Skip to content

chore(deps): bump the http-upgrade group across 1 directory with 15 updates - #26058

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/http-upgrade-28842a1658
Open

chore(deps): bump the http-upgrade group across 1 directory with 15 updates#26058
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/cargo/http-upgrade-28842a1658

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the http-upgrade group with 15 updates in the / directory:

Package From To
tower-http 0.4.4 0.6.8
headers 0.3.9 0.4.1
http 0.2.12 1.3.1
http-serde 1.1.3 2.1.1
http-body 0.4.6 1.0.1
hyper-openssl 0.9.2 0.10.2
warp 0.3.7 0.4.3
prost 0.12.6 0.14.3
prost-build 0.12.6 0.14.3
prost-reflect 0.14.7 0.16.5
prost-types 0.12.6 0.14.3
reqwest 0.11.26 0.13.3
tokio-tungstenite 0.20.1 0.29.0
tonic-health 0.11.0 0.14.5
tonic-reflection 0.11.0 0.14.5

Updates tower-http from 0.4.4 to 0.6.8

Release notes

Sourced from tower-http's releases.

tower-http-0.6.8

Fixed

  • Disable multiple_members in Gzip decoder, since HTTP context only uses one member. (#621)

#621: tower-rs/tower-http#621

What's Changed

New Contributors

Full Changelog: tower-rs/tower-http@tower-http-0.6.7...tower-http-0.6.8

tower-http-0.6.7

Added

  • TimeoutLayer::with_status_code(status) to define the status code returned when timeout is reached. (#599)

Deprecated

  • auth::require_authorization is too basic for real-world. (#591)
  • TimeoutLayer::new() should be replaced with TimeoutLayer::with_status_code(). (Previously was StatusCode::REQUEST_TIMEOUT) (#599)

Fixed

  • on_eos is now called even for successful responses. (#580)
  • ServeDir: call fallback when filename is invalid (#586)
  • decompression will not fail when body is empty (#618)

#580: tower-rs/tower-http#580 #586: tower-rs/tower-http#586 #591: tower-rs/tower-http#591 #599: tower-rs/tower-http#599 #618: tower-rs/tower-http#618

New Contributors

... (truncated)

Commits
  • 33166c8 v0.6.8
  • 6680160 Fix deprecated lints (#608)
  • 81b8231 ci: Switch cargo-public-api-crates to cargo-check-external-types (#613)
  • 1fb0144 ci: pin tracing in msrv job (#622)
  • 1fe4c09 fix(decompression): disable multiple_members option for gzip decoder (#621)
  • 3bf1ba7 v0.6.7
  • 723ca9a fix(decompression): Suppress EOF errors caused by decompressing empty body (#...
  • 8ab9f82 chore(ci): use newer cargo-public-api-crates job (#619)
  • 7cfdf76 doc: Replace doc_auto_cfg with doc_cfg (#609)
  • 50beeaf Add support for custom status code in TimeoutLayer (#599)
  • Additional commits viewable in compare view

Updates headers from 0.3.9 to 0.4.1

Release notes

Sourced from headers's releases.

headers-v0.4.1

What's Changed

New Contributors

Full Changelog: hyperium/headers@headers-v0.4.0...headers-v0.4.1

Commits
  • 8db1b78 headers:0.4.1
  • 12fb1d7 feat: Add a impl From\<http::HeaderName> for Vary (#210)
  • 66371a0 feat: const ::from_static() constructors (#209)
  • d425d3c update copyright year
  • 1a8eac3 doc: Remove empty line in document
  • 743d3b9 fix(tests): Fix test compile error with nightly feature
  • 682d0a6 refactor: Remove needless lifetime
  • 879d2d4 Add methods for must-revalidate flag to CacheControl
  • 0fbde12 docs(readme): add badge to readme
  • 2298faa Add ContentEncoding::zstd
  • Additional commits viewable in compare view

Updates http from 0.2.12 to 1.3.1

Release notes

Sourced from http's releases.

v1.3.1

What's Changed

Full Changelog: hyperium/http@v1.3.0...v1.3.1

v1.3.0

What's Changed

  • Allow most UTF-8 characters in URI path and query. (hyperium/http#715)
    • This means paring Uris with previously illegal characters according the original RFC will now be accepted. They used to be rejected in the name of spec purity, but many operators were using a fork of http because reality is that most characters are seen in the real world.
  • Fix HeaderMap::reserve() to allocate sufficient capacity.

New Contributors

Thanks!

Full Changelog: hyperium/http@v1.2.0...v1.3.0

v1.2.0

What's Changed

  • Add StatusCode::TOO_EARLY constant for 425 status. (#725)
  • Loosen TryFrom<HashMap> for HeaderMap to work with any state generic. (#729)
  • Change Builder methods to use TryInto instead of TryFrom arguments. (#730)
  • Make StatusCode::as_u16 a const function. (#680)
  • Fix Method parsing to allow #$%&' characters. (#713)
  • Fix HeaderName parsing to reject " characters. (#716)
  • Fix off by 1 error in Method::from_bytes that could cause extra allocations. (#708)
  • Fix HeaderMap capacity calculation in some cases (#710)

New Contributors

... (truncated)

Changelog

Sourced from http's changelog.

1.3.1 (March 11, 2025)

  • Fix validation that all characters are UTF-8 in URI path and query.

1.3.0 (March 11, 2025)

  • Allow most UTF-8 characters in URI path and query.
  • Fix HeaderMap::reserve() to allocate sufficient capacity.

1.2.0 (December 3, 2024)

  • Add StatusCode::TOO_EARLY constant for 425 status.
  • Loosen TryFrom<HashMap> for HeaderMap to work with any state generic.
  • Change Builder methods to use TryInto instead of TryFrom arguments.
  • Make StatusCode::as_u16 a const function.
  • Fix Method parsing to allow #$%&' characters.
  • Fix HeaderName parsing to reject " characters.
  • Fix off by 1 error in Method::from_bytes that could cause extra allocations.

1.1.0 (March 4, 2024)

  • Add methods to allow trying to allocate in the HeaderMap, returning an error if oversize instead of panicking.
  • Add Extensions::get_or_insert() method.
  • Implement From<Uri> for uri::Builder.
  • Fix HeaderName::from_lowercase that could allow NUL bytes in some cases.

1.0.0 (November 15, 2023)

  • Implement Clone for Request, Response, and Extensions. This breaking change requires that all extensions now implement Clone.
  • Add a default-on std feature. Disabling it currently is not supported.
  • Fix MIRI warnings in HeaderMap::iter().

0.2.10 (November 10, 2023)

  • Fix parsing of Authority to handle square brackets in incorrect order.
  • Fix HeaderMap::with_capacity() to handle arithmetic overflow.

0.2.9 (February 17, 2023)

  • Add HeaderName constants for cache-status and cdn-cache-control.
  • Implement Hash for PathAndQuery.
  • Re-export HeaderName at crate root.

0.2.8 (June 6, 2022)

  • Fix internal usage of uninitialized memory to use MaybeUninit inside HeaderName.

0.2.7 (April 28, 2022)

... (truncated)

Commits
  • 8c1fb20 v1.3.1
  • 6637a72 fix: validate path bytes are at least utf8 (#756)
  • d0dd91e v1.3.0
  • 64bd92b docs: Fixed encryption/compression typo for 'accept-encoding: identity'. (#695)
  • b03ed6a chore: use range.contains in StatusCode methods (#748)
  • a463fb5 chore(ci): use yq to get rust-version in manifest (#746)
  • 68845bd fix: HeaderMap::reserve allocates insufficient capacity (#741)
  • 4e02046 refactor(header): remove BytesMut inline optimization when creating (#738)
  • 091ee9a feat(uri): allow utf8 char, not rfc 3986 compliant, in path and query (#715)
  • a912445 v1.2.0
  • Additional commits viewable in compare view

Updates http-serde from 1.1.3 to 2.1.1

Commits

Updates http-body from 0.4.6 to 1.0.1

Commits
  • 69e80eb v1.0.1
  • 17451a8 update year of license
  • 482c349 http-body-util: v0.1.2
  • 60c6383 refactor(ci): small refactoring (#113)
  • 23212f1 feat(util): add BodyDataStream (#117)
  • fe8aa7e refactor: replace deprecated std::u64 with primitive type
  • 6a85548 include license files in published crates
  • 46c54fb chore(util): resolve duplicate import
  • b5c769d http-body-util: v0.1.1
  • 76b19e6 perf: improve BufList::copy_to_bytes if len == remaining
  • Additional commits viewable in compare view

Updates hyper-openssl from 0.9.2 to 0.10.2

Changelog

Sourced from hyper-openssl's changelog.

[v0.10.2] - 2023-12-04

Fixed

  • Avoid creation of possibly-uninitialized [u8] slices.

[v0.10.1] - 2023-11-20

Fixed

  • Added a tokio feature, fixed build with the client-legacy feature enabled.

[v0.10.0] - 2023-11-18

Changed

  • Upgraded hyper to 1.0.
Commits

Updates warp from 0.3.7 to 0.4.3

Release notes

Sourced from warp's releases.

v0.4.1

Fixes:

  • Fix Server::graceful() bounds incorrect requiring the filter to be a future.
  • Enable tokio/net when the server feature is enabled.
  • Render cfgs in the docs.

Full Changelog: seanmonstar/warp@v0.4.0...v0.4.1

v0.4.0

Changes:

  • Upgrade to hyper, http, and http-body to v1.
  • Remove multipart and websocket features from being enabled by default.
  • Put warp::serve() behind a server feature, not enabled by default.
  • Put warp::test behind a test feature, not enabled by default.
  • Remove tls feature and types.
  • Remove warp::addr filters.

