From 1391abb55d613e394ba2c944d3191822c8bcc96c Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Wed, 1 Jul 2026 12:16:37 +0300
Subject: [PATCH 1/7] feat: utilize dedicated runtime for CPU-bound tasks in
 yamux service feat: add configurable linear memory residency for Wasm service
 feat: add support for yamux multiplexing in ProxyWasm service

---
 crates/runtime/src/lib.rs | 1 +
 src/main.rs               | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/crates/runtime/src/lib.rs b/crates/runtime/src/lib.rs
index 462d37b..6d2c0d2 100644
--- a/crates/runtime/src/lib.rs
+++ b/crates/runtime/src/lib.rs
@@ -52,6 +52,7 @@ pub const DEFAULT_EPOCH_TICK_INTERVAL: u64 = 10;
 
 const PREVIEW1_ADAPTER: &[u8] = include_bytes!("adapters/wasi_snapshot_preview1.reactor.wasm");
 
+#[allow(non_camel_case_types)]
 #[derive(PartialEq, Copy, Clone, Debug)]
 pub enum AppResult {
     SUCCESS,
diff --git a/src/main.rs b/src/main.rs
index bc99967..09a0bfd 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -251,7 +251,7 @@ fn append_headers(geo: bool, headers: &mut HashMap<SmolStr, SmolStr>) {
         headers.insert("pop-reg".to_smolstr(), "lu".to_smolstr());
         headers.insert("pop-city".to_smolstr(), "luxembourg".to_smolstr());
         headers.insert("pop-continent".to_smolstr(), "eu".to_smolstr());
-        headers.insert("pop-country-code".to_smolstr(), "au".to_smolstr());
+        headers.insert("pop-country-code".to_smolstr(), "lu".to_smolstr());
         headers.insert("pop-country-name".to_smolstr(), "luxembourg".to_smolstr());
     }
 }

From 6f4ddf665228a8871752a20957ddeeee396fa66d Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Wed, 15 Jul 2026 16:19:25 +0300
Subject: [PATCH 2/7] fix: filter out cdn-loop header and ensure content-type
 fallback behavior

---
 Cargo.lock                                    |   3 +-
 crates/http-backend/src/lib.rs                | 118 ++++++++++++++++--
 crates/http-service/src/executor/http.rs      |   2 -
 crates/http-service/src/executor/wasi_http.rs |   1 -
 crates/http-service/src/state.rs              |  52 ++++++--
 5 files changed, 153 insertions(+), 23 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 28ba81f..6d11dcc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4339,7 +4339,6 @@ dependencies = [
 [[package]]
 name = "wasmtime-wasi-http"
 version = "36.0.12"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0#62166f65ac52a1f164419097a2a533ff50e4d07b"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -4355,7 +4354,7 @@ dependencies = [
  "tracing",
  "wasmtime",
  "wasmtime-wasi",
- "wasmtime-wasi-io 36.0.12 (git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0)",
+ "wasmtime-wasi-io 36.0.12",
  "webpki-roots 0.26.11",
 ]
 
diff --git a/crates/http-backend/src/lib.rs b/crates/http-backend/src/lib.rs
index 1ddacf5..1195b1e 100644
--- a/crates/http-backend/src/lib.rs
+++ b/crates/http-backend/src/lib.rs
@@ -44,6 +44,7 @@ const FASTEDGE_HEADER_HOSTNAME: &str = "fastedge_header_hostname";
 const HOST_HEADER: &str = "host";
 const CONTENT_LENGTH_HEADER: &str = "content-length";
 const TRANSFER_ENCODING_HEADER: &str = "transfer-encoding";
+const CDN_LOOP_HEADER: &str = "cdn-loop";
 const FASTEDGE_APP_ID: &str = "fastedge-app-id";
 
 // Default scheme used when an outbound URL doesn't specify one.
@@ -236,7 +237,14 @@ impl<C> Backend<C> {
         let builder = match self.strategy {
             BackendStrategy::Direct => {
                 let mut headers = req.headers.into_iter().collect::<Vec<(String, String)>>();
-                headers.extend(self.propagate_headers_vec());
+                for (k, v) in self.propagate_headers_vec() {
+                    if !headers
+                        .iter()
+                        .any(|(existing, _)| existing.eq_ignore_ascii_case(&k))
+                    {
+                        headers.push((k, v));
+                    }
+                }
                 // CLI has to set Host header from URL, if it is not set already by the request
                 if !headers
                     .iter()
@@ -327,18 +335,15 @@ impl<C> Backend<C> {
                     .filter(|(k, _)| {
                         !matches!(
                             k.as_str(),
-                            HOST_HEADER | CONTENT_LENGTH_HEADER | TRANSFER_ENCODING_HEADER
+                            HOST_HEADER
+                                | CONTENT_LENGTH_HEADER
+                                | TRANSFER_ENCODING_HEADER
+                                | CDN_LOOP_HEADER
                         )
                     })
                     // Block all internal headers with the `fastedge` prefix so
                     // guest modules cannot spoof routing/internal metadata.
                     .filter(|(k, _)| !is_fastedge_internal_header(k))
-                    .filter(|(k, _)| {
-                        !self
-                            .propagate_header_names
-                            .iter()
-                            .any(|name| name.eq(k.as_str()))
-                    })
                     .collect::<Vec<(String, String)>>();
 
                 if self_binding {
@@ -367,7 +372,14 @@ impl<C> Backend<C> {
                         headers.push((FASTEDGE_HEADER_HOSTNAME.to_string(), request_host_header));
                     }
                 }
-                headers.extend(self.propagate_headers_vec());
+                for (k, v) in self.propagate_headers_vec() {
+                    if !headers
+                        .iter()
+                        .any(|(existing, _)| existing.eq_ignore_ascii_case(&k))
+                    {
+                        headers.push((k, v));
+                    }
+                }
 
                 // Inject the application identifier so the backend can
                 // correlate the request with the originating FastEdge app.
@@ -1079,6 +1091,66 @@ mod tests {
         assert_eq!(http::StatusCode::OK, res.status);
     }
 
