527dbcfe6"><code>94f74d2</code></a>
Recognize x86_64-unknown-linux-gnutsan in build script</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/30e5963e4c0a9fc6626bd6417528c4f621e3838e"><code>30e5963</code></a>
epoch: Add missing fence emulation for tsan</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/708a6bd582d1ee482183e186e98527b41bffe565"><code>708a6bd</code></a>
Handle overflow in bounded channel/queue initialization (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1301">#1301</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-0.8.4...crossbeam-0.8.5">compare
view</a></li>
</ul>
</details>
<br />

Updates `crossbeam-channel` from 0.5.16 to 0.5.17
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/crossbeam-rs/crossbeam/releases">crossbeam-channel's
releases</a>.</em></p>
<blockquote>
<h2>crossbeam-channel 0.5.17</h2>
<ul>
<li>Fix UB in bounded channel when <code>SelectedOperation</code> is
leaked. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1295">#1295</a>)</li>
<li>Fix behavior inconsistency on already received case in
<code>at()</code>. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1296">#1296</a>)</li>
<li>Handle overflow in bounded channel initialization. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1301">#1301</a>)</li>
<li>Use 64-bit index on 32-bit platforms if 64-bit atomic is available.
(<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1321">#1321</a>)</li>
<li>Update MSRV policy to support 1 year instead of 6 months to meet
rayon's MSRV policy. (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1284">#1284</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/2920c984290229ab4e0ca0452ef09e48a82063f3"><code>2920c98</code></a>
Prepare for the next release</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/808b75a4cbbb59eab83a92cf867a3c771795f959"><code>808b75a</code></a>
ci: Update codegen job</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/46774e09313d4601c23f77da0b078c914194c152"><code>46774e0</code></a>
channel: Document that send_timeout sends an available message even if
the ti...</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/89a3fe4025857397a1adfc954957687d4dce9c93"><code>89a3fe4</code></a>
epoch: Make Shared::null const</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/383d74adcda222f99d54b4e80b55cce6bf30f142"><code>383d74a</code></a>
Use *::MAX associated constants</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/a30b825e6de35ecc4762a55656f63b4dbf4ccb8a"><code>a30b825</code></a>
channel,deque,queue: Use AtomicU64/u64 in head/tail index if
available</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/a0e4d2929e4bf670bf05aad548880656e187a51e"><code>a0e4d29</code></a>
Replace iterative capacity growth with <code>next_power_of_two</code>
(<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1216">#1216</a>)</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/94f74d26240f5d49e61d56ac10111e6527dbcfe6"><code>94f74d2</code></a>
Recognize x86_64-unknown-linux-gnutsan in build script</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/30e5963e4c0a9fc6626bd6417528c4f621e3838e"><code>30e5963</code></a>
epoch: Add missing fence emulation for tsan</li>
<li><a
href="https://github.com/crossbeam-rs/crossbeam/commit/708a6bd582d1ee482183e186e98527b41bffe565"><code>708a6bd</code></a>
Handle overflow in bounded channel/queue initialization (<a
href="https://redirect.github.com/crossbeam-rs/crossbeam/issues/1301">#1301</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/crossbeam-rs/crossbeam/compare/crossbeam-channel-0.5.16...crossbeam-channel-0.5.17">compare
view</a></li>
</ul>
</details>
<br />

Updates `flate2` from 1.1.9 to 1.1.10
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/flate2-rs/releases">flate2's
releases</a>.</em></p>
<blockquote>
<h2>1.1.10</h2>
<h2>What's Changed</h2>
<ul>
<li>feat: reuse zlib's decoder buffer by <a
href="https://github.com/Vaiz"><code>@​Vaiz</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/532">rust-lang/flate2-rs#532</a></li>
<li>feat: add reset method for read::GzDecoder and buffered::GzDecoder
by <a href="https://github.com/Vaiz"><code>@​Vaiz</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/534">rust-lang/flate2-rs#534</a></li>
<li>Drop cloudflare-zlib by <a
href="https://github.com/kornelski"><code>@​kornelski</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/539">rust-lang/flate2-rs#539</a></li>
<li>Add a wrapper for the <code>Crc</code> struct by <a
href="https://github.com/MikkelPaulson"><code>@​MikkelPaulson</code></a>
in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/540">rust-lang/flate2-rs#540</a></li>
<li>Bump miniz_oxide to 0.9 by <a
href="https://github.com/oscargus"><code>@​oscargus</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/543">rust-lang/flate2-rs#543</a></li>
<li>Upgrade miniz_oxide and add unit tests of the different flush kinds
by <a href="https://github.com/fintelia"><code>@​fintelia</code></a> in
<a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/498">rust-lang/flate2-rs#498</a></li>
<li>Fix infinite loop in writing gzip header/footer by <a
href="https://github.com/Shnatsel"><code>@​Shnatsel</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/547">rust-lang/flate2-rs#547</a></li>
<li>test: generate corrupt gzip fixture at runtime by <a
href="https://github.com/nanookclaw"><code>@​nanookclaw</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/550">rust-lang/flate2-rs#550</a></li>
<li>Reject oversized gzip extra fields by <a
href="https://github.com/Byron"><code>@​Byron</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/553">rust-lang/flate2-rs#553</a></li>
<li>Reject incomplete deflate streams at EOF by <a
href="https://github.com/Guflly"><code>@​Guflly</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/556">rust-lang/flate2-rs#556</a></li>
<li>Include <code>README.md</code> in a private module by <a
href="https://github.com/bushrat011899"><code>@​bushrat011899</code></a>
in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/562">rust-lang/flate2-rs#562</a></li>
<li>Add <code>no_std</code> support using nightly <code>alloc_io</code>
by <a
href="https://github.com/bushrat011899"><code>@​bushrat011899</code></a>
in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/559">rust-lang/flate2-rs#559</a></li>
<li>Update <code>get_mut()</code> documentation to make clear how
'inner` can be used by <a
href="https://github.com/Byron"><code>@​Byron</code></a> in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/558">rust-lang/flate2-rs#558</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Vaiz"><code>@​Vaiz</code></a> made their
first contribution in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/532">rust-lang/flate2-rs#532</a></li>
<li><a
href="https://github.com/MikkelPaulson"><code>@​MikkelPaulson</code></a>
made their first contribution in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/540">rust-lang/flate2-rs#540</a></li>
<li><a href="https://github.com/oscargus"><code>@​oscargus</code></a>
made their first contribution in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/543">rust-lang/flate2-rs#543</a></li>
<li><a
href="https://github.com/nanookclaw"><code>@​nanookclaw</code></a> made
their first contribution in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/550">rust-lang/flate2-rs#550</a></li>
<li><a href="https://github.com/Guflly"><code>@​Guflly</code></a> made
their first contribution in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/556">rust-lang/flate2-rs#556</a></li>
<li><a
href="https://github.com/bushrat011899"><code>@​bushrat011899</code></a>
made their first contribution in <a
href="https://redirect.github.com/rust-lang/flate2-rs/pull/562">rust-lang/flate2-rs#562</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10">https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/ed93d4fc60eaf876c6aded741bf992d524551930"><code>ed93d4f</code></a>
Merge pull request <a
href="https://redirect.github.com/rust-lang/flate2-rs/issues/558">#558</a>
from rust-lang/lib-doc-update</li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/fb5228dcd7ca7f4ffb2240e6aec8547b85064c9a"><code>fb5228d</code></a>
Merge pull request <a
href="https://redirect.github.com/rust-lang/flate2-rs/issues/559">#559</a>
from bushrat011899/no_std</li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/6ed3ba32e321bd6865df6d4ec96d2550c11e50f0"><code>6ed3ba3</code></a>
Add executable <code>no_std</code> example</li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/faed8a04671a608efda8ae3520844889210ada95"><code>faed8a0</code></a>
Expand CI to test <code>no_std</code> compatibility and correctness</li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/2ba8e7e6663bb173782c2c96d1203bed098aadf3"><code>2ba8e7e</code></a>
Add unstable <code>no_std</code> support behind
<code>flate2_unstable_nightly_alloc_io</code></li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/3fe11268ccbb777e22a8352aa95307af72fa8ee9"><code>3fe1126</code></a>
Centralize usage of <code>std</code> for <code>error</code> and
<code>io</code></li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/98e313a26ff137b0d79eb55f192911c80862d6d5"><code>98e313a</code></a>
Add <code>GzHeader::mtime_as_duration</code></li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/064296528d679f3aef0ca11b8ca0e2cad21b283d"><code>0642965</code></a>
Switch to <code>core</code> implicit prelude and only use
<code>std</code> where required</li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/454a63ce8ac5891d938ecf372a537e17e5cae586"><code>454a63c</code></a>
Remove left-over <code>dbg!</code> statement</li>
<li><a
href="https://github.com/rust-lang/flate2-rs/commit/2a490b7df96326c34a8ea75b2930eab4851cac1e"><code>2a490b7</code></a>
Add <code>runtime_detection</code> feature</li>
<li>Additional commits viewable in <a
href="https://github.com/rust-lang/flate2-rs/compare/1.1.9...1.1.10">compare
view</a></li>
</ul>
</details>
<br />

Updates `futures` from 0.3.33 to 0.3.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/futures-rs/releases">futures's
releases</a>.</em></p>
<blockquote>
<h2>0.3.34</h2>
<ul>
<li>Preserve cloned waker identity. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3032">#3032</a>)</li>
<li>Updato <code>syn</code> to 3. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3028">#3028</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md">futures's
changelog</a>.</em></p>
<blockquote>
<h1>0.3.34 - 2026-08-11</h1>
<ul>
<li>Preserve cloned waker identity. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3032">#3032</a>)</li>
<li>Updato <code>syn</code> to 3. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3028">#3028</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/705e6b5c0f06535b1aac1cb1989a172b3d45be8c"><code>705e6b5</code></a>
Release 0.3.34</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/616dac7bf944ff9876b7f8b77b37c6224cbbb506"><code>616dac7</code></a>
compat: Inline RawWaker clone function</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/41763693ee6400e2a7931530790af6e1746eb1c6"><code>4176369</code></a>
Inline remaining RawWaker clone functions</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/f17a8957d9a25a2dd3c95b43f1c6caa108df6bcc"><code>f17a895</code></a>
Fix cloned FuturesUnordered waker identity</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/51d62ada9bb8eab06339475e0f1b19cfa41fb2d7"><code>51d62ad</code></a>
macro: bump <code>syn</code> to v3 (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3028">#3028</a>)</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/9e26177cf01155d57917ee943246d0c97843deed"><code>9e26177</code></a>
ci: Reduce timeout-minutes</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/b2d098331763fca9b0665f80bb31a66e3112a2cf"><code>b2d0983</code></a>
tsan: Enable Adaptive Delay</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/f733d0ea9fed49263203ae0a7cb6beb5fe1a04c4"><code>f733d0e</code></a>
Miri: Ignore compat tests</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/e5def2f60c7eb1e8e6b76da540e148cc7638b115"><code>e5def2f</code></a>
Rename default branch to main</li>
<li>See full diff in <a
href="https://github.com/rust-lang/futures-rs/compare/0.3.33...0.3.34">compare
view</a></li>
</ul>
</details>
<br />

Updates `futures-util` from 0.3.33 to 0.3.34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/futures-rs/releases">futures-util's
releases</a>.</em></p>
<blockquote>
<h2>0.3.34</h2>
<ul>
<li>Preserve cloned waker identity. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3032">#3032</a>)</li>
<li>Updato <code>syn</code> to 3. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3028">#3028</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/rust-lang/futures-rs/blob/main/CHANGELOG.md">futures-util's
changelog</a>.</em></p>
<blockquote>
<h1>0.3.34 - 2026-08-11</h1>
<ul>
<li>Preserve cloned waker identity. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3032">#3032</a>)</li>
<li>Updato <code>syn</code> to 3. (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3028">#3028</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/705e6b5c0f06535b1aac1cb1989a172b3d45be8c"><code>705e6b5</code></a>
Release 0.3.34</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/616dac7bf944ff9876b7f8b77b37c6224cbbb506"><code>616dac7</code></a>
compat: Inline RawWaker clone function</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/41763693ee6400e2a7931530790af6e1746eb1c6"><code>4176369</code></a>
Inline remaining RawWaker clone functions</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/f17a8957d9a25a2dd3c95b43f1c6caa108df6bcc"><code>f17a895</code></a>
Fix cloned FuturesUnordered waker identity</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/51d62ada9bb8eab06339475e0f1b19cfa41fb2d7"><code>51d62ad</code></a>
macro: bump <code>syn</code> to v3 (<a
href="https://redirect.github.com/rust-lang/futures-rs/issues/3028">#3028</a>)</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/9e26177cf01155d57917ee943246d0c97843deed"><code>9e26177</code></a>
ci: Reduce timeout-minutes</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/b2d098331763fca9b0665f80bb31a66e3112a2cf"><code>b2d0983</code></a>
tsan: Enable Adaptive Delay</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/f733d0ea9fed49263203ae0a7cb6beb5fe1a04c4"><code>f733d0e</code></a>
Miri: Ignore compat tests</li>
<li><a
href="https://github.com/rust-lang/futures-rs/commit/e5def2f60c7eb1e8e6b76da540e148cc7638b115"><code>e5def2f</code></a>
Rename default branch to main</li>
<li>See full diff in <a
href="https://github.com/rust-lang/futures-rs/compare/0.3.33...0.3.34">compare
view</a></li>
</ul>
</details>
<br />

Updates `headers` from 0.4.1 to 0.4.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hyperium/headers/commit/50bfa1e1a184a6328c108edabe3d1d347d3d0e27"><code>50bfa1e</code></a>
headers:0.4.2</li>
<li><a
href="https://github.com/hyperium/headers/commit/c3e009e89bde5e77e9d11df681f4b808067c3040"><code>c3e009e</code></a>
feat: add ETag::is_weak (<a
href="https://redirect.github.com/hyperium/headers/issues/228">#228</a>)</li>
<li><a
href="https://github.com/hyperium/headers/commit/e900f04aa329d3211c226dc2333fe37ec143d680"><code>e900f04</code></a>
Add FromIterator&lt;HeaderName&gt; to Vary header (<a
href="https://redirect.github.com/hyperium/headers/issues/223">#223</a>)</li>
<li><a
href="https://github.com/hyperium/headers/commit/be070e896d1d1056d0164b6aefb7c58b168698da"><code>be070e8</code></a>
doc: fix form url encoded header (<a
href="https://redirect.github.com/hyperium/headers/issues/225">#225</a>)</li>
<li><a
href="https://github.com/hyperium/headers/commit/04e44af42f0438cf9313b94a50df79e811a36c68"><code>04e44af</code></a>
increase MSRV to 1.57 to match <code>http</code> crate (<a
href="https://redirect.github.com/hyperium/headers/issues/224">#224</a>)</li>
<li><a
href="https://github.com/hyperium/headers/commit/de0b1a1e97d20f3667a346c4d5b5973d92ab58f9"><code>de0b1a1</code></a>
Use <code>&amp;[u8]::get</code> instead of <code>&amp;[u8]</code> to
avoid panic in basic auth (<a
href="https://redirect.github.com/hyperium/headers/issues/220">#220</a>)</li>
<li><a
href="https://github.com/hyperium/headers/commit/c91416787b689b6ad838d4579556e10fac474d14"><code>c914167</code></a>
chore: remove redundant word in comments (<a
href="https://redirect.github.com/hyperium/headers/issues/218">#218</a>)</li>
<li><a
href="https://github.com/hyperium/headers/commit/0a87dfcc05e6dadd6c38027ddf5d1e2b9a9d1815"><code>0a87dfc</code></a>
fix: handle quoted directives in Cache-Control header (<a
href="https://redirect.github.com/hyperium/headers/issues/216">#216</a>)</li>
<li>See full diff in <a
href="https://github.com/hyperium/headers/compare/headers-v0.4.1...headers-v0.4.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `hickory-resolver` from 0.26.1 to 0.26.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hickory-dns/hickory-dns/releases">hickory-resolver's
releases</a>.</em></p>
<blockquote>
<h2>v0.26.3</h2>
<p>This release fixes regressions introduced in v0.26.2 related to
DNSSEC verification, QUIC servers, HTTP/3 servers, and minimum
dependency versions.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix warnings (release/0.26) by <a
href="https://github.com/divergentdave"><code>@​divergentdave</code></a>
in <a
href="https://redirect.github.com/hickory-dns/hickory-dns/pull/3877">hickory-dns/hickory-dns#3877</a></li>
<li>resolver: use lenient resolv.conf parsing by <a
href="https://github.com/djc"><code>@​djc</code></a> in <a
href="https://redirect.github.com/hickory-dns/hickory-dns/pull/3879">hickory-dns/hickory-dns#3879</a></li>
<li>backport: Fix multi rrsig validation 0.26 by <a
href="https://github.com/MartB"><code>@​MartB</code></a> in <a
href="https://redirect.github.com/hickory-dns/hickory-dns/pull/3892">hickory-dns/hickory-dns#3892</a></li>
<li>Bump version to 0.26.3 by <a
href="https://github.com/djc"><code>@​djc</code></a> in <a
href="https://redirect.github.com/hickory-dns/hickory-dns/pull/3895">hickory-dns/hickory-dns#3895</a></li>
<li>Exclude accepting QUIC connections from timeouts - 0.26 branch by <a
href="https://github.com/divergentdave"><code>@​divergentdave</code></a>
in <a
href="https://redirect.github.com/hickory-dns/hickory-dns/pull/3906">hickory-dns/hickory-dns#3906</a></li>
<li>[0.26] net: fix insecure ancestor delegation by <a
href="https://github.com/djc"><code>@​djc</code></a> in <a
href="https://redirect.github.com/hickory-dns/hickory-dns/pull/3907">hickory-dns/hickory-dns#3907</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/hickory-dns/hickory-dns/compare/v0.26.2...v0.26.3">https://github.com/hickory-dns/hickory-dns/compare/v0.26.2...v0.26.3</a></p>
<h2>v0.26.2</h2>
<p>This release fixes a large number of security vulnerabilities. Most
of the issues were related to DNSSEC validation, denial of service and
resource consumption attacks, and reachable panics in parsers. Other
issues were related to UDP spoofing defenses, caching issues, and
general DNS protocol correctness issues.</p>
<p>This is our first post-vulnpocalypse release, and most of these
vulnerabilities were discovered through LLM-based workflows. The sheer
volume of reports has been a challenge for our volunteer
maintainers.</p>
<p>Resolved advisories:</p>
<ul>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2vgh-3wfw-qj7c">GHSA-2vgh-3wfw-qj7c</a>:
RRSIG Signer's Name not checked against the RRset's zone</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-57pw-897j-v4j6">GHSA-57pw-897j-v4j6</a>:
Improper check of signature validity of NSEC and NSEC3 records</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wjgj-fvg9-65w9">GHSA-wjgj-fvg9-65w9</a>:
DNSSEC validation ignores bogus records with a DNS class other than
IN</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-588m-chg6-8jqj">GHSA-588m-chg6-8jqj</a>:
Inverted NSEC3 comparison allows forgery of proofs of nonexistence</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-qw83-5pm2-ggp5">GHSA-qw83-5pm2-ggp5</a>:
DNSSEC nonexistence forgery via incorrect handling of wraparound NSEC
records</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3jvh-8vj5-65rq">GHSA-3jvh-8vj5-65rq</a>:
NSEC3 apex NODATA accepted as secure with no QNAME-matching NSEC3</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3r6v-f3jh-vvqm">GHSA-3r6v-f3jh-vvqm</a>:
ancestor-delegation NSEC accepted as proof of nonexistence below the
zone cut</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-624w-vvww-xvpw">GHSA-624w-vvww-xvpw</a>:
ancestor-delegation NSEC3 accepted as proof of nonexistence at and below
the zone cut</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-7php-9j59-g3ch">GHSA-7php-9j59-g3ch</a>:
DNSSEC validation is missing RFC 6840 §4.4 checks</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vrv5-968r-5ggm">GHSA-vrv5-968r-5ggm</a>:
DNSSEC validation accepts bogus positive response with wildcard
expansion</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-p2jv-r3m3-7wf4">GHSA-p2jv-r3m3-7wf4</a>:
Nonexistence proof forgery due to insufficient checks on NSEC3 record
names</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-86vr-jm6c-7cpg">GHSA-86vr-jm6c-7cpg</a>:
NSEC validator accepts NXDOMAIN for an empty non-terminal (ENT) that the
covering NSEC proves exists</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-8hq4-5836-w6q4">GHSA-8hq4-5836-w6q4</a>:
Server does not check validation status of SOA record in negative
responses</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-5j98-2g5x-46v6">GHSA-5j98-2g5x-46v6</a>:
Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC
validation failures</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-929p-gjf6-5hqj">GHSA-929p-gjf6-5hqj</a>:
DNSSEC validation accepts responses with the wrong RRset as a positive
answer</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-j2rc-wxwh-62g9">GHSA-j2rc-wxwh-62g9</a>:
<code>TrustAnchors</code> does not check name of DNSKEY</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-rx82-4p2j-j5cv">GHSA-rx82-4p2j-j5cv</a>:
<code>Name::hash</code> discards label boundaries;
<code>ValidationCacheKey(u64)</code> reuses the digest in
<code>Eq</code> implementation, leaking an Insecure DNSSEC verdict
across distinct owner names</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-2hxp-x833-73f7">GHSA-2hxp-x833-73f7</a>:
Hickory DNS recursor: ghost domain attack via child-side NS RRset
queries</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-x962-5xwx-fr8x">GHSA-x962-5xwx-fr8x</a>:
Unchecked subtraction in TSIG RDATA decoding panics when overflow checks
are enabled</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-wgfr-mphw-j5g4">GHSA-wgfr-mphw-j5g4</a>:
Panic in zone file parser for SVCB and HTTPS</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-hx8c-fjhc-hmf5">GHSA-hx8c-fjhc-hmf5</a>:
Panic in zone file parser for SVCB and HTTPS</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-4rph-pmrw-mwpw">GHSA-4rph-pmrw-mwpw</a>:
Zone file parser panics when parsing long lines</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-3w89-7rx5-hpwx">GHSA-3w89-7rx5-hpwx</a>:
Responses with QDCOUNT=0 bypass check for matching question section</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-vcjp-57rr-mpfw">GHSA-vcjp-57rr-mpfw</a>:
Out-of-bailiwick filtering is not applied to negative responses</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6w6g-hm98-mhgm">GHSA-6w6g-hm98-mhgm</a>:
Unbounded TC-retry loop in <code>NameServerPool::try_send</code>
(resource-exhaustion DoS)</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-cx5j-p54p-q756">GHSA-cx5j-p54p-q756</a>:
Cyclic sibling domain name server referrals without glue records cause
exponential upstream query amplification in the recursor</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-6h5c-jjg5-wj59">GHSA-6h5c-jjg5-wj59</a>:
Glueless-NS referral fan-out without per-query work budget</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-v44v-c8m4-gc43">GHSA-v44v-c8m4-gc43</a>:
Denial of service of client UDP connections via spoofed malformed
responses</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-67wc-6jq8-ghrc">GHSA-67wc-6jq8-ghrc</a>:
Remote memory-amplification DoS via attacker-controlled RR counts in DNS
message parsing</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/bd37cafbdd86112a6da32878f8c9bab22e14377e"><code>bd37caf</code></a>
net: require authenticated insecure-delegation proofs</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/5a79511809b03c06f47c29302c7c2d2b52649933"><code>5a79511</code></a>
Add conformance test for regression</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/c268442049d80d9bc693a619d206a35b0a60d732"><code>c268442</code></a>
net: fix ancestor delegation issues</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/9488e8e7af8123e7c006889c7782ea08b3c516a7"><code>9488e8e</code></a>
Exclude accepting QUIC connections from timeouts</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/4ad16c3b62743c79a5217b07b6f62eb0f1ac361a"><code>4ad16c3</code></a>
Bump version to 0.26.3</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/cfab55657609c57a10202ce3e270f79f8563ab61"><code>cfab556</code></a>
proto: ignore RRSIGs in DnssecSummary::from_records</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/819a6bc54031d9d4a8c8c3e296970a755914bc75"><code>819a6bc</code></a>
net: try every RRSIG before marking an RRset bogus</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/688231e504f1b0a3a99dcf3ee32238119b9f9d70"><code>688231e</code></a>
resolver: use lenient resolv.conf parsing</li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/ca5d1a1d4779fd57fbb4ef8bb6be88d7d8ae204c"><code>ca5d1a1</code></a>
resolver: Fix 'unused method' with features
<code>blocklist,tls-ring</code></li>
<li><a
href="https://github.com/hickory-dns/hickory-dns/commit/678b01bf5834e9b9338cac49a36db19430e01ae7"><code>678b01b</code></a>
Fix unnecessary qualification warning</li>
<li>Additional commits viewable in <a
href="https://github.com/hickory-dns/hickory-dns/compare/v0.26.1...v0.26.3">compare
view</a></li>
</ul>
</details>
<br />

Updates `hyper-util` from 0.1.20 to 0.1.21
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/hyperium/hyper-util/releases">hyper-util's
releases</a>.</em></p>
<blockquote>
<h2>v0.1.21</h2>
<h2>Additions</h2>
<ul>
<li>Add crate-level documentation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/327">#327</a>)</li>
<li>Add <code>client::legacy::Builder::http2_header_table_size()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_concurrent_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_local_error_reset_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/277">#277</a>)</li>
<li>Add <code>client::legacy::connect::HttpConnector::set_mark()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/303">#303</a>)</li>
<li>Add <code>rt::tracing::WithSpanExecutor&lt;E&gt;</code>,
<code>hyper_util::rt::tracing::CurrentSpanExecutor&lt;E&gt;</code>, and
<code>hyper_util::rt::tracing::MkSpanExecutor&lt;E, F&gt;</code>
executors. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/323">#323</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>Fix <code>client::legacy::Client</code> so that it properly
validates CONNECT responses. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/315">#315</a>)</li>
<li>Fix <code>client::legacy::Client</code> to cancel the idle interval
once its pool empties. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/292">#292</a>)</li>
<li>Fix <code>client::legacy::Client</code> to properly handle IPv6
addresses when using a SOCKS proxy. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)</li>
<li>Fix <code>client::pool::cache</code> to preserve readiness with
clones. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/297">#297</a>)</li>
<li>Fix <code>client::pool::cache</code> to wake its waiters in FIFO
order. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/298">#298</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to properly
handle cancellation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/299">#299</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to share errors
with all waiters. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/296">#296</a>)</li>
<li>Fix <code>client::proxy::matcher</code> handling for IP wildcards.
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/309">#309</a>)</li>
<li>The <code>tokio/net</code> feature is narrowed to the
<code>client-legacy</code> feature flag, from the <code>client</code>
feature flag. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/276">#276</a>)</li>
<li>Various fixes to the <code>client::legacy::Client</code>'s SOCKS
proxying. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/307">#307</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/308">#308</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/310">#310</a>)</li>
</ul>
<h2>Changes</h2>
<p>This release contains a minor behavioral change for users of the
<code>tracing</code>
feature flag to be aware of.</p>
<p>This feature flag was introduced in v0.1.11. When enabled,
<code>rt::TokioExecutor&lt;E&gt;</code> began propagating the currently
active <code>tracing::Span</code>
to spawned tasks when <code>hyper::rt::Executor::execute()</code> is
called. This caused
issues for some users, due to background tasks keeping a span open for
the
duration of a long-lived connection.</p>
<p>This behavior has now been removed from
<code>rt::TokioExecutor&lt;E&gt;</code>
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/322">#322</a>)
by default. A
collection of executor wrappers have been added to a new
<code>rt::tracing</code>
submodule, to provide facilities for instrumenting a client or server's
spawned
tasks. See the module-level documentation of <code>rt::tracing</code>
for more
information.</p>
<p>To temporarily preserve the previous
<code>rt::TokioExecutor&lt;E&gt;</code> span propagation
behavior, enable the <code>rt-tracing-exec-force</code> feature. Note
that this feature
flag will be removed in a future release.</p>
<p>This release bumps the minimal supported Rust version (MSRV) from
1.64 to 1.85.</p>
<p>This release bumps the rust edition from 2021 to 2024.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/hyperium/hyper-util/blob/master/CHANGELOG.md">hyper-util's
changelog</a>.</em></p>
<blockquote>
<h1>0.1.21 (2026-09-24)</h1>
<p>This release bumps the minimal supported Rust version (MSRV) from
1.64 to 1.85.</p>
<p>This release bumps the rust edition from 2021 to 2024.</p>
<h2>Additions</h2>
<ul>
<li>Add crate-level documentation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/327">#327</a>)</li>
<li>Add <code>client::legacy::Builder::http2_header_table_size()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_concurrent_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/274">#274</a>)</li>
<li>Add
<code>client::legacy::Builder::http2_max_local_error_reset_streams()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/277">#277</a>)</li>
<li>Add <code>client::legacy::connect::HttpConnector::set_mark()</code>
method. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/303">#303</a>)</li>
<li>Add <code>rt::tracing::WithSpanExecutor&lt;E&gt;</code>,
<code>hyper_util::rt::tracing::CurrentSpanExecutor&lt;E&gt;</code>, and
<code>hyper_util::rt::tracing::MkSpanExecutor&lt;E, F&gt;</code>
executors. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/323">#323</a>)</li>
</ul>
<h2>Fixes</h2>
<ul>
<li>Fix <code>client::legacy::Client</code> so that it properly
validates CONNECT responses. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/315">#315</a>)</li>
<li>Fix <code>client::legacy::Client</code> to cancel the idle interval
once its pool empties. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/292">#292</a>)</li>
<li>Fix <code>client::legacy::Client</code> to properly handle IPv6
addresses when using a SOCKS proxy. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)</li>
<li>Fix <code>client::pool::cache</code> to preserve readiness with
clones. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/297">#297</a>)</li>
<li>Fix <code>client::pool::cache</code> to wake its waiters in FIFO
order. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/298">#298</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to properly
handle cancellation. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/299">#299</a>)</li>
<li>Fix <code>client::pool::singleton::Singleton</code> to share errors
with all waiters. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/296">#296</a>)</li>
<li>Fix <code>client::proxy::matcher</code> handling for IP wildcards.
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/309">#309</a>)</li>
<li>The <code>tokio/net</code> feature is narrowed to the
<code>client-legacy</code> feature flag, from the <code>client</code>
feature flag. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/276">#276</a>)</li>
<li>Various fixes to the <code>client::legacy::Client</code>'s SOCKS
proxying. (<a
href="https://redirect.github.com/hyperium/hyper-util/pull/302">#302</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/307">#307</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/308">#308</a>)
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/310">#310</a>)</li>
</ul>
<h2>Changes</h2>
<p>This release contains a minor behavioral change for users of the
<code>tracing</code>
feature flag to be aware of.</p>
<p>This feature flag was introduced in v0.1.11. When enabled,
<code>rt::TokioExecutor&lt;E&gt;</code> began propagating the currently
active <code>tracing::Span</code>
to spawned tasks when <code>hyper::rt::Executor::execute()</code> is
called. This caused
issues for some users, due to background tasks keeping a span open for
the
duration of a long-lived connection.</p>
<p>This behavior has now been removed from
<code>rt::TokioExecutor&lt;E&gt;</code>
(<a
href="https://redirect.github.com/hyperium/hyper-util/pull/322">#322</a>)
by default. A
collection of executor wrappers have been added to a new
<code>rt::tracing</code>
submodule, to provide facilities for instrumenting a client or server's
spawned
tas...