Full Changelog: seanmonstar/warp@v0.3.7...v0.4.0

Changelog

Sourced from warp's changelog.

v0.4.3 (May 4, 2026)

  • Features:
    • Re-implement addr::remote() filter from v0.3.x.
    • Implement From<&'static [u8]> for Body.
    • Add reply::stream() helper.
  • Fixes:
    • Fix returning error from CORS if no request-method header.

v0.4.2 (August 19, 2025)

  • Features:
    • Add support for passing UnixListener to incoming(listener).
  • Fixes:
    • Reduce some dependencies when server is not enabled.

v0.4.1 (August 6, 2025)

  • Fixes:
    • Fix Server::graceful() bounds incorrect requiring the filter to be a future.
    • Enable tokio/net when the server feature is enabled.
    • Render cfgs in the docs.

v0.4.0 (August 5, 2025)

  • Changes:
    • Upgrade to hyper, http, and http-body to v1.
    • Remove multipart and websocket features from being enabled by default.
    • Put warp::serve() behind a server feature, not enabled by default.
    • Put warp::test behind a test feature, not enabled by default.
    • Remove tls feature and types.
    • Remove warp::addr filters.
Commits

Updates prost from 0.12.6 to 0.14.3

Changelog

Sourced from prost's changelog.

Prost version 0.14.3

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

⚠️ Heads-up

  • Add back DecodeError::new (#1382)

    The DecodeError::new() was removed to simplify our code. It was not part of the public API, but removing it broke code in other crates. It is added back to prevent breakage across the ecosystem.

🐛 Bug Fixes

  • Name::full_name() is correct for empty packages (#1386)

💼 Dependencies

  • (deps) Bump actions/upload-artifact from 5 to 6 (#1381)
  • (deps) Update pulldown-cmark-to-cmark requirement from 21 to 22 (#1384)

⚙️ Miscellaneous Tasks

  • Remove protobuf submodule and leverage cmake for it (#1389)

Prost version 0.14.2

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

note: this version was yanked in favor of 0.14.2

⚠️ Heads-up

  • Increase MSRV to 1.82 (#1356)

  • Update maintenance status to Passively Maintained (#1359)

    This excerpt is from the readme:

    The current maintainer is not contributing new features and doesn't have the time to review new features. Bug fixes and small improvements are welcome. Feel free to contribute small and easily reviewable PRs.

    Bug fixes are still important, and security fixes will be released as soon as possible. Contact the #prost channel in Tokio discord if you feel a bug or security fix is not getting enough attention.

    The maintainer expects the official protobuf project to release their rust library soon and expects it to be as fully featured as the C++ library. See their source code and crate for more information.

🚀 Features

  • Configure prost path via prost_build::Config or #[(prost(prost_path = "::prost")] (#1274)
  • Support for deprecated enum and oneof fields (#1316)

🐛 Bug Fixes

  • (prost-build) Resolve OneOf type name conflict with embedded message (#1294)
  • (prost-build) Avoid OneOf type collision with enums and keyword names (#1341)

... (truncated)

Commits

Updates prost-build from 0.12.6 to 0.14.3

Changelog

Sourced from prost-build's changelog.

Prost version 0.14.3

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

⚠️ Heads-up

  • Add back DecodeError::new (#1382)

    The DecodeError::new() was removed to simplify our code. It was not part of the public API, but removing it broke code in other crates. It is added back to prevent breakage across the ecosystem.

🐛 Bug Fixes

  • Name::full_name() is correct for empty packages (#1386)

💼 Dependencies

  • (deps) Bump actions/upload-artifact from 5 to 6 (#1381)
  • (deps) Update pulldown-cmark-to-cmark requirement from 21 to 22 (#1384)

⚙️ Miscellaneous Tasks

  • Remove protobuf submodule and leverage cmake for it (#1389)

Prost version 0.14.2

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

note: this version was yanked in favor of 0.14.2

⚠️ Heads-up

  • Increase MSRV to 1.82 (#1356)

  • Update maintenance status to Passively Maintained (#1359)

    This excerpt is from the readme:

    The current maintainer is not contributing new features and doesn't have the time to review new features. Bug fixes and small improvements are welcome. Feel free to contribute small and easily reviewable PRs.

    Bug fixes are still important, and security fixes will be released as soon as possible. Contact the #prost channel in Tokio discord if you feel a bug or security fix is not getting enough attention.

    The maintainer expects the official protobuf project to release their rust library soon and expects it to be as fully featured as the C++ library. See their source code and crate for more information.