+    #[test]
+    fn make_request_keeps_app_content_type_over_propagated_one() {
+        let connector = mock_http_connector::Connector::builder().build();
+        let mut backend =
+            Backend::<mock_http_connector::Connector>::builder(BackendStrategy::FastEdge)
+                .hostname("be.server")
+                .propagate_headers_names(vec!["content-type".parse().unwrap()])
+                .build(connector);
+
+        let mut incoming_headers = HeaderMap::new();
+        incoming_headers.insert("content-type", "from-original".parse().unwrap());
+        backend.propagate_headers(incoming_headers).unwrap();
+
+        let req = Request {
+            method: Method::Post,
+            uri: "http://example.com/path".to_string(),
+            headers: vec![("content-type".to_string(), "from-app".to_string())],
+            body: None,
+        };
+
+        let out = backend.make_request(req).unwrap();
+        assert_eq!(
+            out.headers()
+                .get("content-type")
+                .and_then(|v| v.to_str().ok()),
+            Some("from-app")
+        );
+        assert_eq!(out.headers().get_all("content-type").iter().count(), 1);
+    }
+
+    #[test]
+    fn make_request_uses_propagated_content_type_when_app_does_not_set_it() {
+        let connector = mock_http_connector::Connector::builder().build();
+        let mut backend =
+            Backend::<mock_http_connector::Connector>::builder(BackendStrategy::FastEdge)
+                .hostname("be.server")
+                .propagate_headers_names(vec!["content-type".parse().unwrap()])
+                .build(connector);
+
+        let mut incoming_headers = HeaderMap::new();
+        incoming_headers.insert("content-type", "from-original".parse().unwrap());
+        backend.propagate_headers(incoming_headers).unwrap();
+
+        let req = Request {
+            method: Method::Post,
+            uri: "http://example.com/path".to_string(),
+            headers: vec![],
+            body: None,
+        };
+
+        let out = backend.make_request(req).unwrap();
+        assert_eq!(
+            out.headers()
+                .get("content-type")
+                .and_then(|v| v.to_str().ok()),
+            Some("from-original")
+        );
+        assert_eq!(out.headers().get_all("content-type").iter().count(), 1);
+    }
+
     #[tokio::test]
     #[tracing_test::traced_test]
     async fn backend_path() {
@@ -1337,6 +1409,34 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_make_request_filters_cdn_loop_header() {
+        let connector = mock_http_connector::Connector::builder().build();
+        let backend = Backend::<mock_http_connector::Connector>::builder(BackendStrategy::FastEdge)
+            .hostname("be.server")
+            .build(connector);
+
+        let req = Request {
+            method: Method::Get,
+            uri: "http://example.com/path".to_string(),
+            headers: vec![
+                ("cdn-loop".to_string(), "guest-value".to_string()),
+                ("x-custom".to_string(), "keep-me".to_string()),
+            ],
+            body: None,
+        };
+
+        let result = backend
+            .make_request(req)
+            .expect("request should be built successfully");
+
+        assert!(result.headers().get("cdn-loop").is_none());
+        assert_eq!(
+            result.headers().get("x-custom").and_then(|v| v.to_str().ok()),
+            Some("keep-me")
+        );
+    }
+
     #[test]
     fn test_make_request_rejects_private_ipv4_from_host_header() {
         let connector = mock_http_connector::Connector::builder().build();
diff --git a/crates/http-service/src/executor/http.rs b/crates/http-service/src/executor/http.rs
index 355244d..8530934 100644
--- a/crates/http-service/src/executor/http.rs
+++ b/crates/http-service/src/executor/http.rs
@@ -116,13 +116,11 @@ where
             http_backend.set_cdn_real_host(cdn_real_host.into());
         }
 
-        let propagate_header_names = http_backend.propagate_header_names();
         let backend_uri = http_backend.uri();
         let state = HttpState {
             http_backend,
             uri: backend_uri,
             propagate_headers: parts.headers,
-            propagate_header_names,
             stats: stats.clone(),
         };
 
diff --git a/crates/http-service/src/executor/wasi_http.rs b/crates/http-service/src/executor/wasi_http.rs
index 72b4d6b..0d534ff 100644
--- a/crates/http-service/src/executor/wasi_http.rs
+++ b/crates/http-service/src/executor/wasi_http.rs
@@ -131,7 +131,6 @@ where
             http_backend,
             uri: backend_uri,
             propagate_headers,
-            propagate_header_names,
             stats: stats.clone(),
         };
 
diff --git a/crates/http-service/src/state.rs b/crates/http-service/src/state.rs
index af8f553..97815ef 100644
--- a/crates/http-service/src/state.rs
+++ b/crates/http-service/src/state.rs
@@ -14,7 +14,6 @@ pub struct HttpState<C> {
     pub(super) http_backend: Backend<C>,
     pub(super) uri: Uri,
     pub(super) propagate_headers: HeaderMap,
-    pub(super) propagate_header_names: Vec<HeaderName>,
     pub(super) stats: Arc<dyn StatsVisitor>,
 }
 
@@ -29,6 +28,7 @@ const FASTEDGE_SCHEME: HeaderName = HeaderName::from_static("fastedge-scheme");
 const FASTEDGE_HEADER_HOSTNAME: HeaderName = HeaderName::from_static("fastedge_header_hostname");
 const FASTEDGE_HOSTNAME_VALUE: HeaderValue = HeaderValue::from_static("127.0.0.1");
 const FASTEDGE_APP_ID: HeaderName = HeaderName::from_static("fastedge-app-id");
+const CDN_LOOP: HeaderName = HeaderName::from_static("cdn-loop");
 
 impl<C> BackendRequest for HttpState<C> {
     #[instrument(skip(self, head), level = "debug", ret)]
@@ -104,11 +104,12 @@ impl<C> BackendRequest for HttpState<C> {
 
                 // Strip internal routing headers and all headers with the
                 // reserved `fastedge` prefix so guests cannot spoof internal metadata.
-                static FILTER_HEADERS: [HeaderName; 4] = [
+                static FILTER_HEADERS: [HeaderName; 5] = [
                     header::HOST,
                     header::CONTENT_LENGTH,
                     header::TRANSFER_ENCODING,
                     header::UPGRADE,
+                    CDN_LOOP,
                 ];
 
                 // filter headers
@@ -117,9 +118,7 @@ impl<C> BackendRequest for HttpState<C> {
                     .into_iter()
                     .filter_map(|(k, v)| k.map(|k| (k, v)))
                     .filter(|(k, _)| {
-                        !FILTER_HEADERS.contains(k)
-                            && !self.propagate_header_names.contains(k)
-                            && !is_fastedge_internal_header(k.as_str())
+                        !FILTER_HEADERS.contains(k) && !is_fastedge_internal_header(k.as_str())
                     })
                     .collect::<HeaderMap>();
 
@@ -141,13 +140,19 @@ impl<C> BackendRequest for HttpState<C> {
                         FASTEDGE_SCHEME,
                         original_url.scheme_str().unwrap_or("http").parse()?,
                     );
-                    //When HTTP app sets Host header, Fastegde needs to set Fastedge_Header_Hostname header for BE.
+                    //When HTTP app sets Host header, Fastedge needs to set Fastedge_Header_Hostname header for BE.
                     if let Some(request_host_header) = request_host_header_value {
                         headers.insert(FASTEDGE_HEADER_HOSTNAME, request_host_header);
                     }
                 }
 
-                headers.extend(self.propagate_headers.clone());
+                // Propagate fallback headers from the original request only
+                // when the app did not already set the same header.
+                for (name, value) in self.propagate_headers.iter() {
+                    if !headers.contains_key(name) {
+                        headers.insert(name.clone(), value.clone());
+                    }
+                }
 
                 // Inject the application identifier so the backend can
                 // correlate the request with the originating FastEdge app.
@@ -266,7 +271,6 @@ mod tests {
             http_backend,
             uri: backend_uri,
             propagate_headers: HeaderMap::new(),
-            propagate_header_names: vec![],
             stats: Arc::new(TestStats),
         }
     }
@@ -423,7 +427,6 @@ mod tests {
             http_backend,
             uri: backend_uri,
             propagate_headers: HeaderMap::new(),
-            propagate_header_names: vec![],
             stats: Arc::new(TestStats),
         };
         let out = state
@@ -440,4 +443,35 @@ mod tests {
             .unwrap();
         assert_eq!(header(&out, "fastedge-app-id"), None);
     }
+
+    #[test]
+    fn propagated_content_type_is_fallback_only() {
+        let mut state = make_state(None);
+        state
+            .propagate_headers
+            .insert(header::CONTENT_TYPE, "from-original".parse().unwrap());
+
+        let out = state
+            .backend_request(parts(
+                "http://example.com/path",
+                &[("content-type", "from-app")],
+            ))
+            .unwrap();
+
+        assert_eq!(header(&out, "content-type"), Some("from-app"));
+    }
+
+    #[test]
+    fn propagated_content_type_is_used_when_app_does_not_set_it() {
+        let mut state = make_state(None);
+        state
+            .propagate_headers
+            .insert(header::CONTENT_TYPE, "from-original".parse().unwrap());
+
+        let out = state
+            .backend_request(parts("http://example.com/path", &[]))
+            .unwrap();
+
+        assert_eq!(header(&out, "content-type"), Some("from-original"));
+    }
 }

From cf0cbbd9f54b3bb6b0771e64c11b45c4caf9a96b Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Tue, 21 Jul 2026 11:29:37 +0300
Subject: [PATCH 3/7] feat(logging): remove Kafka log support and migrate to
 VictoriaLogs exclusively

---
 CLAUDE.md                 | 2 +-
 crates/runtime/Cargo.toml | 7 +++----
 crates/runtime/src/app.rs | 8 --------
 3 files changed, 4 insertions(+), 13 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 0b7bbbb..f8dd2aa 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -71,7 +71,7 @@ Every Wasmtime `Store` holds a `Data<T>` (in `crates/runtime/src/lib.rs`). It bu
 
 ## Crate features worth knowing
 
-- `runtime`: `kafka_log`, `victoria_log` (default on); `metrics` opts into Prometheus + lazy_static and propagates through `http-service/metrics`.
+- `runtime`: `victoria_log` (default on); `metrics` opts into Prometheus + lazy_static and propagates through `http-service/metrics`.
 - `key-value-store`: `redis` enables the Redis-backed implementation. `runtime` already turns this on; if you depend on `key-value-store` from elsewhere, opt in explicitly.
 - `cache`: no features yet — backend choice is at runtime via the `Arc<dyn CacheBackend>` injected into `Data<T>`.
 
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index 79a3307..8e80991 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -6,8 +6,7 @@ publish.workspace = true
 authors.workspace = true
 
 [features]
-default = ["kafka_log", "victoria_log"]
-kafka_log = []
+default = ["victoria_log"]
 victoria_log = []
 metrics = ["prometheus", "lazy_static"]
 
@@ -24,12 +23,12 @@ wasmtime-environ = { workspace = true }
 wasmtime-wasi-io = { workspace = true }
 smol_str = { workspace = true }
 moka = { workspace = true }
-http = {workspace = true}
+http = { workspace = true }
 wit-component = "0.246.2"
 tracing = { workspace = true }
 bytesize = { workspace = true }
 http-backend = { path = "../http-backend" }
-key-value-store = { path = "../key-value-store" , features = ["redis"]}
+key-value-store = { path = "../key-value-store", features = ["redis"] }
 cache = { path = "../cache" }
 utils = { path = "../utils" }
 secret = { path = "../secret" }
diff --git a/crates/runtime/src/app.rs b/crates/runtime/src/app.rs
index 1063678..fb93024 100644
--- a/crates/runtime/src/app.rs
+++ b/crates/runtime/src/app.rs
@@ -79,8 +79,6 @@ pub struct SecretOption {
 pub enum Log {
     #[default]
     None,
-    #[cfg(feature = "kafka_log")]
-    Kafka,
     #[cfg(feature = "victoria_log")]
     Victoria,
 }
@@ -269,12 +267,6 @@ mod tests {
         assert_eq!(w.log, Log::None);
     }
 