_Description has been truncated_

Co-authored-by: Moritz Hoffmann <antiguru@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 Cargo.lock | 132 ++++++++++++++++++++++++++++-------------------------
 deny.toml  |   2 +
 2 files changed, 73 insertions(+), 61 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 866e8b65d53d6..90e4e2eb18941 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -229,7 +229,7 @@ dependencies = [
  "crc32fast",
  "digest 0.10.7",
  "log",
- "miniz_oxide",
+ "miniz_oxide 0.8.9",
  "num-bigint",
  "quad-rand",
  "rand 0.9.4",
@@ -864,13 +864,13 @@ checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
 
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -1728,7 +1728,7 @@ dependencies = [
  "addr2line",
  "cfg-if",
  "libc",
- "miniz_oxide",
+ "miniz_oxide 0.8.9",
  "object",
  "rustc-demangle",
  "windows-link 0.2.1",
@@ -2028,9 +2028,9 @@ dependencies = [
 
 [[package]]
 name = "buildid"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "834a85d2478807f41c43251c7ad226e1185bc34feb2133872f796a11b57155ae"
+checksum = "4b8e278b5bdc31756d01d65c17662e23692e0dbaa19e65adae9b58fc4683bc09"
 dependencies = [
  "cfg-if",
  "libc",
@@ -2209,9 +2209,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "cfg_aliases"
@@ -2323,9 +2323,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.3"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fb99565819980999fb7b4a1796046a5c949e6d4ff132cf5fadf5a641e20d776"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2333,9 +2333,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.2"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -2346,23 +2346,23 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.6.9"
+version = "4.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be2ad0423bdbbb0e25bc89add796f3559706d4a95e1bc98e4d9662a957b6a19"
+checksum = "037e2a1a92236d0aff7e845093f64661d6df4c02c9fcc61a60e9e1d736fa392f"
 dependencies = [
  "clap",
 ]
 
 [[package]]
 name = "clap_derive"
-version = "4.6.3"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32f2392eae7f16557a3d727ef3a12e57b2b2ca6f98566a5f4fb41ffe305df077"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2404,9 +2404,9 @@ checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "columnar"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94063ab5cdb61ed8e5a8294c3c7cc8466c1a9eafc7b9ca02b2a521ea06e52d92"
+checksum = "283ec011cb03e19e71ff8c57e8ae4e736687e16b9d7ad43c6c24bd4ac1da6252"
 dependencies = [
  "bytemuck",
  "columnar_derive",
@@ -2415,9 +2415,9 @@ dependencies = [
 
 [[package]]
 name = "columnar_derive"
-version = "0.13.0"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72c9c88441fb60d0d5d9e939b5765abdff87d1a4d4cc80a90e0f945a6711c438"
+checksum = "54a1d493d903c04df5d9b8fc9f5d1051dfad92664a9d56c39a2b08b68a276ea7"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2702,9 +2702,9 @@ dependencies = [
 
 [[package]]
 name = "crc32fast"
-version = "1.5.0"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
  "cfg-if",
 ]
@@ -2753,9 +2753,9 @@ checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
 [[package]]
 name = "crossbeam"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1137cd7e7fc0fb5d3c5a8678be38ec56e819125d8d7907411fe24ccb943faca8"
+checksum = "e71406cd8807725f7ac2f999a4cdd32e98f829fdf65f528343cebf945e41df1e"
 dependencies = [
  "crossbeam-channel",
  "crossbeam-deque",
@@ -2766,9 +2766,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.16"
+version = "0.5.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -3453,7 +3453,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4036,13 +4036,13 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
  "libz-sys",
- "miniz_oxide",
+ "miniz_oxide 0.9.1",
  "zlib-rs",
 ]
 
@@ -4121,9 +4121,9 @@ checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 
 [[package]]
 name = "futures"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4152,9 +4152,9 @@ checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -4197,13 +4197,13 @@ dependencies = [
 
 [[package]]
 name = "futures-macro"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -4226,9 +4226,9 @@ checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
 
 [[package]]
 name = "futures-util"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -4561,9 +4561,9 @@ dependencies = [
 
 [[package]]
 name = "headers"
-version = "0.4.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3314d5adb5d94bcdf56771f2e50dbbc80bb4bdf88967526706205ac9eff24eb"
+checksum = "fc2700e3fe555c3310aa7286cac6167449f2c87e0eb58769c9208a1c58a1d106"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -4618,9 +4618,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-net"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
+checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d"
 dependencies = [
  "async-trait",
  "cfg-if",
@@ -4642,9 +4642,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-proto"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
+checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d"
 dependencies = [
  "data-encoding",
  "idna",
@@ -4662,9 +4662,9 @@ dependencies = [
 
 [[package]]
 name = "hickory-resolver"
-version = "0.26.1"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c"
+checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -4963,16 +4963,17 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http 1.4.2",
  "http-body 1.0.1",
+ "httparse",
  "hyper 1.9.0",
  "ipnet",
  "libc",
@@ -5199,7 +5200,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
+ "hashbrown 0.15.3",
  "serde",
  "serde_core",
 ]
@@ -5284,9 +5285,9 @@ dependencies = [
 
 [[package]]
 name = "ipnet"
-version = "2.12.1"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a756c3fac73139e83f14c2d742155dd2b78d3ee56597b419a0579b7bdd6dd78"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 dependencies = [
  "serde",
 ]
@@ -5308,7 +5309,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6252,6 +6253,15 @@ name = "miniz_oxide"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
 dependencies = [
  "adler2",
  "simd-adler32",
@@ -11469,7 +11479,7 @@ dependencies = [
  "once_cell",
  "socket2 0.6.5",
  "tracing",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -12341,7 +12351,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -12400,7 +12410,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -13564,7 +13574,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -13583,7 +13593,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.61.1",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/deny.toml b/deny.toml
index 8e7fdb27d523f..fe99f84c46bd2 100644
--- a/deny.toml
+++ b/deny.toml
@@ -114,6 +114,8 @@ skip = [
     { name = "zip", version = "6.0.0" },
     # aws-sdk-s3 is on 0.18, while launchdarkly-server-sdk, mysql_async, and mz-frontegg-auth still use 0.16.
     { name = "lru", version = "0.16.3" },
+    # flate2 is on 0.9, while apache-avro and backtrace still pull 0.8.
+    { name = "miniz_oxide", version = "0.8.9" },
     # Used by azure_core
     { name = "quick-xml", version = "0.31.0" },
     # reqsign-aws (via iceberg) is ahead of opendal, which pulls 0.39.

From 09aad5c9cbf03019b2e24a7e08e3bff0ca2d5ce6 Mon Sep 17 00:00:00 2001
From: Bobby Iliev <bobby@bobbyiliev.com>
Date: Mon, 28 Sep 2026 18:01:24 +0300
Subject: [PATCH 92/94] doc: rename the materialize-docs agent skill to mz-docs
 (DEX-144) (#39130)

Follow-up to #39117 and agent-skills #68, which renamed every skill to
the `mz-` prefix except `materialize-docs`. This is the materialize side
of that rename: the Hugo template that writes the skill's frontmatter
name, the default output directory of `bin/gen-claude-skill`, the
`--skill` installs in `bin/claude-builder`, `bin/codex-builder` and
`scratch.py`, and the two docs pages. The agent-skills side (directory,
update workflow, plugin manifest) is MaterializeInc/agent-skills#74; the
next skill update run regenerates it under the new name once both are
in.

### Release note

Renamed the `materialize-docs` agent skill to `mz-docs`, matching the
other skills. If you installed it with `npx skills`, remove the old copy
with `npx skills remove materialize-docs` and run `npx skills add
MaterializeInc/agent-skills` again.
---
 bin/claude-builder                            |  4 ++--
 bin/codex-builder                             |  4 ++--
 bin/gen-claude-skill                          |  4 ++--
 .../mcp-server/coding-agent-skills.md         | 19 ++++++++++---------
 .../content/headless/agent-skills-table.md    |  2 +-
 doc/user/layouts/index.skill.md               |  2 +-
 misc/python/materialize/scratch.py            |  6 +++---
 7 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/bin/claude-builder b/bin/claude-builder
index eed6d0934a17d..864602db9cd38 100755
--- a/bin/claude-builder
+++ b/bin/claude-builder
@@ -20,8 +20,8 @@ set -euo pipefail
 "$(dirname "$0")"/ci-builder run stable --no-secrets bash -lc '
     export HOME=/tmp
     export NPM_CONFIG_UPDATE_NOTIFIER=false npm_config_update_notifier=false NO_UPDATE_NOTIFIER=1
-    if [ ! -e "/tmp/.claude/skills/materialize-docs" ]; then
-        (npx -q -y skills add MaterializeInc/agent-skills -g -a claude-code --copy -y --skill materialize-docs) >/dev/null 2>&1 || true
+    if [ ! -e "/tmp/.claude/skills/mz-docs" ]; then
+        (npx -q -y skills add MaterializeInc/agent-skills -g -a claude-code --copy -y --skill mz-docs) >/dev/null 2>&1 || true
     fi
     exec npx -q -y @anthropic-ai/claude-code@latest --dangerously-skip-permissions "$@"
 ' -- "$@"
diff --git a/bin/codex-builder b/bin/codex-builder
index 414903b33dc99..5ee002961f80e 100755
--- a/bin/codex-builder
+++ b/bin/codex-builder
@@ -20,8 +20,8 @@ set -euo pipefail
 "$(dirname "$0")"/ci-builder run stable --no-secrets bash -lc '
     export HOME=/tmp
     export NPM_CONFIG_UPDATE_NOTIFIER=false npm_config_update_notifier=false NO_UPDATE_NOTIFIER=1
-    if [ ! -e "/tmp/.codex/skills/materialize-docs" ]; then
-        (npx -q -y skills add MaterializeInc/agent-skills -g -a codex --copy -y --skill materialize-docs) >/dev/null 2>&1 || true
+    if [ ! -e "/tmp/.codex/skills/mz-docs" ]; then
+        (npx -q -y skills add MaterializeInc/agent-skills -g -a codex --copy -y --skill mz-docs) >/dev/null 2>&1 || true
     fi
     exec npx -q -y @openai/codex@latest --dangerously-bypass-approvals-and-sandbox "$@"
 ' -- "$@"
diff --git a/bin/gen-claude-skill b/bin/gen-claude-skill
index e133413276376..4625d4e745ccb 100755
--- a/bin/gen-claude-skill
+++ b/bin/gen-claude-skill
@@ -16,7 +16,7 @@
 #
 # Arguments: OUTPUT_DIR  Directory to output the skill files. The OUTPUT_DIR
 #   directory is cleaned before generation.
-#   Default: .agents/skills/materialize-docs.
+#   Default: .agents/skills/mz-docs.
 #   For publishing to the website,
 #   we will output to doc/user/public/markdown-docs directory.
 #
@@ -30,7 +30,7 @@ cd "$(dirname "$0")/.."
 
 # For publishing to the website, we will output to doc/user/public/markdown-docs
 # directory. The OUTPUT_DIR directory is cleaned before generation.
-OUTPUT_DIR="${1:-.agents/skills/materialize-docs}"
+OUTPUT_DIR="${1:-.agents/skills/mz-docs}"
 
 # Ensure output directory exists
 mkdir -p "$OUTPUT_DIR"
diff --git a/doc/user/content/developer-tools/mcp-server/coding-agent-skills.md b/doc/user/content/developer-tools/mcp-server/coding-agent-skills.md
index 9e45cb25c6822..bde6a4ad3b7a9 100644
--- a/doc/user/content/developer-tools/mcp-server/coding-agent-skills.md
+++ b/doc/user/content/developer-tools/mcp-server/coding-agent-skills.md
@@ -40,11 +40,12 @@ When you install the skills as a plugin, they are namespaced under the plugin
 name, for example `materialize:mz-dbt`.
 
 If you already installed the skills with `npx skills`, remove them before you
-install the plugin. Run this in each project where you installed them, or add
-`-g` if you installed them globally:
+install the plugin. The command lists both the current and the previous skill
+names, and skips any you don't have. Run it in each project where you installed
+them, or add `-g` if you installed them globally:
 
 ```bash
-npx skills remove materialize-docs mz-dbt mz-debug-freshness mz-deploy mz-health-check mz-ontology-design mz-optimize-memory mz-terraform-provider mz-terraform-self-managed
+npx skills remove mz-docs mz-dbt mz-debug-freshness mz-deploy mz-health-check mz-ontology-design mz-optimize-memory mz-terraform-provider mz-terraform-self-managed materialize-docs materialize-dbt materialize-debug-freshness materialize-terraform-provider materialize-terraform-self-managed mcp-developer-analysis
 ```
 
 #### Claude Code
@@ -114,15 +115,15 @@ npx skills update
 
 #### Migrate from the previous skill names
 
-Most skills now use the `mz-` prefix, and `mcp-developer-analysis` is now
-`mz-health-check`. `materialize-docs` keeps its name. If you installed the
+All skills now use the `mz-` prefix: `materialize-docs` is now `mz-docs`, and
+`mcp-developer-analysis` is now `mz-health-check`. If you installed the
 skills before the rename, remove the old copies and install the skills again,
 so each skill appears once under its new name. Run these in each project where
 you installed them, or add `-g` to both commands if you installed them
 globally:
 
 ```bash
-npx skills remove materialize-dbt materialize-debug-freshness materialize-terraform-provider materialize-terraform-self-managed mcp-developer-analysis
+npx skills remove materialize-docs materialize-dbt materialize-debug-freshness materialize-terraform-provider materialize-terraform-self-managed mcp-developer-analysis
 npx skills add MaterializeInc/agent-skills
 ```
 
@@ -143,7 +144,7 @@ installation and configuration.
 ## Reduce permission prompts (Claude Code)
 
 Claude Code prompts before reading files outside your project, so it may ask
-to approve reads each time the `materialize-docs` skill opens a new
+to approve reads each time the `mz-docs` skill opens a new
 documentation subdirectory. To stop these prompts, grant read access to the
 directory where the skill is installed in `~/.claude/settings.json`.
 
@@ -160,13 +161,13 @@ update, so grant the parent:
 ```
 
 If you installed the skills globally [with `npx skills`](#install-with-npx),
-they live under `~/.claude/skills/`. Grant the `materialize-docs` skill's
+they live under `~/.claude/skills/`. Grant the `mz-docs` skill's
 directory:
 