🚀 Features

  • Configure prost path via prost_build::Config or #[(prost(prost_path = "::prost")] (#1274)
  • Support for deprecated enum and oneof fields (#1316)

🐛 Bug Fixes

  • (prost-build) Resolve OneOf type name conflict with embedded message (#1294)
  • (prost-build) Avoid OneOf type collision with enums and keyword names (#1341)

... (truncated)

Commits

Updates prost-reflect from 0.14.7 to 0.16.5

Release notes

Sourced from prost-reflect's releases.

prost-reflect-v0.16.5

Fixed

  • Fixed a performance regression in encoding of DynamicMessage (#200)

prost-reflect-v0.16.4

Fixed

  • Fix proto3 default for is_packed when FieldOptions is present but packed is absent (#196)

Other

  • Update logos to 0.16.0 #192

prost-reflect-v0.16.3

Other

  • Update prost to v0.14.2 and fix error handling (#188)

prost-reflect-v0.16.2

Added

Add FieldDescriptor::is_required (#181)

prost-reflect-v0.16.1

Added

  • Add OneofDescriptor::is_synthetic (#175)
  • Add default_value method to FieldDescriptor, ExtensionDescriptor and Value for better visibility (#176)

prost-reflect-build-v0.16.1

No release notes provided.

prost-reflect-derive-v0.16.1

No release notes provided.

prost-reflect-build-v0.16.0

No release notes provided.

prost-reflect-derive-v0.16.0

No release notes provided.

prost-reflect-v0.16.0

Changed

  • Update prost to 0.14.0 (#167)
  • Fixed documentation for prost-reflect-build (#169)

prost-reflect-v0.15.3

Fixed

... (truncated)

Changelog

Sourced from prost-reflect's changelog.

0.16.5 - 2026-07-09

Fixed

  • Fixed a performance regression in encoding of DynamicMessage (#200)

0.16.4 - 2026-05-24

Fixed

  • Fix proto3 default for is_packed when FieldOptions is present but packed is absent (#196)

Other

  • Update logos to 0.16.0 #192

0.16.3 - 2025-12-01

Other

  • Update prost to v0.14.2 and fix error handling (#188)

0.16.2 - 2025-09-19

Added

Add FieldDescriptor::is_required (#181)

0.16.1 - 2025-08-01

Added

  • Add OneofDescriptor::is_synthetic (#175)
  • Add default_value method to FieldDescriptor, ExtensionDescriptor and Value for better visibility (#176)

0.16.0 - 2025-06-13

Changed

  • Update prost to 0.14.0 (#167)
  • Fixed documentation for prost-reflect-build (#169)

0.15.3 - 2025-05-20

Fixed

  • Revert accidental removal of docs.rs metadata

0.15.2 - 2025-04-19

... (truncated)

Commits

Updates prost-types from 0.12.6 to 0.14.3

Changelog

Sourced from prost-types's changelog.

Prost version 0.14.3

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

⚠️ Heads-up

  • Add back DecodeError::new (#1382)

    The DecodeError::new() was removed to simplify our code. It was not part of the public API, but removing it broke code in other crates. It is added back to prevent breakage across the ecosystem.

🐛 Bug Fixes

  • Name::full_name() is correct for empty packages (#1386)

💼 Dependencies

  • (deps) Bump actions/upload-artifact from 5 to 6 (#1381)
  • (deps) Update pulldown-cmark-to-cmark requirement from 21 to 22 (#1384)

⚙️ Miscellaneous Tasks

  • Remove protobuf submodule and leverage cmake for it (#1389)

Prost version 0.14.2

PROST! is a Protocol Buffers implementation for the Rust Language. prost generates simple, idiomatic Rust code from proto2 and proto3 files.

note: this version was yanked in favor of 0.14.2

⚠️ Heads-up

  • Increase MSRV to 1.82 (#1356)

  • Update maintenance status to Passively Maintained (#1359)

    This excerpt is from the readme:

    The current maintainer is not contributing new features and doesn't have the time to review new features. Bug fixes and small improvements are welcome. Feel free to contribute small and easily reviewable PRs.

    Bug fixes are still important, and security fixes will be released as soon as possible. Contact the #prost channel in Tokio discord if you feel a bug or security fix is not getting enough attention.

    The maintainer expects the official protobuf project to release their rust library soon and expects it to be as fully featured as the C++ library. See their source code and crate for more information.

🚀 Features

  • Configure prost path via prost_build::Config or #[(prost(prost_path = "::prost")] (#1274)
  • Support for deprecated enum and oneof fields (#1316)

🐛 Bug Fixes

  • (prost-build) Resolve OneOf type name conflict with embedded message (#1294)
  • (prost-build) Avoid OneOf type collision with enums and keyword names (#1341)

... (truncated)

Commits
  • fafa97f chore: remove protobuf submodule and leverage cmake for it (#1389)
  • e0643e2 release 0.14.3
  • Description has been truncated

@dependabot dependabot Bot added domain: deps Anything related to Vector's dependencies no-changelog Changes in this PR do not need user-facing explanations in the release changelog labels Aug 7, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 7, 2026 15:09
@dependabot dependabot Bot added domain: deps Anything related to Vector's dependencies no-changelog Changes in this PR do not need user-facing explanations in the release changelog labels Aug 7, 2026
@github-actions github-actions Bot added the domain: core Anything related to core crates i.e. vector-core, core-common, etc label Aug 7, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f0892dc9f5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
prost-reflect = { version = "0.14", features = ["serde"], default-features = false }
prost-types = { version = "0.12", default-features = false }
prost = { version = "0.14", default-features = false, features = ["std"] }
prost-build = { version = "0.14", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep prost-build aligned with tonic-build

Any build that runs the root protobuf-build path or lib/vector-api-client's build script still calls tonic_build::configure().compile_with_config(prost_build::Config::new(), ...), but tonic-build remains at 0.11 and its API is typed against prost-build 0.12. This line makes those build scripts import prost-build 0.14, so the Config argument no longer matches before code generation can run; bump tonic-build with prost or keep prost-build at 0.12.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
Comment on lines +225 to +226
tonic-health = { version = "0.14", default-features = false }
tonic-reflection = { version = "0.14", default-features = false, features = ["server"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep health and reflection on tonic 0.11

With workspace tonic still at 0.11, these crates now resolve to the tonic 0.14 stack, so the API server and vector source try to add 0.14 health/reflection services to TonicServer::builder()/RoutesBuilder from tonic 0.11. Enabling api or sources-vector therefore pulls incompatible Service/NamedService types into the same router; update tonic/tonic-build and call sites together, or leave these crates on 0.11.

Useful? React with 👍 / 👎.

Comment on lines +25 to +26
headers = { version = "0.4.1", default-features = false }
http = { version = "1.3.1", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep proxy types on the hyper-proxy http stack

ProxyConfig::build_proxy passes headers::Authorization and parsed http::Uri values directly to hyper_proxy::Proxy, but hyper-proxy 0.9.1 still exposes the headers 0.3/http 0.2 types. Building vector-core now imports 0.4/1.3 types here, so proxy configuration no longer type-checks unless hyper-proxy is upgraded too or this crate stays on the 0.2 stack.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
tokio-stream = { version = "0.1.18", default-features = false }
tokio-test = "0.4.5"
tokio-tungstenite = { version = "0.20.1", default-features = false }
tokio-tungstenite = { version = "0.29.0", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Adapt websocket Message constructors for tungstenite 0.29

Tungstenite 0.29 changed Message::Text and control-frame payloads to use Utf8Bytes/Bytes, but the websocket source still constructs messages with String and Vec<u8> values such as Message::Text(initial_message.clone()), Message::Text(ping_msg.clone()), and Message::Ping(vec![]). Builds that enable sources-websocket or sinks-websocket will fail until those call sites convert the payloads or this bump is reverted.

Useful? React with 👍 / 👎.


# Utils
http = { version = "0.2", default-features = false }
http = { version = "1.3", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep API client URIs on tonic's http version

Client::new still passes this crate's http::Uri directly into tonic::transport::Endpoint::from, and the top command constructs that URI before calling Client::new. Because tonic is still 0.11 and uses http 0.2, changing only this dependency to http 1.3 makes the API client/top path use a different Uri type than Endpoint accepts; either upgrade tonic with this or keep these crates on http 0.2.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
prost-build = { version = "0.12", default-features = false }
prost-reflect = { version = "0.14", features = ["serde"], default-features = false }
prost-types = { version = "0.12", default-features = false }
prost = { version = "0.14", default-features = false, features = ["std"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep prost on the tonic codec version

tonic remains pinned to 0.11, whose generated services and ProstCodec are built around prost 0.12. Bumping the workspace prost crate alone makes newly generated message types implement the 0.14 prost::Message trait instead, so gRPC crates that use tonic::include_proto! no longer satisfy tonic 0.11's codec bounds even if code generation succeeds; upgrade tonic/tonic-build with prost or leave prost at 0.12.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
rdkafka = { version = "0.39.0", default-features = false }
regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
reqwest = { version = "0.11", features = ["json"] }
reqwest = { version = "0.13", features = ["json"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update reqwest status comparisons for http 1

reqwest 0.13 returns http 1.x status codes, but several tests still compare reqwest::Response::status() directly with http/hyper 0.2 constants, for example tests/integration/shutdown.rs and src/sinks/datadog/traces/apm_stats/integration_tests.rs. Those builds will hit cross-version StatusCode comparisons after this bump; convert the tests to reqwest::StatusCode/as_u16() or keep the workspace reqwest on the old http stack until the comparisons are migrated.

Useful? React with 👍 / 👎.

