chore(deps): bump the rust-dependencies group across 1 directory with 4 updates

[dependabot]

Bumps the rust-dependencies group with 4 updates in the / directory: clap, quote, rmcp and rustls.

Updates clap from 4.6.4 to 4.6.5

Release notes

Sourced from clap's releases.

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

Changelog

Sourced from clap's changelog.

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

Commits

• c8c9355 chore: Release
• af74def docs: Update changelog
• c96f222 Merge pull request #6368 from truffle-dev/fix/fish-env-escaping
• 49a05cd fix(complete): Two-pass quote fish env-completer
• e791004 test(complete): Snapshot fish env quoting cases
• See full diff in compare view

Updates quote from 1.0.46 to 1.0.47

Release notes

Sourced from quote's releases.

1.0.47

• Documentation improvements

Commits

• 723dcb4 Release 1.0.47
• 86e2967 Update documentation links to syn 3
• b56db87 Update ui test suite to nightly-2026-07-14
• cba5d96 Update actions/upload-artifact@v6 -> v7
• See full diff in compare view

Updates rmcp from 3.0.0 to 3.1.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.1.0

Added

• add strict stateless protocol metadata validation (#1091)

Other

• document the ping utility with examples (#1106)
• complete Tier 1 feature docs and finalize roadmap (#1101)
• (conformance) meeting requirements for tier 1 (#1087)

rmcp-v3.1.0

Added

• classify authorization-required errors (#1056)
• add strict stateless protocol metadata validation (#1091)
• SEP-2260 stream-based enforcement of client receive-side request association (#1055)

Fixed

• (model) decode metadata-bearing input-required results affecting mrtr (#1097)
• require metadata for modern HTTP requests (#1089)
• honor supported_protocol_versions when negotiating initialize (#1093)

Other

• document the ping utility with examples (#1106)
• complete Tier 1 feature docs and finalize roadmap (#1101)
• (conformance) meeting requirements for tier 1 (#1087)

rmcp-macros-v3.0.1

Other

• release stable 3.0.0

rmcp-v3.0.1

Fixed

• (auth) use discovered resource for token refresh (#1084)
• return header mismatch for missing protocol header (#1083)
• negotiate stateless initialize versions (#1080)
• stamp server info on graceful subscription results (#1078)

Commits

• 1f9358e chore: release v3.1.0 (#1090)
• 1cf6deb docs: document the ping utility with examples (#1106)
• 00bcf13 fix(model): decode metadata-bearing input-required results affecting mrtr (#1...
• 65f05e9 feat: classify authorization-required errors (#1056)
• 3240b6e docs: complete Tier 1 feature docs and finalize roadmap (#1101)
• def31f0 chore(deps): bump github/codeql-action from 4 to 4.37.3 (#1100)
• 570c478 chore(deps): bump taiki-e/install-action from 2 to 2.85.2 (#1099)
• 983a137 feat: add strict stateless protocol metadata validation (#1091)
• 58b136f fix: require metadata for modern HTTP requests (#1089)
• d272389 fix: honor supported_protocol_versions when negotiating initialize (#1093)
• Additional commits viewable in compare view

Updates rustls from 0.23.42 to 0.23.43

Commits

• fcf61cd Prepare 0.23.43
• f0dad4c Check server's proposed suite against actual offer
• b480cc6 Test for server choosing a non-QUIC TLS1.3 suite
• 883a44d Consider Protocol in ServerConfig::supports_version
• c2f1fd9 Check suitability of server version in QUIC client
• d98e1b9 Add test for server Tls13RequiredForQuic
• e63d9bf Bound ticket age calculation
• 79cd462 Defensiveness improvement for binder suffix arithmetic
• 4a9f025 use checked_sub for the mac tag offset in Rfc5077Ticketer::decrypt
• 3131e5c Accept that libcrux deps are vulnerable
• Additional commits viewable in compare view

[praxis-bot]

PR Review

Summary: Dependabot bumps four lockfile dependencies: clap 4.6.4→4.6.5 (help text fix), quote 1.0.46→1.0.47 (docs only), rmcp 3.0.0→3.1.0 (behavioral changes), and rustls 0.23.42→0.23.43 (security hardening).

Overall assessment: Low risk. Three of the four bumps are patch or docs-only changes. The rmcp minor bump introduces stricter MCP protocol validation that warrants verification against production MCP servers. All 21 CI checks pass. The rustls patch includes valuable security hardening (ticket age bounding, checked arithmetic in decryption, cipher suite validation).

Severity	Finding
Medium	rmcp 3.1.0 adds stricter metadata validation for MCP protocol connections
Medium	Transitive dependency tree regressions: new ahash 0.7.8 duplicate, hashbrown downgrade

Non-inlineable details

Transitive dependency regressions: The rmcp 3.1.0 update shifts quixotic-plecostomus-lru's hashbrown dependency from 0.17.1 to 0.12.3, which pulls in ahash 0.7.8 as a second version alongside ahash 0.8.12. hashbrown 0.12 uses the older ahash-based hasher instead of 0.17's built-in foldhash. Several packages also shift from windows-sys 0.61.2 to 0.59.0. These are side effects of Cargo re-resolving the dependency graph and are unlikely to cause correctness issues, but increase binary size slightly and reduce dependency freshness. No action required unless performance-sensitive LRU paths are affected.

🤖 Generated with Claude Code

[praxis-bot]

[Medium] rmcp 3.0.0→3.1.0 is a minor bump that includes behavioral changes: "require metadata for modern HTTP requests" (#1089) and "strict stateless protocol metadata validation" (#1091). These tighten what the rmcp client expects from MCP server responses during protocol negotiation.

The integration test mock server (tests/utils/src/agentic/mcp.rs) already passes, but it implements the MCP protocol manually and may be more compliant than some real-world MCP servers. Verify that production MCP server connections still work after this bump, particularly servers that may omit protocol metadata or use older MCP protocol versions.

[praxis-bot]

[Medium] This is a new duplicate: ahash 0.7.8 now coexists with ahash 0.8.12. It was pulled in because hashbrown 0.12.3 (now used by quixotic-plecostomus-lru) depends on it. Before this bump, that crate used hashbrown 0.17.1 which has no ahash dependency.

The duplication increases binary size and widens the transitive dependency surface. If this is undesirable, consider adding hashbrown = "0.17" to [workspace.dependencies] to guide the resolver, or accept the regression as a side effect of the rmcp update.

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.