build(deps): bump the production-dependencies group with 10 updates

[dependabot]

Bumps the production-dependencies group with 10 updates:

Package	From	To
libc	0.2.186	0.2.189
opentelemetry-semantic-conventions	0.32.0	0.32.1
sentry	0.48.2	0.48.5
anyhow	1.0.102	1.0.104
clap	4.6.1	4.6.4
serde	1.0.228	1.0.229
tokio	1.52.3	1.53.1
rand	0.10.1	0.10.2
thiserror	2.0.18	2.0.19
tokio-util	0.7.18	0.7.19

Updates libc from 0.2.186 to 0.2.189

Release notes

Sourced from libc's releases.

0.2.189

Added

• Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
• Linux SPARC: Enable the clone3 syscall (#4980)
• Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

• Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

• Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
• NuttX: Fix wchar_t definition under Arm (#5245)
• Windows: Add back link names for time-related symbols (#5300)

0.2.188

Changed

• Restore Send and Sync for DIR (35b062263401)

These were removed in 0.2.187 because libc does not actually make Send and Sync guarantees about DIR (or other extern types), but this caused some crates to break. The traits are added back for now to allow time to migrate, but will be removed again in the future; please make sure your crates are not relying on libc::DIR: Send or libc::DIR: Sync.

0.2.187

This release contains a number of improvements related to 64-bit time_t configuration. Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

• The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits

• uClibc now supports a similar configuration option:

  RUSTFLAGS='--cfg=libc_unstable_uclibc_time64'

... (truncated)

Changelog

Sourced from libc's changelog.

0.2.189 - 2026-07-21

Added

• Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
• Linux SPARC: Enable the clone3 syscall (#4980)
• Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

• Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

• Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
• NuttX: Fix wchar_t definition under Arm (#5245)
• Windows: Add back link names for time-related symbols (#5300)

0.2.188 - 2026-07-21

Changed

• Restore Send and Sync for DIR (35b062263401)

These were removed in 0.2.187 because libc does not actually make Send and Sync guarantees about DIR (or other extern types), but this caused some crates to break. The traits are added back for now to allow time to migrate, but will be removed again in the future; please make sure your crates are not relying on libc::DIR: Send or libc::DIR: Sync.

0.2.187 - 2026-07-20

This release contains a number of improvements related to 64-bit time_t configuration. Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

• The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits
• uClibc now supports a similar configuration option:

... (truncated)

Commits

• ef0906e libc: Release 0.2.189
• 5a79f76 riscv32-musl: Rename padding fields to avoid a conflict
• 3e51062 psp: Fix overflowing_literals warnings
• e352fdd emscripten: add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessa...
• 63221b3 macros: Require safe in safe_f! invocations
• 707ab52 macros: Require unsafe in f! invocations
• 8e40c94 Enable clone3() syscall on sparc-linux and sparc64-linux
• 8427909 windows: Add back link names for time-related symbols
• b4863fa nuttx: fix wchar_t definition under arm
• 41c683d nuttx: mirror type definitions
• Additional commits viewable in compare view

Updates opentelemetry-semantic-conventions from 0.32.0 to 0.32.1

Release notes

Sourced from opentelemetry-semantic-conventions's releases.

opentelemetry-semantic-conventions-0.32.1

See the CHANGELOG for details.

Commits

• 74cb6f3 chore: Release opentelemetry-semantic-conventions 0.32.1 (#3562)
• 10dde18 chore(sdk): add missing changelog entry (#3550)
• ec2da12 refactor: leverage static str key when possible (#3529)
• 90a39a0 feat(api): accept quoted-key fields in otel logging macros (#3567)
• 8c922bc feat(appender-tracing): add builder support for custom instrumentation scope ...
• fb2af9d feat(metrics): add BoundUpDownCounter under experimental_metrics_bound_instru...
• 1b3846c feat(metrics): add BoundGauge under experimental_metrics_bound_instruments (#...
• ee359db fix: remove reqwest-rustls-webpki-roots (#3524)
• 4d4fd4d chore: Bump semantic-conventions to v1.42.0 (#3561)
• 69213f2 fix(prometheus-exporter): Concatenate metric attributes with Scope during col...
• Additional commits viewable in compare view

Updates sentry from 0.48.2 to 0.48.5

Release notes

Sourced from sentry's releases.

0.48.5

Fixes

• Fixed a bug that could cause the SDK to panic and, in some cases, panic while handling the panic, aborting the process (#1241).

0.48.4

New Features

• Added builder-style setters to ClientOptions (#1221):

  // Before
  let options = sentry::ClientOptions {
      dsn: "https://examplePublicKey@o0.ingest.sentry.io/0",
      debug: true,
      release: Some("my-app@1.0.0".into()),
      ..Default::default()
  };
  // After
  let options = sentry::ClientOptions::new()
  .dsn("https://examplePublicKey@o0.ingest.sentry.io/0")
  .debug(true)
  .release("my-app@1.0.0");

Deprecations

• Constructing ClientOptions with struct-literal syntax, including ..Default::default() functional update syntax, is deprecated and will stop compiling in the next breaking release, as we will mark ClientOptions as #[non_exhaustive] (#1221). Reading and assigning individual public fields will remain supported. Please migrate to the builder-style setters introduced in this release.

0.48.3

The Sentry Rust SDK now reports data discarded by the SDK to Sentry’s Stats page. The SDK reports approximate counts for drops from transports, queues, rate-limit backoff, sampling, event processors, and before_send* callbacks, including span counts for dropped transactions and byte counts for dropped logs and metrics.

New Features

• Added EnvelopeFilter and EnvelopeFilterCallbacks, which let callers observe envelope items removed by Envelope::filter, including attachments removed after their event or transaction is filtered out. Existing Envelope::filter closure callers continue to work, although some closures may require an explicit item type annotation (#1182).
• Added the LossSource trait, which provides the client report data categories and quantities to report when supported Sentry data is dropped (#1170).
• Added TransportFactory::create_transport_with_options, which constructs transports from TransportOptions instead of full ClientOptions (#1142).
• Added transport-specific options types and with_options constructors for built-in HTTP transports, including ReqwestHttpTransportOptions, CurlHttpTransportOptions, UreqHttpTransportOptions, and EmbeddedSVCHttpTransportOptions (#1142).
• Added transport worker options types and deprecated the legacy constructors for built-in background transport workers, including StdTransportThreadOptions and TokioTransportThreadOptions (#1142).
• Added client report protocol types in sentry-types, including ClientReport, client_report::Item, client_report::Category, and client_report::Reason, plus support for serializing client_report envelope items (#1144).
• Added a client report Recorder type, which modern TransportFactory implementations receive via TransportOptions. Transports can use this recorder to record discarded Sentry data; the SDK aggregates these reported losses and automatically sends them in a future envelope (#1158).

Deprecations

• Deprecated Hub::with. Use Hub::current instead (#1126).

Fixes

• Fixed ureq transport handling for HTTP error statuses so 429 rate limits and 413 payload-too-large responses are processed correctly (#1177).

... (truncated)

Changelog

Sourced from sentry's changelog.

0.48.5

Fixes

• Fixed a bug that could cause the SDK to panic and, in some cases, panic while handling the panic, aborting the process (#1241).

0.48.4

New Features

• Added builder-style setters to ClientOptions (#1221):

  // Before
  let options = sentry::ClientOptions {
      dsn: "https://examplePublicKey@o0.ingest.sentry.io/0",
      debug: true,
      release: Some("my-app@1.0.0".into()),
      ..Default::default()
  };
  // After
  let options = sentry::ClientOptions::new()
  .dsn("https://examplePublicKey@o0.ingest.sentry.io/0")
  .debug(true)
  .release("my-app@1.0.0");

Deprecations

• Constructing ClientOptions with struct-literal syntax, including ..Default::default() functional update syntax, is deprecated and will stop compiling in the next breaking release, as we will mark ClientOptions as #[non_exhaustive] (#1221). Reading and assigning individual public fields will remain supported. Please migrate to the builder-style setters introduced in this release.

0.48.3

The Sentry Rust SDK now reports data discarded by the SDK to Sentry’s Stats page. The SDK reports approximate counts for drops from transports, queues, rate-limit backoff, sampling, event processors, and before_send* callbacks, including span counts for dropped transactions and byte counts for dropped logs and metrics.

New Features

• Added EnvelopeFilter and EnvelopeFilterCallbacks, which let callers observe envelope items removed by Envelope::filter, including attachments removed after their event or transaction is filtered out. Existing Envelope::filter closure callers continue to work, although some closures may require an explicit item type annotation (#1182).
• Added the LossSource trait, which provides the client report data categories and quantities to report when supported Sentry data is dropped (#1170).
• Added TransportFactory::create_transport_with_options, which constructs transports from TransportOptions instead of full ClientOptions (#1142).
• Added transport-specific options types and with_options constructors for built-in HTTP transports, including ReqwestHttpTransportOptions, CurlHttpTransportOptions, UreqHttpTransportOptions, and EmbeddedSVCHttpTransportOptions (#1142).
• Added transport worker options types and deprecated the legacy constructors for built-in background transport workers, including StdTransportThreadOptions and TokioTransportThreadOptions (#1142).
• Added client report protocol types in sentry-types, including ClientReport, client_report::Item, client_report::Category, and client_report::Reason, plus support for serializing client_report envelope items (#1144).
• Added a client report Recorder type, which modern TransportFactory implementations receive via TransportOptions. Transports can use this recorder to record discarded Sentry data; the SDK aggregates these reported losses and automatically sends them in a future envelope (#1158).

Deprecations

• Deprecated Hub::with. Use Hub::current instead (#1126).

... (truncated)

Commits

• 33cf8ec release: 0.48.5
• aab9f34 fix(core): Prevent HubSwitchGuard panic at thread teardown (#1241)
• 3b3a6ca test: Fix flaky test (#1240)
• 93b0c60 test(tracing): Print count and debug output in assertion helpers (#1236)
• eb932e2 Merge branch 'release/0.48.4'
• 82474e2 release: 0.48.4
• 4e3d88f ref(core): Migrate ClientOptions call sites to builder API (#1222)
• cd1fb7a feat(core): Introduce builder API for ClientOptions (#1221)
• e752b2d meta(codeowners): Set to getsentry/owners-rust-sdk team (#1225)
• af7f3c8 docs(types): Update Envelope filter docs (#1198)
• Additional commits viewable in compare view

Updates anyhow from 1.0.102 to 1.0.104

Release notes

Sourced from anyhow's releases.

1.0.104

• Update syn dev-dependency to version 3

1.0.103

• Fix Stacked Borrows violation (UB) in Error::downcast_mut (#451, #452)

Commits

• 1dbe186 Release 1.0.104
• f6479f8 Update to syn 3
• 5bdb0e2 Release 1.0.103
• e621bd3 Merge pull request #452 from dtolnay/downcast
• 6e8c000 Eliminate pointer->reference->pointer during downcast
• 67c4abd Add regression test for issue 451
• 917a169 Update actions/upload-artifact@v6 -> v7
• d9dc3fa Update actions/checkout@v6 -> v7
• 841522b Raise minimum tested compiler to rust 1.85
• See full diff in compare view

Updates clap from 4.6.1 to 4.6.4

Release notes

Sourced from clap's releases.

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

v4.6.3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

[4.6.3] - 2026-07-20

Fixes

• (derive) Allow "literal".function() as attribute values

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Commits

• 87ec1ad chore: Release
• 78f2529 docs: Update changelog
• b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
• 74c6666 fix(complete): Keep zsh candidate order
• d142d8f Merge pull request #6360 from epage/string
• ba89563 style: Prefer explicit string operations
• bea966e Merge pull request #6359 from epage/man
• b811986 chore(man):Remove unused required-features
• 0010bf2 Merge pull request #6358 from clap-rs/renovate/crate-ci-typos-1.x
• bab9b24 chore(deps): Update compatible (dev) (#6357)
• Additional commits viewable in compare view

Updates serde from 1.0.228 to 1.0.229

Release notes

Sourced from serde's releases.

v1.0.229

• Update to syn 3

Commits

• 7fc3b4c Release 1.0.229
• 6d6e9a1 Merge pull request #3085 from dtolnay/syn3
• 6dec3b7 Update to syn 3
• cfe6692 Resolve mut_mut pedantic clippy lint
• 1023d07 Update actions/upload-artifact@v6 -> v7
• dd682c2 Update actions/checkout@v6 -> v7
• 5f0f18b Update ui test suite to nightly-2026-06-01
• 63a1498 Regenerate stderr with trybuild normalization fixes
• fa7da4a Fix unused_features warning
• 6b1a178 Unpin CI miri toolchain
• Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.53.1

Release notes

Sourced from tokio's releases.