 ```json
 {
   "permissions": {
-    "additionalDirectories": ["~/.claude/skills/materialize-docs"]
+    "additionalDirectories": ["~/.claude/skills/mz-docs"]
   }
 }
 ```
diff --git a/doc/user/content/headless/agent-skills-table.md b/doc/user/content/headless/agent-skills-table.md
index 897a417fc8a76..4af3ecaf40235 100644
--- a/doc/user/content/headless/agent-skills-table.md
+++ b/doc/user/content/headless/agent-skills-table.md
@@ -6,7 +6,7 @@ headless: true
 | `mz-health-check` | Use for operational introspection and troubleshooting via the `materialize-developer` server. Covers exact catalog schemas, diagnostic workflows, remediation runbooks, and guardrails for known pitfalls (cluster-scoped queries, uint8 ID mismatches, etc.).<br><br>Examples: *"why is my materialized view stale?"*, *"what can I optimize to save costs?"*, *"is my source healthy?"* |
 | `mz-debug-freshness` | Use for diagnosing why an object is behind wall-clock time, from the lag ranking down to the operator and the SQL responsible; pairs with the `materialize-developer` server. Covers reading `mz_wallclock_global_lag` as a distribution, the status sweep that catches a stalled source whose frontier still looks current, lag history, hop-by-hop attribution through `mz_materialization_lag`, hydration and replica selection before `EXPLAIN ANALYZE`, per-operator cost and worker skew, and mapping an operator back to the clause that produced it. Diagnosis only, not remediation.<br><br>Examples: *"which object is causing my freshness alert?"*, *"is this delay ingestion or compute?"*, *"why is this dataflow falling behind its input?"* |
 | `mz-optimize-memory` | Use for reducing the memory footprint and cost of a compute cluster; works over SQL or the `materialize-developer` MCP server. Covers finding which objects hold the memory, choosing and sizing the fix (indexes to add or drop, `GROUP SIZE` hints, slimmer views, subquery rewrites), verifying each change by measurement on an experiment cluster, and sizing the replica afterwards.<br><br>Examples: *"why is this cluster using so much memory?"*, *"can I downsize this replica?"*, *"which of these indexes should I drop?"* |
-| `materialize-docs` | Use for authoring view definitions, learning concepts, and looking up patterns; useful with either MCP server. Covers comprehensive Materialize documentation, including SQL syntax, idiomatic patterns, data ingestion, concepts, and best practices (400+ reference files).<br><br>Examples: *"show me how to deduplicate a stream"*, *"what's the idiomatic top-K pattern?"*, *"how do I create a Kafka source?"* |
+| `mz-docs` | Use for authoring view definitions, learning concepts, and looking up patterns; useful with either MCP server. Covers comprehensive Materialize documentation, including SQL syntax, idiomatic patterns, data ingestion, concepts, and best practices (400+ reference files).<br><br>Examples: *"show me how to deduplicate a stream"*, *"what's the idiomatic top-K pattern?"*, *"how do I create a Kafka source?"* |
 | `mz-dbt` | Use for managing Materialize pipelines with dbt. Covers dbt-materialize adapter usage: materializations, profile configuration, index creation, blue/green deployments, and testing.<br><br>Examples: *"write a dbt model for a materialized view"*, *"how do I do a blue/green deployment with dbt?"* |
 | `mz-terraform-provider` | Use for managing Materialize resources declaratively with Terraform. Covers provider configuration for Cloud and self-managed, navigation into the provider's auto-generated resource reference, cross-resource patterns, import workflows, and gotchas.<br><br>Examples: *"create a Kafka source with Terraform"*, *"import my existing clusters into Terraform state"*, *"set up RBAC grants in Terraform"* |
 | `mz-terraform-self-managed` | Use for deploying or operating self-managed Materialize infrastructure with Terraform. Covers module layout and variables for deploying on AWS, Azure, and GCP: networking, Kubernetes, backend URL formats, instance sizing, upgrades, and gotchas.<br><br>Examples: *"deploy Materialize on EKS"*, *"what instance types should Materialize nodes use?"*, *"upgrade my self-managed Materialize"* |
diff --git a/doc/user/layouts/index.skill.md b/doc/user/layouts/index.skill.md
index 097e604180c05..1b14ee05b16e8 100644
--- a/doc/user/layouts/index.skill.md
+++ b/doc/user/layouts/index.skill.md
@@ -1,6 +1,6 @@
 {{- /* Home page template - generates SKILL.md for Claude */ -}}
 ---
-name: materialize-docs
+name: mz-docs
 description: Materialize documentation for SQL syntax, data ingestion, concepts, and best practices. Use when users ask about Materialize queries, sources, sinks, views, or clusters.
 ---
 
diff --git a/misc/python/materialize/scratch.py b/misc/python/materialize/scratch.py
index 3e824165e1083..94b23caa5dbef 100644
--- a/misc/python/materialize/scratch.py
+++ b/misc/python/materialize/scratch.py
@@ -274,7 +274,7 @@ def msftp(
 
 def setup_ai_tools(instance: Instance) -> None:
     """Transfer local Claude Code and Codex configs to a scratch instance
-    and install the materialize-docs skill."""
+    and install the mz-docs skill."""
     import io
     import pathlib
     import tarfile
@@ -323,7 +323,7 @@ def setup_ai_tools(instance: Instance) -> None:
         instance,
         "cd materialize && "
         "NPM_CONFIG_UPDATE_NOTIFIER=false "
-        "npx -q -y skills add MaterializeInc/agent-skills -g -a claude-code --copy -y --skill materialize-docs 2>/dev/null || true",
+        "npx -q -y skills add MaterializeInc/agent-skills -g -a claude-code --copy -y --skill mz-docs 2>/dev/null || true",
         quiet=True,
     )
 
@@ -331,7 +331,7 @@ def setup_ai_tools(instance: Instance) -> None:
         instance,
         "cd materialize && "
         "NPM_CONFIG_UPDATE_NOTIFIER=false "
-        "npx -q -y skills add MaterializeInc/agent-skills -g -a codex --copy -y --skill materialize-docs 2>/dev/null || true",
+        "npx -q -y skills add MaterializeInc/agent-skills -g -a codex --copy -y --skill mz-docs 2>/dev/null || true",
         quiet=True,
     )
 

From 3fbd0db9c893728689fb0abe7ab20916a72e1d6d Mon Sep 17 00:00:00 2001
From: Moritz Hoffmann <antiguru@gmail.com>
Date: Mon, 28 Sep 2026 17:03:48 +0200
Subject: [PATCH 93/94] expr: move catalog decoders into mz-catalog-decode
 (#39177)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `mz_internal.parse_*` functions behind the builtin catalog views
decode `create_sql` strings and durable catalog JSON. That logic copies
formats owned by the catalog, planner, storage and audit log crates, and
isn't scalar-function machinery. This moves it into a new leaf crate,
`mz-catalog-decode`, which sits below `mz-expr`.

### Description

The ten functions stay `UnaryFunc` variants because they run in
dataflows. Their `#[sqlfunc]` wrappers now live in
`mz_expr::scalar::func::impls::catalog` and just call the crate and map
its `String` errors to `EvalError::InvalidCatalogJson`. The crate has
three modules: `create_sql`, `durable` (ids, privileges, ACL modes) and
`audit_log`.

The move doesn't change behavior. Helpers that were copied between
functions are now shared. The unit tests moved with the code.

Registry: `func_registry_source.json` has new body fingerprints for the
ten functions. No properties changed and results are unchanged. The
current `LIR_VERSION` hasn't shipped, so the snapshots were regenerated
in place. From now on, the fingerprints cover only the wrappers, so a
change to the decode logic no longer shows up in the registry.

The new crate is added to CODEOWNERS under `@MaterializeInc/adapter`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01MqGijGQbYPwo6RjEuEcoEx

---
_Generated by [Claude
Code](https://claude.ai/code/session_01MqGijGQbYPwo6RjEuEcoEx)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/CODEOWNERS                            |    1 +
 Cargo.lock                                    |   14 +
 Cargo.toml                                    |    2 +
 src/audit-log/src/lib.rs                      |    2 +-
 src/catalog-decode/Cargo.toml                 |   25 +
 .../src/audit_log.rs}                         |   62 +-
 src/catalog-decode/src/create_sql.rs          | 1960 +++++++++++++++
 src/catalog-decode/src/durable.rs             |  146 ++
 src/catalog-decode/src/lib.rs                 |   22 +
 .../tests/snapshots/func_registry_source.json |   20 +-
 src/expr/Cargo.toml                           |    1 +
 src/expr/src/scalar/func/impls.rs             |    4 +-
 src/expr/src/scalar/func/impls/catalog.rs     |   95 +
 src/expr/src/scalar/func/impls/jsonb.rs       | 2212 +----------------
 test/sqllogictest/mz_aws_connections.slt      |    2 +-
 test/sqllogictest/mz_kafka_connections.slt    |    2 +-
 test/sqllogictest/mz_kafka_source_tables.slt  |    2 +-
 test/sqllogictest/mz_kafka_sources.slt        |    2 +-
 test/sqllogictest/mz_mysql_source_tables.slt  |    2 +-
 .../mz_postgres_source_tables.slt             |    2 +-
 test/sqllogictest/mz_postgres_sources.slt     |    2 +-
 test/sqllogictest/mz_sinks.slt                |    2 +-
 .../mz_sql_server_source_tables.slt           |    2 +-
 .../mz_ssh_tunnel_connections.slt             |    2 +-
 test/sqllogictest/mz_tables.slt               |    2 +-
 test/sqllogictest/mz_views.slt                |    2 +-
 26 files changed, 2319 insertions(+), 2271 deletions(-)
 create mode 100644 src/catalog-decode/Cargo.toml
 rename src/{expr/src/scalar/func/impls/audit_log_details.rs => catalog-decode/src/audit_log.rs} (95%)
 create mode 100644 src/catalog-decode/src/create_sql.rs
 create mode 100644 src/catalog-decode/src/durable.rs
 create mode 100644 src/catalog-decode/src/lib.rs
 create mode 100644 src/expr/src/scalar/func/impls/catalog.rs

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 8eedc3a4504e8..ddc82382e03b7 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -54,6 +54,7 @@
 /src/build-info                     @MaterializeInc/testing @SangJunBak @DAlperin
 /src/catalog                        @MaterializeInc/adapter
 /src/catalog-debug                  @MaterializeInc/adapter
+/src/catalog-decode                 @MaterializeInc/adapter
 /src/ccsr                           @MaterializeInc/adapter @MaterializeInc/cluster
 /src/cloud-resources                @MaterializeInc/cloud
 /src/cluster                        @MaterializeInc/cluster
diff --git a/Cargo.lock b/Cargo.lock
index 90e4e2eb18941..444d79c204057 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6852,6 +6852,19 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "mz-catalog-decode"
+version = "0.0.0"
+dependencies = [
+ "hex",
+ "mz-ore",
+ "mz-repr",
+ "mz-sql-parser",
+ "prost",
+ "serde_json",
+ "tracing",
+]
+
 [[package]]
 name = "mz-catalog-protos"
 version = "0.0.0"
@@ -7531,6 +7544,7 @@ dependencies = [
  "md-5 0.10.6",
  "murmur2",
  "mz-build-tools",
+ "mz-catalog-decode",
  "mz-expr",
  "mz-expr-derive",
  "mz-expr-derive-impl",
diff --git a/Cargo.toml b/Cargo.toml
index 538bf8da78e7b..26e6aa42c64d9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,6 +16,7 @@ members = [
     "src/build-info",
     "src/build-tools",
     "src/catalog",
+    "src/catalog-decode",
     "src/catalog-debug",
     "src/catalog-protos",
     "src/ccsr",
@@ -143,6 +144,7 @@ default-members = [
     "src/build-info",
     "src/build-tools",
     "src/catalog",
+    "src/catalog-decode",
     "src/catalog-debug",
     "src/catalog-protos",
     "src/ccsr",
diff --git a/src/audit-log/src/lib.rs b/src/audit-log/src/lib.rs
index 0a0b202704a53..1d63b647128ea 100644
--- a/src/audit-log/src/lib.rs
+++ b/src/audit-log/src/lib.rs
@@ -25,7 +25,7 @@
 //! `mz_catalog.mz_audit_events.details` exposes. The durable catalog stores
 //! the proto twin from `mz_catalog_protos::objects::audit_log_event_v1`,
 //! which `parse_catalog_audit_log_details` (in
-//! `src/expr/src/scalar/func/impls/jsonb.rs`) reshapes back into
+//! `src/catalog-decode/src/audit_log.rs`) reshapes back into
 //! `as_json`'s output. Changes here that shift that output (new variants,
 //! renamed fields, added `skip_serializing_if`, field-name diffs against
 //! the proto) need matching updates there. The round-trip is covered by
diff --git a/src/catalog-decode/Cargo.toml b/src/catalog-decode/Cargo.toml
new file mode 100644
index 0000000000000..118c25f517b4e
--- /dev/null
+++ b/src/catalog-decode/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "mz-catalog-decode"
+description = "Decoders for durable catalog data, backing the catalog-raw SQL functions."
+version = "0.0.0"
+edition.workspace = true
+rust-version.workspace = true
+publish = false
+
+[lints]
+workspace = true
+
+[dependencies]
+hex.workspace = true
+mz-ore = { path = "../ore", features = ["assert"] }
+mz-repr = { path = "../repr" }
+mz-sql-parser = { path = "../sql-parser" }
+prost.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+
+[dev-dependencies]
+mz-ore = { path = "../ore", features = ["test"] }
+
+[features]
+default = []
diff --git a/src/expr/src/scalar/func/impls/audit_log_details.rs b/src/catalog-decode/src/audit_log.rs
similarity index 95%
rename from src/expr/src/scalar/func/impls/audit_log_details.rs
rename to src/catalog-decode/src/audit_log.rs
index 1692460f730b0..54ae6c002c6e7 100644
--- a/src/expr/src/scalar/func/impls/audit_log_details.rs
+++ b/src/catalog-decode/src/audit_log.rs
@@ -26,12 +26,9 @@
 //! variant and catches drift when either side gains a new variant, field,
 //! or serde attribute.
 
-use mz_expr_derive::sqlfunc;
 use mz_repr::adt::jsonb::{Jsonb, JsonbRef};
 use mz_repr::{Datum, Row, RowPacker};
 
-use crate::EvalError;
-
 /// Reshapes proto `audit_log_event_v1::Details` JSON from `mz_catalog_raw`
 /// (e.g. `{"IdFullNameV1": {"id": "u1", "name": {...}}}`) into the shape
 /// `mz_audit_log::EventDetails::as_json` produces: the format the prior
@@ -40,8 +37,7 @@ use crate::EvalError;
 /// See the module docstring for the mechanism and the reciprocal side. Rule
 /// changes must be paired with tests; the property test at
 /// `src/catalog/tests/audit_log_details.rs` is the safety net.
-#[sqlfunc]
-fn parse_catalog_audit_log_details<'a>(a: JsonbRef<'a>) -> Result<Jsonb, EvalError> {
+pub fn details(a: JsonbRef<'_>) -> Result<Jsonb, String> {
     /// `(variant, path, field, sub_variant)`: `#[serde(flatten)]` sites.
     /// `sub_variant` sets the context for rules on the hoisted content
     /// when the flattened struct itself has a `#[serde(flatten)]`.
@@ -472,43 +468,39 @@ fn parse_catalog_audit_log_details<'a>(a: JsonbRef<'a>) -> Result<Jsonb, EvalErr
         Ok(entries)
     }
 
-    let parse = || -> Result<Jsonb, String> {
-        let Datum::Map(dict) = a.into_datum() else {
-            return Err("expected object".into());
-        };
-        let mut iter = dict.iter();
-        let (variant, inner) = iter
-            .next()
-            .ok_or_else(|| "empty details enum".to_string())?;
-        if iter.next().is_some() {
-            return Err("details enum had multiple keys".into());
-        }
-        let mut row = Row::default();
-        // `ResetAllV1` is the only variant `as_json` maps to null (the
-        // proto `Empty` payload serializes to `{}`).
-        if variant == "ResetAllV1" {
-            row.packer().push(Datum::JsonNull);
-            return Ok(Jsonb::from_row(row));
-        }
-        let Datum::Map(_) = inner else {
-            return Err(format!("expected inner object for variant {variant}"));
-        };
-        rewrite(inner, variant, "", &mut row.packer())?;
-        Ok(Jsonb::from_row(row))
+    let Datum::Map(dict) = a.into_datum() else {
+        return Err("expected object".into());
     };
-
-    parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))
+    let mut iter = dict.iter();
+    let (variant, inner) = iter
+        .next()
+        .ok_or_else(|| "empty details enum".to_string())?;
+    if iter.next().is_some() {
+        return Err("details enum had multiple keys".into());
+    }
+    let mut row = Row::default();
+    // `ResetAllV1` is the only variant `as_json` maps to null (the
+    // proto `Empty` payload serializes to `{}`).
+    if variant == "ResetAllV1" {
+        row.packer().push(Datum::JsonNull);
+        return Ok(Jsonb::from_row(row));
+    }
+    let Datum::Map(_) = inner else {
+        return Err(format!("expected inner object for variant {variant}"));
+    };
+    rewrite(inner, variant, "", &mut row.packer())?;
+    Ok(Jsonb::from_row(row))
 }
 
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    /// Round-trip a JSON `input` through `parse_catalog_audit_log_details` and
+    /// Round-trip a JSON `input` through `details` and
     /// assert the resulting JSON parses equal to `expected`.
     fn check(input: &str, expected: &str) {
         let input: Jsonb = input.parse().expect("valid input JSONB");
-        let actual = parse_catalog_audit_log_details(input.as_ref())
+        let actual = details(input.as_ref())
             .expect("helper succeeded")
             .to_string();
         let actual_value: serde_json::Value =
@@ -518,11 +510,11 @@ mod tests {
         assert_eq!(actual_value, expected_value);
     }
 
-    /// Run `parse_catalog_audit_log_details` on `input` and assert it returns
-    /// a `InvalidCatalogJson` error containing `expected_substr`.
+    /// Run `details` on `input` and assert it returns an error containing
+    /// `expected_substr`.
     fn check_err(input: &str, expected_substr: &str) {
         let input: Jsonb = input.parse().expect("valid input JSONB");
-        let err = parse_catalog_audit_log_details(input.as_ref()).expect_err("helper should error");
+        let err = details(input.as_ref()).expect_err("helper should error");
         let msg = format!("{err:?}");
         assert!(
             msg.contains(expected_substr),
diff --git a/src/catalog-decode/src/create_sql.rs b/src/catalog-decode/src/create_sql.rs
new file mode 100644
index 0000000000000..e79c46cc20a64
--- /dev/null
+++ b/src/catalog-decode/src/create_sql.rs
@@ -0,0 +1,1960 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Decoders for catalog `create_sql` strings.
+//!
+//! Each function parses a persisted `create_sql` and returns a JSON value with
+//! the fields a builtin catalog view projects. Errors are human-readable
+//! strings.
+
+use std::collections::BTreeMap;
+
+use mz_sql_parser::ast::display::AstDisplay;
+use mz_sql_parser::ast::item_refs::collect_item_references;
+use mz_sql_parser::ast::{
+    AstInfo, AvroSchema, ConnectionOption, ConnectionOptionName, CreateConnectionType,
+    CreateSinkConnection, CreateSubsourceOptionName, Format, FormatSpecifier,
+    IcebergSinkConfigOptionName, IcebergSinkMode, KafkaSinkConfigOptionName,
+    KafkaSourceConfigOptionName, PgConfigOptionName, ProtobufSchema, Raw, RawClusterName,
+    RawItemName, SinkEnvelope, SourceEnvelope, SourceErrorPolicy, Statement, UnresolvedItemName,
+    Value, WithOptionValue,
+};
+use prost::Message as _;
+use serde_json::json;
+
+/// Parses `sql`, which must contain exactly one statement.
+fn parse_single_statement(sql: &str) -> Result<Statement<Raw>, String> {
+    let mut stmts = mz_sql_parser::parser::parse_statements(sql)
+        .map_err(|e| format!("failed to parse create_sql: {e}"))?;
+    match stmts.len() {
+        1 => Ok(stmts.remove(0).ast),
+        n => Err(format!("expected a single statement, found {n}")),
+    }
+}
+
+fn item_id(item: RawItemName) -> Result<String, &'static str> {
+    match item {
+        RawItemName::Id(id, _, _) => Ok(id),
+        RawItemName::Name(_) => Err("unresolved item name"),
+    }
+}
+
+fn cluster_id(in_cluster: RawClusterName) -> Result<String, &'static str> {
+    match in_cluster {
+        RawClusterName::Resolved(s) => Ok(s),
+        RawClusterName::Unresolved(_) => Err("unresolved cluster name"),
+    }
+}
+
+fn format_name<T: AstInfo>(fmt: &Format<T>) -> &'static str {
+    match fmt {
+        Format::Bytes => "bytes",
+        Format::Avro(_) => "avro",
+        Format::Protobuf(_) => "protobuf",
+        Format::Regex(_) => "regex",
+        Format::Csv { .. } => "csv",
+        Format::Json { .. } => "json",
+        Format::Text => "text",
+    }
+}
+
+/// Extracts the string form of a `WithOptionValue`, matching how the planner
+/// coerces option values. The blanket `TryFromValue<WithOptionValue<T>>` impl in
+/// `src/sql/src/plan/with_options.rs` accepts a quoted string, a bare identifier,
+/// and a 1-part unresolved item name, all yielding a string. Any other variant
+/// yields None.
+///
+/// `AstDisplay` does not re-quote bare identifiers or 1-part names, so those
+/// forms persist unquoted in `create_sql`. Matching only `Value::String` here
+/// would miss them and silently fall back to a default, so the catalog-raw
+/// parsers below route their string options through this helper.
+fn option_string<T: AstInfo>(value: &WithOptionValue<T>) -> Option<String> {
+    match value {
+        WithOptionValue::Value(Value::String(s)) => Some(s.clone()),
+        WithOptionValue::Ident(ident) => Some(ident.clone().into_string()),
+        WithOptionValue::UnresolvedItemName(UnresolvedItemName(parts)) if parts.len() == 1 => {
+            Some(parts[0].clone().into_string())
+        }
+        _ => None,
+    }
+}
+
+/// Parses a catalog `create_sql` string into a JSON object.
+///
+/// The returned JSON does not fully reflect the parsed SQL and instead contains only fields
+/// required by current callers.
+pub fn item_details(a: &str) -> Result<serde_json::Value, String> {
+    let stmt = parse_single_statement(a)?;
+
+    let mut info = BTreeMap::<&str, serde_json::Value>::new();
+
+    use mz_sql_parser::ast::Statement::*;
+    let item_type = match stmt {
+        CreateSecret(_) => "secret",
+        CreateConnection(stmt) => {
+            let connection_type = stmt.connection_type.as_str();
+            info.insert("connection_type", json!(connection_type));
+
+            "connection"
+        }
+        CreateView(stmt) => {
+            let mut definition = stmt.definition.query.to_ast_string_stable();
+            // PostgreSQL appends a semicolon in `pg_views.definition`, we
+            // do the same for compatibility's sake.
+            definition.push(';');
+            info.insert("definition", json!(definition));
+
+            "view"
+        }
+        CreateMaterializedView(stmt) => {
+            let Some(in_cluster) = stmt.in_cluster else {
+                return Err("missing IN CLUSTER".into());
+            };
+            let cluster_id = match in_cluster {
+                RawClusterName::Unresolved(ident) => ident.into_string(),
+                RawClusterName::Resolved(s) => s,
+            };
+            info.insert("cluster_id", json!(cluster_id));
+
+            let mut definition = stmt.query.to_ast_string_stable();
+            definition.push(';');
+            info.insert("definition", json!(definition));
+
+            "materialized-view"
+        }
+        CreateTable(_) => "table",
+        CreateTableFromSource(stmt) => {
+            let source_id = item_id(stmt.source)?;
+            info.insert("source_id", json!(source_id));
+
+            "table"
+        }
+        CreateSource(stmt) => {
+            let Some(in_cluster) = stmt.in_cluster else {
+                return Err("missing IN CLUSTER".into());
+            };
+            let cluster_id = cluster_id(in_cluster)?;
+            info.insert("cluster_id", json!(cluster_id));
+
+            use mz_sql_parser::ast::CreateSourceConnection::*;
+            let (source_type, connection) = match stmt.connection {
+                Kafka { connection, .. } => ("kafka", Some(connection)),
+                Postgres { connection, .. } => ("postgres", Some(connection)),
+                MySql { connection, .. } => ("mysql", Some(connection)),
+                SqlServer { connection, .. } => ("sql-server", Some(connection)),
+                LoadGenerator { .. } => ("load-generator", None),
+            };
+            info.insert("source_type", json!(source_type));
+            if let Some(conn) = connection {
+                let conn_id = item_id(conn)?;
+                info.insert("connection_id", json!(conn_id));
+            }
+
+            let is_debezium = matches!(
+                stmt.envelope,
+                Some(mz_sql_parser::ast::SourceEnvelope::Debezium)
+            );
+
+            // An old-syntax kafka source ingests into its own relation, so an
+            // omitted ENVELOPE means the default ENVELOPE NONE and the pre-MV
+            // packer reported 'none'. A new-syntax source (no progress
+            // subsource, hence no EXPOSE PROGRESS AS in create_sql) ingests
+            // nothing itself. Its envelopes live on the per-table exports, so
+            // its own envelope_type stays absent (SQL NULL), matching released
+            // behavior. `progress_subsource.is_some()` is the planner's own
+            // old-vs-new discriminator (see `OldSyntaxIngestion` in
+            // plan_create_source). Non-kafka sources carry no envelope either.
+            // See the `mz_sources.envelope_type` column.
+            let envelope_type = match &stmt.envelope {
+                Some(envelope) => {
+                    use mz_sql_parser::ast::SourceEnvelope::*;
+                    Some(match envelope {
+                        None => "none",
+                        Debezium => "debezium",
+                        Upsert { .. } => "upsert",
+                        CdcV2 => "materialize",
+                    })
+                }
+                None if source_type == "kafka" && stmt.progress_subsource.is_some() => Some("none"),
+                None => None,
+            };
+            if let Some(envelope_type) = envelope_type {
+                info.insert("envelope_type", json!(envelope_type));
+            }
+
+            if let Some(format_spec) = stmt.format {
+                match &format_spec {
+                    FormatSpecifier::Bare(fmt) => {
+                        // Debezium sources with a single format spec implicitly use
+                        // the same format for both key and value.
+                        if is_debezium {
+                            info.insert("key_format", json!(format_name(fmt)));
+                        }
+                        info.insert("value_format", json!(format_name(fmt)));
+                    }
+                    FormatSpecifier::KeyValue { key, value } => {
+                        info.insert("key_format", json!(format_name(key)));
+                        info.insert("value_format", json!(format_name(value)));
+                    }
+                }
+            }
+
+            "source"
+        }
+        CreateWebhookSource(stmt) => {
+            if stmt.is_table {
+                "table"
+            } else {
+                info.insert("source_type", json!("webhook"));
+                if let Some(in_cluster) = stmt.in_cluster {
+                    let cluster_id = cluster_id(in_cluster)?;
+                    info.insert("cluster_id", json!(cluster_id));
+                }
+                "source"
+            }
+        }
+        CreateSubsource(stmt) => {
+            use mz_sql_parser::ast::CreateSubsourceOptionName;
+            let is_progress = stmt
+                .with_options
+                .iter()
+                .any(|o| matches!(o.name, CreateSubsourceOptionName::Progress));
+            let source_type = if is_progress { "progress" } else { "subsource" };
+            info.insert("source_type", json!(source_type));
+
+            if let Some(of_source) = stmt.of_source {
+                let of_source_id = item_id(of_source)?;
+                info.insert("of_source_id", json!(of_source_id));
+            }
+
+            "subsource"
+        }
+        // Everything the mz_sinks, mz_kafka_sinks and mz_iceberg_sinks
+        // views read. The Rust side of each value lives in `Sink` and
+        // `StorageSinkConnection`, so those and this have to move together.
+        //
+        // NOTE: we bail below if a sink has no resolved `IN CLUSTER`, no
+        // `TOPIC` on kafka, or no `NAMESPACE`/`TABLE` on iceberg. Planning
+        // guarantees all four. But if one ever slipped through it would
+        // take down every view built on this function, not just the sink
+        // ones.
+        CreateSink(stmt) => {
+            let Some(in_cluster) = stmt.in_cluster else {
+                return Err("missing IN CLUSTER".into());
+            };
+            info.insert("cluster_id", json!(cluster_id(in_cluster)?));
+
+            match stmt.connection {
+                CreateSinkConnection::Kafka {
+                    connection,
+                    options,
+                    key: sink_key,
+                    ..
+                } => {
+                    info.insert("sink_type", json!("kafka"));
+                    info.insert("connection_id", json!(item_id(connection)?));
+
+                    let topic = options
+                        .into_iter()
+                        .find(|o| o.name == KafkaSinkConfigOptionName::Topic)
+                        .and_then(|o| o.value.as_ref().and_then(option_string))
+                        .ok_or("kafka sink missing TOPIC")?;
+                    info.insert("topic", json!(topic));
+
+                    if let Some(envelope) = stmt.envelope {
+                        let envelope_type = match envelope {
+                            SinkEnvelope::Upsert => "upsert",
+                            SinkEnvelope::Debezium => "debezium",
+                        };
+                        info.insert("envelope_type", json!(envelope_type));
+                    }
+
+                    if let Some(format_spec) = stmt.format {
+                        // A key format only survives if the sink has a
+                        // `KEY`. Without one `kafka_sink_builder` throws
+                        // away the key half of a key/value spec, and does
+                        // not copy a bare spec over to the key either.
+                        let (key_format, value_format) = match (&format_spec, sink_key.is_some()) {
+                            (FormatSpecifier::Bare(fmt), false) => (None, format_name(fmt)),
+                            (FormatSpecifier::Bare(fmt), true) => {
+                                (Some(format_name(fmt)), format_name(fmt))
+                            }
+                            (FormatSpecifier::KeyValue { value, .. }, false) => {
+                                (None, format_name(value))
+                            }
+                            (FormatSpecifier::KeyValue { key, value }, true) => {
+                                (Some(format_name(key)), format_name(value))
+                            }
+                        };
+                        if let Some(key_format) = key_format {
+                            info.insert("key_format", json!(key_format));
+                        }
+                        info.insert("value_format", json!(value_format));
+
+                        // The deprecated combined `format`. Only avro/avro
+                        // and json/json collapse to a single name.
+                        // Everything else, text/text and bytes/bytes
+                        // included, gets the composite form.
+                        let combined = match key_format {
+                            None => value_format.to_string(),
+                            Some(key_format)
+                                if key_format == value_format
+                                    && matches!(value_format, "avro" | "json") =>
+                            {
+                                value_format.to_string()
+                            }
+                            Some(key_format) => {
+                                format!("key-{key_format}-value-{value_format}")
+                            }
+                        };
+                        info.insert("format", json!(combined));
+                    }
+                }
+                CreateSinkConnection::Iceberg {
+                    catalog_connection,
+                    options,
+                    ..
+                } => {
+                    info.insert("sink_type", json!("iceberg"));
+                    // The catalog connection, not the optional AWS one.
+                    info.insert("connection_id", json!(item_id(catalog_connection)?));
+
+                    let mut namespace = None;
+                    let mut table = None;
+                    for option in options {
+                        match option.name {
+                            IcebergSinkConfigOptionName::Namespace => {
+                                namespace = option.value.as_ref().and_then(option_string)
+                            }
+                            IcebergSinkConfigOptionName::Table => {
+                                table = option.value.as_ref().and_then(option_string)
+                            }
+                        }
+                    }
+                    info.insert(
+                        "namespace",
+                        json!(namespace.ok_or("iceberg sink missing NAMESPACE")?),
+                    );
+                    info.insert("table", json!(table.ok_or("iceberg sink missing TABLE")?));
+
+                    // Iceberg spells the envelope `MODE`, and has no format
+                    // columns at all.
+                    if let Some(mode) = stmt.mode {
+                        let envelope_type = match mode {
+                            IcebergSinkMode::Upsert => "upsert",
+                            IcebergSinkMode::Append => "append",
+                        };
+                        info.insert("envelope_type", json!(envelope_type));
+                    }
+                }
+            }
+
+            "sink"
+        }
+        CreateMetricSink(stmt) => {
+            let Some(in_cluster) = stmt.in_cluster else {
+                return Err("missing IN CLUSTER".into());
+            };
+            let cluster_id = cluster_id(in_cluster)?;
+            info.insert("cluster_id", json!(cluster_id));
+            let from_id = item_id(stmt.from)?;
+            info.insert("from_id", json!(from_id));
+            "metric-sink"
+        }
+        CreateIndex(stmt) => {
+            let Some(in_cluster) = stmt.in_cluster else {
+                return Err("missing IN CLUSTER".into());
+            };
+            let cluster_id = cluster_id(in_cluster)?;
+            info.insert("cluster_id", json!(cluster_id));
+            let on_id = item_id(stmt.on_name)?;
+            info.insert("on_id", json!(on_id));
+            "index"
+        }
+        CreateType(_) => "type",
+        // NOTE: every statement that creates a catalog item needs an arm above. These
+        // catalog views run this over every item row before their type filter drops the
+        // unwanted rows, so one unclassified `create_sql` takes out `mz_objects`,
+        // `mz_indexes`, and every sibling view at once. The match is exhaustive to make
+        // that a compile error here, not a runtime failure.
+        Select(_)
+        | Insert(_)
+        | Copy(_)
+        | Update(_)
+        | Delete(_)
+        | CreateDatabase(_)
+        | CreateSchema(_)
+        | CreateRole(_)
+        | CreateCluster(_)
+        | CreateClusterReplica(_)
+        | CreateNetworkPolicy(_)
+        | AlterCluster(_)
+        | AlterOwner(_)
+        | AlterObjectRename(_)
+        | AlterObjectSwap(_)
+        | AlterRetainHistory(_)
+        | AlterIndex(_)
+        | AlterSecret(_)
+        | AlterSetCluster(_)
+        | AlterSink(_)
+        | AlterSource(_)
+        | AlterSystemSet(_)
+        | AlterSystemReset(_)
+        | AlterSystemResetAll(_)
+        | AlterConnection(_)
+        | AlterNetworkPolicy(_)
+        | AlterRole(_)
+        | AlterTableAddColumn(_)
+        | AlterMaterializedViewApplyReplacement(_)
+        | Discard(_)
+        | DropObjects(_)
+        | DropOwned(_)
+        | SetVariable(_)
+        | ResetVariable(_)
+        | Show(_)
+        | StartTransaction(_)
+        | SetTransaction(_)
+        | Commit(_)
+        | Rollback(_)
+        | Subscribe(_)
+        | ExplainPlan(_)
+        | ExplainPushdown(_)
+        | ExplainTimestamp(_)
+        | ExplainSinkSchema(_)
+        | ExplainAnalyzeObject(_)
+        | ExplainAnalyzeCluster(_)
+        | Declare(_)
+        | Fetch(_)
+        | Close(_)
+        | Prepare(_)
+        | Execute(_)
+        | ExecuteUnitTest(_)
+        | Deallocate(_)
+        | Raise(_)
+        | GrantRole(_)
+        | RevokeRole(_)
+        | GrantPrivileges(_)
+        | RevokePrivileges(_)
+        | AlterDefaultPrivileges(_)
+        | ReassignOwned(_)
+        | ValidateConnection(_)
+        | Comment(_) => return Err("not a CREATE item statement".into()),
+    };
+    info.insert("type", json!(item_type));
+
+    let info = info.into_iter().map(|(k, v)| (k.to_string(), v)).collect();
+    Ok(info)
+}
+
+/// Extracts the catalog item references from a catalog `create_sql` string as a JSONB object.
+///
+/// - `ids`: array of catalog id strings from `[<id> AS <name>]` references.
+/// - `named_funcs`: array of function references such as "pg_catalog"."max".
+/// - `named_types`: array of type references such as "pg_catalog"."int4", exclusive from the ones
+///   in `ids`.
+/// - `named_relations`: array of relation references, exclusive from the ones in `ids`.
+pub fn item_references(a: &str) -> Result<serde_json::Value, String> {
+    fn qualified(name: &UnresolvedItemName) -> serde_json::Value {
+        match &name.0[..] {
+            [.., schema, item] => json!({"schema": schema.as_str(), "name": item.as_str()}),
+            [item] => json!({"schema": serde_json::Value::Null, "name": item.as_str()}),
+            [] => json!({"schema": serde_json::Value::Null, "name": ""}),
+        }
+    }
+
+    let stmt = parse_single_statement(a)?;
+
+    let refs = collect_item_references(&stmt);
+    mz_ore::soft_assert_or_log!(
+        refs.named_array_elements.is_empty(),
+        "persisted create_sql should never carry an array type T[] \
+        and resolve its array type in `ids`: {:?}",
+        refs.named_array_elements
+    );
+    Ok(json!({
+        "ids": refs.ids.iter().collect::<Vec<_>>(),
+        "named_funcs": refs.named_funcs.iter().map(qualified).collect::<Vec<_>>(),
+        "named_types": refs.named_types.iter().map(qualified).collect::<Vec<_>>(),
+        "named_relations": refs.named_relations.iter().map(qualified).collect::<Vec<_>>(),
+    }))
+}
+
+/// Minimal decoder for `ProtoPostgresSourcePublicationDetails`. The
+/// canonical proto lives in `mz-storage-types`, which depends on this
+/// crate via `mz-expr`, so we redeclare the two tags we read here. Upstream tag
+/// renumbers slip past silently. The `mz_postgres_sources` lockdown
+/// SLTs catch them.
+#[derive(Clone, PartialEq, ::prost::Message)]
+struct PostgresPublicationDetailsSubset {
+    #[prost(string, tag = "2")]
+    slot: String,
+    #[prost(uint64, optional, tag = "3")]
+    timeline_id: Option<u64>,
+}
+
+/// Extracts postgres source publication details (slot, timeline_id) from a
+/// catalog `create_sql`. Returns:
+///
+/// - jsonb `{"slot": <text>, "timeline_id": <u64 | null>}` for `CREATE SOURCE ... FROM POSTGRES
+///   CONNECTION ... (DETAILS = ...)` statements.
+/// - jsonb `null` for any other statement.
+///
+/// Errors if the statement fails to parse, is a postgres source without
+/// a `DETAILS` option, or if the `DETAILS` value can't be hex- and
+/// proto-decoded.
+pub fn postgres_source_details(a: &str) -> Result<serde_json::Value, String> {
+    let stmt = parse_single_statement(a)?;
+
+    use mz_sql_parser::ast::CreateSourceConnection;
+    use mz_sql_parser::ast::Statement::CreateSource;
+    let options = match stmt {
+        CreateSource(stmt) => match stmt.connection {
+            CreateSourceConnection::Postgres { options, .. } => options,
+            _ => return Ok(serde_json::Value::Null),
+        },
+        _ => return Ok(serde_json::Value::Null),
+    };
+
+    let details_hex = options
+        .into_iter()
+        .find(|opt| opt.name == PgConfigOptionName::Details)
+        .and_then(|opt| match opt.value {
+            Some(WithOptionValue::Value(Value::String(s))) => Some(s),
+            _ => None,
+        })
+        .ok_or("missing DETAILS option on postgres source")?;
+
+    let details_bytes =
+        hex::decode(&details_hex).map_err(|e| format!("DETAILS is not valid hex: {e}"))?;
+
+    let details = PostgresPublicationDetailsSubset::decode(&*details_bytes)
+        .map_err(|e| format!("DETAILS is not a valid publication-details proto: {e}"))?;
+
+    Ok(json!({
+        "slot": details.slot,
+        "timeline_id": details.timeline_id,
+    }))
+}
+
+/// Extracts kafka source configuration (topic, group id prefix, connection
+/// id) from a catalog `create_sql`. Returns:
+///
+/// - jsonb `{"topic": <text>, "group_id_prefix": <text | null>, "connection_id": <text>}` for
+///   `CREATE SOURCE ... FROM KAFKA CONNECTION ... (TOPIC = ..., [GROUP ID PREFIX = ...])`
+///   statements.
+/// - jsonb `null` for any other statement.
+///
+/// Errors if the statement fails to parse, is a kafka source without a
+/// `TOPIC` option, or references an unresolved connection name (i.e. one
+/// that hasn't been through purification).
+pub fn kafka_source_details(a: &str) -> Result<serde_json::Value, String> {
+    let stmt = parse_single_statement(a)?;
+
+    use mz_sql_parser::ast::CreateSourceConnection;
+    use mz_sql_parser::ast::Statement::CreateSource;
+    let (connection, options) = match stmt {
+        CreateSource(stmt) => match stmt.connection {
+            CreateSourceConnection::Kafka {
+                connection,
+                options,
+            } => (connection, options),
+            _ => return Ok(serde_json::Value::Null),
+        },
+        _ => return Ok(serde_json::Value::Null),
+    };
+
+    let connection_id = item_id(connection)?;
+
+    let mut topic: Option<String> = None;
+    let mut group_id_prefix: Option<String> = None;
+    for opt in options {
+        let string_value = opt.value.as_ref().and_then(option_string);
+        match opt.name {
+            KafkaSourceConfigOptionName::Topic => topic = string_value,
+            KafkaSourceConfigOptionName::GroupIdPrefix => group_id_prefix = string_value,
+            _ => {}
+        }
+    }
+
+    let topic = topic.ok_or("missing TOPIC option on kafka source")?;
+
+    Ok(json!({
+        "topic": topic,
+        "group_id_prefix": group_id_prefix,
+        "connection_id": connection_id,
+    }))
+}
+
+/// Extracts source-export (source table) metadata from a catalog `create_sql`.
+///
+/// Returns, for a `CREATE TABLE ... FROM SOURCE` or a non-progress
+/// `CREATE SUBSOURCE ... OF SOURCE ...` statement:
+///
+/// ```json
+/// {
+///   "source_id": "<parent source item id>",
+///   "external_reference": ["part1", "part2", ...],
+///   "envelope_type": <text | null>,
+///   "key_format": <text | null>,
+///   "value_format": <text | null>
+/// }
+/// ```
+///
+/// `envelope_type`, `key_format`, and `value_format` are always null for a
+/// `CREATE SUBSOURCE` (the postgres/mysql/sql-server exports that use the old
+/// subsource syntax carry neither format nor envelope). They may also be null
+/// for a `CREATE TABLE ... FROM SOURCE` that omits FORMAT/ENVELOPE.
+///
+/// Returns jsonb `null` for progress subsources and for any statement that is
+/// not a source export. The caller distinguishes the four source-table views
+/// by joining `source_id` against `mz_sources` and filtering on the parent's
+/// type, so this helper stays connection-type agnostic.
+///
+/// Errors if the statement fails to parse, references an unresolved item name,
+/// or is a non-progress subsource missing its OF SOURCE or EXTERNAL REFERENCE.
+///
+/// The `key_format`/`value_format` derivation mirrors the runtime
+/// `DataSourceDesc::formats()` that the removed `pack_kafka_source_tables_update`
+/// packer read. A bare FORMAT only carries a key when it resolves to an
+/// encoding that has one, which among bare formats is only Avro or Protobuf
+/// read from a Confluent Schema Registry whose purified seed carries a key
+/// schema. A KEY FORMAT ... VALUE FORMAT ... spec always carries both.
+pub fn source_export_details(a: &str) -> Result<serde_json::Value, String> {
+    // A bare FORMAT resolves to an encoding with a key only for Avro or
+    // Protobuf read from a schema registry whose purified seed carries a key
+    // schema. Every other bare format is value-only.
+    fn bare_format_has_key<T: AstInfo>(fmt: &Format<T>) -> bool {
+        match fmt {
+            Format::Avro(AvroSchema::Csr { csr_connection }) => csr_connection
+                .seed
+                .as_ref()
+                .is_some_and(|seed| seed.key_schema.is_some()),
+            Format::Protobuf(ProtobufSchema::Csr { csr_connection }) => csr_connection
+                .seed
+                .as_ref()
+                .is_some_and(|seed| seed.key.is_some()),
+            _ => false,
+        }
+    }
+
+    fn key_value_formats<T: AstInfo>(
+        spec: &FormatSpecifier<T>,
+    ) -> (Option<&'static str>, Option<&'static str>) {
+        match spec {
+            FormatSpecifier::KeyValue { key, value } => {
+                (Some(format_name(key)), Some(format_name(value)))
+            }
+            FormatSpecifier::Bare(fmt) => {
+                let value = Some(format_name(fmt));
+                let key = bare_format_has_key(fmt).then(|| format_name(fmt));
+                (key, value)
+            }
+        }
+    }
+
+    fn envelope_name(envelope: &SourceEnvelope) -> &'static str {
+        match envelope {
+            SourceEnvelope::None => "none",
+            SourceEnvelope::Debezium => "debezium",
+            SourceEnvelope::Upsert {
+                value_decode_err_policy,
+            } => {
+                if value_decode_err_policy
+                    .iter()
+                    .any(|p| matches!(p, SourceErrorPolicy::Inline { .. }))
+                {
+                    "upsert-value-err-inline"
+                } else {
+                    "upsert"
+                }
+            }
+            SourceEnvelope::CdcV2 => "materialize",
+        }
+    }
+
+    let stmt = parse_single_statement(a)?;
+
+    use mz_sql_parser::ast::Statement::{CreateSubsource, CreateTableFromSource};
+    match stmt {
+        CreateTableFromSource(stmt) => {
+            let source_id = item_id(stmt.source)?;
+            let external_reference = stmt
+                .external_reference
+                .ok_or("missing external reference on CREATE TABLE FROM SOURCE")?
+                .0
+                .into_iter()
+                .map(|ident| ident.into_string())
+                .collect::<Vec<_>>();
+
+            let envelope_type = stmt.envelope.as_ref().map(envelope_name);
+            let (key_format, value_format) = match &stmt.format {
+                Some(spec) => key_value_formats(spec),
+                None => (None, None),
+            };
+
+            Ok(json!({
+                "source_id": source_id,
+                "external_reference": external_reference,
+                "envelope_type": envelope_type,
+                "key_format": key_format,
+                "value_format": value_format,
+            }))
+        }
+        CreateSubsource(stmt) => {
+            // Progress subsources track ingestion progress and are not
+            // source tables. They have no external reference.
+            let is_progress = stmt
+                .with_options
+                .iter()
+                .any(|o| matches!(o.name, CreateSubsourceOptionName::Progress));
+            if is_progress {
+                return Ok(serde_json::Value::Null);
+            }
+
+            let source_id = stmt
+                .of_source
+                .ok_or("non-progress CREATE SUBSOURCE without OF SOURCE")
+                .and_then(item_id)?;
+
+            let external_reference = stmt
+                .with_options
+                .into_iter()
+                .find(|o| matches!(o.name, CreateSubsourceOptionName::ExternalReference))
+                .and_then(|o| match o.value {
+                    Some(WithOptionValue::UnresolvedItemName(name)) => Some(name),
+                    _ => None,
+                })
+                .ok_or("CREATE SUBSOURCE missing EXTERNAL REFERENCE option")?
+                .0
+                .into_iter()
+                .map(|ident| ident.into_string())
+                .collect::<Vec<_>>();
+
+            Ok(json!({
+                "source_id": source_id,
+                "external_reference": external_reference,
+                "envelope_type": serde_json::Value::Null,
+                "key_format": serde_json::Value::Null,
+                "value_format": serde_json::Value::Null,
+            }))
+        }
+        _ => Ok(serde_json::Value::Null),
+    }
+}
+
+/// Extracts connection-detail metadata from a catalog `create_sql`.
+///
+/// Returns a per-connection-type object with the fields that the
+/// `mz_kafka_connections`, `mz_ssh_tunnel_connections`, and `mz_aws_connections`
+/// builtin views need. For everything else (other connection types, including
+/// aws-privatelink whose only detail is context-derived, and non-connection
+/// statements) it returns jsonb `null`, so callers filter on `IS NOT NULL` and
+/// gate on the connection type separately (via
+/// `parse_catalog_create_sql(...)->>'connection_type'`, the way `mz_connections`
+/// already does).
+///
+/// The shape per type:
+///
+/// ```json
+/// // kafka
+/// { "brokers": ["host:port", ...], "progress_topic": <text | null> }
+/// // ssh-tunnel
+/// { "public_key_1": "<text>", "public_key_2": "<text>" }
+/// // aws
+/// {
+///   "auth_kind": "credentials" | "assume-role",
+///   "endpoint": <text | null>, "region": <text | null>,
+///   "access_key_id": <text | null>, "access_key_id_secret_id": <text | null>,
+///   "secret_access_key_secret_id": <text | null>,
+///   "session_token": <text | null>, "session_token_secret_id": <text | null>,
+///   "assume_role_arn": <text | null>, "assume_role_session_name": <text | null>
+/// }
+/// ```
+///
+/// `progress_topic` is null when the connection does not set an explicit
+/// `PROGRESS TOPIC`. The default (`_materialize-progress-<env>-<conn_id>`) is
+/// reconstructed by the view, not here, because it needs the environment id and
+/// the connection's own id. Values derived only from environment context
+/// (AWS principal, external id, trust policy, privatelink principal) are also
+/// left to the view. This keeps the helper a pure function of the `create_sql`.
+///
+/// For aws, an option is either an inline value or a secret reference. Inline
+/// values land in `access_key_id`/`session_token`; a secret reference lands in
+/// the matching `*_secret_id` as the referenced secret's catalog item id (the
+/// persisted `create_sql` stores resolved references as `[uNNN AS name]`).
+/// `auth_kind` is `assume-role` when `ASSUME ROLE ARN` is present, else
+/// `credentials`, matching the `AwsAuth` variant the removed packer read.
+///
+/// Errors if the statement fails to parse.
+pub fn connection_details(a: &str) -> Result<serde_json::Value, String> {
+    // The persisted `create_sql` stores an inline broker as a single `BROKER`
+    // option and a broker list as a `BROKERS (...)` sequence. Either way we
+    // only need the addresses, which are present regardless of the tunnel
+    // (direct, SSH, or PrivateLink).
+    fn broker_addresses<T: AstInfo>(values: &[ConnectionOption<T>]) -> Vec<String> {
+        let mut brokers = Vec::new();
+        for opt in values {
+            match (&opt.name, &opt.value) {
+                (ConnectionOptionName::Broker, Some(WithOptionValue::ConnectionKafkaBroker(b))) => {
+                    brokers.push(b.address.clone());
+                }
+                (ConnectionOptionName::Brokers, Some(WithOptionValue::Sequence(seq))) => {
+                    for v in seq {
+                        if let WithOptionValue::ConnectionKafkaBroker(b) = v {
+                            brokers.push(b.address.clone());
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+        brokers
+    }
+
+    fn string_option<T: AstInfo>(
+        values: &[ConnectionOption<T>],
+        name: ConnectionOptionName,
+    ) -> Option<String> {
+        values
+            .iter()
+            .find(|o| o.name == name)
+            .and_then(|o| o.value.as_ref())
+            .and_then(option_string)
+    }
+
+    // The catalog id of the secret a `SECRET ...` option references. Resolved
+    // references persist as `RawItemName::Id`, so an unresolved name yields
+    // None (the same treatment [`item_id`] gives item names).
+    fn secret_id_option<T: AstInfo<ItemName = RawItemName>>(
+        values: &[ConnectionOption<T>],
+        name: ConnectionOptionName,
+    ) -> Option<String> {
+        values.iter().find_map(|o| match &o.value {
+            Some(WithOptionValue::Secret(RawItemName::Id(id, _, _))) if o.name == name => {
+                Some(id.clone())
+            }
+            _ => None,
+        })
+    }
+
+    let stmt = parse_single_statement(a)?;
+
+    use mz_sql_parser::ast::Statement::CreateConnection;
+    let stmt = match stmt {
+        CreateConnection(stmt) => stmt,
+        _ => return Ok(serde_json::Value::Null),
+    };
+
+    match stmt.connection_type {
+        CreateConnectionType::Kafka => Ok(json!({
+            "brokers": broker_addresses(&stmt.values),
+            "progress_topic": string_option(&stmt.values, ConnectionOptionName::ProgressTopic),
+        })),
+        CreateConnectionType::Ssh => Ok(json!({
+            "public_key_1": string_option(&stmt.values, ConnectionOptionName::PublicKey1),
+            "public_key_2": string_option(&stmt.values, ConnectionOptionName::PublicKey2),
+        })),
+        CreateConnectionType::Aws => {
+            let assume_role_arn = string_option(&stmt.values, ConnectionOptionName::AssumeRoleArn);
+            let auth_kind = if assume_role_arn.is_some() {
+                "assume-role"
+            } else {
+                "credentials"
+            };
+            Ok(json!({
+                "auth_kind": auth_kind,
+                // Planning coerces an empty ENDPOINT to None (see
+                // `src/sql/src/plan/statement/ddl/connection.rs`), so the
+                // removed packer wrote NULL for `ENDPOINT = ''`. Match that.
+                "endpoint": string_option(&stmt.values, ConnectionOptionName::Endpoint)
+                    .filter(|s| !s.is_empty()),
+                "region": string_option(&stmt.values, ConnectionOptionName::Region),
+                "access_key_id": string_option(&stmt.values, ConnectionOptionName::AccessKeyId),
+                "access_key_id_secret_id":
+                    secret_id_option(&stmt.values, ConnectionOptionName::AccessKeyId),
+                "secret_access_key_secret_id":
+                    secret_id_option(&stmt.values, ConnectionOptionName::SecretAccessKey),
+                "session_token": string_option(&stmt.values, ConnectionOptionName::SessionToken),
+                "session_token_secret_id":
+                    secret_id_option(&stmt.values, ConnectionOptionName::SessionToken),
+                "assume_role_arn": assume_role_arn,
+                "assume_role_session_name":
+                    string_option(&stmt.values, ConnectionOptionName::AssumeRoleSessionName),
+            }))
+        }
+        _ => Ok(serde_json::Value::Null),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use prost::Message as _;
+    use serde_json::json;
+
+    /// Encode the two proto fields our decoder cares about, using the same
+    /// tag numbering as the canonical proto.
+    fn encode_pg_details(slot: &str, timeline_id: Option<u64>) -> String {
+        let details = super::PostgresPublicationDetailsSubset {
+            slot: slot.to_string(),
+            timeline_id,
+        };
+        hex::encode(details.encode_to_vec())
+    }
+
+    fn pg_source_sql(details_hex: &str) -> String {
+        format!(
+            "CREATE SOURCE \"materialize\".\"public\".\"pg_src\" \
+             IN CLUSTER [u42] \
+             FROM POSTGRES CONNECTION [u10 AS \"materialize\".\"public\".\"pg_conn\"] \
+             (DETAILS = '{details_hex}', PUBLICATION = 'mz_source') \
+             FOR ALL TABLES"
+        )
+    }
+
+    fn kafka_source_sql(with_prefix: bool) -> String {
+        let prefix_opt = if with_prefix {
+            ", GROUP ID PREFIX 'my-prefix-'"
+        } else {
+            ""
+        };
+        format!(
+            "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
+             (TOPIC 'test'{prefix_opt}) FORMAT TEXT"
+        )
+    }
+
+    // --- parse_postgres_source_details ---------------------------------------
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `decContextDefault` on OS `linux`
+    fn pg_happy_path_with_timeline() {
+        let hex = encode_pg_details("materialize_abc", Some(42));
+        let sql = pg_source_sql(&hex);
+        let out = super::postgres_source_details(&sql).expect("ok");
+        assert_eq!(out, json!({ "slot": "materialize_abc", "timeline_id": 42 }));
+    }
+
+    #[mz_ore::test]
+    fn pg_happy_path_null_timeline() {
+        // Pre-2024 sources have no timeline_id field. The decoder must
+        // surface that as JSON null, not error.
+        let hex = encode_pg_details("materialize_legacy", None);
+        let sql = pg_source_sql(&hex);
+        let out = super::postgres_source_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({ "slot": "materialize_legacy", "timeline_id": null }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn pg_non_postgres_source_returns_null_jsonb() {
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
+             IN CLUSTER [u42] FROM LOAD GENERATOR COUNTER";
+        let out = super::postgres_source_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn pg_non_create_source_returns_null_jsonb() {
+        let sql = "CREATE VIEW v AS SELECT 1";
+        let out = super::postgres_source_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    fn pg_missing_details_option_errors() {
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"pg_src\" \
+             IN CLUSTER [u42] \
+             FROM POSTGRES CONNECTION [u10 AS \"materialize\".\"public\".\"pg_conn\"] \
+             (PUBLICATION = 'mz_source') FOR ALL TABLES";
+        let err = super::postgres_source_details(sql).unwrap_err();
+        assert!(
+            err.contains("missing DETAILS"),
+            "wrong error message: {err}"
+        );
+    }
+
+    #[mz_ore::test]
+    fn pg_malformed_hex_errors() {
+        let sql = pg_source_sql("not-hex!!");
+        let err = super::postgres_source_details(&sql).unwrap_err();
+        assert!(err.contains("valid hex"), "wrong error message: {err}");
+    }
+
+    #[mz_ore::test]
+    fn pg_malformed_proto_errors() {
+        // Valid hex, garbage bytes. Prost decoding fails on unexpected wire
+        // format.
+        let sql = pg_source_sql("ffff");
+        let err = super::postgres_source_details(&sql).unwrap_err();
+        assert!(
+            err.contains("publication-details proto"),
+            "wrong error message: {err}"
+        );
+    }
+
+    // --- parse_kafka_source_details ------------------------------------------
+
+    #[mz_ore::test]
+    fn kafka_happy_path_with_prefix() {
+        let sql = kafka_source_sql(true);
+        let out = super::kafka_source_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "topic": "test",
+                "group_id_prefix": "my-prefix-",
+                "connection_id": "u11",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn kafka_happy_path_without_prefix() {
+        let sql = kafka_source_sql(false);
+        let out = super::kafka_source_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "topic": "test",
+                "group_id_prefix": null,
+                "connection_id": "u11",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn kafka_non_kafka_source_returns_null_jsonb() {
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
+             IN CLUSTER [u42] FROM LOAD GENERATOR COUNTER";
+        let out = super::kafka_source_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    fn kafka_missing_topic_errors() {
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
+             FORMAT TEXT";
+        let err = super::kafka_source_details(sql).unwrap_err();
+        assert!(err.contains("missing TOPIC"), "wrong error message: {err}");
+    }
+
+    #[mz_ore::test]
+    fn kafka_unquoted_topic_and_prefix() {
+        // Planning accepts a bare identifier for TOPIC / GROUP ID PREFIX, and it
+        // persists unquoted in create_sql. Matching only quoted strings would
+        // drop TOPIC and error the whole mz_kafka_source_tables view.
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
+             (TOPIC = my_topic, GROUP ID PREFIX = my_prefix) FORMAT TEXT";
+        let out = super::kafka_source_details(sql).expect("ok");
+        assert_eq!(out["topic"], json!("my_topic"));
+        assert_eq!(out["group_id_prefix"], json!("my_prefix"));
+    }
+
+    #[mz_ore::test]
+    fn kafka_unresolved_connection_errors() {
+        // A bare-name connection reference never happens after purification,
+        // but the decoder must reject it explicitly rather than silently
+        // dropping the connection_id.
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION k_conn (TOPIC 'test') FORMAT TEXT";
+        let err = super::kafka_source_details(sql).unwrap_err();
+        assert!(
+            err.contains("unresolved item name"),
+            "wrong error message: {err}"
+        );
+    }
+
+    // --- parse_source_export_details -----------------------------------------
+
+    fn table_from_source_sql(reference: &str, suffix: &str) -> String {
+        format!(
+            "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
+             FROM SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
+             (REFERENCE = {reference}){suffix}"
+        )
+    }
+
+    #[mz_ore::test]
+    fn export_table_postgres_style_no_format() {
+        // Postgres/mysql/sql-server tables carry a multi-part external
+        // reference and no format or envelope.
+        let sql = table_from_source_sql("\"db\".\"public\".\"t\"", "");
+        let out = super::source_export_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "source_id": "u1",
+                "external_reference": ["db", "public", "t"],
+                "envelope_type": null,
+                "key_format": null,
+                "value_format": null,
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn export_table_kafka_bare_value_only() {
+        // A bare non-registry FORMAT is value-only: no key format.
+        let sql = table_from_source_sql("\"topic\"", " FORMAT TEXT ENVELOPE NONE");
+        let out = super::source_export_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "source_id": "u1",
+                "external_reference": ["topic"],
+                "envelope_type": "none",
+                "key_format": null,
+                "value_format": "text",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn export_table_kafka_omitted_envelope_is_null() {
+        // Omitting ENVELOPE persists as absent in create_sql, so this
+        // source-type-agnostic helper reports null. The mz_kafka_source_tables
+        // view is responsible for defaulting kafka's null envelope to 'none'.
+        let sql = table_from_source_sql("\"topic\"", " FORMAT TEXT");
+        let out = super::source_export_details(&sql).expect("ok");
+        assert_eq!(out["envelope_type"], serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    fn export_table_kafka_key_value_format() {
+        let sql = table_from_source_sql(
+            "\"topic\"",
+            " KEY FORMAT TEXT VALUE FORMAT TEXT ENVELOPE NONE",
+        );
+        let out = super::source_export_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "source_id": "u1",
+                "external_reference": ["topic"],
+                "envelope_type": "none",
+                "key_format": "text",
+                "value_format": "text",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn export_table_kafka_bare_avro_seed_with_key() {
+        // A bare Avro CSR format whose seed carries a key schema resolves to
+        // an encoding with a key, so key_format mirrors value_format. This is
+        // the upsert/debezium path.
+        let sql = table_from_source_sql(
+            "\"topic\"",
+            " FORMAT AVRO USING CONFLUENT SCHEMA REGISTRY \
+             CONNECTION [u5 AS \"materialize\".\"public\".\"csr\"] \
+             SEED KEY SCHEMA 'k' VALUE SCHEMA 'v' ENVELOPE UPSERT",
+        );
+        let out = super::source_export_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "source_id": "u1",
+                "external_reference": ["topic"],
+                "envelope_type": "upsert",
+                "key_format": "avro",
+                "value_format": "avro",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn export_table_kafka_bare_avro_seed_without_key() {
+        // A bare Avro CSR seed with only a value schema is value-only.
+        let sql = table_from_source_sql(
+            "\"topic\"",
+            " FORMAT AVRO USING CONFLUENT SCHEMA REGISTRY \
+             CONNECTION [u5 AS \"materialize\".\"public\".\"csr\"] \
+             SEED VALUE SCHEMA 'v' ENVELOPE NONE",
+        );
+        let out = super::source_export_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "source_id": "u1",
+                "external_reference": ["topic"],
+                "envelope_type": "none",
+                "key_format": null,
+                "value_format": "avro",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn export_subsource_non_progress() {
+        // Old-syntax subsource: external reference lives in a WITH option, and
+        // there is never a format or envelope.
+        let sql = "CREATE SUBSOURCE \"materialize\".\"public\".\"sub\" (id int4) \
+             OF SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
+             WITH (EXTERNAL REFERENCE = \"db\".\"public\".\"t\")";
+        let out = super::source_export_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "source_id": "u1",
+                "external_reference": ["db", "public", "t"],
+                "envelope_type": null,
+                "key_format": null,
+                "value_format": null,
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn export_progress_subsource_returns_null_jsonb() {
+        let sql = "CREATE SUBSOURCE \"materialize\".\"public\".\"progress\" (id int4) \
+             WITH (PROGRESS)";
+        let out = super::source_export_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn export_non_source_export_returns_null_jsonb() {
+        let sql = "CREATE VIEW v AS SELECT 1";
+        let out = super::source_export_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    fn export_unresolved_source_name_errors() {
+        let sql = "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
+             FROM SOURCE src (REFERENCE = \"topic\")";
+        let err = super::source_export_details(sql).unwrap_err();
+        assert!(
+            err.contains("unresolved item name"),
+            "wrong error message: {err}"
+        );
+    }
+
+    // --- parse_connection_details --------------------------------------------
+
+    #[mz_ore::test]
+    fn connection_kafka_single_broker_default_progress() {
+        // No explicit PROGRESS TOPIC: the helper leaves it null and the view
+        // reconstructs the default.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
+             (BROKER = 'localhost:9092', SECURITY PROTOCOL = plaintext)";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "brokers": ["localhost:9092"],
+                "progress_topic": null,
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_kafka_explicit_progress_topic() {
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
+             (BROKER = 'localhost:9092', PROGRESS TOPIC = 'override', \
+              SECURITY PROTOCOL = plaintext)";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "brokers": ["localhost:9092"],
+                "progress_topic": "override",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_kafka_broker_list() {
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
+             (BROKERS ('b1:9092', 'b2:9092'), SECURITY PROTOCOL = plaintext)";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "brokers": ["b1:9092", "b2:9092"],
+                "progress_topic": null,
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_ssh_public_keys() {
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO SSH TUNNEL \
+             (HOST = 'ssh.example.com', PORT = 22, USER = 'mz', \
+              PUBLIC KEY 1 = 'ssh-ed25519 AAAA', PUBLIC KEY 2 = 'ssh-ed25519 BBBB')";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "public_key_1": "ssh-ed25519 AAAA",
+                "public_key_2": "ssh-ed25519 BBBB",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_aws_credentials_inline_key() {
+        // Inline ACCESS KEY ID, secret SECRET ACCESS KEY. Assume-role columns
+        // stay null and auth_kind is credentials.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
+             (ACCESS KEY ID = 'AKIAEXAMPLE', \
+              SECRET ACCESS KEY = SECRET [u1 AS \"materialize\".\"public\".\"sk\"])";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "auth_kind": "credentials",
+                "endpoint": null,
+                "region": null,
+                "access_key_id": "AKIAEXAMPLE",
+                "access_key_id_secret_id": null,
+                "secret_access_key_secret_id": "u1",
+                "session_token": null,
+                "session_token_secret_id": null,
+                "assume_role_arn": null,
+                "assume_role_session_name": null,
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_aws_credentials_secret_key_and_session_token() {
+        // Every credential provided as a secret reference lands in the matching
+        // *_secret_id column as the referenced secret's catalog id.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
+             (ENDPOINT = 'http://localhost', REGION = 'us-east-1', \
+              ACCESS KEY ID = SECRET [u1 AS \"materialize\".\"public\".\"ak\"], \
+              SECRET ACCESS KEY = SECRET [u2 AS \"materialize\".\"public\".\"sk\"], \
+              SESSION TOKEN = SECRET [u3 AS \"materialize\".\"public\".\"st\"])";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "auth_kind": "credentials",
+                "endpoint": "http://localhost",
+                "region": "us-east-1",
+                "access_key_id": null,
+                "access_key_id_secret_id": "u1",
+                "secret_access_key_secret_id": "u2",
+                "session_token": null,
+                "session_token_secret_id": "u3",
+                "assume_role_arn": null,
+                "assume_role_session_name": null,
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_aws_assume_role() {
+        // Assume-role sets auth_kind and the assume-role columns; credential
+        // columns stay null.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
+             (ASSUME ROLE ARN 'arn:aws:iam::123:role/mz', \
+              ASSUME ROLE SESSION NAME 'sess')";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "auth_kind": "assume-role",
+                "endpoint": null,
+                "region": null,
+                "access_key_id": null,
+                "access_key_id_secret_id": null,
+                "secret_access_key_secret_id": null,
+                "session_token": null,
+                "session_token_secret_id": null,
+                "assume_role_arn": "arn:aws:iam::123:role/mz",
+                "assume_role_session_name": "sess",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn connection_kafka_unquoted_progress_topic() {
+        // A bare identifier PROGRESS TOPIC persists unquoted in create_sql. The
+        // helper must surface it, else the view substitutes the default topic.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
+             (BROKER = 'localhost:9092', PROGRESS TOPIC = my_topic, \
+              SECURITY PROTOCOL = plaintext)";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(out["progress_topic"], json!("my_topic"));
+    }
+
+    #[mz_ore::test]
+    fn connection_aws_unquoted_option_values() {
+        // Planning accepts bare identifiers for these options and persists them
+        // unquoted. The helper must surface them, not fall back to NULL.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
+             (ENDPOINT = localhost, REGION = useast1, \
+              ASSUME ROLE ARN 'arn:aws:iam::123:role/mz', \
+              ASSUME ROLE SESSION NAME = mysession)";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(out["endpoint"], json!("localhost"));
+        assert_eq!(out["region"], json!("useast1"));
+        assert_eq!(out["assume_role_session_name"], json!("mysession"));
+    }
+
+    #[mz_ore::test]
+    fn connection_aws_empty_endpoint_is_null() {
+        // Planning coerces ENDPOINT = '' to None, so the packer wrote NULL. The
+        // view must match, not report an empty string.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
+             (ENDPOINT = '', ASSUME ROLE ARN 'arn:aws:iam::123:role/mz')";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(out["endpoint"], serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    fn connection_other_type_returns_null_jsonb() {
+        // A connection type without a detail view (postgres) yields null.
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO POSTGRES \
+             (HOST = 'db', DATABASE = 'postgres', USER = 'mz')";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn connection_non_connection_returns_null_jsonb() {
+        let sql = "CREATE VIEW v AS SELECT 1";
+        let out = super::connection_details(sql).expect("ok");
+        assert_eq!(out, serde_json::Value::Null);
+    }
+
+    // --- parse_catalog_create_sql envelope_type ------------------------------
+
+    #[mz_ore::test]
+    fn catalog_kafka_old_syntax_omitted_envelope_defaults_none() {
+        // An old-syntax kafka source (carries EXPOSE PROGRESS AS) ingests into
+        // its own relation, so an omitted ENVELOPE means the default NONE, which
+        // the pre-MV packer reported as 'none'.
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
+             (TOPIC 'test') FORMAT TEXT \
+             EXPOSE PROGRESS AS [u12 AS \"materialize\".\"public\".\"k_progress\"]";
+        let out = super::item_details(sql).expect("ok");
+        assert_eq!(out["envelope_type"], json!("none"));
+    }
+
+    #[mz_ore::test]
+    fn catalog_kafka_old_syntax_explicit_envelope() {
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
+             (TOPIC 'test') FORMAT BYTES ENVELOPE UPSERT \
+             EXPOSE PROGRESS AS [u12 AS \"materialize\".\"public\".\"k_progress\"]";
+        let out = super::item_details(sql).expect("ok");
+        assert_eq!(out["envelope_type"], json!("upsert"));
+    }
+
+    #[mz_ore::test]
+    fn catalog_kafka_new_syntax_source_omits_envelope_type() {
+        // A new-syntax kafka source has no progress subsource (no EXPOSE PROGRESS
+        // AS). It ingests nothing itself. Envelopes live on the per-table exports,
+        // so its own envelope_type stays absent (SQL NULL).
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k\" \
+             IN CLUSTER [u42] \
+             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"]";
+        let out = super::item_details(sql).expect("ok");
+        assert_eq!(out.get("envelope_type"), None);
+    }
+
+    #[mz_ore::test]
+    fn catalog_non_kafka_source_omits_envelope_type() {
+        // Non-kafka sources carry no envelope, so envelope_type stays absent
+        // (SQL NULL), not 'none'.
+        let sql = "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
+             IN CLUSTER [u42] FROM LOAD GENERATOR COUNTER";
+        let out = super::item_details(sql).expect("ok");
+        assert_eq!(out.get("envelope_type"), None);
+    }
+
+    // --- parse_catalog_create_sql, CreateSink arm ----------------------------
+
+    const AVRO_FORMAT: &str = "FORMAT AVRO USING CONFLUENT SCHEMA REGISTRY CONNECTION \
+         [u12 AS \"materialize\".\"public\".\"csr_conn\"]";
+
+    /// A persisted kafka-sink `create_sql`: resolved names, and a `TOPIC` that
+    /// planning guarantees.
+    fn kafka_sink_sql(key: Option<&str>, format: &str, envelope: &str) -> String {
+        let key_clause = key.map(|k| format!(" KEY ({k})")).unwrap_or_default();
+        format!(
+            "CREATE SINK \"materialize\".\"public\".\"snk\" \
+             IN CLUSTER [u42] \
+             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+             INTO KAFKA CONNECTION [u10 AS \"materialize\".\"public\".\"k_conn\"] \
+             (TOPIC 'sink-topic'){key_clause} {format} ENVELOPE {envelope}"
+        )
+    }
+
+    fn iceberg_sink_sql(mode: &str) -> String {
+        format!(
+            "CREATE SINK \"materialize\".\"public\".\"ice\" \
+             IN CLUSTER [u42] \
