chore(deps): bump the compatible-updates group across 1 directory with 6 updates

[dependabot]

Bumps the compatible-updates group with 6 updates in the / directory:

Package	From	To
clap	4.6.6	4.6.7
pubky-noise	0.1.0-rc7	0.1.0-rc8
pkarr	8.0.0	8.0.1
rand	0.8.7	0.8.8
reqwest	0.13.4	0.13.5
uuid	1.25.0	1.26.1

Updates clap from 4.6.6 to 4.6.7

Release notes

Sourced from clap's releases.

v4.6.7

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Changelog

Sourced from clap's changelog.

[4.6.7] - 2026-09-14

Features

• (derive) Add #[command(defer = <bool>)] attribute to opt-in to lazy initialisation of subcommands

Commits

• d3e59a9 chore: Release
• d997f87 docs: Update changelog
• fb6058c Merge pull request #6409 from heaths/pwsh-support
• 2310870 test(complete): Add tests for completer_for_path
• 5967c17 refactor(complete): Move shell detection to Shells
• 594602b fix(complete): Detect pwsh for PowerShell
• 3a4f2d0 Merge pull request #6427 from clap-rs/renovate/shlex-2.x
• 67ebaed Merge pull request #6426 from clap-rs/renovate/actions-checkout-7.x
• c968b13 chore(deps): Update Rust crate shlex to v2
• 8f247cb chore(deps): Update actions/checkout action to v7
• Additional commits viewable in compare view

Updates pubky-noise from 0.1.0-rc7 to 0.1.0-rc8

Commits

• See full diff in compare view

Updates pkarr from 8.0.0 to 8.0.1

Commits

• 938a938 chore: release v8.0.1 (#298)
• b25a104 deps: bump chacha20 to 0.10.2 (#297)
• 35e434d fix(relay): limit HTTP/1 connection buffers (#296)
• d01bfa4 deps: bump the cargo-dependencies group with 10 updates (#295)
• 6e23e39 fix(relay): bound HTTP connection lifetimes (#281)
• 941cb63 refactor(relay): reduce error result size (#294)
• ef31e78 deps: bump the cargo-dependencies group with 17 updates (#293)
• c4bc12e docs: document client and relay architecture (#280)
• 6302456 deps: bump the cargo-dependencies group with 13 updates (#289)
• See full diff in compare view

Updates rand from 0.8.7 to 0.8.8

Changelog

Sourced from rand's changelog.

[0.8.8] - 2026-08-25

Fixes

• Fix build for --no-default-features --features serde1 (#1825)

#1825: rust-random/rand#1825

Commits

• 572d3b0 v0.8: fix no-std + serde1 build (#1825)
• 229f547 Prepare 0.8.8
• 1ad885e Add test + fix for feature serde1 without std
• See full diff in compare view

Updates reqwest from 0.13.4 to 0.13.5

Release notes

Sourced from reqwest's releases.

v0.13.5

tl;dr

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

What's Changed

• fix(blocking): preserve version and extensions in TryFromhttp::Request by @​wwhsaber in seanmonstar/reqwest#3050
• Remove unnecessary clones by @​FranciscoTGouveia in seanmonstar/reqwest#3052
• Add Referrer and Referrer Policy methods to WASM Request API by @​Billy-Sheppard in seanmonstar/reqwest#3049
• chore(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in seanmonstar/reqwest#3058
• feat: add Error::is_dns() to identify DNS resolution failures by @​JoakoI98 in seanmonstar/reqwest#3057
• Fix blocking client timeout panic by @​V-Mann-Nick in seanmonstar/reqwest#3060
• Use LookupIpStrategy::Ipv6AndIpv4 to actually prefer IPv6 when using hickory-dns by @​FalkWoldmann in seanmonstar/reqwest#3063
• feat: Add ClientBuilder::http1_max_headers by @​smaeda-ks in seanmonstar/reqwest#3065
• feat: expose the negotiated TLS version via TlsInfo by @​dennisameling in seanmonstar/reqwest#3067
• fix(error): detect timeouts wrapped in body decode errors by @​raphaelroshan in seanmonstar/reqwest#3064
• Remove unnecessary clones and a cast by @​FranciscoTGouveia in seanmonstar/reqwest#3071
• chore(deps): upgrade base64 to 0.23 by @​paolobarbolini in seanmonstar/reqwest#3074
• perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody by @​spellsaif in seanmonstar/reqwest#3085
• fix(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture::poll by @​spellsaif in seanmonstar/reqwest#3084
• src/async_impl/request.rs_improved_doc_for_json_fn: by @​Athleteg in seanmonstar/reqwest#3082
• fix: proxy could use wrong credentials if many matched by @​seanmonstar in seanmonstar/reqwest#3098

New Contributors

• @​wwhsaber made their first contribution in seanmonstar/reqwest#3050
• @​FranciscoTGouveia made their first contribution in seanmonstar/reqwest#3052
• @​Billy-Sheppard made their first contribution in seanmonstar/reqwest#3049
• @​JoakoI98 made their first contribution in seanmonstar/reqwest#3057
• @​V-Mann-Nick made their first contribution in seanmonstar/reqwest#3060
• @​FalkWoldmann made their first contribution in seanmonstar/reqwest#3063
• @​smaeda-ks made their first contribution in seanmonstar/reqwest#3065
• @​raphaelroshan made their first contribution in seanmonstar/reqwest#3064
• @​spellsaif made their first contribution in seanmonstar/reqwest#3085
• @​Athleteg made their first contribution in seanmonstar/reqwest#3082

Full Changelog: seanmonstar/reqwest@v0.13.4...v0.13.5

Changelog

Sourced from reqwest's changelog.

v0.13.5

• Add Error::is_dns() to identify errors caused by DNS resolution failures.
• Add ClientBuilder::http1_max_headers(usize) to configure the maximum number of headers accepted in an HTTP/1 response (default 100).
• Add TLS version to TlsInfo extension.
• Fix hickory-dns feature to use Ipv6AndIpv4 strategy to prefer IPv6.
• Fix sending wrong proxy-auth if multiple proxies intercept a given URL.

Commits

• de55373 v0.13.5
• 4d3fe12 fix: proxy could use wrong credentials if many matched (#3098)
• 9f06fd2 docs: improve description of JSON method (#3082)
• 5bdb2f0 perf(cookie): avoid cloning store and url on Poll::Pending in ResponseFuture:...
• ffda263 perf(body): reuse tokio::time::Sleep timer via reset() in ReadTimeoutBody (#3...
• 4e9a3c7 chore: add pull request template for human-written content
• 17e9bcb chore(deps): upgrade base64 to 0.23 (#3074)
• 221abe9 chore: Remove unnecessary clones and a cast (#3071)
• 99996a1 fix(error): detect timeouts wrapped in body decode errors (#3064)
• fc99bd5 feat: expose the negotiated TLS version via TlsInfo (#3067)
• Additional commits viewable in compare view

Updates uuid from 1.25.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

v1.26.0

What's Changed

• Add ContextV7::with_additional_precision_bits by @​ChrisJr404 in uuid-rs/uuid#904
• Prepare for 1.26.0 release by @​KodrAus in uuid-rs/uuid#905

Full Changelog: uuid-rs/uuid@1.25.0...v1.26.0

Commits

• 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
• d4df8f0 prepare for 1.26.1 release
• 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
• fda00eb don't panic in overflowing Timestamp to SystemTime conversion
• c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
• ac065a6 Align the counter diagram
• 34ec102 Seat the v7 counter below the version nibble
• cdc96a8 Merge pull request #905 from uuid-rs/cargo/v1.26.0
• 34e4f49 don't test macros under miri
• d9e7242 update nightly used for miri
• Additional commits viewable in compare view

[dzdidi]

Reviewed exact head e95af92bcba3feff889ea6a67532f5e3fc2985b7.

Recommended human verdict: request changes. Exact-head Checks fail because paykit-lib rc48 does not compile against pubky-noise rc8. One blocking inline finding attached. RustSec passes.

[dzdidi]

High — rc8 is incompatible with pinned paykit-lib rc48. Lock resolution selects rc8 for both Locks and Paykit, but rc48 still uses rc7 APIs: it expects receive_message() plaintext as &[u8; PUBKY_NOISE_MSG_LEN] while rc8 returns Vec<Vec<u8>>, and it passes encryptor.snapshot() directly while rc8 returns Result<PubkyNoiseSessionState, PubkyNoiseError>. Result: workspace does not compile. Keep pubky-noise = "=0.1.0-rc7", or upgrade paykit-lib to a release adapted to rc8's variable-length plaintext and fallible snapshot API.