[dependabot]

Bumps the rust-dependencies group with 7 updates in the / directory:

Package	From	To
redis	1.7.0	1.7.1
schemars	1.2.2	1.2.3
serde_json	1.0.151	1.0.154
sha2	0.11.0	0.11.1
tokio	1.53.1	1.53.3
toml	1.1.6+spec-1.1.0	1.1.8+spec-1.1.0
tower-mcp	0.23.2	0.24.0

Updates redis from 1.7.0 to 1.7.1

Release notes

Sourced from redis's releases.

redis-1.7.1

Changes & Bug fixes

• Add the remaining simple field types for FT.CREATE [3/8] (#2317 by @​StefanPalashev)
• Fix READONLY being sent to servers that don't support it. (#2414 by @​nihohit)
• fix: async cluster client deadlock when refresh_slots() race with rec… (#2419 by @​virratanasangpunth)

CI & operational improvements

• docs: Fix casing of Valkey (#2412 by @​somechris)
• ci: Bump Redis 8.8 to Redis 8.10 (#2402 by @​somechris)
• ci: Bump Valkey patch versions (#2405 by @​somechris)
• ci: Build servers in parallel (#2408 by @​somechris)
• doc: Add PROTOCOL variable (#2409 by @​somechris)

Full Changelog: redis-rs/redis-rs@redis-1.7.0...redis-1.7.1

Commits

• 9e9e62a Prepare version (#2421)
• 2ec6907 fix: async cluster client deadlock when refresh_slots() race with reconnect_l...
• 9ec91d1 docs: Fix casing of Valkey (#2412)
• b3d0850 Fix READONLY being sent to servers that don't support it. (#2414)
• 1d9fdc2 doc: Add PROTOCOL variable (#2409)
• 2420b84 ci: Build servers in parallel (#2408)
• 984e7c6 ci: Bump Valkey patch versions (#2405)
• 532d66b ci: Bump Redis 8.8 to Redis 8.10 (#2402)
• 68629b3 Add the remaining simple field types for FT.CREATE [3/8] (#2317)
• See full diff in compare view

Updates schemars from 1.2.2 to 1.2.3

Release notes

Sourced from schemars's releases.

v1.2.3

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Changelog

Sourced from schemars's changelog.

[1.2.3] - 2026-10-12

Fixed

• schema creation panics with arbitrary precision JSON numbers (GREsau/schemars#527)
• Resolve unused_qualifications lint violation in generated code (GREsau/schemars#539 / GREsau/schemars#541)

Changed

• Put the tag of internally-tagged enums first in the schema's properties array (GREsau/schemars#537 / GREsau/schemars#538)

Commits

• 4791bb7 v1.2.3
• c6a89b7 Put the tag of an internally tagged enum first in properties
• c5cd8b5 fix: schema creation panics with arbitrary precision JSON numbers
• 766d70b Resolve unused_qualifications lint in crate and generated code - #541 (#541)
• d07655e Resolve clippy error
• See full diff in compare view

Updates serde_json from 1.0.151 to 1.0.154

Release notes

Sourced from serde_json's releases.

v1.0.154

• Support preserve_order in no_std builds (#1333, thanks @​razmser)

v1.0.153

• Report invalid UTF-8 at the first bad byte (#1345, thanks @​00200200)

v1.0.152

• Preserve sign of -0 in arbitrary_precision mode (#1346, thanks @​yuxi-liu-wired)
• Fix comparison of large non-integer values with f32::INFINITY (#1347, thanks @​yuxi-liu-wired)

Commits

• 20572a6 Release 1.0.154
• a91bfaf Fix RandomState links in map documentation
• 3c932c0 Merge pull request #1333 from razmser/no-std-preserve-order
• 4b2d726 Release 1.0.153
• 83335ee Touch up PR 1345
• 4b4810a Resolve range_plus_one pedantic clippy lint
• 8af71cc Merge pull request #1345 from 00200200/fix-invalid-utf8-error-column
• 452afa2 Correct multiline raw UTF-8 error positions and simplify indexing
• c9f1e3b Release 1.0.152
• 854fc70 Touch up PR 1347
• Additional commits viewable in compare view

Updates sha2 from 0.11.0 to 0.11.1

Commits

• 138dc5a Release sha2 v0.11.1 (#927)
• cf01056 sha2: fix unsafe_op_in_unsafe_fn lint, bump MSRV to 1.88 (#926)
• 7c59cad Update Cargo.lock (#921)
• f57b947 streebog: tweak internal implementation (#925)
• 336611f Fix cargo::manual_readme lint (#924)
• 1df8877 md2: fix clippy::needless_range_loop lint (#923)
• 6075989 sha2: fix loading of round constants on AArch64 backends (#922)
• eadfd90 Update Cargo.lock (#913)
• fa30840 blake2 v0.11.0 (#911)
• f6c786d ci: bump the all-deps group across 1 directory with 3 updates (#896)
• Additional commits viewable in compare view

Updates tokio from 1.53.1 to 1.53.3

Release notes

Sourced from tokio's releases.

Tokio v1.53.3

1.53.3 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#8595)
• sync: wake waiters outside the lock when closing a semaphore (#8529)
• test: fix several flaky tests (#8196, #8427, #8609)

Fixed (unstable)

• rt: keep io_uring op alive when submission fails after push (#8185)

#8185: tokio-rs/tokio#8185 #8196: tokio-rs/tokio#8196 #8427: tokio-rs/tokio#8427 #8518: tokio-rs/tokio#8518 #8529: tokio-rs/tokio#8529 #8587: tokio-rs/tokio#8587 #8595: tokio-rs/tokio#8595 #8609: tokio-rs/tokio#8609 #8618: tokio-rs/tokio#8618

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

... (truncated)

Commits

• a85c3f5 chore: prepare Tokio v1.53.3 (#8639)
• df4443e Merge 'tokio-1.51.6' into 'tokio-1.53.x' (#8638)
• f00b2e6 chore: prepare Tokio v1.51.6 (#8637)
• 482eadd runtime: record time wake when unparking tasks on current thread (#8595)
• 55fbab7 io: wake and drop DuplexStream wakers outside the lock (#8618)
• c5e4d9e runtime: keep io_uring op alive when submission fails after push (#8185)
• 0448618 sync: make tracing_sync tests synchronous (#8427)
• 2bc1146 net: accept ConnectionReset in shutdown_after_tcp_reset test (#8196)
• bb28a94 Merge 'tokio-1.51.x' into 'tokio-1.53.x' (#8624)
• 6b97913 macros: avoid unreachable_code in join! and try_join! for Infallible ...
• Additional commits viewable in compare view

Updates toml from 1.1.6+spec-1.1.0 to 1.1.8+spec-1.1.0

Commits

• ceac6e4 chore: Release
• 0fe9e93 docs: Update changelog
• e3a64aa fix(display): Ensure all keys are encoded (#1245)
• 76484d0 fix(display): Ensure all keys are encoded
• 711b1ba refactor(display): Clarify that we are working with encoded keys
• 4f73ebd test(display): Reproduce the key bug
• 6c6a5cd fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 9c5e95d fix(parser): Remove risk of unsoundness with synthetic parser events and 'uns...
• 4d45944 perf(parser): Remove no-op code (#1243)
• 189c91c perf(parser): Remove no-op code
• Additional commits viewable in compare view

Updates tower-mcp from 0.23.2 to 0.24.0

Release notes

Sourced from tower-mcp's releases.

tower-mcp-v0.24.0

Upgrade notes

• Error codes (breaking). An unknown, disabled or filtered tool or prompt is now answered -32602 (Invalid params) on every protocol revision, as every supported spec revision specifies, instead of -32601 (Method not found). DenialBehavior::NotFound produces -32602 too. On the 2026-07-28 HTTP path, a handler's -32602 stays in-band at HTTP 200 instead of becoming HTTP 400, which clients read as "fall back to initialize". Code or tests that match -32601 for these cases must change (#1560).
• HTTP client errors. A 429 or 5xx no longer disconnects HttpClientTransport; only 404 and 410 without a session close it. Failed requests carry httpStatus, retryAfter and wwwAuthenticate in the error data, readable with HttpStatusDetails::from_error (#1559, #1565). Any 404 on a 2025-11-25 session request now re-initializes the session (#1565).
• Client sessions. A failed initialize() sends a DELETE for the session the server issued (#1570). ClientTransport gains end_session, with a default no-op.
• Origin and Host. A request with more than one Origin header gets 403, and userinfo, query, fragment or invalid-port origins are no longer treated as localhost. WebSocketTransport validates Host with the same defaults as HTTP (#1566).
• structuredContent. An explicit "structuredContent": null now decodes as Some(Value::Null) instead of None (#1568).
• OAuth client. With no explicit, challenge or protected-resource scopes, the authorization URL no longer lists the authorization server's scopes_supported. A confidential dynamic registration that returns no client_secret is an error at registration (#1569).
• stdio. A request the client cancels is no longer answered (#1552). When drain_timeout expires, in-flight handlers are cancelled and then aborted (#1562).

Bug Fixes

• tool: Reject a non-object structuredContent on 2025 requests (closes #1540) (#1541)
• client: Accept servers that answer protocol version 2024-11-05 (#1550)
• Do not answer a request the client cancelled (#1552)
• [breaking] http: Keep handler -32602 errors in-band on 2026-07-28 and answer unknown tools and prompts with -32602 (#1560)
• client: Kill the stdio child when its transport is dropped (#1543)
• client: Keep the HTTP client usable after a 429 or 5xx and expose the status (#1559)
• stdio: Cancel in-flight handlers when drain_timeout expires (#1562)
• http: Restore the client's capabilities into router session state on SessionStore restore (#1564)
• client: Keep the HTTP status on a 401/403 JSON-RPC error and recover sessions on any background 404 (#1565)
• http: Clean up the session of a rejected initialize, harden Origin parsing, check Host on WebSocket (#1566)
• Preserve a null structuredContent, hide a non-object outputSchema from 2025 peers, answer non-integer request ids (#1568)
• oauth-client: Refresh with granted scopes, honor advertised auth methods, omit scope instead of AS scopes_supported (#1569)
• client: HTTP initialize ping deadlock, failed-initialize session cleanup, x-mcp-header types, cancellation on 2025 sessions (#1570)

Documentation

• session_store: Load must not return an expired record (closes #1529) (#1534)

Features

• router: Expose the initializing client's clientInfo to request handlers (#1551)
• client: Let StdioClientTransport callers stop the child's process group and read its exit status (#1563)

tower-mcp-types-v0.24.0

Bug Fixes

• tool: Reject a non-object structuredContent on 2025 requests (closes #1540) (#1541)
• Preserve a null structuredContent, hide a non-object outputSchema from 2025 peers, answer non-integer request ids (#1568)

tower-mcp-macros-v0.24.0

No release notes provided.

Commits

• 8abea9b chore: release (#1542)
• 1737a52 fix(client): HTTP initialize ping deadlock, failed-initialize session cleanup...
• 162b218 fix(oauth-client): refresh with granted scopes, honor advertised auth methods...
• e2ee825 fix: preserve a null structuredContent, hide a non-object outputSchema from 2...
• ee7b2c6 fix(http): clean up the session of a rejected initialize, harden Origin parsi...
• 03b9c0e feat(client): let StdioClientTransport callers stop the child's process group...
• db8b1f3 chore(mcp2md): ship LICENSE files in the published crate (#1567)
• ac7a75b fix(client): keep the HTTP status on a 401/403 JSON-RPC error and recover ses...
• d90a83b fix(http): restore the client's capabilities into router session state on Ses...
• 61b5afe fix(stdio): cancel in-flight handlers when drain_timeout expires (#1562)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.