[dependabot]

Bumps the rust-dependencies group in /rust with 4 updates: serde_json, sha2, syn and tokio-util.

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates syn from 3.0.6 to 3.0.9

Release notes

Sourced from syn's releases.

3.0.9

• Add Punctuated::retain (#2088)

3.0.8

• Fix parsing of <- and -> tokens in expressions (#2086, #2087)

3.0.7

• Fix parsing absolute path expr in labeled break (#2085, thanks @​A4-Tacks)

Commits

• 7c44a55 Release 3.0.9
• 13234ab Merge pull request #2088 from dtolnay/retain
• b617dc9 Add Punctuated::retain
• f18a083 Release 3.0.8
• e1eab98 Merge pull request #2087 from dtolnay/rightarrow
• 5345ee5 Allow end of expr before ->
• 5631c74 Merge pull request #2086 from dtolnay/leftarrow
• c5b3cf0 Fix left arrow being split into less-than and negative-sign
• ec4c2da Release 3.0.7
• f947cf7 Merge pull request #2085 from A4-Tacks/break-label-abs-path
• Additional commits viewable in compare view

Updates tokio-util from 0.7.19 to 0.7.20

Commits

• 5ec9e6b chore: prepare tokio-util v0.7.20 (#8608)
• afd1b26 docs: fix stray braces and broken links in rustdoc (#8605)
• 3eb95a4 wasm: use sleep on emscripten without JSPI (#8528)
• b22c802 wasm: link emscripten_promise_await for Emscripten 4.x compatibility (#8528)
• 16b1f9d ci: pin libc to 0.2.189 on FreeBSD (#8594)
• b263675 time: clean up stale Err(Invalid) doc and typo (#8590)
• 5d5cd8b Merge 'tokio-1.53.2' into 'master' (#8578)
• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[bgentry]

🤖 Codex review: Blocked by the dependency advisory gate; the four upgrade artifacts and their source changes have no blocking supply-chain finding.

Upgrade

• serde_json: 1.0.151 → 1.0.154
• sha2: 0.11.0 → 0.11.1
• syn: 3.0.6 → 3.0.9
• tokio-util: 0.7.19 → 0.7.20
• Reviewed head: 1bffea35ce35b830fd099fb7bbf4361040ab50c4

Blocking findings

• Unchanged rustls-webpki 0.103.15 is affected by RUSTSEC-2026-0382; update to 0.103.16 or a later patched version.
• Unchanged webpki-roots 1.0.9 is affected by RUSTSEC-2026-0381; update to 1.0.10 or later.
• Both advisories concern distrusted emSign certificate intermediates (CVE-2026-111943). SQLx's enabled Rustls support makes this relevant to CLI database TLS. These issues exist in the base and are not introduced by this PR, but they keep the security gate red.

Security review

• Inspected all eight old/new published crate archives. Every SHA-256 matches Cargo.lock and crates.io. Shipped runtime sources, build scripts, original manifests, and packaged changelogs match their embedded upstream Git commits.
• Reviewed parser/JSON changes, SHA-2 architecture backend refactoring, Tokio utility changes, and the complete lockfile delta. No new crate identities, source substitutions, lifecycle execution, credential access, or native payload additions were found. Existing Windows dependency edges re-resolve within published constraints.
• sha2's Rust 1.88 and tokio-util's Rust 1.85 minimums fit the workspace's Rust 1.95 minimum.

Compatibility verification

• make check/rust/dependencies — reproduced the same two advisory errors locally; bans, licenses, and sources pass.
• Existing CI compilation/tests across Rust 1.95–1.97, Postgres 14–18, packaging, nightly docs, and API compatibility pass. CI quality fails on these advisories.
• Further executable validation is deferred until the advisory gate is resolved. After a TLS dependency update, refresh the security review and run Rust lint, full tests, documentation, packaging, and SHA-2 hash vectors on arm64/x86_64.

Residual risk

• Certificate trust vulnerabilities remain unresolved. This PR is not approved for merge.

[bgentry]

🤖 Codex review update: Upgrade artifact/security delta and compatibility validation are clear. Proceeding with normal squash merge under the maintainer's explicit approval of the preexisting TLS advisory exception.

Reviewed head remains 1bffea35ce35b830fd099fb7bbf4361040ab50c4. The exact crate versions, checksums, canonical upstream source, and complete dependency delta are unchanged from the prior deep security review; no new artifact review is needed. The latest base changes only Go and JavaScript dependency manifests and does not change Rust validation inputs.

Compatibility verification

• make lint/rust — passed on native Darwin ARM64, including all-feature, Postgres-only, SQLite-only, and integration-test configurations.
• make test/rust/postgres with a dedicated Postgres 18 database — passed the full unit, SQLite, Postgres, and macro suites: 539 tests, including SHA-256 and protocol goldens, 11 syn trybuild cases, and cancellation/shutdown behavior. An initial SQLx username setup error was corrected and the complete rerun passed.
• make doc/rust — passed all backend variants and compiled examples.
• make check/rust/package — passed all five publishable crates.
• make check/rust/semver — passed against rust/v0.3.0.
• Existing CI compilation/tests across Rust 1.95–1.97 and Postgres 14–18, packaging, documentation, API compatibility, and every currently required branch check pass. The sole failed job is the documented full advisory scan.

Accepted residual risk and follow-up
The existing rustls-webpki 0.103.15 / webpki-roots 1.0.9 advisories remain. They are not introduced by this upgrade, and the maintainer has explicitly instructed merging this PR now. Verified that compatible lockfile-only updates to 0.103.16 and 1.0.10 resolve the findings without SQLx, Rustls, manifest, OS runner, or other dependency changes. The CI advisory/policy split and required-check infrastructure change are being prepared separately.