Tokio v1.53.1

1.53.1 (July 20th, 2026)

Fixed

• signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)

Fixed (unstable)

• time: fix alt timer cancellation and insertion race (#8252)

Documented

• runtime: remove dead link definition in Runtime::block_on (#8301)

#8252: tokio-rs/tokio#8252 #8300: tokio-rs/tokio#8300 #8301: tokio-rs/tokio#8301

Tokio v1.53.0

1.53.0 (July 17th, 2026)

Added

• fs: implement From<OwnedFd> and From<OwnedHandle> for File (#8266)
• metrics: add task schedule latency metric (#7986)
• net: add SocketAddr methods to Unix sockets (#8144)

Changed

• io: add #[inline] to IO trait impls for in-memory types (#8242)
• net: implement UCred::pid on FreeBSD (#8086)
• net: support Nuttx target os (#8259)
• signal: refactor global variables on Windows (#8231)
• sync: mpsc::{Receiver,UnboundedReceiver} now drops waker on drop, even if there are still senders (#8095)
• taskdump: support taskdumps on s390x (#8192)
• time: add #[track_caller] to timeout_at() (#8077)
• time: consolidate mutex locks on spurious poll (#8124)
• time: defer waker clone on spurious poll (#8107)
• time: move lazy-registration state into Sleep (#8132)
• tracing: remove unnecessary span clone (#8126)

Fixed

• io: do not treat zero-length reads as EOF in Chain (#8251)
• net: use getpeereid for QNX peer credentials (#8270)
• runtime: avoid illegal state in FastRand (#8078)
• sync: wake mpsc receiver when a queued reserve[_many] returns permits (#8260)
• taskdump: skip double wake on Trace::capture/Trace::trace_with (#8043)
• time: avoid stack overflow in runtime constructor (#8093)

... (truncated)

Commits

• 75fef53 chore: prepare Tokio v1.53.1 (#8303)
• ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
• eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
• 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
• a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
• be689a3 chore: prepare Tokio v1.53.0 (#8294)
• 50f76c7 chore: prepare tokio-macros v2.7.1 (#8295)
• f61fcca Merge 'tokio-1.52.4' into 'master' (#8290)
• efdba5f chore: prepare Tokio v1.52.4 (#8289)
• b0ba02e Merge 'tokio-1.51.4' into 'tokio-1.52.x' (#8288)
• Additional commits viewable in compare view

Updates rand from 0.10.1 to 0.10.2

Changelog

Sourced from rand's changelog.

[0.10.2] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1790)

Changes

• Document required output order of fn partial_shuffle and apply #[must_use] (#1769)
• Avoid usage of unsafe in contexts where non-local memory corruption could invalidate contract (#1791)

#1769: rust-random/rand#1769 #1790: rust-random/rand#1790 #1791: rust-random/rand#1791

Commits

• 1540ea3 Prepare rand 0.10.2 (#1800)
• a29964a Bump chacha20 from 0.10.0 to 0.10.1 in the all-deps group (#1801)
• ced9491 Tweak docs for RngExt::random_range and SampleRange (#1798)
• db14664 Check UniformChar validity on deser (#1790)
• bea8620 Bump the all-deps group with 2 updates (#1796)
• 4f44932 Bump actions/cache from 5 to 6 (#1795)
• b999a13 Bump actions/checkout from 6 to 7 (#1794)
• aeab810 Avoid unsafe where safety depends on non-local values (#1791)
• 1896d7c Add typos CI job (#1789)
• 43eddee Bump the all-deps group with 2 updates (#1788)
• Additional commits viewable in compare view

Updates thiserror from 2.0.18 to 2.0.19

Release notes

Sourced from thiserror's releases.

2.0.19

• Update to syn 3

Commits

• e13a785 Release 2.0.19
• 0a0e76c Update to syn 3
• ec42ea7 Update actions/upload-artifact@v6 -> v7
• 4178c4a Update actions/checkout@v6 -> v7
• 7214e0e Ignore items_after_statements pedantic clippy lint in test
• febcc03 Merge pull request #451 from vip892766gma/maint/20260521171412
• c50e387 chore: improve thiserror maintenance path
• d4a2507 Raise minimum tested compiler to rust 1.85
• 99e8a6c Unpin CI miri toolchain
• 9ac165c Pin CI miri to nightly-2026-02-11
• Additional commits viewable in compare view

Updates tokio-util from 0.7.18 to 0.7.19

Commits

• f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
• 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
• ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
• 75fef53 chore: prepare Tokio v1.53.1 (#8303)
• ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
• eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
• 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
• a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
• be689a3 chore: prepare Tokio v1.53.0 (#8294)
• 50f76c7 chore: prepare tokio-macros v2.7.1 (#8295)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions