#570 chore(deps): weekly batch — non-breaking

Weekly batch for the non-breaking group. Replaces the single-dependency Renovate PRs listed under "Supersedes". Batch config: #568.

Dependency updates

Cargo.lock (cargo update -p, latest compatible at run time; requirement unchanged):

• async-trait 0.1 (locked 0.1.89 -> 0.1.92)
• bytes 1.6 (locked 1.12.0 -> 1.12.1)
• clap 4.5 (locked 4.6.1 -> 4.6.7)
• flate2 1 (locked 1.1.9 -> 1.1.10)
• futures 0.3 (locked 0.3.32 -> 0.3.34; futures-util 0.3 in preloop-cli moves with it)
• glob 0.3 (locked 0.3.3 -> 0.3.4)
• globset 0.4 (locked 0.4.18 -> 0.4.20)
• hyper 1.0 (locked 1.10.1 -> 1.12.0)
• hyper-util 0.1 (locked 0.1.20 -> 0.1.21)
• indexmap 2.2 (locked 2.14.0 -> 2.14.2)
• libc 0.2 (locked 0.2.186 -> 0.2.190; workspace and preloop-cli)
• proptest 1.4 (locked 1.11.0 -> 1.12.0)
• regex 1.10 (locked 1.12.4 -> 1.13.1)
• reqwest 0.13 (locked 0.13.4 -> 0.13.5)
• serde 1.0 (locked 1.0.228 -> 1.0.229; serde_core and serde_derive move with it)
• serde_json 1.0 (locked 1.0.150 -> 1.0.154)
• tokio 1.37 (locked 1.52.3 -> 1.53.2)
• tokio-util 0.7 (locked 0.7.18 -> 0.7.20)
• uuid 1.8 (locked 1.23.4 -> 1.28.0)

GitHub Actions (SHA-pinned, comment matches the tag; SHAs resolved with gh api repos/<owner>/<repo>/commits/<tag>):

• actions/checkout v5.0.0 -> v5.1.0 (15 workflows, 32 uses)
• actions/download-artifact v8.0.1 -> v8.0.2 (golden-runtime-drift.yml, release.yml)
• actions/attest-build-provenance v4.1.1 -> v4.2.2 (official-golden.yml, release-golden.yml, release.yml)
• actions/setup-node v7.0.0 -> v7.1.0 (release.yml)
• taiki-e/install-action v2.85.10 -> v2.87.26 (release-runner.yml, supply-chain.yml)

Other:

• contrib/openobserve/compose.yml: digest sha256:88fb692a... -> sha256:d4a878fa... (matches public.ecr.aws/zinclabs/openobserve:latest, checked with docker buildx imagetools inspect)
• fixtures/actions/docker-manifest-lifecycle/Dockerfile: alpine 3.20 -> 3.24 (tag only, as in the file today)

Supersedes

#508, #509, #510, #511, #512, #513, #514, #515, #516, #517, #518, #519, #521, #522, #523, #524, #525, #535, #538, #540, #545, #548

Notes

• serde: cargo update -p serde on its own is held at 1.0.228 by the exact-pinned serde_core and serde_derive, so the three are unlocked together (as in #518).
• Several locked versions are newer than the Renovate PR they supersede (uuid 1.28.0 vs 1.27.0, tokio-util 0.7.20 vs 0.7.19, serde_json 1.0.154 vs 1.0.151), because cargo resolved to the newest compatible releases.
• Rebased onto main after #569 (rust-toolchain) merged. The rebase was clean and did not touch Cargo.lock.

Verification

cargo check --workspace --all-targets --locked: passed locally on rustc 1.97 before the rebase, and passed again on rustc 1.99 after rebasing onto main (13m25s, warnings only).

Known breakage

None.