Comment thread lib/vector-top/Cargo.toml
ratatui = { version = "0.30.0", default-features = false, features = ["crossterm", "layout-cache"] }
regex.workspace = true
http = { version = "0.2", default-features = false }
http = { version = "1.3", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep top URI types aligned with the binary

The binary still parses its API URL as the workspace http::Uri while the root workspace http dependency remains 0.2, then passes it to vector_top::metrics::init_components/subscribe. This change makes vector-top's public signatures use http 1.3::Uri, so enabling top leaves the binary and library with incompatible URI types; either move the root workspace to the same http version or keep vector-top on 0.2 with the rest of the binary.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
tokio-stream = { version = "0.1.18", default-features = false }
tokio-test = "0.4.5"
tokio-tungstenite = { version = "0.20.1", default-features = false }
tokio-tungstenite = { version = "0.29.0", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Adapt websocket handshakes to http 1 types

tokio-tungstenite 0.29's client/server handshake request and response aliases are on the http 1.x types, but the websocket code still applies crate::http::Auth to that request and builds handshake error responses/statuses with the workspace http 0.2 types. Any build with websocket features will fail in those handshake paths unless the code converts to tungstenite's http types or this bump waits until the workspace http stack is upgraded.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
tokio-stream = { version = "0.1.18", default-features = false }
tokio-test = "0.4.5"
tokio-tungstenite = { version = "0.20.1", default-features = false }
tokio-tungstenite = { version = "0.29.0", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update CloseFrame handling for tungstenite 0.29

The websocket source still types close frames as CloseFrame<'_> and calls frame.into_owned() when returning RemoteClosed. Tungstenite 0.29 changed close frames to an owned type without the lifetime/into_owned API, so sources-websocket will not compile until that handling is updated or the tungstenite bump is reverted.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/http-upgrade-28842a1658 branch from f0892dc to 49e49af Compare August 7, 2026 16:52
@datadog-official

This comment has been minimized.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49e49afcaa

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
rdkafka = { version = "0.39.0", default-features = false }
regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
reqwest = { version = "0.11", features = ["json"] }
reqwest = { version = "0.13", features = ["json"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove duplicate reqwest alias after bump

When building the main vector crate, this bump makes reqwest.workspace = true and the existing renamed reqwest_13 = { package = "reqwest", version = "0.13", ... } dependency resolve to the same package/version under two different names. Cargo rejects that setup for a single crate with “depends on crate ... multiple times with different names”, so the root crate will not build until the alias is removed/retargeted or the workspace dependency stays on a different version.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
rdkafka = { version = "0.39.0", default-features = false }
regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
reqwest = { version = "0.11", features = ["json"] }
reqwest = { version = "0.13", features = ["json"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Enable reqwest query/form features

When tests or integration-test modules using reqwest are compiled, RequestBuilder::query and RequestBuilder::form are no longer available because reqwest 0.13 made the query and form crate features opt-in (release notes). The workspace dependency only enables json, but code still calls .query() in src/sources/splunk_hec/mod.rs:2270 / src/sinks/influxdb/mod.rs:475 and .form() in Splunk HEC integration tests, so those builds fail until the workspace features include query and form or the call sites avoid those helpers.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/http-upgrade-28842a1658 branch 2 times, most recently from f898e12 to af4b3d8 Compare August 7, 2026 22:36

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: af4b3d849f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
rdkafka = { version = "0.39.0", default-features = false }
regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
reqwest = { version = "0.11", features = ["json"] }
reqwest = { version = "0.13", features = ["json"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use reqwest HTTP types in request test helpers

When the default/test build compiles sources-http_server or sources-datadog_agent, the helpers in src/sources/http_server.rs and src/sources/datadog_agent/tests.rs still pass workspace/warp http 0.2 HeaderMap/Method values into reqwest request builders via .headers(headers) and .request(method, ...). After this line moves workspace reqwest to 0.13, those builders use reqwest's http 1.x types, so these test modules no longer type-check; migrate the helpers to reqwest::header::HeaderMap/reqwest::Method or keep reqwest on the old stack until the callers are updated.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
rdkafka = { version = "0.39.0", default-features = false }
regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
reqwest = { version = "0.11", features = ["json"] }
reqwest = { version = "0.13", features = ["json"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep default builds off aws-lc

With default features still enabled here, reqwest 0.13 switches its default TLS stack to rustls with the aws-lc provider (release notes), and this lockfile consequently adds aws-lc-sys with a hard cmake build dependency. That makes ordinary vector builds require CMake even when they do not opt into the repo's default-cmake/vendored feature sets, so local/dev or distro builders without CMake will fail before Rust compilation; disable reqwest defaults and select the existing non-CMake TLS provider/features explicitly.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/http-upgrade-28842a1658 branch from af4b3d8 to 67457a8 Compare August 10, 2026 19:58

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 67457a85a6

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
prost-types = { version = "0.12", default-features = false }
prost = { version = "0.14", default-features = false, features = ["std"] }
prost-build = { version = "0.14", default-features = false }
prost-reflect = { version = "0.16", features = ["serde"], default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep prost-reflect aligned with VRL protobuf helpers

Any build of vector-lib/codecs now gets two incompatible prost-reflect crates: this line makes lib/codecs import 0.16, while vrl is still locked to prost-reflect 0.14.7/prost 0.13.5 in Cargo.lock. The protobuf serializer/deserializer pass prost_reflect::MessageDescriptor/DynamicMessage values into vrl::protobuf::{encode_message, proto_to_value}, so those public API types no longer match; bump VRL to the same prost-reflect stack or keep this dependency at 0.14.

Useful? React with 👍 / 👎.

Comment thread Cargo.lock
Comment on lines +1225 to +1226
[[package]]
name = "aws-lc-rs"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Regenerate third-party license metadata

This lockfile now introduces additional third-party crates, for example aws-lc-rs/aws-lc-sys and their dunce/fs_extra deps, but LICENSE-3rdparty.csv was not regenerated and contains no entries for those names. The dependency update leaves the license check and distribution metadata stale; run the license generation step with the dependency bump.

AGENTS.md reference: AGENTS.md:L120-L126

Useful? React with 👍 / 👎.

Comment thread Cargo.lock
Comment on lines +1225 to +1226
[[package]]
name = "aws-lc-rs"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Regenerate third-party license metadata

This lockfile now introduces additional third-party crates, for example aws-lc-rs/aws-lc-sys and their dunce/fs_extra deps, but LICENSE-3rdparty.csv was not regenerated and contains no entries for those names. The dependency update leaves the license check and distribution metadata stale; run the license generation step with the dependency bump.

Useful? React with 👍 / 👎.

Comment thread Cargo.toml
tokio-stream = { version = "0.1.18", default-features = false }
tokio-test = "0.4.5"
tokio-tungstenite = { version = "0.20.1", default-features = false }
tokio-tungstenite = { version = "0.29.0", default-features = false }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Convert websocket test text payloads to String

When compiling the websocket sink tests with sinks-websocket, tungstenite 0.29 makes Message::into_text() return Utf8Bytes instead of String; create_count_receiver still returns a CountReceiver<String> while its stream now yields Utf8Bytes from msg.into_text().unwrap(). That leaves the test helper's stream item type mismatched until the value is converted with to_string()/into() or the receiver type is updated.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/http-upgrade-28842a1658 branch 3 times, most recently from bbdd8a8 to ca576f5 Compare August 13, 2026 20:06

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca576f50f3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread Cargo.toml
rdkafka = { version = "0.39.0", default-features = false }
regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
reqwest = { version = "0.11", features = ["json"] }
reqwest = { version = "0.13", features = ["json"] }

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use reqwest's header name in APM tests

When the Datadog APM stats integration tests are compiled, send_trace imports CONTENT_TYPE from axum::http (http 0.2) and passes it to reqwest::RequestBuilder::header at src/sinks/datadog/traces/apm_stats/integration_tests.rs:200. After this bump the reqwest builder is on the http 1.x stack, so that header name no longer satisfies reqwest's header-name type; use reqwest::header::CONTENT_TYPE (or a string) with the bumped client.

Useful? React with 👍 / 👎.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/http-upgrade-28842a1658 branch 4 times, most recently from 271963f to 3da1dee Compare August 18, 2026 20:51
…pdates

Bumps the http-upgrade group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [tower-http](https://github.com/tower-rs/tower-http) | `0.4.4` | `0.6.8` |
| [headers](https://github.com/hyperium/headers) | `0.3.9` | `0.4.1` |
| [http](https://github.com/hyperium/http) | `0.2.12` | `1.3.1` |
| [http-serde](https://gitlab.com/kornelski/http-serde) | `1.1.3` | `2.1.1` |
| [http-body](https://github.com/hyperium/http-body) | `0.4.6` | `1.0.1` |
| [hyper-openssl](https://github.com/sfackler/hyper-openssl) | `0.9.2` | `0.10.2` |
| [warp](https://github.com/seanmonstar/warp) | `0.3.7` | `0.4.3` |
| [prost](https://github.com/tokio-rs/prost) | `0.12.6` | `0.14.3` |
| [prost-build](https://github.com/tokio-rs/prost) | `0.12.6` | `0.14.3` |
| [prost-reflect](https://github.com/andrewhickman/prost-reflect) | `0.14.7` | `0.16.5` |
| [prost-types](https://github.com/tokio-rs/prost) | `0.12.6` | `0.14.3` |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.11.26` | `0.13.3` |
| [tokio-tungstenite](https://github.com/snapview/tokio-tungstenite) | `0.20.1` | `0.29.0` |
| [tonic-health](https://github.com/hyperium/tonic) | `0.11.0` | `0.14.5` |
| [tonic-reflection](https://github.com/hyperium/tonic) | `0.11.0` | `0.14.5` |