+             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+             INTO ICEBERG CATALOG CONNECTION [u20 AS \"materialize\".\"public\".\"cat_conn\"] \
+             (NAMESPACE 'ns', TABLE 'tbl') \
+             USING AWS CONNECTION [u21 AS \"materialize\".\"public\".\"aws_conn\"] \
+             MODE {mode}"
+        )
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_bare_format_without_key() {
+        let sql = kafka_sink_sql(None, "FORMAT JSON", "DEBEZIUM");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "type": "sink",
+                "sink_type": "kafka",
+                "cluster_id": "u42",
+                "connection_id": "u10",
+                "topic": "sink-topic",
+                "envelope_type": "debezium",
+                "format": "json",
+                "value_format": "json",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_bare_format_with_key_derives_key_format() {
+        // A bare format applies to the key too once the sink has a KEY, which
+        // is what makes the deprecated `format` column collapse to `avro`.
+        let sql = kafka_sink_sql(Some("a"), AVRO_FORMAT, "UPSERT");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "type": "sink",
+                "sink_type": "kafka",
+                "cluster_id": "u42",
+                "connection_id": "u10",
+                "topic": "sink-topic",
+                "envelope_type": "upsert",
+                "format": "avro",
+                "key_format": "avro",
+                "value_format": "avro",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_bare_text_format_with_key_does_not_collapse() {
+        // Only avro/avro and json/json collapse, so a keyed text sink reports
+        // the composite form even though both halves are `text`.
+        let sql = kafka_sink_sql(Some("a"), "FORMAT TEXT", "UPSERT");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(out["format"], json!("key-text-value-text"));
+        assert_eq!(out["key_format"], json!("text"));
+        assert_eq!(out["value_format"], json!("text"));
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_key_value_json_collapses() {
+        let sql = kafka_sink_sql(Some("a"), "KEY FORMAT JSON VALUE FORMAT JSON", "UPSERT");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(out["format"], json!("json"));
+        assert_eq!(out["key_format"], json!("json"));
+        assert_eq!(out["value_format"], json!("json"));
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_key_value_mixed_is_composite() {
+        let sql = kafka_sink_sql(Some("a"), "KEY FORMAT TEXT VALUE FORMAT BYTES", "UPSERT");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(out["format"], json!("key-text-value-bytes"));
+        assert_eq!(out["key_format"], json!("text"));
+        assert_eq!(out["value_format"], json!("bytes"));
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_key_format_without_key_is_dropped() {
+        // `kafka_sink_builder` ignores the key half of the format spec when the
+        // sink has no KEY, so neither `key_format` nor the composite `format`
+        // may reflect it.
+        let sql = kafka_sink_sql(None, "KEY FORMAT JSON VALUE FORMAT TEXT", "DEBEZIUM");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(out["format"], json!("text"));
+        assert_eq!(out["key_format"], serde_json::Value::Null);
+        assert_eq!(out["value_format"], json!("text"));
+    }
+
+    #[mz_ore::test]
+    fn sink_kafka_missing_topic_errors() {
+        let sql = "CREATE SINK \"materialize\".\"public\".\"snk\" \
+             IN CLUSTER [u42] \
+             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+             INTO KAFKA CONNECTION [u10 AS \"materialize\".\"public\".\"k_conn\"] \
+             FORMAT JSON ENVELOPE DEBEZIUM";
+        let err = super::item_details(sql).unwrap_err();
+        assert!(err.contains("missing TOPIC"), "wrong error message: {err}");
+    }
+
+    #[mz_ore::test]
+    fn sink_iceberg_upsert_mode() {
+        let sql = iceberg_sink_sql("UPSERT");
+        let out = super::item_details(&sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "type": "sink",
+                "sink_type": "iceberg",
+                "cluster_id": "u42",
+                // The catalog connection, never the AWS connection (u21).
+                "connection_id": "u20",
+                "namespace": "ns",
+                "table": "tbl",
+                "envelope_type": "upsert",
+            }),
+        );
+    }
+
+    #[mz_ore::test]
+    fn sink_iceberg_append_mode() {
+        let sql = iceberg_sink_sql("APPEND");
+        let out = super::item_details(&sql).expect("ok");
+        // `append` is reachable only through an iceberg sink's MODE.
+        assert_eq!(out["envelope_type"], json!("append"));
+    }
+
+    #[mz_ore::test]
+    fn sink_iceberg_missing_table_errors() {
+        let sql = "CREATE SINK \"materialize\".\"public\".\"ice\" \
+             IN CLUSTER [u42] \
+             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+             INTO ICEBERG CATALOG CONNECTION [u20 AS \"materialize\".\"public\".\"cat_conn\"] \
+             (NAMESPACE 'ns') MODE UPSERT";
+        let err = super::item_details(sql).unwrap_err();
+        assert!(err.contains("missing TABLE"), "wrong error message: {err}");
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn sink_arm_leaves_other_item_types_alone() {
+        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS SELECT 1";
+        let out = super::item_details(sql).expect("ok");
+        assert_eq!(out, json!({ "type": "view", "definition": "SELECT 1;" }));
+    }
+
+    // --- parse_catalog_create_sql --------------------------------------------
+
+    /// `type` for a `create_sql`, or the error message if parsing failed.
+    fn item_type(sql: &str) -> Result<String, String> {
+        match super::item_details(sql) {
+            Ok(out) => match out {
+                serde_json::Value::Object(mut m) => match m.remove("type") {
+                    Some(serde_json::Value::String(s)) => Ok(s),
+                    other => panic!("no string `type` key: {other:?}"),
+                },
+                other => panic!("not a JSON object: {other:?}"),
+            },
+            Err(msg) => Err(msg),
+        }
+    }
+
+    fn view_sql(query: &str) -> String {
+        format!("CREATE VIEW \"materialize\".\"public\".\"v\" AS {query}")
+    }
+
+    /// `definition` for a `CREATE VIEW` whose query is `query`.
+    fn view_definition(query: &str) -> String {
+        match super::item_details(&view_sql(query)).expect("ok") {
+            serde_json::Value::Object(mut m) => match m.remove("definition") {
+                Some(serde_json::Value::String(s)) => s,
+                other => panic!("no string `definition` key: {other:?}"),
+            },
+            other => panic!("not a JSON object: {other:?}"),
+        }
+    }
+
+    /// `mz_tables` and `mz_views` select rows by
+    /// `parse_catalog_create_sql(...)->>'type'`, and the function runs over
+    /// every `Item` row in the catalog, so a statement kind that changes its
+    /// reported type silently gains or loses rows in those relations. Pin the
+    /// type of every kind the catalog can hold.
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn catalog_item_type_per_statement_kind() {
+        let cases = [
+            (
+                "CREATE TABLE \"materialize\".\"public\".\"t\" (a int4)",
+                "table",
+            ),
+            // A table created from a source, and a webhook table, are both
+            // `table`, so both land in mz_tables.
+            (
+                "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
+                 FROM SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
+                 (REFERENCE = \"topic\") FORMAT TEXT",
+                "table",
+            ),
+            (
+                "CREATE TABLE \"materialize\".\"public\".\"wht\" FROM WEBHOOK BODY FORMAT JSON",
+                "table",
+            ),
+            (
+                "CREATE VIEW \"materialize\".\"public\".\"v\" AS SELECT 1",
+                "view",
+            ),
+            (
+                "CREATE MATERIALIZED VIEW \"materialize\".\"public\".\"mv\" \
+                 IN CLUSTER [u1] AS SELECT 1",
+                "materialized-view",
+            ),
+            (
+                "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
+                 IN CLUSTER [u1] FROM LOAD GENERATOR COUNTER",
+                "source",
+            ),
+            (
+                "CREATE SOURCE \"materialize\".\"public\".\"wh\" \
+                 IN CLUSTER [u1] FROM WEBHOOK BODY FORMAT JSON",
+                "source",
+            ),
+            (
+                "CREATE SUBSOURCE \"materialize\".\"public\".\"sub\" (id int4) \
+                 OF SOURCE [u1 AS \"materialize\".\"public\".\"src\"]",
+                "subsource",
+            ),
+            (
+                "CREATE SUBSOURCE \"materialize\".\"public\".\"progress\" (id int4) \
+                 WITH (PROGRESS)",
+                "subsource",
+            ),
+            (
+                "CREATE SINK \"materialize\".\"public\".\"snk\" IN CLUSTER [u1] \
+                 FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+                 INTO KAFKA CONNECTION [u2 AS \"materialize\".\"public\".\"c\"] \
+                 (TOPIC 'tp') FORMAT JSON ENVELOPE DEBEZIUM",
+                "sink",
+            ),
+            (
+                "CREATE INDEX \"i\" IN CLUSTER [u1] \
+                 ON [u1 AS \"materialize\".\"public\".\"t\"] (\"a\")",
+                "index",
+            ),
+            (
+                "CREATE TYPE \"materialize\".\"public\".\"ty\" AS LIST (ELEMENT TYPE = int4)",
+                "type",
+            ),
+            (
+                "CREATE SECRET \"materialize\".\"public\".\"s\" AS 'x'",
+                "secret",
+            ),
+            (
+                "CREATE CONNECTION \"materialize\".\"public\".\"c\" \
+                 TO KAFKA (BROKER 'b', SECURITY PROTOCOL PLAINTEXT)",
+                "connection",
+            ),
+        ];
+        for (sql, expected) in cases {
+            assert_eq!(item_type(sql).as_deref(), Ok(expected), "for {sql}");
+        }
+    }
+
+    /// `mz_views.definition` is produced here. It used to be produced by
+    /// `pack_view_update` in the adapter, so the exact rendering is a
+    /// compatibility surface: `pg_views.definition` reads it.
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn catalog_view_definition() {
+        // Identifiers and function names come back fully quoted, literals
+        // untouched, and PostgreSQL's trailing semicolon is appended.
+        assert_eq!(view_definition("SELECT 1"), "SELECT 1;");
+        assert_eq!(
+            view_definition("WITH c AS (SELECT 1 AS a) SELECT a FROM c"),
+            "WITH \"c\" AS (SELECT 1 AS \"a\") SELECT \"a\" FROM \"c\";"
+        );
+        assert_eq!(
+            view_definition("SELECT 1 UNION ALL SELECT 2"),
+            "SELECT 1 UNION ALL SELECT 2;"
+        );
+        assert_eq!(
+            view_definition("SELECT (SELECT max(a) FROM [u1 AS \"materialize\".\"public\".\"t\"])"),
+            "SELECT (SELECT \"max\"(\"a\") FROM [u1 AS \"materialize\".\"public\".\"t\"]);"
+        );
+        // Identifiers needing quotes, an embedded double quote, non-ASCII, an
+        // embedded single quote in a literal, and ORDER BY all survive.
+        assert_eq!(
+            view_definition(
+                "SELECT \"a b\", \"héllo\", \"q\"\"x\" \
+                 FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+                 WHERE s = 'lit''eral' AND n = 42 ORDER BY 1"
+            ),
+            "SELECT \"a b\", \"héllo\", \"q\"\"x\" \
+             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+             WHERE \"s\" = 'lit''eral' AND \"n\" = 42 ORDER BY 1;"
+        );
+    }
+
+    /// The rendering must be a fixed point: `pg_views` consumers re-issue
+    /// `definition` as the body of a new view, so a second pass through the
+    /// parser has to produce the identical string. The trailing `;` is part of
+    /// what gets re-parsed.
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn catalog_view_definition_is_idempotent() {
+        for query in [
+            "SELECT 1",
+            "WITH c AS (SELECT 1 AS a) SELECT a FROM c",
+            "SELECT 1 UNION ALL SELECT 2",
+            "SELECT \"a b\", \"q\"\"x\" FROM [u1 AS \"materialize\".\"public\".\"t\"] \
+             WHERE s = 'lit''eral' ORDER BY 1",
+        ] {
+            let once = view_definition(query);
+            assert_eq!(
+                view_definition(&once),
+                once,
+                "not a fixed point for {query}"
+            );
+        }
+    }
+
+    /// `mz_tables.source_id` comes from this key. A table with no source must
+    /// omit it entirely, so the MV's `->>'source_id'` yields SQL NULL.
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn catalog_table_source_id() {
+        let from_source = super::item_details(
+            "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
+                 FROM SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
+                 (REFERENCE = \"topic\") FORMAT TEXT",
+        )
+        .expect("ok");
+        assert_eq!(from_source, json!({ "type": "table", "source_id": "u1" }));
+
+        for sql in [
+            "CREATE TABLE \"materialize\".\"public\".\"t\" (a int4)",
+            "CREATE TABLE \"materialize\".\"public\".\"wht\" FROM WEBHOOK BODY FORMAT JSON",
+        ] {
+            assert_eq!(
+                super::item_details(sql).expect("ok"),
+                json!({ "type": "table" }),
+                "for {sql}"
+            );
+        }
+    }
+
+    /// Every error here is fatal to the whole of `mz_tables`/`mz_views`, not to
+    /// one row: the MVs call this function inside their `WHERE` clause, so an
+    /// item the parser rejects makes the relation unreadable for everyone.
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn catalog_create_sql_errors() {
+        assert_eq!(
+            item_type("this is not sql"),
+            Err(
+                "failed to parse create_sql: Expected a keyword at the beginning of a statement, \
+                 found identifier \"this\""
+                    .to_string()
+            )
+        );
+        assert_eq!(
+            item_type("CREATE TABLE t (a int4); CREATE TABLE u (b int4)"),
+            Err("expected a single statement, found 2".to_string())
+        );
+        // A statement that is not a CREATE of a catalog item, e.g. if a future
+        // change persists something else in an Item record.
+        assert_eq!(
+            item_type("SELECT 1"),
+            Err("not a CREATE item statement".to_string())
+        );
+        // Catalog `create_sql` always names items by id. An unresolved name
+        // means the record was written wrong.
+        assert_eq!(
+            item_type(
+                "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
+                 FROM SOURCE src (REFERENCE = \"topic\")"
+            ),
+            Err("unresolved item name".to_string())
+        );
+    }
+
+    // --- parse_catalog_item_references ----------------------------------------
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn item_references_view() {
+        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS \
+             SELECT \"pg_catalog\".\"abs\"(\"a\"::[s20 AS \"pg_catalog\".\"int4\"]) \
+             FROM [u1 AS \"materialize\".\"public\".\"t\"]";
+        let out = super::item_references(sql).expect("ok");
+        assert_eq!(
+            out,
+            json!({
+                "ids": ["s20", "u1"],
+                "named_funcs": [{"schema": "pg_catalog", "name": "abs"}],
+                "named_types": [],
+                "named_relations": [],
+            })
+        );
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn item_references_connection() {
+        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"kc\" TO KAFKA (\
+             BROKER 'kafka:9092', \
+             SSH TUNNEL [u5 AS \"materialize\".\"public\".\"ssh\"], \
+             SASL PASSWORD = SECRET [u7 AS \"materialize\".\"public\".\"pw\"])";
+        let out = super::item_references(sql).expect("ok");
+        assert_eq!(out["ids"], json!(["u5", "u7"]));
+        assert_eq!(out["named_funcs"], json!([]));
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn item_references_cte_shadowing() {
+        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS \
+             WITH \"c\" AS (SELECT * FROM [u1 AS \"materialize\".\"public\".\"t\"]) \
+             SELECT * FROM \"c\"";
+        let out = super::item_references(sql).expect("ok");
+        assert_eq!(out["ids"], json!(["u1"]));
+        assert_eq!(out["named_relations"], json!([]));
+    }
+
+    #[mz_ore::test]
+    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
+    fn item_references_name_based_relation_surfaces() {
+        // Stored SQL always prints relations as id references. A name-based
+        // relation must surface in "named_relations" rather than vanish.
+        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS \
+             SELECT * FROM \"mz_catalog\".\"mz_tables\"";
+        let out = super::item_references(sql).expect("ok");
+        assert_eq!(
+            out["named_relations"],
+            json!([{"schema": "mz_catalog", "name": "mz_tables"}])
+        );
+    }
+
+    #[mz_ore::test]
+    fn item_references_parse_error() {
+        let err = super::item_references("NOT SQL").unwrap_err();
+        assert!(
+            err.contains("failed to parse"),
+            "wrong error message: {err}"
+        );
+    }
+}
diff --git a/src/catalog-decode/src/durable.rs b/src/catalog-decode/src/durable.rs
new file mode 100644
index 0000000000000..6fdd592bbc9a6
--- /dev/null
+++ b/src/catalog-decode/src/durable.rs
@@ -0,0 +1,146 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Decoders for values in their durable catalog JSON encoding, the serde shape
+//! of the `mz-catalog-protos` types.
+
+use mz_repr::Datum;
+use mz_repr::adt::jsonb::JsonbRef;
+use mz_repr::adt::mz_acl_item::{AclMode, MzAclItem};
+use mz_repr::adt::numeric;
+use mz_repr::role_id::RoleId;
+
+/// Converts a JSONB `Datum` into a `u64`.
+fn jsonb_datum_to_u64<'a>(d: Datum<'a>) -> Result<u64, String> {
+    let Datum::Numeric(n) = d else {
+        return Err("expected numeric value".into());
+    };
+
+    let mut cx = numeric::cx_datum();
+    cx.try_into_u64(n.0)
+        .map_err(|_| format!("number out of u64 range: {n}"))
+}
+
+/// Decodes a JSONB object of shape `{"bitflags": <u64>}` into an `AclMode`.
+///
+/// Shared decoder for [`privileges`] (which embeds the object as the
+/// `acl_mode` field of each privilege) and [`acl_mode`] (which receives the
+/// object at the top level).
+fn jsonb_datum_to_acl_mode(d: Datum) -> Result<AclMode, String> {
+    let Datum::Map(dict) = d else {
+        return Err(format!("unexpected acl_mode: {d}"));
+    };
+    let mut bits = None;
+    for (key, val) in dict.iter() {
+        match key {
+            "bitflags" => bits = Some(jsonb_datum_to_u64(val)?),
+            other => return Err(format!("unexpected acl_mode field: {other}")),
+        }
+    }
+    let bits = bits.ok_or_else(|| "missing acl_mode bitflags".to_string())?;
+    AclMode::from_bits(bits).ok_or_else(|| format!("invalid acl_mode bitflags: {bits}"))
+}
+
+/// Converts a JSONB `Datum` into a `RoleId`.
+fn jsonb_datum_to_role_id(d: Datum) -> Result<RoleId, String> {
+    match d {
+        Datum::String("Public") => Ok(RoleId::Public),
+        Datum::String(other) => Err(format!("unexpected role ID variant: {other}")),
+        Datum::Map(dict) => {
+            let (key, val) = dict.iter().next().ok_or_else(|| "empty".to_string())?;
+            let n = jsonb_datum_to_u64(val)?;
+            match key {
+                "User" => Ok(RoleId::User(n)),
+                "System" => Ok(RoleId::System(n)),
+                "Predefined" => Ok(RoleId::Predefined(n)),
+                other => Err(format!("unexpected role ID variant: {other}")),
+            }
+        }
+        _ => Err("expected string or object".into()),
+    }
+}
+
+/// Converts a catalog JSON-serialized ID value into the appropriate string format.
+///
+/// Supports all of Materialize's various ID types of the form `<prefix><u64>`.
+pub fn catalog_id(a: JsonbRef<'_>) -> Result<String, String> {
+    match a.into_datum() {
+        // Unit variant, e.g. "Public"
+        Datum::String(variant) => match variant {
+            "Explain" => Ok("e".to_string()),
+            "Public" => Ok("p".to_string()),
+            other => Err(format!("unexpected ID variant: {other}")),
+        },
+        // Newtype variant, e.g. {"User": 1}
+        Datum::Map(dict) => {
+            let (key, val) = dict.iter().next().ok_or_else(|| "empty".to_string())?;
+            let prefix = match key {
+                "IntrospectionSourceIndex" => "si",
+                "Predefined" => "g",
+                "System" => "s",
+                "Transient" => "t",
+                "User" => "u",
+                other => return Err(format!("unexpected ID variant: {other}")),
+            };
+            let n = jsonb_datum_to_u64(val)?;
+            Ok(format!("{prefix}{n}"))
+        }
+        _ => Err("expected string or object".into()),
+    }
+}
+
+/// Converts a catalog JSON-serialized privilege array into a list of `MzAclItem`s.
+pub fn privileges(a: JsonbRef<'_>) -> Result<Vec<MzAclItem>, String> {
+    let parse_one = |datum| match datum {
+        Datum::Map(dict) => {
+            let mut grantee = None;
+            let mut grantor = None;
+            let mut acl_mode = None;
+            for (key, val) in dict.iter() {
+                match key {
+                    "grantee" => {
+                        let id = jsonb_datum_to_role_id(val)?;
+                        grantee = Some(id);
+                    }
+                    "grantor" => {
+                        let id = jsonb_datum_to_role_id(val)?;
+                        grantor = Some(id);
+                    }
+                    "acl_mode" => {
+                        acl_mode = Some(jsonb_datum_to_acl_mode(val)?);
+                    }
+                    other => return Err(format!("unexpected privilege field: {other}")),
+                }
+            }
+            Ok(MzAclItem {
+                grantee: grantee.ok_or_else(|| format!("missing grantee: {dict:?}"))?,
+                grantor: grantor.ok_or_else(|| "missing grantor in privilege".to_string())?,
+                acl_mode: acl_mode.ok_or_else(|| "missing acl_mode in privilege".to_string())?,
+            })
+        }
+        other => Err(format!("expected object in array, found: {other}")),
+    };
+
+    match a.into_datum() {
+        Datum::List(list) => {
+            let mut result = Vec::new();
+            for item in list.iter() {
+                result.push(parse_one(item)?);
+            }
+            Ok(result)
+        }
+        _ => Err("expected array".to_string()),
+    }
+}
+
+/// Converts a catalog JSON-serialized `AclMode` bitflags object
+/// (e.g. `{"bitflags": 514}`) into an `AclMode`.
+pub fn acl_mode(a: JsonbRef<'_>) -> Result<AclMode, String> {
+    jsonb_datum_to_acl_mode(a.into_datum())
+}
diff --git a/src/catalog-decode/src/lib.rs b/src/catalog-decode/src/lib.rs
new file mode 100644
index 0000000000000..321a21c7610f9
--- /dev/null
+++ b/src/catalog-decode/src/lib.rs
@@ -0,0 +1,22 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Decoders for durable catalog data.
+//!
+//! The builtin catalog views derive their columns from `mz_catalog_raw`, which
+//! exposes catalog objects in their durable encoding. The decoding logic lives
+//! here, and `mz-expr` exposes each decoder as an `mz_internal.parse_*` scalar
+//! function. It sits below `mz-expr` in the dependency graph, so it cannot use
+//! the crates that own the decoded formats (`mz-catalog-protos`, `mz-sql`,
+//! `mz-storage-types`, `mz-audit-log`) and mirrors their shapes instead.
+//! Tests in those crates and the catalog sqllogictests catch drift.
+
+pub mod audit_log;
+pub mod create_sql;
+pub mod durable;
diff --git a/src/compute-types/tests/snapshots/func_registry_source.json b/src/compute-types/tests/snapshots/func_registry_source.json
index 1a141a9baee86..f5aaf0b008968 100644
--- a/src/compute-types/tests/snapshots/func_registry_source.json
+++ b/src/compute-types/tests/snapshots/func_registry_source.json
@@ -527,16 +527,16 @@
     "pad_char": {"display":"padchar","sqlfunc_decl":null,"body_fingerprint":null},
     "pad_char[unbounded]": {"display":"padchar","sqlfunc_decl":null,"body_fingerprint":null},
     "panic": {"display":"mz_panic","sqlfunc_decl":"#[sqlfunc(sqlname = \"mz_panic\")] fn panic<'a>(a: &'a str) -> String","body_fingerprint":"95469a722cc261a6"},
-    "parse_catalog_acl_mode": {"display":"parse_catalog_acl_mode","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_acl_mode<'a>(a: JsonbRef<'a>) -> Result<String, EvalError>","body_fingerprint":"9f9ba9300791097b"},
-    "parse_catalog_audit_log_details": {"display":"parse_catalog_audit_log_details","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_audit_log_details<'a>(a: JsonbRef<'a>) -> Result<Jsonb, EvalError>","body_fingerprint":"4d767508de48e9e0"},
-    "parse_catalog_create_sql": {"display":"parse_catalog_create_sql","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_create_sql<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"525420f3abbc957f"},
-    "parse_catalog_id": {"display":"parse_catalog_id","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_id<'a>(a: JsonbRef<'a>) -> Result<String, EvalError>","body_fingerprint":"cf39474c1e9e1bb9"},
-    "parse_catalog_item_references": {"display":"parse_catalog_item_references","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_item_references<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"3296877cab7a9c6b"},
-    "parse_catalog_privileges": {"display":"parse_catalog_privileges","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_privileges<'a>(a: JsonbRef<'a>) -> Result<ArrayRustType<MzAclItem>, EvalError>","body_fingerprint":"203b2915643066b2"},
-    "parse_connection_details": {"display":"parse_connection_details","sqlfunc_decl":"#[sqlfunc] fn parse_connection_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"4b1754595ee6cc23"},
-    "parse_kafka_source_details": {"display":"parse_kafka_source_details","sqlfunc_decl":"#[sqlfunc] fn parse_kafka_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"da33c684761dac6e"},
-    "parse_postgres_source_details": {"display":"parse_postgres_source_details","sqlfunc_decl":"#[sqlfunc] fn parse_postgres_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"c61ad0624dcc7138"},
-    "parse_source_export_details": {"display":"parse_source_export_details","sqlfunc_decl":"#[sqlfunc] fn parse_source_export_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"b73b420b90bf9bae"},
+    "parse_catalog_acl_mode": {"display":"parse_catalog_acl_mode","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_acl_mode<'a>(a: JsonbRef<'a>) -> Result<String, EvalError>","body_fingerprint":"416a57d9f77c1f57"},
+    "parse_catalog_audit_log_details": {"display":"parse_catalog_audit_log_details","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_audit_log_details<'a>(a: JsonbRef<'a>) -> Result<Jsonb, EvalError>","body_fingerprint":"d71918c119d2ecf5"},
+    "parse_catalog_create_sql": {"display":"parse_catalog_create_sql","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_create_sql<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"826a24b886478cf7"},
+    "parse_catalog_id": {"display":"parse_catalog_id","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_id<'a>(a: JsonbRef<'a>) -> Result<String, EvalError>","body_fingerprint":"3df74fa5b95ad2a3"},
+    "parse_catalog_item_references": {"display":"parse_catalog_item_references","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_item_references<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"afac69531d801621"},
+    "parse_catalog_privileges": {"display":"parse_catalog_privileges","sqlfunc_decl":"#[sqlfunc] fn parse_catalog_privileges<'a>(a: JsonbRef<'a>) -> Result<ArrayRustType<MzAclItem>, EvalError>","body_fingerprint":"0189155db8d73f28"},
+    "parse_connection_details": {"display":"parse_connection_details","sqlfunc_decl":"#[sqlfunc] fn parse_connection_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"479b90a7cbe943f6"},
+    "parse_kafka_source_details": {"display":"parse_kafka_source_details","sqlfunc_decl":"#[sqlfunc] fn parse_kafka_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"8717ae9a730e89a0"},
+    "parse_postgres_source_details": {"display":"parse_postgres_source_details","sqlfunc_decl":"#[sqlfunc] fn parse_postgres_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"00a79828148946a7"},
+    "parse_source_export_details": {"display":"parse_source_export_details","sqlfunc_decl":"#[sqlfunc] fn parse_source_export_details<'a>(a: &'a str) -> Result<Jsonb, EvalError>","body_fingerprint":"a8e38e11bf5b92ac"},
     "pg_column_size": {"display":"pg_column_size","sqlfunc_decl":"#[sqlfunc] fn pg_column_size<'a>(a: Datum<'a>) -> Result<Option<i32>, EvalError>","body_fingerprint":"b7ff6ebfef49b70e"},
     "pg_size_pretty": {"display":"pg_size_pretty","sqlfunc_decl":"#[sqlfunc(sqlname = \"pg_size_pretty\", preserves_uniqueness = false)] fn pg_size_pretty(mut a: Numeric) -> Result<String, EvalError>","body_fingerprint":"c6b922cd4760b991"},
     "quote_ident": {"display":"quote_ident","sqlfunc_decl":"#[sqlfunc(sqlname = \"quote_ident\", preserves_uniqueness = true)] fn quote_ident<'a>(a: &'a str) -> Result<String, EvalError>","body_fingerprint":"bbf06e94673c774c"},
diff --git a/src/expr/Cargo.toml b/src/expr/Cargo.toml
index a914d891dc1e1..ba29ae746a882 100644
--- a/src/expr/Cargo.toml
+++ b/src/expr/Cargo.toml
@@ -40,6 +40,7 @@ hmac.workspace = true
 itertools.workspace = true
 md-5.workspace = true
 murmur2.workspace = true
+mz-catalog-decode = { path = "../catalog-decode" }
 mz-expr-derive = { path = "../expr-derive", features = ["test"] }
 mz-ore = { path = "../ore", features = ["network", "proptest", "id_gen"] }
 mz-persist-types = { path = "../persist-types" }
diff --git a/src/expr/src/scalar/func/impls.rs b/src/expr/src/scalar/func/impls.rs
index a1bbe477d3190..ae00788120800 100644
--- a/src/expr/src/scalar/func/impls.rs
+++ b/src/expr/src/scalar/func/impls.rs
@@ -8,10 +8,10 @@
 // by the Apache License, Version 2.0.
 
 mod array;
-mod audit_log_details;
 mod boolean;
 mod byte;
 mod case_literal;
+mod catalog;
 mod char;
 mod date;
 mod datum;
@@ -43,10 +43,10 @@ mod uuid;
 mod varchar;
 
 pub use crate::scalar::func::impls::array::*;
-pub use crate::scalar::func::impls::audit_log_details::*;
 pub use crate::scalar::func::impls::boolean::*;
 pub use crate::scalar::func::impls::byte::*;
 pub use crate::scalar::func::impls::case_literal::*;
+pub use crate::scalar::func::impls::catalog::*;
 pub use crate::scalar::func::impls::char::*;
 pub use crate::scalar::func::impls::date::*;
 pub use crate::scalar::func::impls::datum::*;
diff --git a/src/expr/src/scalar/func/impls/catalog.rs b/src/expr/src/scalar/func/impls/catalog.rs
new file mode 100644
index 0000000000000..a639394dfe195
--- /dev/null
+++ b/src/expr/src/scalar/func/impls/catalog.rs
@@ -0,0 +1,95 @@
+// Copyright Materialize, Inc. and contributors. All rights reserved.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0.
+
+//! Scalar functions that decode durable catalog data for the builtin catalog
+//! views. The decoders live in `mz_catalog_decode`, documented there.
+
+use mz_catalog_decode::{audit_log, create_sql, durable};
+use mz_expr_derive::sqlfunc;
+use mz_repr::ArrayRustType;
+use mz_repr::adt::jsonb::{Jsonb, JsonbRef};
+use mz_repr::adt::mz_acl_item::MzAclItem;
+
+use crate::EvalError;
+
+fn catalog_err(e: String) -> EvalError {
+    EvalError::InvalidCatalogJson(e.into())
+}
+
+fn to_jsonb(val: serde_json::Value) -> Jsonb {
+    Jsonb::from_serde_json(val).expect("valid JSONB")
+}
+
+#[sqlfunc]
+fn parse_catalog_id<'a>(a: JsonbRef<'a>) -> Result<String, EvalError> {
+    durable::catalog_id(a).map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_catalog_privileges<'a>(a: JsonbRef<'a>) -> Result<ArrayRustType<MzAclItem>, EvalError> {
+    durable::privileges(a)
+        .map(ArrayRustType)
+        .map_err(catalog_err)
+}
+
+/// Returns the PostgreSQL ACL char-code string (e.g. `"ar"`) of a catalog
+/// `AclMode`.
+#[sqlfunc]
+fn parse_catalog_acl_mode<'a>(a: JsonbRef<'a>) -> Result<String, EvalError> {
+    durable::acl_mode(a)
+        .map(|mode| mode.to_string())
+        .map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_catalog_audit_log_details<'a>(a: JsonbRef<'a>) -> Result<Jsonb, EvalError> {
+    audit_log::details(a).map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_catalog_create_sql<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
+    create_sql::item_details(a)
+        .map(to_jsonb)
+        .map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_catalog_item_references<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
+    create_sql::item_references(a)
+        .map(to_jsonb)
+        .map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_postgres_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
+    create_sql::postgres_source_details(a)
+        .map(to_jsonb)
+        .map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_kafka_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
+    create_sql::kafka_source_details(a)
+        .map(to_jsonb)
+        .map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_source_export_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
+    create_sql::source_export_details(a)
+        .map(to_jsonb)
+        .map_err(catalog_err)
+}
+
+#[sqlfunc]
+fn parse_connection_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
+    create_sql::connection_details(a)
+        .map(to_jsonb)
+        .map_err(catalog_err)
+}
diff --git a/src/expr/src/scalar/func/impls/jsonb.rs b/src/expr/src/scalar/func/impls/jsonb.rs
index f21b7109b1b00..92fadbe54f8bd 100644
--- a/src/expr/src/scalar/func/impls/jsonb.rs
+++ b/src/expr/src/scalar/func/impls/jsonb.rs
@@ -7,27 +7,13 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
-use std::collections::BTreeMap;
 use std::fmt;
 
 use mz_expr_derive::sqlfunc;
 use mz_repr::adt::jsonb::{Jsonb, JsonbRef};
-use mz_repr::adt::mz_acl_item::{AclMode, MzAclItem};
 use mz_repr::adt::numeric::{self, Numeric, NumericMaxScale};
-use mz_repr::role_id::RoleId;
-use mz_repr::{ArrayRustType, Datum, Row, RowPacker, SqlColumnType, SqlScalarType, strconv};
-use mz_sql_parser::ast::display::AstDisplay;
-use mz_sql_parser::ast::item_refs::collect_item_references;
-use mz_sql_parser::ast::{
-    AstInfo, AvroSchema, ConnectionOption, ConnectionOptionName, CreateConnectionType,
-    CreateSinkConnection, CreateSubsourceOptionName, Format, FormatSpecifier,
-    IcebergSinkConfigOptionName, IcebergSinkMode, KafkaSinkConfigOptionName,
-    KafkaSourceConfigOptionName, PgConfigOptionName, ProtobufSchema, RawClusterName, RawItemName,
-    SinkEnvelope, SourceEnvelope, SourceErrorPolicy, UnresolvedItemName, Value, WithOptionValue,
-};
-use prost::Message as _;
+use mz_repr::{Datum, Row, RowPacker, SqlColumnType, SqlScalarType, strconv};
 use serde::{Deserialize, Serialize};
-use serde_json::json;
 
 use crate::EvalError;
 use crate::scalar::func::EagerUnaryFunc;
@@ -243,2199 +229,3 @@ fn jsonb_pretty<'a>(a: JsonbRef<'a>) -> String {
     strconv::format_jsonb_pretty(&mut buf, a);
     buf
 }
-
-/// Converts a JSONB `Datum` into a `u64`.
-fn jsonb_datum_to_u64<'a>(d: Datum<'a>) -> Result<u64, String> {
-    let Datum::Numeric(n) = d else {
-        return Err("expected numeric value".into());
-    };
-
-    let mut cx = numeric::cx_datum();
-    cx.try_into_u64(n.0)
-        .map_err(|_| format!("number out of u64 range: {n}"))
-}
-
-/// Decodes a JSONB object of shape `{"bitflags": <u64>}` into an `AclMode`.
-///
-/// Shared decoder for `parse_catalog_privileges` (which embeds the object as
-/// the `acl_mode` field of each privilege) and `parse_catalog_acl_mode` (which
-/// receives the object at the top level).
-fn jsonb_datum_to_acl_mode(d: Datum) -> Result<AclMode, String> {
-    let Datum::Map(dict) = d else {
-        return Err(format!("unexpected acl_mode: {d}"));
-    };
-    let mut bits = None;
-    for (key, val) in dict.iter() {
-        match key {
-            "bitflags" => bits = Some(jsonb_datum_to_u64(val)?),
-            other => return Err(format!("unexpected acl_mode field: {other}")),
-        }
-    }
-    let bits = bits.ok_or_else(|| "missing acl_mode bitflags".to_string())?;
-    AclMode::from_bits(bits).ok_or_else(|| format!("invalid acl_mode bitflags: {bits}"))
-}
-
-/// Converts a JSONB `Datum` into a `RoleId`.
-fn jsonb_datum_to_role_id(d: Datum) -> Result<RoleId, String> {
-    match d {
-        Datum::String("Public") => Ok(RoleId::Public),
-        Datum::String(other) => Err(format!("unexpected role ID variant: {other}")),
-        Datum::Map(dict) => {
-            let (key, val) = dict.iter().next().ok_or_else(|| "empty".to_string())?;
-            let n = jsonb_datum_to_u64(val)?;
-            match key {
-                "User" => Ok(RoleId::User(n)),
-                "System" => Ok(RoleId::System(n)),
-                "Predefined" => Ok(RoleId::Predefined(n)),
-                other => Err(format!("unexpected role ID variant: {other}")),
-            }
-        }
-        _ => Err("expected string or object".into()),
-    }
-}
-
-/// Converts a catalog JSON-serialized ID value into the appropriate string format.
-///
-/// Supports all of Materialize's various ID types of the form `<prefix><u64>`.
-#[sqlfunc]
-fn parse_catalog_id<'a>(a: JsonbRef<'a>) -> Result<String, EvalError> {
-    let parse = || match a.into_datum() {
-        // Unit variant, e.g. "Public"
-        Datum::String(variant) => match variant {
-            "Explain" => Ok("e".to_string()),
-            "Public" => Ok("p".to_string()),
-            other => Err(format!("unexpected ID variant: {other}")),
-        },
-        // Newtype variant, e.g. {"User": 1}
-        Datum::Map(dict) => {
-            let (key, val) = dict.iter().next().ok_or_else(|| "empty".to_string())?;
-            let prefix = match key {
-                "IntrospectionSourceIndex" => "si",
-                "Predefined" => "g",
-                "System" => "s",
-                "Transient" => "t",
-                "User" => "u",
-                other => return Err(format!("unexpected ID variant: {other}")),
-            };
-            let n = jsonb_datum_to_u64(val)?;
-            Ok(format!("{prefix}{n}"))
-        }
-        _ => Err("expected string or object".into()),
-    };
-
-    parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))
-}
-
-/// Converts a catalog JSON-serialized privilege array into an `mz_aclitem[]`.
-#[sqlfunc]
-fn parse_catalog_privileges<'a>(a: JsonbRef<'a>) -> Result<ArrayRustType<MzAclItem>, EvalError> {
-    let parse_one = |datum| match datum {
-        Datum::Map(dict) => {
-            let mut grantee = None;
-            let mut grantor = None;
-            let mut acl_mode = None;
-            for (key, val) in dict.iter() {
-                match key {
-                    "grantee" => {
-                        let id = jsonb_datum_to_role_id(val)?;
-                        grantee = Some(id);
-                    }
-                    "grantor" => {
-                        let id = jsonb_datum_to_role_id(val)?;
-                        grantor = Some(id);
-                    }
-                    "acl_mode" => {
-                        acl_mode = Some(jsonb_datum_to_acl_mode(val)?);
-                    }
-                    other => return Err(format!("unexpected privilege field: {other}")),
-                }
-            }
-            Ok(MzAclItem {
-                grantee: grantee.ok_or_else(|| format!("missing grantee: {dict:?}"))?,
-                grantor: grantor.ok_or_else(|| "missing grantor in privilege".to_string())?,
-                acl_mode: acl_mode.ok_or_else(|| "missing acl_mode in privilege".to_string())?,
-            })
-        }
-        other => Err(format!("expected object in array, found: {other}")),
-    };
-
-    let parse = || match a.into_datum() {
-        Datum::List(list) => {
-            let mut result = Vec::new();
-            for item in list.iter() {
-                result.push(parse_one(item)?);
-            }
-            Ok(result)
-        }
-        _ => Err("expected array".to_string()),
-    };
-
-    parse()
-        .map(ArrayRustType)
-        .map_err(|e| EvalError::InvalidCatalogJson(e.into()))
-}
-
-/// Converts a catalog JSON-serialized `AclMode` bitflags object into a
-/// PostgreSQL ACL char-code string (e.g. `{"bitflags": 514}` → `"ar"`).
-#[sqlfunc]
-fn parse_catalog_acl_mode<'a>(a: JsonbRef<'a>) -> Result<String, EvalError> {
-    jsonb_datum_to_acl_mode(a.into_datum())
-        .map(|mode| mode.to_string())
-        .map_err(|e| EvalError::InvalidCatalogJson(e.into()))
-}
-
-/// Extracts the string form of a `WithOptionValue`, matching how the planner
-/// coerces option values. The blanket `TryFromValue<WithOptionValue<T>>` impl in
-/// `src/sql/src/plan/with_options.rs` accepts a quoted string, a bare identifier,
-/// and a 1-part unresolved item name, all yielding a string. Any other variant
-/// yields None.
-///
-/// `AstDisplay` does not re-quote bare identifiers or 1-part names, so those
-/// forms persist unquoted in `create_sql`. Matching only `Value::String` here
-/// would miss them and silently fall back to a default, so the catalog-raw
-/// parsers below route their string options through this helper.
-fn option_string<T: AstInfo>(value: &WithOptionValue<T>) -> Option<String> {
-    match value {
-        WithOptionValue::Value(Value::String(s)) => Some(s.clone()),
-        WithOptionValue::Ident(ident) => Some(ident.clone().into_string()),
-        WithOptionValue::UnresolvedItemName(UnresolvedItemName(parts)) if parts.len() == 1 => {
-            Some(parts[0].clone().into_string())
-        }
-        _ => None,
-    }
-}
-
-/// Parses a catalog `create_sql` string into a JSONB object.
-///
-/// The returned JSONB does not fully reflect the parsed SQL and instead contains only fields
-/// required by current callers.
-// TODO: This function isn't parsing JSONB and therefore shouldn't live in the `jsonb` module.
-//       Consider moving all the `parse_catalog_*` functions into their own module.
-#[sqlfunc]
-fn parse_catalog_create_sql<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
-    fn get_cluster_id(in_cluster: RawClusterName) -> Result<String, &'static str> {
-        match in_cluster {
-            RawClusterName::Resolved(s) => Ok(s),
-            RawClusterName::Unresolved(_) => Err("unresolved cluster name"),
-        }
-    }
-
-    fn get_item_id(item: RawItemName) -> Result<String, &'static str> {
-        match item {
-            RawItemName::Id(id, _, _) => Ok(id),
-            RawItemName::Name(_) => Err("unresolved item name"),
-        }
-    }
-
-    fn format_name<T: AstInfo>(fmt: &Format<T>) -> &'static str {
-        match fmt {
-            Format::Bytes => "bytes",
-            Format::Avro(_) => "avro",
-            Format::Protobuf(_) => "protobuf",
-            Format::Regex(_) => "regex",
-            Format::Csv { .. } => "csv",
-            Format::Json { .. } => "json",
-            Format::Text => "text",
-        }
-    }
-
-    let parse = || -> Result<serde_json::Value, String> {
-        let mut stmts = mz_sql_parser::parser::parse_statements(a)
-            .map_err(|e| format!("failed to parse create_sql: {e}"))?;
-        let stmt = match stmts.len() {
-            1 => stmts.remove(0).ast,
-            n => return Err(format!("expected a single statement, found {n}")),
-        };
-
-        let mut info = BTreeMap::<&str, serde_json::Value>::new();
-
-        use mz_sql_parser::ast::Statement::*;
-        let item_type = match stmt {
-            CreateSecret(_) => "secret",
-            CreateConnection(stmt) => {
-                let connection_type = stmt.connection_type.as_str();
-                info.insert("connection_type", json!(connection_type));
-
-                "connection"
-            }
-            CreateView(stmt) => {
-                let mut definition = stmt.definition.query.to_ast_string_stable();
-                // PostgreSQL appends a semicolon in `pg_views.definition`, we
-                // do the same for compatibility's sake.
-                definition.push(';');
-                info.insert("definition", json!(definition));
-
-                "view"
-            }
-            CreateMaterializedView(stmt) => {
-                let Some(in_cluster) = stmt.in_cluster else {
-                    return Err("missing IN CLUSTER".into());
-                };
-                let cluster_id = match in_cluster {
-                    RawClusterName::Unresolved(ident) => ident.into_string(),
-                    RawClusterName::Resolved(s) => s,
-                };
-                info.insert("cluster_id", json!(cluster_id));
-
-                let mut definition = stmt.query.to_ast_string_stable();
-                definition.push(';');
-                info.insert("definition", json!(definition));
-
-                "materialized-view"
-            }
-            CreateTable(_) => "table",
-            CreateTableFromSource(stmt) => {
-                let source_id = get_item_id(stmt.source)?;
-                info.insert("source_id", json!(source_id));
-
-                "table"
-            }
-            CreateSource(stmt) => {
-                let Some(in_cluster) = stmt.in_cluster else {
-                    return Err("missing IN CLUSTER".into());
-                };
-                let cluster_id = get_cluster_id(in_cluster)?;
-                info.insert("cluster_id", json!(cluster_id));
-
-                use mz_sql_parser::ast::CreateSourceConnection::*;
-                let (source_type, connection) = match stmt.connection {
-                    Kafka { connection, .. } => ("kafka", Some(connection)),
-                    Postgres { connection, .. } => ("postgres", Some(connection)),
-                    MySql { connection, .. } => ("mysql", Some(connection)),
-                    SqlServer { connection, .. } => ("sql-server", Some(connection)),
-                    LoadGenerator { .. } => ("load-generator", None),
-                };
-                info.insert("source_type", json!(source_type));
-                if let Some(conn) = connection {
-                    let conn_id = get_item_id(conn)?;
-                    info.insert("connection_id", json!(conn_id));
-                }
-
-                let is_debezium = matches!(
-                    stmt.envelope,
-                    Some(mz_sql_parser::ast::SourceEnvelope::Debezium)
-                );
-
-                // An old-syntax kafka source ingests into its own relation, so an
-                // omitted ENVELOPE means the default ENVELOPE NONE and the pre-MV
-                // packer reported 'none'. A new-syntax source (no progress
-                // subsource, hence no EXPOSE PROGRESS AS in create_sql) ingests
-                // nothing itself. Its envelopes live on the per-table exports, so
-                // its own envelope_type stays absent (SQL NULL), matching released
-                // behavior. `progress_subsource.is_some()` is the planner's own
-                // old-vs-new discriminator (see `OldSyntaxIngestion` in
-                // plan_create_source). Non-kafka sources carry no envelope either.
-                // See the `mz_sources.envelope_type` column.
-                let envelope_type = match &stmt.envelope {
-                    Some(envelope) => {
-                        use mz_sql_parser::ast::SourceEnvelope::*;
-                        Some(match envelope {
-                            None => "none",
-                            Debezium => "debezium",
-                            Upsert { .. } => "upsert",
-                            CdcV2 => "materialize",
-                        })
-                    }
-                    None if source_type == "kafka" && stmt.progress_subsource.is_some() => {
-                        Some("none")
-                    }
-                    None => None,
-                };
-                if let Some(envelope_type) = envelope_type {
-                    info.insert("envelope_type", json!(envelope_type));
-                }
-
-                if let Some(format_spec) = stmt.format {
-                    match &format_spec {
-                        FormatSpecifier::Bare(fmt) => {
-                            // Debezium sources with a single format spec implicitly use
-                            // the same format for both key and value.
-                            if is_debezium {
-                                info.insert("key_format", json!(format_name(fmt)));
-                            }
-                            info.insert("value_format", json!(format_name(fmt)));
-                        }
-                        FormatSpecifier::KeyValue { key, value } => {
-                            info.insert("key_format", json!(format_name(key)));
-                            info.insert("value_format", json!(format_name(value)));
-                        }
-                    }
-                }
-
-                "source"
-            }
-            CreateWebhookSource(stmt) => {
-                if stmt.is_table {
-                    "table"
-                } else {
-                    info.insert("source_type", json!("webhook"));
-                    if let Some(in_cluster) = stmt.in_cluster {
-                        let cluster_id = get_cluster_id(in_cluster)?;
-                        info.insert("cluster_id", json!(cluster_id));
-                    }
-                    "source"
-                }
-            }
-            CreateSubsource(stmt) => {
-                use mz_sql_parser::ast::CreateSubsourceOptionName;
-                let is_progress = stmt
-                    .with_options
-                    .iter()
-                    .any(|o| matches!(o.name, CreateSubsourceOptionName::Progress));
-                let source_type = if is_progress { "progress" } else { "subsource" };
-                info.insert("source_type", json!(source_type));
-
-                if let Some(of_source) = stmt.of_source {
-                    let of_source_id = get_item_id(of_source)?;
-                    info.insert("of_source_id", json!(of_source_id));
-                }
-
-                "subsource"
-            }
-            // Everything the mz_sinks, mz_kafka_sinks and mz_iceberg_sinks
-            // views read. The Rust side of each value lives in `Sink` and
-            // `StorageSinkConnection`, so those and this have to move together.
-            //
-            // NOTE: we bail below if a sink has no resolved `IN CLUSTER`, no
-            // `TOPIC` on kafka, or no `NAMESPACE`/`TABLE` on iceberg. Planning
-            // guarantees all four. But if one ever slipped through it would
-            // take down every view built on this function, not just the sink
-            // ones.
-            CreateSink(stmt) => {
-                let Some(in_cluster) = stmt.in_cluster else {
-                    return Err("missing IN CLUSTER".into());
-                };
-                info.insert("cluster_id", json!(get_cluster_id(in_cluster)?));
-
-                match stmt.connection {
-                    CreateSinkConnection::Kafka {
-                        connection,
-                        options,
-                        key: sink_key,
-                        ..
-                    } => {
-                        info.insert("sink_type", json!("kafka"));
-                        info.insert("connection_id", json!(get_item_id(connection)?));
-
-                        let topic = options
-                            .into_iter()
-                            .find(|o| o.name == KafkaSinkConfigOptionName::Topic)
-                            .and_then(|o| o.value.as_ref().and_then(option_string))
-                            .ok_or("kafka sink missing TOPIC")?;
-                        info.insert("topic", json!(topic));
-
-                        if let Some(envelope) = stmt.envelope {
-                            let envelope_type = match envelope {
-                                SinkEnvelope::Upsert => "upsert",
-                                SinkEnvelope::Debezium => "debezium",
-                            };
-                            info.insert("envelope_type", json!(envelope_type));
-                        }
-
-                        if let Some(format_spec) = stmt.format {
-                            // A key format only survives if the sink has a
-                            // `KEY`. Without one `kafka_sink_builder` throws
-                            // away the key half of a key/value spec, and does
-                            // not copy a bare spec over to the key either.
-                            let (key_format, value_format) =
-                                match (&format_spec, sink_key.is_some()) {
-                                    (FormatSpecifier::Bare(fmt), false) => (None, format_name(fmt)),
-                                    (FormatSpecifier::Bare(fmt), true) => {
-                                        (Some(format_name(fmt)), format_name(fmt))
-                                    }
-                                    (FormatSpecifier::KeyValue { value, .. }, false) => {
-                                        (None, format_name(value))
-                                    }
-                                    (FormatSpecifier::KeyValue { key, value }, true) => {
-                                        (Some(format_name(key)), format_name(value))
-                                    }
-                                };
-                            if let Some(key_format) = key_format {
-                                info.insert("key_format", json!(key_format));
-                            }
-                            info.insert("value_format", json!(value_format));
-
-                            // The deprecated combined `format`. Only avro/avro
-                            // and json/json collapse to a single name.
-                            // Everything else, text/text and bytes/bytes
-                            // included, gets the composite form.
-                            let combined = match key_format {
-                                None => value_format.to_string(),
-                                Some(key_format)
-                                    if key_format == value_format
-                                        && matches!(value_format, "avro" | "json") =>
-                                {
-                                    value_format.to_string()
-                                }
-                                Some(key_format) => {
-                                    format!("key-{key_format}-value-{value_format}")
-                                }
-                            };
-                            info.insert("format", json!(combined));
-                        }
-                    }
-                    CreateSinkConnection::Iceberg {
-                        catalog_connection,
-                        options,
-                        ..
-                    } => {
-                        info.insert("sink_type", json!("iceberg"));
-                        // The catalog connection, not the optional AWS one.
-                        info.insert("connection_id", json!(get_item_id(catalog_connection)?));
-
-                        let mut namespace = None;
-                        let mut table = None;
-                        for option in options {
-                            match option.name {
-                                IcebergSinkConfigOptionName::Namespace => {
-                                    namespace = option.value.as_ref().and_then(option_string)
-                                }
-                                IcebergSinkConfigOptionName::Table => {
-                                    table = option.value.as_ref().and_then(option_string)
-                                }
-                            }
-                        }
-                        info.insert(
-                            "namespace",
-                            json!(namespace.ok_or("iceberg sink missing NAMESPACE")?),
-                        );
-                        info.insert("table", json!(table.ok_or("iceberg sink missing TABLE")?));
-
-                        // Iceberg spells the envelope `MODE`, and has no format
-                        // columns at all.
-                        if let Some(mode) = stmt.mode {
-                            let envelope_type = match mode {
-                                IcebergSinkMode::Upsert => "upsert",
-                                IcebergSinkMode::Append => "append",
-                            };
-                            info.insert("envelope_type", json!(envelope_type));
-                        }
-                    }
-                }
-
-                "sink"
-            }
-            CreateMetricSink(stmt) => {
-                let Some(in_cluster) = stmt.in_cluster else {
-                    return Err("missing IN CLUSTER".into());
-                };
-                let cluster_id = get_cluster_id(in_cluster)?;
-                info.insert("cluster_id", json!(cluster_id));
-                let from_id = get_item_id(stmt.from)?;
-                info.insert("from_id", json!(from_id));
-                "metric-sink"
-            }
-            CreateIndex(stmt) => {
-                let Some(in_cluster) = stmt.in_cluster else {
-                    return Err("missing IN CLUSTER".into());
-                };
-                let cluster_id = get_cluster_id(in_cluster)?;
-                info.insert("cluster_id", json!(cluster_id));
-                let on_id = get_item_id(stmt.on_name)?;
-                info.insert("on_id", json!(on_id));
-                "index"
-            }
-            CreateType(_) => "type",
-            // NOTE: every statement that creates a catalog item needs an arm above. These
-            // catalog views run this over every item row before their type filter drops the
-            // unwanted rows, so one unclassified `create_sql` takes out `mz_objects`,
-            // `mz_indexes`, and every sibling view at once. The match is exhaustive to make
-            // that a compile error here, not a runtime failure.
-            Select(_)
-            | Insert(_)
-            | Copy(_)
-            | Update(_)
-            | Delete(_)
-            | CreateDatabase(_)
-            | CreateSchema(_)
-            | CreateRole(_)
-            | CreateCluster(_)
-            | CreateClusterReplica(_)
-            | CreateNetworkPolicy(_)
-            | AlterCluster(_)
-            | AlterOwner(_)
-            | AlterObjectRename(_)
-            | AlterObjectSwap(_)
-            | AlterRetainHistory(_)
-            | AlterIndex(_)
-            | AlterSecret(_)
-            | AlterSetCluster(_)
-            | AlterSink(_)
-            | AlterSource(_)
-            | AlterSystemSet(_)
-            | AlterSystemReset(_)
-            | AlterSystemResetAll(_)
-            | AlterConnection(_)
-            | AlterNetworkPolicy(_)
-            | AlterRole(_)
-            | AlterTableAddColumn(_)
-            | AlterMaterializedViewApplyReplacement(_)
-            | Discard(_)
-            | DropObjects(_)
-            | DropOwned(_)
-            | SetVariable(_)
-            | ResetVariable(_)
-            | Show(_)
-            | StartTransaction(_)
-            | SetTransaction(_)
-            | Commit(_)
-            | Rollback(_)
-            | Subscribe(_)
-            | ExplainPlan(_)
-            | ExplainPushdown(_)
-            | ExplainTimestamp(_)
-            | ExplainSinkSchema(_)
-            | ExplainAnalyzeObject(_)
-            | ExplainAnalyzeCluster(_)
-            | Declare(_)
-            | Fetch(_)
-            | Close(_)
-            | Prepare(_)
-            | Execute(_)
-            | ExecuteUnitTest(_)
-            | Deallocate(_)
-            | Raise(_)
-            | GrantRole(_)
-            | RevokeRole(_)
-            | GrantPrivileges(_)
-            | RevokePrivileges(_)
-            | AlterDefaultPrivileges(_)
-            | ReassignOwned(_)
-            | ValidateConnection(_)
-            | Comment(_) => return Err("not a CREATE item statement".into()),
-        };
-        info.insert("type", json!(item_type));
-
-        let info = info.into_iter().map(|(k, v)| (k.to_string(), v)).collect();
-        Ok(info)
-    };
-
-    let val = parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))?;
-    let jsonb = Jsonb::from_serde_json(val).expect("valid JSONB");
-    Ok(jsonb)
-}
-
-/// Extracts the catalog item references from a catalog `create_sql` string as a JSONB object.
-///
-/// - `ids`: array of catalog id strings from `[<id> AS <name>]` references.
-/// - `named_funcs`: array of function references such as "pg_catalog"."max".
-/// - `named_types`: array of type references such as "pg_catalog"."int4", exclusive from the ones
-///   in `ids`.
-/// - `named_relations`: array of relation references, exclusive from the ones in `ids`.
-#[sqlfunc]
-fn parse_catalog_item_references<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
-    fn qualified(name: &UnresolvedItemName) -> serde_json::Value {
-        match &name.0[..] {
-            [.., schema, item] => json!({"schema": schema.as_str(), "name": item.as_str()}),
-            [item] => json!({"schema": serde_json::Value::Null, "name": item.as_str()}),
-            [] => json!({"schema": serde_json::Value::Null, "name": ""}),
-        }
-    }
-
-    let parse = || -> Result<serde_json::Value, String> {
-        let mut stmts = mz_sql_parser::parser::parse_statements(a)
-            .map_err(|e| format!("failed to parse create_sql: {e}"))?;
-        let stmt = match stmts.len() {
-            1 => stmts.remove(0).ast,
-            n => return Err(format!("expected a single statement, found {n}")),
-        };
-
-        let refs = collect_item_references(&stmt);
-        mz_ore::soft_assert_or_log!(
-            refs.named_array_elements.is_empty(),
-            "persisted create_sql should never carry an array type T[] \
-            and resolve its array type in `ids`: {:?}",
-            refs.named_array_elements
-        );
-        Ok(json!({
-            "ids": refs.ids.iter().collect::<Vec<_>>(),
-            "named_funcs": refs.named_funcs.iter().map(qualified).collect::<Vec<_>>(),
-            "named_types": refs.named_types.iter().map(qualified).collect::<Vec<_>>(),
-            "named_relations": refs.named_relations.iter().map(qualified).collect::<Vec<_>>(),
-        }))
-    };
-
-    let val = parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))?;
-    let jsonb = Jsonb::from_serde_json(val).expect("valid JSONB");
-    Ok(jsonb)
-}
-
-/// Minimal decoder for `ProtoPostgresSourcePublicationDetails`. The
-/// canonical proto lives in `mz-storage-types`, which depends on
-/// `mz-expr`, so we redeclare the two tags we read here. Upstream tag
-/// renumbers slip past silently. The `mz_postgres_sources` lockdown
-/// SLTs catch them.
-#[derive(Clone, PartialEq, ::prost::Message)]
-struct PostgresPublicationDetailsSubset {
-    #[prost(string, tag = "2")]
-    slot: String,
-    #[prost(uint64, optional, tag = "3")]
-    timeline_id: Option<u64>,
-}
-
-/// Extracts postgres source publication details (slot, timeline_id) from a
-/// catalog `create_sql`. Returns:
-///
-/// - jsonb `{"slot": <text>, "timeline_id": <u64 | null>}` for `CREATE SOURCE ... FROM POSTGRES
-///   CONNECTION ... (DETAILS = ...)` statements.
-/// - jsonb `null` for any other statement.
-///
-/// Errors if the statement fails to parse, is a postgres source without
-/// a `DETAILS` option, or if the `DETAILS` value can't be hex- and
-/// proto-decoded.
-#[sqlfunc]
-fn parse_postgres_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
-    let parse = || -> Result<serde_json::Value, String> {
-        let mut stmts = mz_sql_parser::parser::parse_statements(a)
-            .map_err(|e| format!("failed to parse create_sql: {e}"))?;
-        let stmt = match stmts.len() {
-            1 => stmts.remove(0).ast,
-            n => return Err(format!("expected a single statement, found {n}")),
-        };
-
-        use mz_sql_parser::ast::CreateSourceConnection;
-        use mz_sql_parser::ast::Statement::CreateSource;
-        let options = match stmt {
-            CreateSource(stmt) => match stmt.connection {
-                CreateSourceConnection::Postgres { options, .. } => options,
-                _ => return Ok(serde_json::Value::Null),
-            },
-            _ => return Ok(serde_json::Value::Null),
-        };
-
-        let details_hex = options
-            .into_iter()
-            .find(|opt| opt.name == PgConfigOptionName::Details)
-            .and_then(|opt| match opt.value {
-                Some(WithOptionValue::Value(Value::String(s))) => Some(s),
-                _ => None,
-            })
-            .ok_or("missing DETAILS option on postgres source")?;
-
-        let details_bytes =
-            hex::decode(&details_hex).map_err(|e| format!("DETAILS is not valid hex: {e}"))?;
-
-        let details = PostgresPublicationDetailsSubset::decode(&*details_bytes)
-            .map_err(|e| format!("DETAILS is not a valid publication-details proto: {e}"))?;
-
-        Ok(json!({
-            "slot": details.slot,
-            "timeline_id": details.timeline_id,
-        }))
-    };
-
-    let val = parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))?;
-    let jsonb = Jsonb::from_serde_json(val).expect("valid JSONB");
-    Ok(jsonb)
-}
-
-/// Extracts kafka source configuration (topic, group id prefix, connection
-/// id) from a catalog `create_sql`. Returns:
-///
-/// - jsonb `{"topic": <text>, "group_id_prefix": <text | null>, "connection_id": <text>}` for
-///   `CREATE SOURCE ... FROM KAFKA CONNECTION ... (TOPIC = ..., [GROUP ID PREFIX = ...])`
-///   statements.
-/// - jsonb `null` for any other statement.
-///
-/// Errors if the statement fails to parse, is a kafka source without a
-/// `TOPIC` option, or references an unresolved connection name (i.e. one
-/// that hasn't been through purification).
-#[sqlfunc]
-fn parse_kafka_source_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
-    fn get_item_id(item: RawItemName) -> Result<String, &'static str> {
-        match item {
-            RawItemName::Id(id, _, _) => Ok(id),
-            RawItemName::Name(_) => Err("unresolved item name"),
-        }
-    }
-
-    let parse = || -> Result<serde_json::Value, String> {
-        let mut stmts = mz_sql_parser::parser::parse_statements(a)
-            .map_err(|e| format!("failed to parse create_sql: {e}"))?;
-        let stmt = match stmts.len() {
-            1 => stmts.remove(0).ast,
-            n => return Err(format!("expected a single statement, found {n}")),
-        };
-
-        use mz_sql_parser::ast::CreateSourceConnection;
-        use mz_sql_parser::ast::Statement::CreateSource;
-        let (connection, options) = match stmt {
-            CreateSource(stmt) => match stmt.connection {
-                CreateSourceConnection::Kafka {
-                    connection,
-                    options,
-                } => (connection, options),
-                _ => return Ok(serde_json::Value::Null),
-            },
-            _ => return Ok(serde_json::Value::Null),
-        };
-
-        let connection_id = get_item_id(connection)?;
-
-        let mut topic: Option<String> = None;
-        let mut group_id_prefix: Option<String> = None;
-        for opt in options {
-            let string_value = opt.value.as_ref().and_then(option_string);
-            match opt.name {
-                KafkaSourceConfigOptionName::Topic => topic = string_value,
-                KafkaSourceConfigOptionName::GroupIdPrefix => group_id_prefix = string_value,
-                _ => {}
-            }
-        }
-
-        let topic = topic.ok_or("missing TOPIC option on kafka source")?;
-
-        Ok(json!({
-            "topic": topic,
-            "group_id_prefix": group_id_prefix,
-            "connection_id": connection_id,
-        }))
-    };
-
-    let val = parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))?;
-    let jsonb = Jsonb::from_serde_json(val).expect("valid JSONB");
-    Ok(jsonb)
-}
-
-/// Extracts source-export (source table) metadata from a catalog `create_sql`.
-///
-/// Returns, for a `CREATE TABLE ... FROM SOURCE` or a non-progress
-/// `CREATE SUBSOURCE ... OF SOURCE ...` statement:
-///
-/// ```json
-/// {
-///   "source_id": "<parent source item id>",
-///   "external_reference": ["part1", "part2", ...],
-///   "envelope_type": <text | null>,
-///   "key_format": <text | null>,
-///   "value_format": <text | null>
-/// }
-/// ```
-///
-/// `envelope_type`, `key_format`, and `value_format` are always null for a
-/// `CREATE SUBSOURCE` (the postgres/mysql/sql-server exports that use the old
-/// subsource syntax carry neither format nor envelope). They may also be null
-/// for a `CREATE TABLE ... FROM SOURCE` that omits FORMAT/ENVELOPE.
-///
-/// Returns jsonb `null` for progress subsources and for any statement that is
-/// not a source export. The caller distinguishes the four source-table views
-/// by joining `source_id` against `mz_sources` and filtering on the parent's
-/// type, so this helper stays connection-type agnostic.
-///
-/// Errors if the statement fails to parse, references an unresolved item name,
-/// or is a non-progress subsource missing its OF SOURCE or EXTERNAL REFERENCE.
-///
-/// The `key_format`/`value_format` derivation mirrors the runtime
-/// `DataSourceDesc::formats()` that the removed `pack_kafka_source_tables_update`
-/// packer read. A bare FORMAT only carries a key when it resolves to an
-/// encoding that has one, which among bare formats is only Avro or Protobuf
-/// read from a Confluent Schema Registry whose purified seed carries a key
-/// schema. A KEY FORMAT ... VALUE FORMAT ... spec always carries both.
-#[sqlfunc]
-fn parse_source_export_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
-    fn get_item_id(item: RawItemName) -> Result<String, &'static str> {
-        match item {
-            RawItemName::Id(id, _, _) => Ok(id),
-            RawItemName::Name(_) => Err("unresolved item name"),
-        }
-    }
-
-    fn format_name<T: AstInfo>(fmt: &Format<T>) -> &'static str {
-        match fmt {
-            Format::Bytes => "bytes",
-            Format::Avro(_) => "avro",
-            Format::Protobuf(_) => "protobuf",
-            Format::Regex(_) => "regex",
-            Format::Csv { .. } => "csv",
-            Format::Json { .. } => "json",
-            Format::Text => "text",
-        }
-    }
-
-    // A bare FORMAT resolves to an encoding with a key only for Avro or
-    // Protobuf read from a schema registry whose purified seed carries a key
-    // schema. Every other bare format is value-only.
-    fn bare_format_has_key<T: AstInfo>(fmt: &Format<T>) -> bool {
-        match fmt {
-            Format::Avro(AvroSchema::Csr { csr_connection }) => csr_connection
-                .seed
-                .as_ref()
-                .is_some_and(|seed| seed.key_schema.is_some()),
-            Format::Protobuf(ProtobufSchema::Csr { csr_connection }) => csr_connection
-                .seed
-                .as_ref()
-                .is_some_and(|seed| seed.key.is_some()),
-            _ => false,
-        }
-    }
-
-    fn key_value_formats<T: AstInfo>(
-        spec: &FormatSpecifier<T>,
-    ) -> (Option<&'static str>, Option<&'static str>) {
-        match spec {
-            FormatSpecifier::KeyValue { key, value } => {
-                (Some(format_name(key)), Some(format_name(value)))
-            }
-            FormatSpecifier::Bare(fmt) => {
-                let value = Some(format_name(fmt));
-                let key = bare_format_has_key(fmt).then(|| format_name(fmt));
-                (key, value)
-            }
-        }
-    }
-
-    fn envelope_name(envelope: &SourceEnvelope) -> &'static str {
-        match envelope {
-            SourceEnvelope::None => "none",
-            SourceEnvelope::Debezium => "debezium",
-            SourceEnvelope::Upsert {
-                value_decode_err_policy,
-            } => {
-                if value_decode_err_policy
-                    .iter()
-                    .any(|p| matches!(p, SourceErrorPolicy::Inline { .. }))
-                {
-                    "upsert-value-err-inline"
-                } else {
-                    "upsert"
-                }
-            }
-            SourceEnvelope::CdcV2 => "materialize",
-        }
-    }
-
-    let parse = || -> Result<serde_json::Value, String> {
-        let mut stmts = mz_sql_parser::parser::parse_statements(a)
-            .map_err(|e| format!("failed to parse create_sql: {e}"))?;
-        let stmt = match stmts.len() {
-            1 => stmts.remove(0).ast,
-            n => return Err(format!("expected a single statement, found {n}")),
-        };
-
-        use mz_sql_parser::ast::Statement::{CreateSubsource, CreateTableFromSource};
-        match stmt {
-            CreateTableFromSource(stmt) => {
-                let source_id = get_item_id(stmt.source)?;
-                let external_reference = stmt
-                    .external_reference
-                    .ok_or("missing external reference on CREATE TABLE FROM SOURCE")?
-                    .0
-                    .into_iter()
-                    .map(|ident| ident.into_string())
-                    .collect::<Vec<_>>();
-
-                let envelope_type = stmt.envelope.as_ref().map(envelope_name);
-                let (key_format, value_format) = match &stmt.format {
-                    Some(spec) => key_value_formats(spec),
-                    None => (None, None),
-                };
-
-                Ok(json!({
-                    "source_id": source_id,
-                    "external_reference": external_reference,
-                    "envelope_type": envelope_type,
-                    "key_format": key_format,
-                    "value_format": value_format,
-                }))
-            }
-            CreateSubsource(stmt) => {
-                // Progress subsources track ingestion progress and are not
-                // source tables. They have no external reference.
-                let is_progress = stmt
-                    .with_options
-                    .iter()
-                    .any(|o| matches!(o.name, CreateSubsourceOptionName::Progress));
-                if is_progress {
-                    return Ok(serde_json::Value::Null);
-                }
-
-                let source_id = stmt
-                    .of_source
-                    .ok_or("non-progress CREATE SUBSOURCE without OF SOURCE")
-                    .and_then(get_item_id)?;
-
-                let external_reference = stmt
-                    .with_options
-                    .into_iter()
-                    .find(|o| matches!(o.name, CreateSubsourceOptionName::ExternalReference))
-                    .and_then(|o| match o.value {
-                        Some(WithOptionValue::UnresolvedItemName(name)) => Some(name),
-                        _ => None,
-                    })
-                    .ok_or("CREATE SUBSOURCE missing EXTERNAL REFERENCE option")?
-                    .0
-                    .into_iter()
-                    .map(|ident| ident.into_string())
-                    .collect::<Vec<_>>();
-
-                Ok(json!({
-                    "source_id": source_id,
-                    "external_reference": external_reference,
-                    "envelope_type": serde_json::Value::Null,
-                    "key_format": serde_json::Value::Null,
-                    "value_format": serde_json::Value::Null,
-                }))
-            }
-            _ => Ok(serde_json::Value::Null),
-        }
-    };
-
-    let val = parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))?;
-    let jsonb = Jsonb::from_serde_json(val).expect("valid JSONB");
-    Ok(jsonb)
-}
-
-/// Extracts connection-detail metadata from a catalog `create_sql`.
-///
-/// Returns a per-connection-type object with the fields that the
-/// `mz_kafka_connections`, `mz_ssh_tunnel_connections`, and `mz_aws_connections`
-/// builtin views need. For everything else (other connection types, including
-/// aws-privatelink whose only detail is context-derived, and non-connection
-/// statements) it returns jsonb `null`, so callers filter on `IS NOT NULL` and
-/// gate on the connection type separately (via
-/// `parse_catalog_create_sql(...)->>'connection_type'`, the way `mz_connections`
-/// already does).
-///
-/// The shape per type:
-///
-/// ```json
-/// // kafka
-/// { "brokers": ["host:port", ...], "progress_topic": <text | null> }
-/// // ssh-tunnel
-/// { "public_key_1": "<text>", "public_key_2": "<text>" }
-/// // aws
-/// {
-///   "auth_kind": "credentials" | "assume-role",
-///   "endpoint": <text | null>, "region": <text | null>,
-///   "access_key_id": <text | null>, "access_key_id_secret_id": <text | null>,
-///   "secret_access_key_secret_id": <text | null>,
-///   "session_token": <text | null>, "session_token_secret_id": <text | null>,
-///   "assume_role_arn": <text | null>, "assume_role_session_name": <text | null>
-/// }
-/// ```
-///
-/// `progress_topic` is null when the connection does not set an explicit
-/// `PROGRESS TOPIC`. The default (`_materialize-progress-<env>-<conn_id>`) is
-/// reconstructed by the view, not here, because it needs the environment id and
-/// the connection's own id. Values derived only from environment context
-/// (AWS principal, external id, trust policy, privatelink principal) are also
-/// left to the view. This keeps the helper a pure function of the `create_sql`.
-///
-/// For aws, an option is either an inline value or a secret reference. Inline
-/// values land in `access_key_id`/`session_token`; a secret reference lands in
-/// the matching `*_secret_id` as the referenced secret's catalog item id (the
-/// persisted `create_sql` stores resolved references as `[uNNN AS name]`).
-/// `auth_kind` is `assume-role` when `ASSUME ROLE ARN` is present, else
-/// `credentials`, matching the `AwsAuth` variant the removed packer read.
-///
-/// Errors if the statement fails to parse.
-#[sqlfunc]
-fn parse_connection_details<'a>(a: &'a str) -> Result<Jsonb, EvalError> {
-    // The persisted `create_sql` stores an inline broker as a single `BROKER`
-    // option and a broker list as a `BROKERS (...)` sequence. Either way we
-    // only need the addresses, which are present regardless of the tunnel
-    // (direct, SSH, or PrivateLink).
-    fn broker_addresses<T: AstInfo>(values: &[ConnectionOption<T>]) -> Vec<String> {
-        let mut brokers = Vec::new();
-        for opt in values {
-            match (&opt.name, &opt.value) {
-                (ConnectionOptionName::Broker, Some(WithOptionValue::ConnectionKafkaBroker(b))) => {
-                    brokers.push(b.address.clone());
-                }
-                (ConnectionOptionName::Brokers, Some(WithOptionValue::Sequence(seq))) => {
-                    for v in seq {
-                        if let WithOptionValue::ConnectionKafkaBroker(b) = v {
-                            brokers.push(b.address.clone());
-                        }
-                    }
-                }
-                _ => {}
-            }
-        }
-        brokers
-    }
-
-    fn string_option<T: AstInfo>(
-        values: &[ConnectionOption<T>],
-        name: ConnectionOptionName,
-    ) -> Option<String> {
-        values
-            .iter()
-            .find(|o| o.name == name)
-            .and_then(|o| o.value.as_ref())
-            .and_then(option_string)
-    }
-
-    // The catalog id of the secret a `SECRET ...` option references. Resolved
-    // references persist as `RawItemName::Id`, so an unresolved name yields
-    // None (the same treatment `parse_source_export_details` gives item names).
-    fn secret_id_option<T: AstInfo<ItemName = RawItemName>>(
-        values: &[ConnectionOption<T>],
-        name: ConnectionOptionName,
-    ) -> Option<String> {
-        values.iter().find_map(|o| match &o.value {
-            Some(WithOptionValue::Secret(RawItemName::Id(id, _, _))) if o.name == name => {
-                Some(id.clone())
-            }
-            _ => None,
-        })
-    }
-
-    let parse = || -> Result<serde_json::Value, String> {
-        let mut stmts = mz_sql_parser::parser::parse_statements(a)
-            .map_err(|e| format!("failed to parse create_sql: {e}"))?;
-        let stmt = match stmts.len() {
-            1 => stmts.remove(0).ast,
-            n => return Err(format!("expected a single statement, found {n}")),
-        };
-
-        use mz_sql_parser::ast::Statement::CreateConnection;
-        let stmt = match stmt {
-            CreateConnection(stmt) => stmt,
-            _ => return Ok(serde_json::Value::Null),
-        };
-
-        match stmt.connection_type {
-            CreateConnectionType::Kafka => Ok(json!({
-                "brokers": broker_addresses(&stmt.values),
-                "progress_topic": string_option(&stmt.values, ConnectionOptionName::ProgressTopic),
-            })),
-            CreateConnectionType::Ssh => Ok(json!({
-                "public_key_1": string_option(&stmt.values, ConnectionOptionName::PublicKey1),
-                "public_key_2": string_option(&stmt.values, ConnectionOptionName::PublicKey2),
-            })),
-            CreateConnectionType::Aws => {
-                let assume_role_arn =
-                    string_option(&stmt.values, ConnectionOptionName::AssumeRoleArn);
-                let auth_kind = if assume_role_arn.is_some() {
-                    "assume-role"
-                } else {
-                    "credentials"
-                };
-                Ok(json!({
-                    "auth_kind": auth_kind,
-                    // Planning coerces an empty ENDPOINT to None (see
-                    // `src/sql/src/plan/statement/ddl/connection.rs`), so the
-                    // removed packer wrote NULL for `ENDPOINT = ''`. Match that.
-                    "endpoint": string_option(&stmt.values, ConnectionOptionName::Endpoint)
-                        .filter(|s| !s.is_empty()),
-                    "region": string_option(&stmt.values, ConnectionOptionName::Region),
-                    "access_key_id": string_option(&stmt.values, ConnectionOptionName::AccessKeyId),
-                    "access_key_id_secret_id":
-                        secret_id_option(&stmt.values, ConnectionOptionName::AccessKeyId),
-                    "secret_access_key_secret_id":
-                        secret_id_option(&stmt.values, ConnectionOptionName::SecretAccessKey),
-                    "session_token": string_option(&stmt.values, ConnectionOptionName::SessionToken),
-                    "session_token_secret_id":
-                        secret_id_option(&stmt.values, ConnectionOptionName::SessionToken),
-                    "assume_role_arn": assume_role_arn,
-                    "assume_role_session_name":
-                        string_option(&stmt.values, ConnectionOptionName::AssumeRoleSessionName),
-                }))
-            }
-            _ => Ok(serde_json::Value::Null),
-        }
-    };
-
-    let val = parse().map_err(|e| EvalError::InvalidCatalogJson(e.into()))?;
-    let jsonb = Jsonb::from_serde_json(val).expect("valid JSONB");
-    Ok(jsonb)
-}
-
-#[cfg(test)]
-mod tests {
-    use mz_repr::adt::jsonb::Jsonb;
-    use prost::Message as _;
-    use serde_json::json;
-
-    use crate::EvalError;
-
-    /// Encode the two proto fields our decoder cares about, using the same
-    /// tag numbering as the canonical proto.
-    fn encode_pg_details(slot: &str, timeline_id: Option<u64>) -> String {
-        let details = super::PostgresPublicationDetailsSubset {
-            slot: slot.to_string(),
-            timeline_id,
-        };
-        hex::encode(details.encode_to_vec())
-    }
-
-    fn pg_source_sql(details_hex: &str) -> String {
-        format!(
-            "CREATE SOURCE \"materialize\".\"public\".\"pg_src\" \
-             IN CLUSTER [u42] \
-             FROM POSTGRES CONNECTION [u10 AS \"materialize\".\"public\".\"pg_conn\"] \
-             (DETAILS = '{details_hex}', PUBLICATION = 'mz_source') \
-             FOR ALL TABLES"
-        )
-    }
-
-    fn kafka_source_sql(with_prefix: bool) -> String {
-        let prefix_opt = if with_prefix {
-            ", GROUP ID PREFIX 'my-prefix-'"
-        } else {
-            ""
-        };
-        format!(
-            "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
-             (TOPIC 'test'{prefix_opt}) FORMAT TEXT"
-        )
-    }
-
-    fn as_serde(jsonb: Jsonb) -> serde_json::Value {
-        jsonb.as_ref().to_serde_json()
-    }
-
-    // --- parse_postgres_source_details ---------------------------------------
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `decContextDefault` on OS `linux`
-    fn pg_happy_path_with_timeline() {
-        let hex = encode_pg_details("materialize_abc", Some(42));
-        let sql = pg_source_sql(&hex);
-        let out = super::parse_postgres_source_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({ "slot": "materialize_abc", "timeline_id": 42 }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn pg_happy_path_null_timeline() {
-        // Pre-2024 sources have no timeline_id field. The decoder must
-        // surface that as JSON null, not error.
-        let hex = encode_pg_details("materialize_legacy", None);
-        let sql = pg_source_sql(&hex);
-        let out = super::parse_postgres_source_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({ "slot": "materialize_legacy", "timeline_id": null }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn pg_non_postgres_source_returns_null_jsonb() {
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
-             IN CLUSTER [u42] FROM LOAD GENERATOR COUNTER";
-        let out = super::parse_postgres_source_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn pg_non_create_source_returns_null_jsonb() {
-        let sql = "CREATE VIEW v AS SELECT 1";
-        let out = super::parse_postgres_source_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    fn pg_missing_details_option_errors() {
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"pg_src\" \
-             IN CLUSTER [u42] \
-             FROM POSTGRES CONNECTION [u10 AS \"materialize\".\"public\".\"pg_conn\"] \
-             (PUBLICATION = 'mz_source') FOR ALL TABLES";
-        let err = super::parse_postgres_source_details(sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("missing DETAILS")),
-            "wrong error variant/message"
-        );
-    }
-
-    #[mz_ore::test]
-    fn pg_malformed_hex_errors() {
-        let sql = pg_source_sql("not-hex!!");
-        let err = super::parse_postgres_source_details(&sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("valid hex")),
-            "wrong error variant/message"
-        );
-    }
-
-    #[mz_ore::test]
-    fn pg_malformed_proto_errors() {
-        // Valid hex, garbage bytes. Prost decoding fails on unexpected wire
-        // format.
-        let sql = pg_source_sql("ffff");
-        let err = super::parse_postgres_source_details(&sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("publication-details proto")),
-            "wrong error variant/message"
-        );
-    }
-
-    // --- parse_kafka_source_details ------------------------------------------
-
-    #[mz_ore::test]
-    fn kafka_happy_path_with_prefix() {
-        let sql = kafka_source_sql(true);
-        let out = super::parse_kafka_source_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "topic": "test",
-                "group_id_prefix": "my-prefix-",
-                "connection_id": "u11",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn kafka_happy_path_without_prefix() {
-        let sql = kafka_source_sql(false);
-        let out = super::parse_kafka_source_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "topic": "test",
-                "group_id_prefix": null,
-                "connection_id": "u11",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn kafka_non_kafka_source_returns_null_jsonb() {
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
-             IN CLUSTER [u42] FROM LOAD GENERATOR COUNTER";
-        let out = super::parse_kafka_source_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    fn kafka_missing_topic_errors() {
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
-             FORMAT TEXT";
-        let err = super::parse_kafka_source_details(sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("missing TOPIC")),
-            "wrong error variant/message"
-        );
-    }
-
-    #[mz_ore::test]
-    fn kafka_unquoted_topic_and_prefix() {
-        // Planning accepts a bare identifier for TOPIC / GROUP ID PREFIX, and it
-        // persists unquoted in create_sql. Matching only quoted strings would
-        // drop TOPIC and error the whole mz_kafka_source_tables view.
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
-             (TOPIC = my_topic, GROUP ID PREFIX = my_prefix) FORMAT TEXT";
-        let out = super::parse_kafka_source_details(sql).expect("ok");
-        let out = as_serde(out);
-        assert_eq!(out["topic"], json!("my_topic"));
-        assert_eq!(out["group_id_prefix"], json!("my_prefix"));
-    }
-
-    #[mz_ore::test]
-    fn kafka_unresolved_connection_errors() {
-        // A bare-name connection reference never happens after purification,
-        // but the decoder must reject it explicitly rather than silently
-        // dropping the connection_id.
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k_src\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION k_conn (TOPIC 'test') FORMAT TEXT";
-        let err = super::parse_kafka_source_details(sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("unresolved item name")),
-            "wrong error variant/message"
-        );
-    }
-
-    // --- parse_source_export_details -----------------------------------------
-
-    fn table_from_source_sql(reference: &str, suffix: &str) -> String {
-        format!(
-            "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
-             FROM SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
-             (REFERENCE = {reference}){suffix}"
-        )
-    }
-
-    #[mz_ore::test]
-    fn export_table_postgres_style_no_format() {
-        // Postgres/mysql/sql-server tables carry a multi-part external
-        // reference and no format or envelope.
-        let sql = table_from_source_sql("\"db\".\"public\".\"t\"", "");
-        let out = super::parse_source_export_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "source_id": "u1",
-                "external_reference": ["db", "public", "t"],
-                "envelope_type": null,
-                "key_format": null,
-                "value_format": null,
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn export_table_kafka_bare_value_only() {
-        // A bare non-registry FORMAT is value-only: no key format.
-        let sql = table_from_source_sql("\"topic\"", " FORMAT TEXT ENVELOPE NONE");
-        let out = super::parse_source_export_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "source_id": "u1",
-                "external_reference": ["topic"],
-                "envelope_type": "none",
-                "key_format": null,
-                "value_format": "text",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn export_table_kafka_omitted_envelope_is_null() {
-        // Omitting ENVELOPE persists as absent in create_sql, so this
-        // source-type-agnostic helper reports null. The mz_kafka_source_tables
-        // view is responsible for defaulting kafka's null envelope to 'none'.
-        let sql = table_from_source_sql("\"topic\"", " FORMAT TEXT");
-        let out = super::parse_source_export_details(&sql).expect("ok");
-        assert_eq!(as_serde(out)["envelope_type"], serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    fn export_table_kafka_key_value_format() {
-        let sql = table_from_source_sql(
-            "\"topic\"",
-            " KEY FORMAT TEXT VALUE FORMAT TEXT ENVELOPE NONE",
-        );
-        let out = super::parse_source_export_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "source_id": "u1",
-                "external_reference": ["topic"],
-                "envelope_type": "none",
-                "key_format": "text",
-                "value_format": "text",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn export_table_kafka_bare_avro_seed_with_key() {
-        // A bare Avro CSR format whose seed carries a key schema resolves to
-        // an encoding with a key, so key_format mirrors value_format. This is
-        // the upsert/debezium path.
-        let sql = table_from_source_sql(
-            "\"topic\"",
-            " FORMAT AVRO USING CONFLUENT SCHEMA REGISTRY \
-             CONNECTION [u5 AS \"materialize\".\"public\".\"csr\"] \
-             SEED KEY SCHEMA 'k' VALUE SCHEMA 'v' ENVELOPE UPSERT",
-        );
-        let out = super::parse_source_export_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "source_id": "u1",
-                "external_reference": ["topic"],
-                "envelope_type": "upsert",
-                "key_format": "avro",
-                "value_format": "avro",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn export_table_kafka_bare_avro_seed_without_key() {
-        // A bare Avro CSR seed with only a value schema is value-only.
-        let sql = table_from_source_sql(
-            "\"topic\"",
-            " FORMAT AVRO USING CONFLUENT SCHEMA REGISTRY \
-             CONNECTION [u5 AS \"materialize\".\"public\".\"csr\"] \
-             SEED VALUE SCHEMA 'v' ENVELOPE NONE",
-        );
-        let out = super::parse_source_export_details(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "source_id": "u1",
-                "external_reference": ["topic"],
-                "envelope_type": "none",
-                "key_format": null,
-                "value_format": "avro",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn export_subsource_non_progress() {
-        // Old-syntax subsource: external reference lives in a WITH option, and
-        // there is never a format or envelope.
-        let sql = "CREATE SUBSOURCE \"materialize\".\"public\".\"sub\" (id int4) \
-             OF SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
-             WITH (EXTERNAL REFERENCE = \"db\".\"public\".\"t\")";
-        let out = super::parse_source_export_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "source_id": "u1",
-                "external_reference": ["db", "public", "t"],
-                "envelope_type": null,
-                "key_format": null,
-                "value_format": null,
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn export_progress_subsource_returns_null_jsonb() {
-        let sql = "CREATE SUBSOURCE \"materialize\".\"public\".\"progress\" (id int4) \
-             WITH (PROGRESS)";
-        let out = super::parse_source_export_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn export_non_source_export_returns_null_jsonb() {
-        let sql = "CREATE VIEW v AS SELECT 1";
-        let out = super::parse_source_export_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    fn export_unresolved_source_name_errors() {
-        let sql = "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
-             FROM SOURCE src (REFERENCE = \"topic\")";
-        let err = super::parse_source_export_details(sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("unresolved item name")),
-            "wrong error variant/message"
-        );
-    }
-
-    // --- parse_connection_details --------------------------------------------
-
-    #[mz_ore::test]
-    fn connection_kafka_single_broker_default_progress() {
-        // No explicit PROGRESS TOPIC: the helper leaves it null and the view
-        // reconstructs the default.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
-             (BROKER = 'localhost:9092', SECURITY PROTOCOL = plaintext)";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "brokers": ["localhost:9092"],
-                "progress_topic": null,
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_kafka_explicit_progress_topic() {
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
-             (BROKER = 'localhost:9092', PROGRESS TOPIC = 'override', \
-              SECURITY PROTOCOL = plaintext)";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "brokers": ["localhost:9092"],
-                "progress_topic": "override",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_kafka_broker_list() {
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
-             (BROKERS ('b1:9092', 'b2:9092'), SECURITY PROTOCOL = plaintext)";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "brokers": ["b1:9092", "b2:9092"],
-                "progress_topic": null,
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_ssh_public_keys() {
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO SSH TUNNEL \
-             (HOST = 'ssh.example.com', PORT = 22, USER = 'mz', \
-              PUBLIC KEY 1 = 'ssh-ed25519 AAAA', PUBLIC KEY 2 = 'ssh-ed25519 BBBB')";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "public_key_1": "ssh-ed25519 AAAA",
-                "public_key_2": "ssh-ed25519 BBBB",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_aws_credentials_inline_key() {
-        // Inline ACCESS KEY ID, secret SECRET ACCESS KEY. Assume-role columns
-        // stay null and auth_kind is credentials.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
-             (ACCESS KEY ID = 'AKIAEXAMPLE', \
-              SECRET ACCESS KEY = SECRET [u1 AS \"materialize\".\"public\".\"sk\"])";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "auth_kind": "credentials",
-                "endpoint": null,
-                "region": null,
-                "access_key_id": "AKIAEXAMPLE",
-                "access_key_id_secret_id": null,
-                "secret_access_key_secret_id": "u1",
-                "session_token": null,
-                "session_token_secret_id": null,
-                "assume_role_arn": null,
-                "assume_role_session_name": null,
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_aws_credentials_secret_key_and_session_token() {
-        // Every credential provided as a secret reference lands in the matching
-        // *_secret_id column as the referenced secret's catalog id.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
-             (ENDPOINT = 'http://localhost', REGION = 'us-east-1', \
-              ACCESS KEY ID = SECRET [u1 AS \"materialize\".\"public\".\"ak\"], \
-              SECRET ACCESS KEY = SECRET [u2 AS \"materialize\".\"public\".\"sk\"], \
-              SESSION TOKEN = SECRET [u3 AS \"materialize\".\"public\".\"st\"])";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "auth_kind": "credentials",
-                "endpoint": "http://localhost",
-                "region": "us-east-1",
-                "access_key_id": null,
-                "access_key_id_secret_id": "u1",
-                "secret_access_key_secret_id": "u2",
-                "session_token": null,
-                "session_token_secret_id": "u3",
-                "assume_role_arn": null,
-                "assume_role_session_name": null,
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_aws_assume_role() {
-        // Assume-role sets auth_kind and the assume-role columns; credential
-        // columns stay null.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
-             (ASSUME ROLE ARN 'arn:aws:iam::123:role/mz', \
-              ASSUME ROLE SESSION NAME 'sess')";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "auth_kind": "assume-role",
-                "endpoint": null,
-                "region": null,
-                "access_key_id": null,
-                "access_key_id_secret_id": null,
-                "secret_access_key_secret_id": null,
-                "session_token": null,
-                "session_token_secret_id": null,
-                "assume_role_arn": "arn:aws:iam::123:role/mz",
-                "assume_role_session_name": "sess",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn connection_kafka_unquoted_progress_topic() {
-        // A bare identifier PROGRESS TOPIC persists unquoted in create_sql. The
-        // helper must surface it, else the view substitutes the default topic.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO KAFKA \
-             (BROKER = 'localhost:9092', PROGRESS TOPIC = my_topic, \
-              SECURITY PROTOCOL = plaintext)";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(as_serde(out)["progress_topic"], json!("my_topic"));
-    }
-
-    #[mz_ore::test]
-    fn connection_aws_unquoted_option_values() {
-        // Planning accepts bare identifiers for these options and persists them
-        // unquoted. The helper must surface them, not fall back to NULL.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
-             (ENDPOINT = localhost, REGION = useast1, \
-              ASSUME ROLE ARN 'arn:aws:iam::123:role/mz', \
-              ASSUME ROLE SESSION NAME = mysession)";
-        let out = super::parse_connection_details(sql).expect("ok");
-        let out = as_serde(out);
-        assert_eq!(out["endpoint"], json!("localhost"));
-        assert_eq!(out["region"], json!("useast1"));
-        assert_eq!(out["assume_role_session_name"], json!("mysession"));
-    }
-
-    #[mz_ore::test]
-    fn connection_aws_empty_endpoint_is_null() {
-        // Planning coerces ENDPOINT = '' to None, so the packer wrote NULL. The
-        // view must match, not report an empty string.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO AWS \
-             (ENDPOINT = '', ASSUME ROLE ARN 'arn:aws:iam::123:role/mz')";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(as_serde(out)["endpoint"], serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    fn connection_other_type_returns_null_jsonb() {
-        // A connection type without a detail view (postgres) yields null.
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"c\" TO POSTGRES \
-             (HOST = 'db', DATABASE = 'postgres', USER = 'mz')";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn connection_non_connection_returns_null_jsonb() {
-        let sql = "CREATE VIEW v AS SELECT 1";
-        let out = super::parse_connection_details(sql).expect("ok");
-        assert_eq!(as_serde(out), serde_json::Value::Null);
-    }
-
-    // --- parse_catalog_create_sql envelope_type ------------------------------
-
-    #[mz_ore::test]
-    fn catalog_kafka_old_syntax_omitted_envelope_defaults_none() {
-        // An old-syntax kafka source (carries EXPOSE PROGRESS AS) ingests into
-        // its own relation, so an omitted ENVELOPE means the default NONE, which
-        // the pre-MV packer reported as 'none'.
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
-             (TOPIC 'test') FORMAT TEXT \
-             EXPOSE PROGRESS AS [u12 AS \"materialize\".\"public\".\"k_progress\"]";
-        let out = super::parse_catalog_create_sql(sql).expect("ok");
-        assert_eq!(as_serde(out)["envelope_type"], json!("none"));
-    }
-
-    #[mz_ore::test]
-    fn catalog_kafka_old_syntax_explicit_envelope() {
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"] \
-             (TOPIC 'test') FORMAT BYTES ENVELOPE UPSERT \
-             EXPOSE PROGRESS AS [u12 AS \"materialize\".\"public\".\"k_progress\"]";
-        let out = super::parse_catalog_create_sql(sql).expect("ok");
-        assert_eq!(as_serde(out)["envelope_type"], json!("upsert"));
-    }
-
-    #[mz_ore::test]
-    fn catalog_kafka_new_syntax_source_omits_envelope_type() {
-        // A new-syntax kafka source has no progress subsource (no EXPOSE PROGRESS
-        // AS). It ingests nothing itself. Envelopes live on the per-table exports,
-        // so its own envelope_type stays absent (SQL NULL).
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"k\" \
-             IN CLUSTER [u42] \
-             FROM KAFKA CONNECTION [u11 AS \"materialize\".\"public\".\"k_conn\"]";
-        let out = super::parse_catalog_create_sql(sql).expect("ok");
-        assert_eq!(as_serde(out).get("envelope_type"), None);
-    }
-
-    #[mz_ore::test]
-    fn catalog_non_kafka_source_omits_envelope_type() {
-        // Non-kafka sources carry no envelope, so envelope_type stays absent
-        // (SQL NULL), not 'none'.
-        let sql = "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
-             IN CLUSTER [u42] FROM LOAD GENERATOR COUNTER";
-        let out = super::parse_catalog_create_sql(sql).expect("ok");
-        assert_eq!(as_serde(out).get("envelope_type"), None);
-    }
-
-    // --- parse_catalog_create_sql, CreateSink arm ----------------------------
-
-    const AVRO_FORMAT: &str = "FORMAT AVRO USING CONFLUENT SCHEMA REGISTRY CONNECTION \
-         [u12 AS \"materialize\".\"public\".\"csr_conn\"]";
-
-    /// A persisted kafka-sink `create_sql`: resolved names, and a `TOPIC` that
-    /// planning guarantees.
-    fn kafka_sink_sql(key: Option<&str>, format: &str, envelope: &str) -> String {
-        let key_clause = key.map(|k| format!(" KEY ({k})")).unwrap_or_default();
-        format!(
-            "CREATE SINK \"materialize\".\"public\".\"snk\" \
-             IN CLUSTER [u42] \
-             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-             INTO KAFKA CONNECTION [u10 AS \"materialize\".\"public\".\"k_conn\"] \
-             (TOPIC 'sink-topic'){key_clause} {format} ENVELOPE {envelope}"
-        )
-    }
-
-    fn iceberg_sink_sql(mode: &str) -> String {
-        format!(
-            "CREATE SINK \"materialize\".\"public\".\"ice\" \
-             IN CLUSTER [u42] \
-             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-             INTO ICEBERG CATALOG CONNECTION [u20 AS \"materialize\".\"public\".\"cat_conn\"] \
-             (NAMESPACE 'ns', TABLE 'tbl') \
-             USING AWS CONNECTION [u21 AS \"materialize\".\"public\".\"aws_conn\"] \
-             MODE {mode}"
-        )
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_bare_format_without_key() {
-        let sql = kafka_sink_sql(None, "FORMAT JSON", "DEBEZIUM");
-        let out = super::parse_catalog_create_sql(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "type": "sink",
-                "sink_type": "kafka",
-                "cluster_id": "u42",
-                "connection_id": "u10",
-                "topic": "sink-topic",
-                "envelope_type": "debezium",
-                "format": "json",
-                "value_format": "json",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_bare_format_with_key_derives_key_format() {
-        // A bare format applies to the key too once the sink has a KEY, which
-        // is what makes the deprecated `format` column collapse to `avro`.
-        let sql = kafka_sink_sql(Some("a"), AVRO_FORMAT, "UPSERT");
-        let out = super::parse_catalog_create_sql(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "type": "sink",
-                "sink_type": "kafka",
-                "cluster_id": "u42",
-                "connection_id": "u10",
-                "topic": "sink-topic",
-                "envelope_type": "upsert",
-                "format": "avro",
-                "key_format": "avro",
-                "value_format": "avro",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_bare_text_format_with_key_does_not_collapse() {
-        // Only avro/avro and json/json collapse, so a keyed text sink reports
-        // the composite form even though both halves are `text`.
-        let sql = kafka_sink_sql(Some("a"), "FORMAT TEXT", "UPSERT");
-        let out = super::parse_catalog_create_sql(&sql).expect("ok");
-        let out = as_serde(out);
-        assert_eq!(out["format"], json!("key-text-value-text"));
-        assert_eq!(out["key_format"], json!("text"));
-        assert_eq!(out["value_format"], json!("text"));
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_key_value_json_collapses() {
-        let sql = kafka_sink_sql(Some("a"), "KEY FORMAT JSON VALUE FORMAT JSON", "UPSERT");
-        let out = as_serde(super::parse_catalog_create_sql(&sql).expect("ok"));
-        assert_eq!(out["format"], json!("json"));
-        assert_eq!(out["key_format"], json!("json"));
-        assert_eq!(out["value_format"], json!("json"));
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_key_value_mixed_is_composite() {
-        let sql = kafka_sink_sql(Some("a"), "KEY FORMAT TEXT VALUE FORMAT BYTES", "UPSERT");
-        let out = as_serde(super::parse_catalog_create_sql(&sql).expect("ok"));
-        assert_eq!(out["format"], json!("key-text-value-bytes"));
-        assert_eq!(out["key_format"], json!("text"));
-        assert_eq!(out["value_format"], json!("bytes"));
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_key_format_without_key_is_dropped() {
-        // `kafka_sink_builder` ignores the key half of the format spec when the
-        // sink has no KEY, so neither `key_format` nor the composite `format`
-        // may reflect it.
-        let sql = kafka_sink_sql(None, "KEY FORMAT JSON VALUE FORMAT TEXT", "DEBEZIUM");
-        let out = as_serde(super::parse_catalog_create_sql(&sql).expect("ok"));
-        assert_eq!(out["format"], json!("text"));
-        assert_eq!(out["key_format"], serde_json::Value::Null);
-        assert_eq!(out["value_format"], json!("text"));
-    }
-
-    #[mz_ore::test]
-    fn sink_kafka_missing_topic_errors() {
-        let sql = "CREATE SINK \"materialize\".\"public\".\"snk\" \
-             IN CLUSTER [u42] \
-             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-             INTO KAFKA CONNECTION [u10 AS \"materialize\".\"public\".\"k_conn\"] \
-             FORMAT JSON ENVELOPE DEBEZIUM";
-        let err = super::parse_catalog_create_sql(sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("missing TOPIC")),
-            "wrong error variant/message"
-        );
-    }
-
-    #[mz_ore::test]
-    fn sink_iceberg_upsert_mode() {
-        let sql = iceberg_sink_sql("UPSERT");
-        let out = super::parse_catalog_create_sql(&sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({
-                "type": "sink",
-                "sink_type": "iceberg",
-                "cluster_id": "u42",
-                // The catalog connection, never the AWS connection (u21).
-                "connection_id": "u20",
-                "namespace": "ns",
-                "table": "tbl",
-                "envelope_type": "upsert",
-            }),
-        );
-    }
-
-    #[mz_ore::test]
-    fn sink_iceberg_append_mode() {
-        let sql = iceberg_sink_sql("APPEND");
-        let out = as_serde(super::parse_catalog_create_sql(&sql).expect("ok"));
-        // `append` is reachable only through an iceberg sink's MODE.
-        assert_eq!(out["envelope_type"], json!("append"));
-    }
-
-    #[mz_ore::test]
-    fn sink_iceberg_missing_table_errors() {
-        let sql = "CREATE SINK \"materialize\".\"public\".\"ice\" \
-             IN CLUSTER [u42] \
-             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-             INTO ICEBERG CATALOG CONNECTION [u20 AS \"materialize\".\"public\".\"cat_conn\"] \
-             (NAMESPACE 'ns') MODE UPSERT";
-        let err = super::parse_catalog_create_sql(sql).unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("missing TABLE")),
-            "wrong error variant/message"
-        );
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn sink_arm_leaves_other_item_types_alone() {
-        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS SELECT 1";
-        let out = super::parse_catalog_create_sql(sql).expect("ok");
-        assert_eq!(
-            as_serde(out),
-            json!({ "type": "view", "definition": "SELECT 1;" })
-        );
-    }
-
-    // --- parse_catalog_create_sql --------------------------------------------
-
-    /// `type` for a `create_sql`, or the error message if parsing failed.
-    fn item_type(sql: &str) -> Result<String, String> {
-        match super::parse_catalog_create_sql(sql) {
-            Ok(out) => match as_serde(out) {
-                serde_json::Value::Object(mut m) => match m.remove("type") {
-                    Some(serde_json::Value::String(s)) => Ok(s),
-                    other => panic!("no string `type` key: {other:?}"),
-                },
-                other => panic!("not a JSON object: {other:?}"),
-            },
-            Err(EvalError::InvalidCatalogJson(msg)) => Err(msg.to_string()),
-            Err(e) => panic!("unexpected error variant: {e:?}"),
-        }
-    }
-
-    fn view_sql(query: &str) -> String {
-        format!("CREATE VIEW \"materialize\".\"public\".\"v\" AS {query}")
-    }
-
-    /// `definition` for a `CREATE VIEW` whose query is `query`.
-    fn view_definition(query: &str) -> String {
-        match as_serde(super::parse_catalog_create_sql(&view_sql(query)).expect("ok")) {
-            serde_json::Value::Object(mut m) => match m.remove("definition") {
-                Some(serde_json::Value::String(s)) => s,
-                other => panic!("no string `definition` key: {other:?}"),
-            },
-            other => panic!("not a JSON object: {other:?}"),
-        }
-    }
-
-    /// `mz_tables` and `mz_views` select rows by
-    /// `parse_catalog_create_sql(...)->>'type'`, and the function runs over
-    /// every `Item` row in the catalog, so a statement kind that changes its
-    /// reported type silently gains or loses rows in those relations. Pin the
-    /// type of every kind the catalog can hold.
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn catalog_item_type_per_statement_kind() {
-        let cases = [
-            (
-                "CREATE TABLE \"materialize\".\"public\".\"t\" (a int4)",
-                "table",
-            ),
-            // A table created from a source, and a webhook table, are both
-            // `table`, so both land in mz_tables.
-            (
-                "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
-                 FROM SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
-                 (REFERENCE = \"topic\") FORMAT TEXT",
-                "table",
-            ),
-            (
-                "CREATE TABLE \"materialize\".\"public\".\"wht\" FROM WEBHOOK BODY FORMAT JSON",
-                "table",
-            ),
-            (
-                "CREATE VIEW \"materialize\".\"public\".\"v\" AS SELECT 1",
-                "view",
-            ),
-            (
-                "CREATE MATERIALIZED VIEW \"materialize\".\"public\".\"mv\" \
-                 IN CLUSTER [u1] AS SELECT 1",
-                "materialized-view",
-            ),
-            (
-                "CREATE SOURCE \"materialize\".\"public\".\"lg\" \
-                 IN CLUSTER [u1] FROM LOAD GENERATOR COUNTER",
-                "source",
-            ),
-            (
-                "CREATE SOURCE \"materialize\".\"public\".\"wh\" \
-                 IN CLUSTER [u1] FROM WEBHOOK BODY FORMAT JSON",
-                "source",
-            ),
-            (
-                "CREATE SUBSOURCE \"materialize\".\"public\".\"sub\" (id int4) \
-                 OF SOURCE [u1 AS \"materialize\".\"public\".\"src\"]",
-                "subsource",
-            ),
-            (
-                "CREATE SUBSOURCE \"materialize\".\"public\".\"progress\" (id int4) \
-                 WITH (PROGRESS)",
-                "subsource",
-            ),
-            (
-                "CREATE SINK \"materialize\".\"public\".\"snk\" IN CLUSTER [u1] \
-                 FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-                 INTO KAFKA CONNECTION [u2 AS \"materialize\".\"public\".\"c\"] \
-                 (TOPIC 'tp') FORMAT JSON ENVELOPE DEBEZIUM",
-                "sink",
-            ),
-            (
-                "CREATE INDEX \"i\" IN CLUSTER [u1] \
-                 ON [u1 AS \"materialize\".\"public\".\"t\"] (\"a\")",
-                "index",
-            ),
-            (
-                "CREATE TYPE \"materialize\".\"public\".\"ty\" AS LIST (ELEMENT TYPE = int4)",
-                "type",
-            ),
-            (
-                "CREATE SECRET \"materialize\".\"public\".\"s\" AS 'x'",
-                "secret",
-            ),
-            (
-                "CREATE CONNECTION \"materialize\".\"public\".\"c\" \
-                 TO KAFKA (BROKER 'b', SECURITY PROTOCOL PLAINTEXT)",
-                "connection",
-            ),
-        ];
-        for (sql, expected) in cases {
-            assert_eq!(item_type(sql).as_deref(), Ok(expected), "for {sql}");
-        }
-    }
-
-    /// `mz_views.definition` is produced here. It used to be produced by
-    /// `pack_view_update` in the adapter, so the exact rendering is a
-    /// compatibility surface: `pg_views.definition` reads it.
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn catalog_view_definition() {
-        // Identifiers and function names come back fully quoted, literals
-        // untouched, and PostgreSQL's trailing semicolon is appended.
-        assert_eq!(view_definition("SELECT 1"), "SELECT 1;");
-        assert_eq!(
-            view_definition("WITH c AS (SELECT 1 AS a) SELECT a FROM c"),
-            "WITH \"c\" AS (SELECT 1 AS \"a\") SELECT \"a\" FROM \"c\";"
-        );
-        assert_eq!(
-            view_definition("SELECT 1 UNION ALL SELECT 2"),
-            "SELECT 1 UNION ALL SELECT 2;"
-        );
-        assert_eq!(
-            view_definition("SELECT (SELECT max(a) FROM [u1 AS \"materialize\".\"public\".\"t\"])"),
-            "SELECT (SELECT \"max\"(\"a\") FROM [u1 AS \"materialize\".\"public\".\"t\"]);"
-        );
-        // Identifiers needing quotes, an embedded double quote, non-ASCII, an
-        // embedded single quote in a literal, and ORDER BY all survive.
-        assert_eq!(
-            view_definition(
-                "SELECT \"a b\", \"héllo\", \"q\"\"x\" \
-                 FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-                 WHERE s = 'lit''eral' AND n = 42 ORDER BY 1"
-            ),
-            "SELECT \"a b\", \"héllo\", \"q\"\"x\" \
-             FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-             WHERE \"s\" = 'lit''eral' AND \"n\" = 42 ORDER BY 1;"
-        );
-    }
-
-    /// The rendering must be a fixed point: `pg_views` consumers re-issue
-    /// `definition` as the body of a new view, so a second pass through the
-    /// parser has to produce the identical string. The trailing `;` is part of
-    /// what gets re-parsed.
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn catalog_view_definition_is_idempotent() {
-        for query in [
-            "SELECT 1",
-            "WITH c AS (SELECT 1 AS a) SELECT a FROM c",
-            "SELECT 1 UNION ALL SELECT 2",
-            "SELECT \"a b\", \"q\"\"x\" FROM [u1 AS \"materialize\".\"public\".\"t\"] \
-             WHERE s = 'lit''eral' ORDER BY 1",
-        ] {
-            let once = view_definition(query);
-            assert_eq!(
-                view_definition(&once),
-                once,
-                "not a fixed point for {query}"
-            );
-        }
-    }
-
-    /// `mz_tables.source_id` comes from this key. A table with no source must
-    /// omit it entirely, so the MV's `->>'source_id'` yields SQL NULL.
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn catalog_table_source_id() {
-        let from_source = as_serde(
-            super::parse_catalog_create_sql(
-                "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
-                 FROM SOURCE [u1 AS \"materialize\".\"public\".\"src\"] \
-                 (REFERENCE = \"topic\") FORMAT TEXT",
-            )
-            .expect("ok"),
-        );
-        assert_eq!(from_source, json!({ "type": "table", "source_id": "u1" }));
-
-        for sql in [
-            "CREATE TABLE \"materialize\".\"public\".\"t\" (a int4)",
-            "CREATE TABLE \"materialize\".\"public\".\"wht\" FROM WEBHOOK BODY FORMAT JSON",
-        ] {
-            assert_eq!(
-                as_serde(super::parse_catalog_create_sql(sql).expect("ok")),
-                json!({ "type": "table" }),
-                "for {sql}"
-            );
-        }
-    }
-
-    /// Every error here is fatal to the whole of `mz_tables`/`mz_views`, not to
-    /// one row: the MVs call this function inside their `WHERE` clause, so an
-    /// item the parser rejects makes the relation unreadable for everyone.
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn catalog_create_sql_errors() {
-        assert_eq!(
-            item_type("this is not sql"),
-            Err(
-                "failed to parse create_sql: Expected a keyword at the beginning of a statement, \
-                 found identifier \"this\""
-                    .to_string()
-            )
-        );
-        assert_eq!(
-            item_type("CREATE TABLE t (a int4); CREATE TABLE u (b int4)"),
-            Err("expected a single statement, found 2".to_string())
-        );
-        // A statement that is not a CREATE of a catalog item, e.g. if a future
-        // change persists something else in an Item record.
-        assert_eq!(
-            item_type("SELECT 1"),
-            Err("not a CREATE item statement".to_string())
-        );
-        // Catalog `create_sql` always names items by id. An unresolved name
-        // means the record was written wrong.
-        assert_eq!(
-            item_type(
-                "CREATE TABLE \"materialize\".\"public\".\"tbl\" \
-                 FROM SOURCE src (REFERENCE = \"topic\")"
-            ),
-            Err("unresolved item name".to_string())
-        );
-    }
-
-    // --- parse_catalog_item_references ----------------------------------------
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn item_references_view() {
-        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS \
-             SELECT \"pg_catalog\".\"abs\"(\"a\"::[s20 AS \"pg_catalog\".\"int4\"]) \
-             FROM [u1 AS \"materialize\".\"public\".\"t\"]";
-        let out = as_serde(super::parse_catalog_item_references(sql).expect("ok"));
-        assert_eq!(
-            out,
-            json!({
-                "ids": ["s20", "u1"],
-                "named_funcs": [{"schema": "pg_catalog", "name": "abs"}],
-                "named_types": [],
-                "named_relations": [],
-            })
-        );
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn item_references_connection() {
-        let sql = "CREATE CONNECTION \"materialize\".\"public\".\"kc\" TO KAFKA (\
-             BROKER 'kafka:9092', \
-             SSH TUNNEL [u5 AS \"materialize\".\"public\".\"ssh\"], \
-             SASL PASSWORD = SECRET [u7 AS \"materialize\".\"public\".\"pw\"])";
-        let out = as_serde(super::parse_catalog_item_references(sql).expect("ok"));
-        assert_eq!(out["ids"], json!(["u5", "u7"]));
-        assert_eq!(out["named_funcs"], json!([]));
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn item_references_cte_shadowing() {
-        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS \
-             WITH \"c\" AS (SELECT * FROM [u1 AS \"materialize\".\"public\".\"t\"]) \
-             SELECT * FROM \"c\"";
-        let out = as_serde(super::parse_catalog_item_references(sql).expect("ok"));
-        assert_eq!(out["ids"], json!(["u1"]));
-        assert_eq!(out["named_relations"], json!([]));
-    }
-
-    #[mz_ore::test]
-    #[cfg_attr(miri, ignore)] // error: unsupported operation: can't call foreign function `rust_psm_stack_pointer` on OS `linux`
-    fn item_references_name_based_relation_surfaces() {
-        // Stored SQL always prints relations as id references. A name-based
-        // relation must surface in "named_relations" rather than vanish.
-        let sql = "CREATE VIEW \"materialize\".\"public\".\"v\" AS \
-             SELECT * FROM \"mz_catalog\".\"mz_tables\"";
-        let out = as_serde(super::parse_catalog_item_references(sql).expect("ok"));
-        assert_eq!(
-            out["named_relations"],
-            json!([{"schema": "mz_catalog", "name": "mz_tables"}])
-        );
-    }
-
-    #[mz_ore::test]
-    fn item_references_parse_error() {
-        let err = super::parse_catalog_item_references("NOT SQL").unwrap_err();
-        assert!(
-            matches!(err, EvalError::InvalidCatalogJson(msg) if msg.contains("failed to parse")),
-            "wrong error variant/message"
-        );
-    }
-}
diff --git a/test/sqllogictest/mz_aws_connections.slt b/test/sqllogictest/mz_aws_connections.slt
index 96ca58cd70462..8a2971072524b 100644
--- a/test/sqllogictest/mz_aws_connections.slt
+++ b/test/sqllogictest/mz_aws_connections.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_AWS_CONNECTIONS in src/catalog/src/builtin/mz_internal.rs and the
 # parse_connection_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. The assume-role columns (principal,
+# src/catalog-decode/src/create_sql.rs. The assume-role columns (principal,
 # external_id, example_trust_policy) are reconstructed from the AWS context
 # functions; the sqllogictest env configures that context (see
 # ConnectionContext::for_tests), so the built-in mz_analytics connection
diff --git a/test/sqllogictest/mz_kafka_connections.slt b/test/sqllogictest/mz_kafka_connections.slt
index 18e30b1b71b10..7a1d2d48d0807 100644
--- a/test/sqllogictest/mz_kafka_connections.slt
+++ b/test/sqllogictest/mz_kafka_connections.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_KAFKA_CONNECTIONS in src/catalog/src/builtin/mz_catalog.rs and the
 # parse_connection_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. Rows with a live broker are
+# src/catalog-decode/src/create_sql.rs. Rows with a live broker are
 # exercised by test/testdrive/connection-create-drop.td; this file pins the
 # column shape, the progress-topic default, and the parent-type filtering,
 # none of which need a live Kafka.
diff --git a/test/sqllogictest/mz_kafka_source_tables.slt b/test/sqllogictest/mz_kafka_source_tables.slt
index bf2e55335d509..357be41b1518e 100644
--- a/test/sqllogictest/mz_kafka_source_tables.slt
+++ b/test/sqllogictest/mz_kafka_source_tables.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_KAFKA_SOURCE_TABLES in src/catalog/src/builtin/mz_internal.rs and the
 # parse_source_export_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. Rows with real upstream data, and
+# src/catalog-decode/src/create_sql.rs. Rows with real upstream data, and
 # the envelope/format resolution, are exercised by test/testdrive/mz-sources.td;
 # this file pins the column shape and the parent-type filtering that need no
 # live Kafka.
diff --git a/test/sqllogictest/mz_kafka_sources.slt b/test/sqllogictest/mz_kafka_sources.slt
index 8011caeba01ca..2323d4826a228 100644
--- a/test/sqllogictest/mz_kafka_sources.slt
+++ b/test/sqllogictest/mz_kafka_sources.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw:
 # see MZ_KAFKA_SOURCES in src/catalog/src/builtin/mz_catalog.rs and the
 # parse_kafka_source_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. These tests pin down the
+# src/catalog-decode/src/create_sql.rs. These tests pin down the
 # column shape, nullability, and cross-catalog invariants that must be
 # preserved as the SQL evolves.
 #
diff --git a/test/sqllogictest/mz_mysql_source_tables.slt b/test/sqllogictest/mz_mysql_source_tables.slt
index ec599e474b64b..bde6c6ce27a97 100644
--- a/test/sqllogictest/mz_mysql_source_tables.slt
+++ b/test/sqllogictest/mz_mysql_source_tables.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_MYSQL_SOURCE_TABLES in src/catalog/src/builtin/mz_internal.rs and the
 # parse_source_export_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. Rows with real upstream data are
+# src/catalog-decode/src/create_sql.rs. Rows with real upstream data are
 # exercised by test/mysql-cdc; this file pins the column shape and the
 # parent-type filtering that need no live MySQL.
 
diff --git a/test/sqllogictest/mz_postgres_source_tables.slt b/test/sqllogictest/mz_postgres_source_tables.slt
index 9655a5e8207b9..95977208151d7 100644
--- a/test/sqllogictest/mz_postgres_source_tables.slt
+++ b/test/sqllogictest/mz_postgres_source_tables.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_POSTGRES_SOURCE_TABLES in src/catalog/src/builtin/mz_internal.rs and the
 # parse_source_export_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. Rows with real upstream data are
+# src/catalog-decode/src/create_sql.rs. Rows with real upstream data are
 # exercised by test/pg-cdc; this file pins the column shape and the
 # parent-type filtering that need no live Postgres.
 
diff --git a/test/sqllogictest/mz_postgres_sources.slt b/test/sqllogictest/mz_postgres_sources.slt
index 7771c324ccc7e..aac57baf52807 100644
--- a/test/sqllogictest/mz_postgres_sources.slt
+++ b/test/sqllogictest/mz_postgres_sources.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw:
 # see MZ_POSTGRES_SOURCES in src/catalog/src/builtin/mz_internal.rs and
 # the parse_postgres_source_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. These tests pin down the
+# src/catalog-decode/src/create_sql.rs. These tests pin down the
 # column shape, nullability, and cross-catalog invariants that must be
 # preserved as the SQL evolves.
 
diff --git a/test/sqllogictest/mz_sinks.slt b/test/sqllogictest/mz_sinks.slt
index 71ffe8123bcaa..b6a97e830e019 100644
--- a/test/sqllogictest/mz_sinks.slt
+++ b/test/sqllogictest/mz_sinks.slt
@@ -11,7 +11,7 @@
 # and mz_catalog.mz_iceberg_sinks. All three are materialized views over
 # mz_internal.mz_catalog_raw and get every sink detail out of the
 # persisted create_sql, in the CreateSink arm of parse_catalog_create_sql
-# (src/expr/src/scalar/func/impls/jsonb.rs).
+# (src/catalog-decode/src/create_sql.rs).
 #
 # Note we can't create a sink here at all: purification always talks to
 # the broker or the iceberg catalog, and there is no VALIDATE = false to
diff --git a/test/sqllogictest/mz_sql_server_source_tables.slt b/test/sqllogictest/mz_sql_server_source_tables.slt
index db079af1c322b..6c5a7b3f931e0 100644
--- a/test/sqllogictest/mz_sql_server_source_tables.slt
+++ b/test/sqllogictest/mz_sql_server_source_tables.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_SQL_SERVER_SOURCE_TABLES in src/catalog/src/builtin/mz_internal.rs and the
 # parse_source_export_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. Rows with real upstream data are
+# src/catalog-decode/src/create_sql.rs. Rows with real upstream data are
 # exercised by test/sql-server-cdc; this file pins the column shape and the
 # parent-type filtering that need no live SQL Server.
 
diff --git a/test/sqllogictest/mz_ssh_tunnel_connections.slt b/test/sqllogictest/mz_ssh_tunnel_connections.slt
index b555697bb352e..5f6caf54510e0 100644
--- a/test/sqllogictest/mz_ssh_tunnel_connections.slt
+++ b/test/sqllogictest/mz_ssh_tunnel_connections.slt
@@ -11,7 +11,7 @@
 # BuiltinMaterializedView backed by SQL over mz_internal.mz_catalog_raw: see
 # MZ_SSH_TUNNEL_CONNECTIONS in src/catalog/src/builtin/mz_catalog.rs and the
 # parse_connection_details helper in
-# src/expr/src/scalar/func/impls/jsonb.rs. The end-to-end SSH tunnel behaviour
+# src/catalog-decode/src/create_sql.rs. The end-to-end SSH tunnel behaviour
 # is exercised by test/ssh-connection/*; this file pins the column shape and
 # the parent-type filtering.
 
diff --git a/test/sqllogictest/mz_tables.slt b/test/sqllogictest/mz_tables.slt
index 487d2ade49020..ca504a2112105 100644
--- a/test/sqllogictest/mz_tables.slt
+++ b/test/sqllogictest/mz_tables.slt
@@ -12,7 +12,7 @@
 # src/catalog/src/builtin/mz_catalog.rs) with two union branches, user tables
 # and builtin tables, and it derives every column from the durable catalog JSON
 # through parse_catalog_id, parse_catalog_privileges, redact_sql and
-# parse_catalog_create_sql (src/expr/src/scalar/func/impls/jsonb.rs).
+# parse_catalog_create_sql (src/catalog-decode/src/create_sql.rs).
 #
 # Before that it was a BuiltinTable populated by pack_table_update in the
 # adapter, so the values pinned here are a compatibility surface:
diff --git a/test/sqllogictest/mz_views.slt b/test/sqllogictest/mz_views.slt
index 5fd82a0c8a6b5..d7c4cb3bb7e20 100644
--- a/test/sqllogictest/mz_views.slt
+++ b/test/sqllogictest/mz_views.slt
@@ -12,7 +12,7 @@
 # src/catalog/src/builtin/mz_catalog.rs) with two union branches, user views and
 # builtin views, and it derives every column from the durable catalog JSON
 # through parse_catalog_id, parse_catalog_privileges, redact_sql and
-# parse_catalog_create_sql (src/expr/src/scalar/func/impls/jsonb.rs).
+# parse_catalog_create_sql (src/catalog-decode/src/create_sql.rs).
 #
 # Before that it was a BuiltinTable populated by pack_view_update in the
 # adapter, so the values pinned here are a compatibility surface. The

From e2be59fc1af62a171bb518eda317aac8ec37cce8 Mon Sep 17 00:00:00 2001
From: Sang Jun Bak <jun@materialize.com>
Date: Mon, 28 Sep 2026 11:51:18 -0400
Subject: [PATCH 94/94] adapter: migrate mz_source_references to a materialized
 view (#38790)

Converts mz_source_references to a builtin materialized view. Read
commit messages for more details

### Motivation

Closes [SQL-704](https://linear.app/materializeinc/issue/SQL-704)

### Description
Part of the builtin migration work. The migration is pretty straight
forward.

### Verification
- Created a new SLT to test the SQL itself.
- Diffed this relation using a customer's workload replay against main
and this branch.
---
 src/adapter/src/catalog/apply.rs              |  4 +-
 .../src/catalog/builtin_table_updates.rs      | 53 +---------
 .../catalog/open/builtin_schema_migration.rs  |  9 ++
 src/catalog/src/builtin.rs                    |  4 +-
 src/catalog/src/builtin/mz_internal.rs        | 99 ++++++++++++-------
 src/pgrepr-consts/src/oid.rs                  |  2 +-
 test/sqllogictest/catalog_server_explain.slt  | 78 +++++++++++++--
 .../information_schema_tables.slt             |  2 +-
 test/sqllogictest/mz_source_references.slt    | 67 +++++++++++++
 test/testdrive/catalog.td                     |  4 +-
 10 files changed, 223 insertions(+), 99 deletions(-)
 create mode 100644 test/sqllogictest/mz_source_references.slt

diff --git a/src/adapter/src/catalog/apply.rs b/src/adapter/src/catalog/apply.rs
index a7c3721f3b7e8..ed0c6e5e06aea 100644
--- a/src/adapter/src/catalog/apply.rs
+++ b/src/adapter/src/catalog/apply.rs
@@ -1482,9 +1482,7 @@ impl CatalogState {
             }
             StateUpdateKind::Item(item) => self.pack_item_update(item.id, diff),
             StateUpdateKind::Comment(_) => Vec::new(),
-            StateUpdateKind::SourceReferences(source_references) => {
-                self.pack_source_references_update(&source_references, diff)
-            }
+            StateUpdateKind::SourceReferences(_) => Vec::new(),
             // mz_audit_events is a MaterializedView backed by
             // mz_internal.mz_catalog_raw, so audit log rows do not produce
             // builtin table updates here.
diff --git a/src/adapter/src/catalog/builtin_table_updates.rs b/src/adapter/src/catalog/builtin_table_updates.rs
index b6653b1305ad2..6b92124b586f9 100644
--- a/src/adapter/src/catalog/builtin_table_updates.rs
+++ b/src/adapter/src/catalog/builtin_table_updates.rs
@@ -19,10 +19,9 @@ use mz_catalog::builtin::{
     MZ_CLUSTER_REPLICA_SIZES, MZ_COLUMNS, MZ_EGRESS_IPS, MZ_FUNCTIONS,
     MZ_HISTORY_RETENTION_STRATEGIES, MZ_INDEX_COLUMNS, MZ_LICENSE_KEYS, MZ_LIST_TYPES,
     MZ_MAP_TYPES, MZ_MATERIALIZED_VIEW_REFRESH_STRATEGIES, MZ_OPERATORS, MZ_PSEUDO_TYPES,
-    MZ_REPLACEMENTS, MZ_ROLE_AUTH, MZ_SESSIONS, MZ_SOURCE_REFERENCES, MZ_STORAGE_USAGE_BY_SHARD,
-    MZ_SUBSCRIPTIONS, MZ_TYPE_PG_METADATA, MZ_TYPES, MZ_WEBHOOKS_SOURCES,
+    MZ_REPLACEMENTS, MZ_ROLE_AUTH, MZ_SESSIONS, MZ_STORAGE_USAGE_BY_SHARD, MZ_SUBSCRIPTIONS,
+    MZ_TYPE_PG_METADATA, MZ_TYPES, MZ_WEBHOOKS_SOURCES,
 };
-use mz_catalog::durable::SourceReferences;
 use mz_catalog::memory::error::Error;
 use mz_catalog::memory::objects::{
     CatalogItem, DataSourceDesc, Func, Index, MaterializedView, Table, TableDataSource, Type,
@@ -853,52 +852,4 @@ impl CatalogState {
             diff,
         )
     }
-
-    pub fn pack_source_references_update(
-        &self,
-        source_references: &SourceReferences,
-        diff: Diff,
-    ) -> Vec<BuiltinTableUpdate<&'static BuiltinTable>> {
-        let source_id = source_references.source_id.to_string();
-        let updated_at = &source_references.updated_at;
-        source_references
-            .references
-            .iter()
-            .map(|reference| {
-                let mut row = Row::default();
-                let mut packer = row.packer();
-                packer.extend([
-                    Datum::String(&source_id),
-                    reference
-                        .namespace
-                        .as_ref()
-                        .map(|s| Datum::String(s))
-                        .unwrap_or(Datum::Null),
-                    Datum::String(&reference.name),
-                    Datum::TimestampTz(
-                        mz_ore::now::to_datetime(*updated_at)
-                            .try_into()
-                            .expect("must fit"),
-                    ),
-                ]);
-                if reference.columns.len() > 0 {
-                    packer
-                        .try_push_array(
-                            &[ArrayDimension {
-                                lower_bound: 1,
-                                length: reference.columns.len(),
-                            }],
-                            reference.columns.iter().map(|col| Datum::String(col)),
-                        )
-                        .expect(
-                            "columns is 1 dimensional, and its length is used for the array length",
-                        );
-                } else {
-                    packer.push(Datum::Null);
-                }
-
-                BuiltinTableUpdate::row(&*MZ_SOURCE_REFERENCES, row, diff)
-            })
-            .collect()
-    }
 }
diff --git a/src/adapter/src/catalog/open/builtin_schema_migration.rs b/src/adapter/src/catalog/open/builtin_schema_migration.rs
index 48e295d21bf2a..707be62f46b59 100644
--- a/src/adapter/src/catalog/open/builtin_schema_migration.rs
+++ b/src/adapter/src/catalog/open/builtin_schema_migration.rs
@@ -487,6 +487,15 @@ static MIGRATIONS: LazyLock<Vec<MigrationStep>> = LazyLock::new(|| {
             MZ_INTERNAL_SCHEMA,
             "mz_object_global_ids",
         ),
+        // Converting mz_source_references from a builtin table to a
+        // materialized view over mz_catalog_raw changes its catalog
+        // fingerprint.
+        MigrationStep::replacement(
+            "26.45.0-dev.0",
+            CatalogItemType::MaterializedView,
+            MZ_INTERNAL_SCHEMA,
+            "mz_source_references",
+        ),
     ]
 });
 
diff --git a/src/catalog/src/builtin.rs b/src/catalog/src/builtin.rs
index 7d10a3a92531a..bb659d6d8a1fe 100644
--- a/src/catalog/src/builtin.rs
+++ b/src/catalog/src/builtin.rs
@@ -1159,7 +1159,7 @@ pub static BUILTINS_STATIC: LazyLock<Vec<Builtin<NameReference>>> = LazyLock::ne
         Builtin::Table(&MZ_INDEX_COLUMNS),
         Builtin::MaterializedView(&MZ_TABLES),
         // mz_sources is generated dynamically below with inlined builtin VALUES.
-        Builtin::Table(&MZ_SOURCE_REFERENCES),
+        Builtin::MaterializedView(&MZ_SOURCE_REFERENCES),
         Builtin::MaterializedView(&MZ_POSTGRES_SOURCES),
         Builtin::MaterializedView(&MZ_POSTGRES_SOURCE_TABLES),
         Builtin::MaterializedView(&MZ_MYSQL_SOURCE_TABLES),
@@ -1536,7 +1536,7 @@ pub static BUILTINS_STATIC: LazyLock<Vec<Builtin<NameReference>>> = LazyLock::ne
         // all items that follow it in the list.
         let insert_pos = builtin_items
             .iter()
-            .position(|b| matches!(b, Builtin::Table(t) if t.name == "mz_source_references"))
+            .position(|b| b.name() == "mz_source_references")
             .expect("mz_source_references must be present in builtin_items");
         builtin_items.insert(insert_pos, Builtin::MaterializedView(mz_sources_ref));
     }
diff --git a/src/catalog/src/builtin/mz_internal.rs b/src/catalog/src/builtin/mz_internal.rs
index abd0bda3efd28..4b155ca94720a 100644
--- a/src/catalog/src/builtin/mz_internal.rs
+++ b/src/catalog/src/builtin/mz_internal.rs
@@ -3572,39 +3572,72 @@ FROM commented",
     }
 });
 
-pub static MZ_SOURCE_REFERENCES: LazyLock<BuiltinTable> = LazyLock::new(|| BuiltinTable {
-    name: "mz_source_references",
-    schema: MZ_INTERNAL_SCHEMA,
-    oid: oid::TABLE_MZ_SOURCE_REFERENCES_OID,
-    desc: RelationDesc::builder()
-        .with_column("source_id", SqlScalarType::String.nullable(false))
-        .with_column("namespace", SqlScalarType::String.nullable(true))
-        .with_column("name", SqlScalarType::String.nullable(false))
-        .with_column(
-            "updated_at",
-            SqlScalarType::TimestampTz { precision: None }.nullable(false),
-        )
-        .with_column(
-            "columns",
-            SqlScalarType::Array(Box::new(SqlScalarType::String)).nullable(true),
-        )
-        .finish(),
-    column_comments: BTreeMap::new(),
-    is_retained_metrics_object: false,
-    access: vec![PUBLIC_SELECT],
-    ontology: Some(Ontology {
-        entity_name: "source_reference",
-        description: "External references tracked by sources",
-        links: &const {
-            [OntologyLink {
-                name: "references_source",
-                target: "source",
-                properties: LinkProperties::fk("source_id", "id", Cardinality::ManyToOne),
-            }]
-        },
-        column_semantic_types: &[("source_id", SemanticType::CatalogItemId)],
-    }),
-});
+pub static MZ_SOURCE_REFERENCES: LazyLock<BuiltinMaterializedView> =
+    LazyLock::new(|| BuiltinMaterializedView {
+        name: "mz_source_references",
+        schema: MZ_INTERNAL_SCHEMA,
+        oid: oid::MV_MZ_SOURCE_REFERENCES_OID,
+        desc: RelationDesc::builder()
+            .with_column("source_id", SqlScalarType::String.nullable(false))
+            .with_column("namespace", SqlScalarType::String.nullable(true))
+            .with_column("name", SqlScalarType::String.nullable(false))
+            .with_column(
+                "updated_at",
+                SqlScalarType::TimestampTz { precision: None }.nullable(false),
+            )
+            .with_column(
+                "columns",
+                SqlScalarType::Array(Box::new(SqlScalarType::String)).nullable(true),
+            )
+            .finish(),
+        column_comments: BTreeMap::new(),
+        sql: "
+IN CLUSTER mz_catalog_server
+WITH (
+    ASSERT NOT NULL source_id,
+    ASSERT NOT NULL name,
+    ASSERT NOT NULL updated_at
+) AS
+-- `refs` projects away usage of the `data` column before the `columns` subquery.
+-- Without the CTE, each row would need a copy of `data` which contains all source
+-- references, leading to memory growing quadratically.
+WITH refs AS (
+    SELECT
+        mz_internal.parse_catalog_id(data->'key'->'source') AS source_id,
+        -- `updated_at` is an `EpochMillis`, serialized as `{\"millis\": <u64>}`
+        to_timestamp(((data->'value'->'updated_at'->>'millis')::double) / 1000.0) AS updated_at,
+        reference
+    FROM
+        mz_internal.mz_catalog_raw,
+        jsonb_array_elements(data->'value'->'references') AS reference
+    WHERE data->>'kind' = 'SourceReferences'
+)
+SELECT
+    source_id,
+    reference->>'namespace' AS namespace,
+    reference->>'name' AS name,
+    updated_at,
+    (
+        SELECT array_agg(c.value ORDER BY c.ord)
+        FROM jsonb_array_elements_text(reference->'columns')
+             WITH ORDINALITY AS c(value, ord)
+    ) AS columns
+FROM refs",
+        is_retained_metrics_object: false,
+        access: vec![PUBLIC_SELECT],
+        ontology: Some(Ontology {
+            entity_name: "source_reference",
+            description: "External references tracked by sources",
+            links: &const {
+                [OntologyLink {
+                    name: "references_source",
+                    target: "source",
+                    properties: LinkProperties::fk("source_id", "id", Cardinality::ManyToOne),
+                }]
+            },
+            column_semantic_types: &[("source_id", SemanticType::CatalogItemId)],
+        }),
+    });
 
 pub static MZ_WEBHOOKS_SOURCES: LazyLock<BuiltinTable> = LazyLock::new(|| BuiltinTable {
     name: "mz_webhook_sources",
diff --git a/src/pgrepr-consts/src/oid.rs b/src/pgrepr-consts/src/oid.rs
index 5d0e360c6459f..3740c57458562 100644
--- a/src/pgrepr-consts/src/oid.rs
+++ b/src/pgrepr-consts/src/oid.rs
@@ -732,7 +732,7 @@ pub const INDEX_MZ_OBJECTS_IND_OID: u32 = 17011;
 pub const INDEX_MZ_COLUMNS_IND_OID: u32 = 17012;
 pub const INDEX_MZ_SECRETS_IND_OID: u32 = 17013;
 pub const INDEX_MZ_VIEWS_IND_OID: u32 = 17014;
-pub const TABLE_MZ_SOURCE_REFERENCES_OID: u32 = 17015;
+pub const MV_MZ_SOURCE_REFERENCES_OID: u32 = 17015;
 pub const SOURCE_MZ_CLUSTER_REPLICA_METRICS_HISTORY_OID: u32 = 17016;
 pub const INDEX_MZ_CLUSTER_REPLICA_METRICS_HISTORY_IND_OID: u32 = 17017;
 pub const VIEW_MZ_CLUSTER_REPLICA_UTILIZATION_HISTORY_OID: u32 = 17018;
diff --git a/test/sqllogictest/catalog_server_explain.slt b/test/sqllogictest/catalog_server_explain.slt
index 898186c238260..cad9d876f6b93 100644
--- a/test/sqllogictest/catalog_server_explain.slt
+++ b/test/sqllogictest/catalog_server_explain.slt
@@ -5127,7 +5127,7 @@ mz_catalog.mz_materialized_views:
           Project: #4, #0, #5, #1, #6, #2, #9, #8, #3, #7
           Map: {=r/s1, s1=r/s1}, "s1"
       →Arrange (#1{schema_name}, #2{name})
-        →Constant (45 rows)
+        →Constant (46 rows)
       →Arrange (empty key) (#0{schema_name}) (#0{schema_name}, #1{name})
         →Fused with Child Map/Filter/Project
           Project: #4, #3, #5
@@ -5472,7 +5472,7 @@ mz_catalog.mz_tables:
           Project: #3, #0, #4, #1, #5, #2, #6, #6, #6
           Map: "s1", null
       →Arrange (#1{schema_name}, #2{name})
-        →Constant (29 rows)
+        →Constant (28 rows)
       →Arrange (#0{schema_name}) (#0{schema_name}, #1{name})
         →Fused with Child Map/Filter/Project
           Project: #5, #4, #6
@@ -5889,7 +5889,7 @@ mz_internal.mz_object_dependencies:
               Project: #4..=#6, #2
               Filter: case when (#7{ref_kind} = "func") then (#3{object_type} = "8") else case when (#7{ref_kind} = "type") then (#3{object_type} = "7") else ((#3{object_type} != "7") AND (#3{object_type} != "8")) end end
           →Arrange (#0{object_schema}..=#2{object_type}) (#3{ref_schema}, #4{ref_name})
-            →Constant (1027 rows)
+            →Constant (1034 rows)
           →Arrange (#1{schema_name}..=#3{object_type})
             →Fused with Child Map/Filter/Project
               Project: #5, #4, #2, #3
@@ -6071,6 +6071,72 @@ Target cluster: mz_catalog_server
 
 EOF
 
+query T multiline
+EXPLAIN MATERIALIZED VIEW "mz_internal"."mz_source_references";
+----
+mz_internal.mz_source_references:
+  →With
+    cte l0 =
+      →Fused with Child Map/Filter/Project
+        Project: #1..=#3
+        Map: parse_catalog_id(((#0{data} -> "key") -> "source")), tots((text_to_double((((#0{data} -> "value") -> "updated_at") ->> "millis")) / 1000))
+          →Table Function jsonb_array_elements(((#0{data} -> "value") -> "references"))
+            →Read mz_internal.mz_catalog_raw
+    cte l1 =
+      →Distinct GroupAggregate
+        →Fused with Child Map/Filter/Project
+          Project: #0
+            →Read l0
+    cte l2 =
+      →Non-incremental GroupAggregate
+        Aggregation: array_agg[order_by=[#0 asc nulls_last]](row(array[#1{value}], #2{ord}))
+        Key:
+          Project: #0
+        →Table Function jsonb_array_elements_text[with_ordinality]((#0{reference} -> "columns"))
+          →Arranged l1
+    cte l3 =
+      →Union
+        →Unarranged Raw Stream
+          →Arranged l2
+        →Map/Filter/Project
+          Project: #0, #1
+          Map: null
+            →Consolidating Union
+              →Negate Diffs
+                →Fused with Child Map/Filter/Project
+                  Project: #0
+                    →Arranged l2
+                      Key: (#0)
+              →Unarranged Raw Stream
+                →Arranged l1
+  →Return
+    →Differential Join %1[#0] » %0:l0[#0]
+      after %0:
+        Project: #2, #4, #5, #3, #1
+        Map: (#0{reference} ->> "namespace"), (#0{reference} ->> "name")
+      →Arrange (#0)
+        →Stream l0
+      →Arrange (#0)
+        →Union
+          →Stream l3
+          →Map/Filter/Project
+            Project: #0, #1
+            Map: null
+              →Consolidating Union
+                →Negate Diffs
+                  →Fused with Child Map/Filter/Project
+                    Project: #0
+                      →Read l3
+                →Unarranged Raw Stream
+                  →Arranged l1
+
+Source mz_internal.mz_catalog_raw
+  filter=(("SourceReferences" = (#0{data} ->> "kind")))
+
+Target cluster: mz_catalog_server
+
+EOF
+
 query T multiline
 EXPLAIN MATERIALIZED VIEW "mz_internal"."mz_sql_server_source_tables";
 ----
@@ -8374,7 +8440,7 @@ query T multiline
 EXPLAIN SELECT * FROM "mz_internal"."mz_builtin_materialized_views";
 ----
 Explained Query (fast path):
-  →Constant (45 rows)
+  →Constant (46 rows)
 
 Target cluster: mz_catalog_server
 
@@ -8394,7 +8460,7 @@ query T multiline
 EXPLAIN SELECT * FROM "mz_internal"."mz_builtin_tables";
 ----
 Explained Query (fast path):
-  →Constant (29 rows)
+  →Constant (28 rows)
 
 Target cluster: mz_catalog_server
 
@@ -10322,7 +10388,7 @@ Explained Query:
               Project: #3, #4
               Filter: case when (#2{ref_kind} = "func") then (#5{object_type} = "8") else case when (#2{ref_kind} = "type") then (#5{object_type} = "7") else ((#5{object_type} != "7") AND (#5{object_type} != "8")) end end
           →Unarranged Raw Stream
-            →Constant (1027 rows)
+            →Constant (1034 rows)
           →Arrange (#1{schema_name}..=#3{object_type})
             →Fused with Child Map/Filter/Project
               Project: #5, #4, #2, #3
diff --git a/test/sqllogictest/information_schema_tables.slt b/test/sqllogictest/information_schema_tables.slt
index eef88c8d3ba9a..a479593c146be 100644
--- a/test/sqllogictest/information_schema_tables.slt
+++ b/test/sqllogictest/information_schema_tables.slt
@@ -766,7 +766,7 @@ VIEW
 materialize
 mz_internal
 mz_source_references
-BASE TABLE
+MATERIALIZED VIEW
 materialize
 mz_internal
 mz_source_statistics
diff --git a/test/sqllogictest/mz_source_references.slt b/test/sqllogictest/mz_source_references.slt
new file mode 100644
index 0000000000000..a1a0a2496c96c
--- /dev/null
+++ b/test/sqllogictest/mz_source_references.slt
@@ -0,0 +1,67 @@
+# Copyright Materialize, Inc. and contributors. All rights reserved.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file at the root of this repository.
+#
+# As of the Change Date specified in that file, in accordance with
+# the Business Source License, use of this software will be governed
+# by the Apache License, Version 2.0.
+
+# Behavioural tests for mz_internal.mz_source_references.
+
+mode cockroach
+
+reset-server
+
+# The auction house load generator generates multiple source references.
+statement ok
+CREATE SOURCE lg_auction IN CLUSTER quickstart FROM LOAD GENERATOR AUCTION FOR ALL TABLES
+
+query TTT
+SELECT r.namespace, r.name, r.columns::text
+FROM mz_internal.mz_source_references r
+JOIN mz_catalog.mz_sources s ON s.id = r.source_id
+WHERE s.name = 'lg_auction'
+ORDER BY r.name
+----
+auction  accounts  {id,org_id,balance}
+auction  auctions  {id,seller,item,end_time}
+auction  bids  {id,buyer,auction_id,amount,bid_time}
+auction  organizations  {id,name}
+auction  users  {id,org_id,name}
+
+# A single-output load generator records the reference but no column list.
+statement ok
+CREATE SOURCE lg_counter IN CLUSTER quickstart FROM LOAD GENERATOR COUNTER
+
+query TTT
+SELECT r.namespace, r.name, (r.columns IS NULL)::text
+FROM mz_internal.mz_source_references r
+JOIN mz_catalog.mz_sources s ON s.id = r.source_id
+WHERE s.name = 'lg_counter'
+----
+counter  counter  true
+
+# `updated_at` is when the references were last fetched.
+query B
+SELECT bool_and(updated_at BETWEEN now() - INTERVAL '1 hour' AND now() + INTERVAL '1 minute')
+FROM mz_internal.mz_source_references
+----
+true
+
+# Dropping a source retracts its references.
+statement ok
+DROP SOURCE lg_auction CASCADE
+
+query I
+SELECT count(*) FROM mz_internal.mz_source_references
+----
+1
+
+statement ok
+DROP SOURCE lg_counter CASCADE
+
+query I
+SELECT count(*) FROM mz_internal.mz_source_references
+----
+0
diff --git a/test/testdrive/catalog.td b/test/testdrive/catalog.td
index d0baa38912fd3..ea2b6ae857f02 100644
--- a/test/testdrive/catalog.td
+++ b/test/testdrive/catalog.td
@@ -613,7 +613,6 @@ mz_optimizer_notices                     ""
 mz_replacements                          ""
 mz_replica_hydration_history             ""
 mz_sessions                              ""
-mz_source_references                     ""
 mz_storage_usage_by_shard                ""
 mz_subscriptions                         ""
 mz_type_pg_metadata                      ""
@@ -740,6 +739,7 @@ mz_pending_cluster_replicas    mz_catalog_server   ""
 mz_postgres_source_tables      mz_catalog_server   ""
 mz_postgres_sources            mz_catalog_server   ""
 mz_replica_system_parameters   mz_catalog_server   ""
+mz_source_references           mz_catalog_server   ""
 mz_sql_server_source_tables    mz_catalog_server   ""
 
 # Check default sources, tables, and views in mz_introspection.
@@ -838,7 +838,7 @@ test_table ""
 
 # `SHOW TABLES` and `mz_tables` should agree.
 > SELECT COUNT(*) FROM mz_tables WHERE id LIKE 's%'
-29
+28
 
 # There is one entry in mz_indexes for each field_number/expression of the index.
 > SELECT COUNT(id) FROM mz_indexes WHERE id LIKE 's%'