-    #[cfg(feature = "kafka_log")]
-    #[test]
-    fn test_log_deserialize_kafka() {
-        let log: Log = assert_ok!(serde_json::from_str("\"kafka\""));
-        assert_eq!(log, Log::Kafka);
-    }
 
     #[cfg(feature = "victoria_log")]
     #[test]

From ecbb4820d249aeed2284a8ea1c2b8fc1f76e81bd Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Tue, 21 Jul 2026 12:55:19 +0300
Subject: [PATCH 4/7] feat(logging): remove VictoriaLogs feature flag and make
 support always enabled

---
 CLAUDE.md                 | 2 +-
 crates/runtime/Cargo.toml | 2 --
 crates/runtime/src/app.rs | 3 ---
 3 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index f8dd2aa..d25bf3b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -71,7 +71,7 @@ Every Wasmtime `Store` holds a `Data<T>` (in `crates/runtime/src/lib.rs`). It bu
 
 ## Crate features worth knowing
 
-- `runtime`: `victoria_log` (default on); `metrics` opts into Prometheus + lazy_static and propagates through `http-service/metrics`.
+- `runtime`: `metrics` opts into Prometheus + lazy_static and propagates through `http-service/metrics`.
 - `key-value-store`: `redis` enables the Redis-backed implementation. `runtime` already turns this on; if you depend on `key-value-store` from elsewhere, opt in explicitly.
 - `cache`: no features yet — backend choice is at runtime via the `Arc<dyn CacheBackend>` injected into `Data<T>`.
 
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index 8e80991..d65243c 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -6,8 +6,6 @@ publish.workspace = true
 authors.workspace = true
 
 [features]
-default = ["victoria_log"]
-victoria_log = []
 metrics = ["prometheus", "lazy_static"]
 
 [dependencies]
diff --git a/crates/runtime/src/app.rs b/crates/runtime/src/app.rs
index fb93024..3fc71a4 100644
--- a/crates/runtime/src/app.rs
+++ b/crates/runtime/src/app.rs
@@ -79,7 +79,6 @@ pub struct SecretOption {
 pub enum Log {
     #[default]
     None,
-    #[cfg(feature = "victoria_log")]
     Victoria,
 }
 
@@ -268,14 +267,12 @@ mod tests {
     }
 
 
-    #[cfg(feature = "victoria_log")]
     #[test]
     fn test_log_deserialize_victoria_logs() {
         let log: Log = assert_ok!(serde_json::from_str("\"victoria\""));
         assert_eq!(log, Log::Victoria);
     }
 
-    #[cfg(feature = "victoria_log")]
     #[test]
     fn deserialize_app_with_victoria_log() {
         let json = json!({

From d286c8912704996732626044f510ee2041cc3900 Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Tue, 28 Jul 2026 13:08:34 +0300
Subject: [PATCH 5/7] fix(hostnames): enhance hostname validation to reject
 loopback and cloud metadata addresses

---
 crates/http-backend/src/lib.rs | 106 ++++++++++++++++++++++++++++-----
 1 file changed, 92 insertions(+), 14 deletions(-)

diff --git a/crates/http-backend/src/lib.rs b/crates/http-backend/src/lib.rs
index 1195b1e..df91dcb 100644
--- a/crates/http-backend/src/lib.rs
+++ b/crates/http-backend/src/lib.rs
@@ -651,10 +651,38 @@ pub fn is_public_host(host: &str) -> bool {
     // Try to parse as IP address
     match host.parse::<IpAddr>() {
         Ok(ip) => !is_private_ip(&ip),
-        Err(_) => true, // Not an IP address, assume it's a hostname
+        // Not an IP literal: reject hostnames that are guaranteed to resolve to
+        // a loopback/internal address. Arbitrary hostnames still need to be
+        // re-validated against their resolved IP at connection time (see
+        // `is_private_ip`) to fully close the SSRF vector (CWE-918).
+        Err(_) => !is_private_hostname(host),
     }
 }
 
+/// Returns `true` for hostnames that must never be treated as public because
+/// they are defined to resolve to loopback/internal addresses.
+///
+/// `localhost` (and any `*.localhost` subdomain) is reserved by RFC 6761 and
+/// always maps to a loopback address, so it is rejected regardless of the
+/// resolver. A trailing root-label dot (`localhost.`) is normalized away.
+///
+/// Well-known cloud metadata hostnames are also rejected here as
+/// defense-in-depth against SSRF (CWE-918): they resolve to link-local
+/// metadata endpoints that can hand out instance credentials. This is a
+/// best-effort denylist — it does not replace validating the *resolved* IP at
+/// connection time, which is required to stop arbitrary hostnames and DNS
+/// rebinding. (Most clouds — AWS/Azure/Oracle/DigitalOcean — address the
+/// metadata service by the `169.254.169.254` IP directly, which is already
+/// blocked as link-local; GCP additionally exposes it by name.)
+fn is_private_hostname(host: &str) -> bool {
+    let host = host.trim_end_matches('.').to_ascii_lowercase();
+    host == "localhost"
+        || host.ends_with(".localhost")
+        // GCP metadata server (and its bare alias).
+        || host == "metadata.google.internal"
+        || host == "metadata"
+}
+
 /// Returns `true` if the given `target_host` resolves to the same authority as
 /// the backend resource URI. This is used to prevent guest modules from making
 /// direct outbound requests to the internal backend, bypassing FastEdge routing.
@@ -670,19 +698,31 @@ fn is_private_ip(ip: &IpAddr) -> bool {
     }
 }
 
-/// Check if an IPv4 address is private
-/// This is a a copu of std::net::Ipv4Addr::is_global with inverted logic and some additions
+/// Check if an IPv4 address is private / not globally-reachable.
+///
+/// This mirrors the (unstable) `std::net::Ipv4Addr::is_global` with inverted
+/// logic, implemented with explicit octet checks so it does not depend on
+/// unstable std APIs. Every non-globally-routable range is treated as private
+/// to prevent guest outbound SSRF (CWE-918).
 fn is_private_ipv4(ip: &Ipv4Addr) -> bool {
-    ip.octets()[0] == 0 // "This network"
-        || ip.is_private()
-        || ip.is_loopback()
-        || ip.is_link_local()
-        || (
-        ip.octets()[0] == 192 && ip.octets()[1] == 0 && ip.octets()[2] == 0
-            && ip.octets()[3] != 9 && ip.octets()[3] != 10
-    )
-        || ip.is_documentation()
-        || ip.is_broadcast()
+    let [a, b, c, d] = ip.octets();
+    a == 0 // "This network" (0.0.0.0/8, RFC 1122)
+        || ip.is_private() // 10/8, 172.16/12, 192.168/16 (RFC 1918)
+        || ip.is_loopback() // 127.0.0.0/8 (RFC 1122)
+        || ip.is_link_local() // 169.254.0.0/16 (RFC 3927)
+        // Shared address space / CGNAT (RFC 6598): 100.64.0.0/10
+        || (a == 100 && (b & 0xC0) == 0x40)
+        // IETF protocol assignments (RFC 6890): 192.0.0.0/24, except the two
+        // globally-reachable PCP anycast addresses 192.0.0.9 and 192.0.0.10.
+        || (a == 192 && b == 0 && c == 0 && d != 9 && d != 10)
+        // 6to4 relay anycast (RFC 3068 / RFC 7526): 192.88.99.0/24
+        || (a == 192 && b == 88 && c == 99)
+        // Benchmarking (RFC 2544): 198.18.0.0/15
+        || (a == 198 && (b & 0xFE) == 18)
+        || ip.is_documentation() // 192.0.2/24, 198.51.100/24, 203.0.113/24 (RFC 5737)
+        || ip.is_broadcast() // 255.255.255.255 (RFC 919)
+        // Reserved for future use (RFC 1112): 240.0.0.0/4 (broadcast already covered above)
+        || (a & 0xF0) == 240
 }
 
 /// Check if an IPv6 address is private
@@ -1256,6 +1296,32 @@ mod tests {
         assert!(!is_public_host("192.0.2.1"));
         assert!(!is_public_host("198.51.100.1"));
         assert!(!is_public_host("203.0.113.1"));
+
+        // Shared address space / CGNAT (RFC 6598): 100.64.0.0/10
+        assert!(!is_public_host("100.64.0.0"));
+        assert!(!is_public_host("100.100.100.200"));
+        assert!(!is_public_host("100.127.255.255:8080"));
+
+        // Benchmarking (RFC 2544): 198.18.0.0/15
+        assert!(!is_public_host("198.18.0.1"));
+        assert!(!is_public_host("198.19.255.255:80"));
+
+        // 6to4 relay anycast (RFC 3068): 192.88.99.0/24
+        assert!(!is_public_host("192.88.99.1"));
+
+        // Reserved for future use (RFC 1112): 240.0.0.0/4
+        assert!(!is_public_host("240.0.0.1"));
+        assert!(!is_public_host("250.1.2.3:9000"));
+    }
+
+    #[test]
+    fn test_is_public_host_cgnat_boundaries_are_public() {
+        // Addresses just outside 100.64.0.0/10 remain public.
+        assert!(is_public_host("100.63.255.255"));
+        assert!(is_public_host("100.128.0.0"));
+        // Just outside 198.18.0.0/15.
+        assert!(is_public_host("198.17.255.255"));
+        assert!(is_public_host("198.20.0.0"));
     }
 
     #[test]
@@ -1310,7 +1376,19 @@ mod tests {
         assert!(is_public_host("www.example.com"));
         assert!(is_public_host("api.example.com:443"));
         assert!(is_public_host("subdomain.example.co.uk"));
-        assert!(is_public_host("localhost")); // hostname, not IP
+        // `localhost` is reserved (RFC 6761) and always loopback → not public.
+        assert!(!is_public_host("localhost"));
+        assert!(!is_public_host("localhost:8080"));
+        assert!(!is_public_host("LOCALHOST"));
+        assert!(!is_public_host("localhost."));
+        assert!(!is_public_host("foo.localhost"));
+        assert!(!is_public_host("foo.localhost:3000"));
+        // Well-known cloud metadata hostnames → not public.
+        assert!(!is_public_host("metadata.google.internal"));
+        assert!(!is_public_host("metadata.google.internal:80"));
+        assert!(!is_public_host("Metadata.Google.Internal"));
+        assert!(!is_public_host("metadata.google.internal."));
+        assert!(!is_public_host("metadata"));
     }
 
     #[test]

From f759bb9dd73e5204ceec1107a05d752d0609be8c Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Tue, 28 Jul 2026 13:29:36 +0300
Subject: [PATCH 6/7] refactor(tests): improve readability of assertions in
 test cases

---
 crates/http-backend/src/lib.rs | 5 ++++-
 crates/runtime/src/app.rs      | 1 -
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/crates/http-backend/src/lib.rs b/crates/http-backend/src/lib.rs
index df91dcb..e558387 100644
--- a/crates/http-backend/src/lib.rs
+++ b/crates/http-backend/src/lib.rs
@@ -1510,7 +1510,10 @@ mod tests {
 
         assert!(result.headers().get("cdn-loop").is_none());
         assert_eq!(
-            result.headers().get("x-custom").and_then(|v| v.to_str().ok()),
+            result
+                .headers()
+                .get("x-custom")
+                .and_then(|v| v.to_str().ok()),
             Some("keep-me")
         );
     }
diff --git a/crates/runtime/src/app.rs b/crates/runtime/src/app.rs
index 3fc71a4..b982044 100644
--- a/crates/runtime/src/app.rs
+++ b/crates/runtime/src/app.rs
@@ -266,7 +266,6 @@ mod tests {
         assert_eq!(w.log, Log::None);
     }
 
-
     #[test]
     fn test_log_deserialize_victoria_logs() {
         let log: Log = assert_ok!(serde_json::from_str("\"victoria\""));

From 314c43ee5d7cce4939754a7def5b5099fccbbe02 Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Tue, 28 Jul 2026 13:36:01 +0300
Subject: [PATCH 7/7] chore(dependencies): update various crate versions in
 Cargo.lock

---
 Cargo.lock | 505 +++++++++++++++++++++++++++--------------------------
 1 file changed, 253 insertions(+), 252 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 6d11dcc..a13573d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -93,9 +93,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arbitrary"
@@ -108,9 +108,9 @@ dependencies = [
 
 [[package]]
 name = "arc-swap"
-version = "1.9.1"
+version = "1.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
 dependencies = [
  "rustversion",
 ]
@@ -134,13 +134,13 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -193,9 +193,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "block-buffer"
@@ -208,9 +208,9 @@ dependencies = [
 
 [[package]]
 name = "borsh"
-version = "1.7.0"
+version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f3f6da4992df95bbcd9af42a6c7dcb994498fc9048230405f3b36ff7cd3f145"
+checksum = "a88b7ea17d208c4193f2c1e6de3c35fe71f98c96982d5ced308bdcc749ff6e1f"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -227,22 +227,22 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.25.0"
+version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 dependencies = [
  "bytemuck_derive",
 ]
 
 [[package]]
 name = "bytemuck_derive"
-version = "1.10.2"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9abbd1bc6865053c427f7198e6af43bfdedc55ab791faed4fbd361d789575ff"
+checksum = "f65693059b6b9c588b9f62fed1cedbf0a8b805631457ea162d68f0de186f3de5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -253,15 +253,15 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.12.0"
+version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "bytesize"
-version = "2.4.0"
+version = "2.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49e78e506b9d7633710dab98996f22f95f3d0f488e8f1aa162830556ed9fc14d"
+checksum = "3d7c8918969267b2932ffd5655509bbbea0833823058c378876953217f5fc50e"
 
 [[package]]
 name = "cache"
@@ -288,7 +288,7 @@ dependencies = [
  "memmap2",
  "num-traits",
  "num_cpus",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rand_distr",
  "rayon",
  "safetensors",
@@ -324,7 +324,7 @@ dependencies = [
  "candle-nn",
  "fancy-regex",
  "num-traits",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rayon",
  "serde",
  "serde_json",
@@ -381,7 +381,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8144c22e24bbcf26ade86cb6501a0916c46b7e4787abdb0045a467eb1645a1d"
 dependencies = [
  "ambient-authority",
- "rand 0.8.6",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -412,9 +412,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.65"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+checksum = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -430,9 +430,9 @@ checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chrono"
@@ -456,9 +456,9 @@ checksum = "bba18ee93d577a8428902687bcc2b6b45a56b1981a1f6d779731c86cc4c5db18"
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "d91e0c145792ef73a6ad36d27c75ac09f1832222a3c209689d90f534685ee5b7"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -466,9 +466,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -478,14 +478,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.1"
+version = "4.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
@@ -500,7 +500,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
 dependencies = [
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -533,15 +533,6 @@ dependencies = [
  "tokio-util",
 ]
 
-[[package]]
-name = "concurrent-queue"
-version = "2.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
-dependencies = [
- "crossbeam-utils",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -718,18 +709,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.15"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
+checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -737,18 +728,18 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
 
 [[package]]
 name = "crunchy"
@@ -783,7 +774,7 @@ checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -825,7 +816,7 @@ checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -856,9 +847,9 @@ checksum = "e1d926b4d407d372f141f93bb444696142c29d32962ccbd3531117cf3aa0bfa9"
 
 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
 [[package]]
 name = "embedded-io"
@@ -890,7 +881,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -924,11 +915,10 @@ dependencies = [
 
 [[package]]
 name = "event-listener"
-version = "5.4.1"
+version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
- "concurrent-queue",
  "parking",
  "pin-project-lite",
 ]
@@ -990,9 +980,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "fd-lock"
@@ -1066,9 +1056,9 @@ dependencies = [
 
 [[package]]
 name = "futures"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1081,9 +1071,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1091,15 +1081,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1108,38 +1098,38 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1167,7 +1157,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "debugid",
  "fxhash",
  "serde",
@@ -1495,7 +1485,7 @@ dependencies = [
  "cfg-if",
  "crunchy",
  "num-traits",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rand_distr",
  "zerocopy",
 ]
@@ -1575,9 +1565,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "1.0.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
  "http",
@@ -1585,9 +1575,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1643,15 +1633,15 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
 
 [[package]]
 name = "hyper"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1935,11 +1925,11 @@ dependencies = [
 
 [[package]]
 name = "jobserver"
-version = "0.1.34"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "libc",
 ]
 
@@ -1988,9 +1978,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libloading"
@@ -2010,9 +2000,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
 dependencies = [
  "libc",
 ]
@@ -2076,9 +2066,9 @@ checksum = "4facc753ae494aeb6e3c22f839b158aebd4f9270f55cd3c79906c45476c47ab4"
 
 [[package]]
 name = "memchr"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "memfd"
@@ -2110,9 +2100,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "wasi",
@@ -2159,7 +2149,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8628de41fe064cc3f0cf07f3d299ee3e73521adaff72278731d5c8cae3797873"
 dependencies = [
- "rand 0.9.4",
+ "rand 0.9.5",
 ]
 
 [[package]]
@@ -2218,9 +2208,9 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.6"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
 dependencies = [
  "num-integer",
  "num-traits",
@@ -2247,11 +2237,10 @@ dependencies = [
 
 [[package]]
 name = "num-iter"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
 dependencies = [
- "autocfg",
  "num-integer",
  "num-traits",
 ]
@@ -2306,7 +2295,7 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2339,7 +2328,7 @@ version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -2355,7 +2344,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2467,7 +2456,7 @@ checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2490,9 +2479,9 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
 
 [[package]]
 name = "postcard"
@@ -2540,14 +2529,14 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.12+spec-1.1.0",
+ "toml_edit 0.25.13+spec-1.1.0",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
@@ -2558,7 +2547,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "hex",
  "procfs-core",
  "rustix 0.38.44",
@@ -2570,7 +2559,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "hex",
 ]
 
@@ -2588,7 +2577,7 @@ dependencies = [
  "parking_lot",
  "procfs",
  "protobuf",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -2627,7 +2616,7 @@ version = "36.0.12"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2658,9 +2647,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.46"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -2679,9 +2668,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -2690,9 +2679,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -2743,7 +2732,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
 dependencies = [
  "num-traits",
- "rand 0.9.4",
+ "rand 0.9.5",
 ]
 
 [[package]]
@@ -2761,7 +2750,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -2799,9 +2788,9 @@ checksum = "03251193000f4bd3b042892be858ee50e8b3719f2b08e5833ac4353724632430"
 
 [[package]]
 name = "redis"
-version = "1.2.4"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bae41a63fd0b8a5372f82b21e810e09a316f5dd7efd96bf08e678fb240fc1918"
+checksum = "b0b9503711b03773e43b31668c7b5bd279ee7cd9b7d18cff7c23a42cc1d08e5a"
 dependencies = [
  "arc-swap",
  "arcstr",
@@ -2833,7 +2822,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -2863,9 +2852,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2875,9 +2864,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "8fcfdb36bda0c880c5931cdc7a2bcdc8ba4556847b9d912bca70bc94708711ad"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2942,15 +2931,15 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.27"
+version = "0.1.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
+checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustix"
@@ -2958,7 +2947,7 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -2971,7 +2960,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
@@ -3004,9 +2993,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
  "zeroize",
 ]
@@ -3024,9 +3013,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "ryu"
@@ -3089,7 +3078,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -3124,9 +3113,9 @@ checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -3134,29 +3123,29 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -3273,9 +3262,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -3301,9 +3290,20 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.118"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3318,7 +3318,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3327,7 +3327,7 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec7dddc5f0fee506baf8b9fdb989e242f17e4b11c61dfbb0635b705217199eea"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -3341,7 +3341,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -3355,7 +3355,7 @@ version = "0.27.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc4592f674ce18521c2a81483873a49596655b179f71c5e05d10c1fe66c78745"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cap-fs-ext",
  "cap-std",
  "fd-lock",
@@ -3417,7 +3417,7 @@ dependencies = [
  "cfg-if",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3428,7 +3428,7 @@ checksum = "5c89e72a01ed4c579669add59014b9a524d609c0c88c6a585ce37485879f6ffb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "test-case-core",
 ]
 
@@ -3443,11 +3443,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl 2.0.19",
 ]
 
 [[package]]
@@ -3458,25 +3458,25 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.18"
+version = "2.0.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
@@ -3493,9 +3493,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -3510,13 +3510,13 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "6328af13490e73a9b4694030fafd93f8c8c6a9dede33e821c3fc63eddf8042ba"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3542,9 +3542,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -3553,14 +3553,15 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-io",
  "futures-sink",
+ "libc",
  "pin-project-lite",
  "slab",
  "tokio",
@@ -3612,23 +3613,23 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.12+spec-1.1.0"
+version = "0.25.13+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
+checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
 dependencies = [
  "indexmap",
  "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow 1.0.3",
+ "winnow 1.0.4",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
- "winnow 1.0.3",
+ "winnow 1.0.4",
 ]
 
 [[package]]
@@ -3679,7 +3680,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3739,7 +3740,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ad06847b7afb65c7866a36664b75c40b895e318cea4f71299f013fb22965329d"
 dependencies = [
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3832,9 +3833,9 @@ dependencies = [
 
 [[package]]
 name = "uuid"
-version = "1.23.4"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -3890,7 +3891,7 @@ version = "36.0.12"
 source = "git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0#62166f65ac52a1f164419097a2a533ff50e4d07b"
 dependencies = [
  "anyhow",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "cap-fs-ext",
  "cap-rand",
  "cap-std",
@@ -3901,7 +3902,7 @@ dependencies = [
  "log",
  "rustix 1.1.4",
  "system-interface",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tracing",
  "wasmtime",
  "wiggle 36.0.12 (git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0)",
@@ -3949,7 +3950,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
@@ -3984,12 +3985,12 @@ dependencies = [
 
 [[package]]
 name = "wasm-encoder"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8185ae345fa5687c054626ff9a50e7089797a343d9904d1dc9820eb4c4d3196f"
+checksum = "09480d646178e5fdd12bb06e812d0af9a3a191dbc9cd697fdc86687beade7393"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.252.0",
+ "wasmparser 0.254.0",
 ]
 
 [[package]]
@@ -4010,7 +4011,7 @@ version = "0.236.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9b1e81f3eb254cf7404a82cee6926a4a3ccc5aad80cc3d43608a070c67aa1d7"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "hashbrown 0.15.5",
  "indexmap",
  "semver",
@@ -4023,7 +4024,7 @@ version = "0.246.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71cde4757396defafd25417cfb36aa3161027d06d865b0c24baaae229aac005d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "hashbrown 0.16.1",
  "indexmap",
  "semver",
@@ -4031,11 +4032,11 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.252.0"
+version = "0.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3eb099dcadcde5be9eef55e3a337128efd4e44b4c93122487e4d2e4e1c6627c"
+checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "indexmap",
  "semver",
 ]
@@ -4058,7 +4059,7 @@ dependencies = [
  "addr2line",
  "anyhow",
  "async-trait",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bumpalo",
  "cc",
  "cfg-if",
@@ -4181,7 +4182,7 @@ dependencies = [
  "anyhow",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "wasmtime-internal-component-util",
  "wasmtime-internal-wit-bindgen",
  "wit-parser 0.236.1",
@@ -4209,7 +4210,7 @@ dependencies = [
  "pulley-interpreter",
  "smallvec",
  "target-lexicon",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "wasmparser 0.236.1",
  "wasmtime-environ 36.0.12",
  "wasmtime-internal-math",
@@ -4278,7 +4279,7 @@ version = "36.0.12"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4301,7 +4302,7 @@ name = "wasmtime-internal-wit-bindgen"
 version = "36.0.12"
 dependencies = [
  "anyhow",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "heck",
  "indexmap",
  "wit-parser 0.236.1",
@@ -4313,7 +4314,7 @@ version = "36.0.12"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "bytes",
  "cap-fs-ext",
  "cap-net-ext",
@@ -4326,7 +4327,7 @@ dependencies = [
  "io-lifetimes",
  "rustix 1.1.4",
  "system-interface",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tokio",
  "tracing",
  "url",
@@ -4390,7 +4391,7 @@ dependencies = [
  "candle-nn",
  "candle-transformers",
  "openvino",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "tracing",
  "walkdir",
  "wasmtime",
@@ -4409,24 +4410,24 @@ dependencies = [
 
 [[package]]
 name = "wast"
-version = "252.0.0"
+version = "254.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "942a3449d6a593fccc111a6241c8df52bda168af30e40bf9580d4394d7374c65"
+checksum = "e7ed4dfc8f6b9fc38b231065e2cdfbf7359af5ab945990abf09658dcc63c3e32"
 dependencies = [
  "bumpalo",
  "leb128fmt",
  "memchr",
  "unicode-width",
- "wasm-encoder 0.252.0",
+ "wasm-encoder 0.254.0",
 ]
 
 [[package]]
 name = "wat"
-version = "1.252.0"
+version = "1.254.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c72a4ba7088f7bac94cf516e49882bdf97068904a563768cf249efc839ec42cb"
+checksum = "7127f7f9b8f127c879991cecd35f494e4628bae1b0874c681414d8d8831e952c"
 dependencies = [
- "wast 252.0.0",
+ "wast 254.0.0",
 ]
 
 [[package]]
@@ -4435,14 +4436,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.8",
+ "webpki-roots 1.0.9",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf85cb06032201fa7c6f829d7db5a7e5aa45bcc0655327713065f6f0576731bf"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -4453,8 +4454,8 @@ version = "36.0.12"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.13.0",
- "thiserror 2.0.18",
+ "bitflags 2.13.1",
+ "thiserror 2.0.19",
  "tracing",
  "wasmtime",
  "wiggle-macro 36.0.12",
@@ -4467,8 +4468,8 @@ source = "git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0#62166
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.13.0",
- "thiserror 2.0.18",
+ "bitflags 2.13.1",
+ "thiserror 2.0.19",
  "tracing",
  "wasmtime",
  "wiggle-macro 36.0.12 (git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0)",
@@ -4482,7 +4483,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "witx",
 ]
 
@@ -4495,7 +4496,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "witx",
 ]
 
@@ -4505,7 +4506,7 @@ version = "36.0.12"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "wiggle-generate 36.0.12",
 ]
 
@@ -4516,7 +4517,7 @@ source = "git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0#62166
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "wiggle-generate 36.0.12 (git+https://github.com/G-Core/wasmtime.git?branch=release-36.0.0)",
 ]
 
@@ -4562,7 +4563,7 @@ dependencies = [
  "regalloc2",
  "smallvec",
  "target-lexicon",
- "thiserror 2.0.18",
+ "thiserror 2.0.19",
  "wasmparser 0.236.1",
  "wasmtime-environ 36.0.12",
  "wasmtime-internal-cranelift",
@@ -4611,7 +4612,7 @@ checksum = "12168c33176773b86799be25e2a2ba07c7aab9968b37541f1094dbd7a60c8946"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4622,7 +4623,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4633,7 +4634,7 @@ checksum = "9d8dc32e0095a7eeccebd0e3f09e9509365ecb3fc6ac4d6f5f14a3f6392942d1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4644,7 +4645,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4847,9 +4848,9 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 dependencies = [
  "memchr",
 ]
@@ -4860,7 +4861,7 @@ version = "0.36.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f3fd376f71958b862e7afb20cfe5a22830e1963462f3a17f49d82a6c1d1f42d"
 dependencies = [
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "windows-sys 0.59.0",
 ]
 
@@ -4877,7 +4878,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1936c26cb24b93dc36bf78fb5dc35c55cd37f66ecdc2d2663a717d9fb3ee951e"
 dependencies = [
  "anyhow",
- "bitflags 2.13.0",
+ "bitflags 2.13.1",
  "indexmap",
  "log",
  "serde",
@@ -4946,9 +4947,9 @@ checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "xxhash-rust"
-version = "0.8.15"
+version = "0.8.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+checksum = "aee1b19627c7c60102ab80d3a9cbe18de90bfe03bfa6c3715447681f0e8c8af6"
 
 [[package]]
 name = "yoke"
@@ -4981,7 +4982,7 @@ checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "synstructure",
 ]
 
@@ -4993,28 +4994,28 @@ checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.52"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+checksum = "b5a105cd7b140f6eeec8acff2ea38135d3cab283ada58540f629fe51e46696eb"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.52"
+version = "0.8.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+checksum = "0fe976fb70c78cd64cccfe3a6fc142244e8a77b70959b30faf9d0ac37ee228eb"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5034,7 +5035,7 @@ checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "synstructure",
 ]
 
@@ -5074,7 +5075,7 @@ checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5094,9 +5095,9 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
 
 [[package]]
 name = "zstd"