Updates `tower-http` from 0.4.4 to 0.6.8
- [Release notes](https://github.com/tower-rs/tower-http/releases)
- [Commits](tower-rs/tower-http@tower-http-0.4.4...tower-http-0.6.8)

Updates `headers` from 0.3.9 to 0.4.1
- [Release notes](https://github.com/hyperium/headers/releases)
- [Commits](hyperium/headers@headers-v0.3.9...headers-v0.4.1)

Updates `http` from 0.2.12 to 1.3.1
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](hyperium/http@v0.2.12...v1.3.1)

Updates `http-serde` from 1.1.3 to 2.1.1
- [Commits](https://gitlab.com/kornelski/http-serde/compare/v1.1.3...v2.1.1)

Updates `http-body` from 0.4.6 to 1.0.1
- [Release notes](https://github.com/hyperium/http-body/releases)
- [Commits](hyperium/http-body@v0.4.6...v1.0.1)

Updates `hyper-openssl` from 0.9.2 to 0.10.2
- [Release notes](https://github.com/sfackler/hyper-openssl/releases)
- [Changelog](https://github.com/sfackler/hyper-openssl/blob/master/CHANGELOG.md)
- [Commits](sfackler/hyper-openssl@0.9.2...0.10.2)

Updates `warp` from 0.3.7 to 0.4.3
- [Release notes](https://github.com/seanmonstar/warp/releases)
- [Changelog](https://github.com/seanmonstar/warp/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/warp@v0.3.7...v0.4.3)

Updates `prost` from 0.12.6 to 0.14.3
- [Release notes](https://github.com/tokio-rs/prost/releases)
- [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/prost@v0.12.6...v0.14.3)

Updates `prost-build` from 0.12.6 to 0.14.3
- [Release notes](https://github.com/tokio-rs/prost/releases)
- [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/prost@v0.12.6...v0.14.3)

Updates `prost-reflect` from 0.14.7 to 0.16.5
- [Release notes](https://github.com/andrewhickman/prost-reflect/releases)
- [Changelog](https://github.com/andrewhickman/prost-reflect/blob/main/CHANGELOG.md)
- [Commits](https://github.com/andrewhickman/prost-reflect/commits/prost-reflect-v0.16.5)

Updates `prost-types` from 0.12.6 to 0.14.3
- [Release notes](https://github.com/tokio-rs/prost/releases)
- [Changelog](https://github.com/tokio-rs/prost/blob/master/CHANGELOG.md)
- [Commits](tokio-rs/prost@v0.12.6...v0.14.3)

Updates `reqwest` from 0.11.26 to 0.13.3
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](seanmonstar/reqwest@v0.11.26...v0.13.3)

Updates `tokio-tungstenite` from 0.20.1 to 0.29.0
- [Changelog](https://github.com/snapview/tokio-tungstenite/blob/master/CHANGELOG.md)
- [Commits](snapview/tokio-tungstenite@v0.20.1...v0.29.0)

Updates `tonic-health` from 0.11.0 to 0.14.5
- [Release notes](https://github.com/hyperium/tonic/releases)
- [Changelog](https://github.com/grpc/grpc-rust/blob/master/CHANGELOG.md)
- [Commits](grpc/grpc-rust@v0.11.0...v0.14.5)

Updates `tonic-reflection` from 0.11.0 to 0.14.5
- [Release notes](https://github.com/hyperium/tonic/releases)
- [Changelog](https://github.com/grpc/grpc-rust/blob/master/CHANGELOG.md)
- [Commits](grpc/grpc-rust@v0.11.0...v0.14.5)

---
updated-dependencies:
- dependency-name: headers
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: http
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: http-upgrade
- dependency-name: http-body
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: http-upgrade
- dependency-name: http-serde
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: http-upgrade
- dependency-name: hyper-openssl
  dependency-version: 0.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: prost
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: prost-build
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: prost-reflect
  dependency-version: 0.16.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: prost-types
  dependency-version: 0.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: reqwest
  dependency-version: 0.13.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: tokio-tungstenite
  dependency-version: 0.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: tonic-health
  dependency-version: 0.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: tonic-reflection
  dependency-version: 0.14.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: tower-http
  dependency-version: 0.6.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
- dependency-name: warp
  dependency-version: 0.4.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-upgrade
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/http-upgrade-28842a1658 branch from 3da1dee to 08378c2 Compare August 18, 2026 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: core Anything related to core crates i.e. vector-core, core-common, etc domain: deps Anything related to Vector's dependencies no-changelog Changes in this PR do not need user-facing explanations in the release changelog

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants