build(deps): Bump the cargo-minor-patch group across 1 directory with 10 updates

[dependabot]

Bumps the cargo-minor-patch group with 10 updates in the / directory:

Package	From	To
arc-swap	1.9.1	1.9.2
aws-lc-rs	1.17.0	1.17.1
bytes	1.12.0	1.12.1
clap	4.6.1	4.6.2
ryu-js	1.0.2	1.0.3
time	0.3.51	0.3.53
tokio	1.52.3	1.52.4
toml	1.1.2+spec-1.1.0	1.1.3+spec-1.1.0
uuid	1.23.4	1.24.0
regex	1.12.4	1.13.1

Updates arc-swap from 1.9.1 to 1.9.2

Changelog

Sourced from arc-swap's changelog.

1.9.2

• Document RefCnt must not panic (#208).

Commits

• See full diff in compare view

Updates aws-lc-rs from 1.17.0 to 1.17.1

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.1

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

• [Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) (static)
• [Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

• In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

• Support linking against a system-installed AWS-LC:
  • Set AWS_LC_SYS_SYSTEM_DIR or let pkg-config / OPENSSL_* environment variables auto-detect an existing AWS-LC installation instead of building from source by @​justsmth in aws/aws-lc-rs#1129
  • Support system-installed AWS-LC FIPS library for aws-lc-fips-sys by @​justsmth in aws/aws-lc-rs#1143
  • Auto-detect system AWS-LC from OPENSSL_* and pkg-config by @​justsmth in aws/aws-lc-rs#1156
  • Gate system AWS-LC on a declared minimum version by @​justsmth in aws/aws-lc-rs#1152
• Implement Send/Sync for RSA hazmat encryption key types by @​justsmth in aws/aws-lc-rs#1128
• Add Salt::none constructor for HKDF by @​justsmth in aws/aws-lc-rs#1135
• Add wasm32-unknown-emscripten build and test support by @​justsmth in aws/aws-lc-rs#1059
• Report specific key rejection reasons for invalid RSA key sizes by @​justsmth in aws/aws-lc-rs#1153

Upstream AWS-LC (v5.1.0)

aws-lc-sys now aligns with AWS-LC v5.1.0 (previously v1.73.0). Notable upstream changes include:

• ML-DSA native assembly backends for x86_64 and aarch64, imported from mldsa-native by @​jakemas in aws/aws-lc#3195 and aws/aws-lc#3219
• Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs)

Build Improvements

• Fix memcmp_check build failure when CFLAGS contains LTO flags by @​justsmth in aws/aws-lc-rs#1134
• Fix missing poly_Rq_mul symbol in Linux x86_64 build by @​Lebei2046 in aws/aws-lc-rs#1130
• Apply -ffile-prefix-map to jitterentropy builder by @​justsmth in aws/aws-lc-rs#1139
• Select compiler flag dialect by driver mode, not target ABI by @​justsmth in aws/aws-lc-rs#1147

Issues Being Closed

• RSA hazmat encryption key types missing Send/Sync -- aws/aws-lc-rs#1125
• RSA key rejection reports generic Unspecified for invalid key sizes -- aws/aws-lc-rs#1082
• Build failure when CFLAGS contains LTO flags (Windows/clang) -- aws/aws-lc-rs#1132
• cargo-xwin (clang-cl) jitterentropy build failure on x86_64-pc-windows-msvc -- aws/aws-lc-rs#1146
• Support system-provided AWS-LC library -- aws/aws-lc-rs#936
• cpu_arm_linux.c assumes sys/auxv.h and getauxval (uclibc targets) -- aws/aws-lc-rs#1108
• jitterentropy embeds absolute paths to files -- aws/aws-lc-rs#1137

Other Merged PRs

• Add ML-DSA aarch64 native assembly to CC builder scripts by @​jakemas in aws/aws-lc-rs#1113
• Clarify HKDF info concatenation and encoding responsibility by @​justsmth in aws/aws-lc-rs#1145
• CI: support zig cross compile for arm32 by @​justsmth in aws/aws-lc-rs#1124
• fix(clippy): fix truncate warnings by @​justsmth in aws/aws-lc-rs#1126
• ci: replace dtolnay/rust-toolchain with direct rustup invocations by @​justsmth in aws/aws-lc-rs#1133

... (truncated)

Commits

• 741dbf5 Prepare aws-lc-rs v1.17.1 (#1164)
• e6d42b8 Prepare aws-lc-sys v0.42.0 (#1162)
• bd7abf5 Harden GitHub Actions workflows against script injection (#1161)
• 93b0123 Add wasm32-unknown-emscripten build and test support (#1059)
• 7b8a0e7 feat(system-lib): auto-detect system AWS-LC from OPENSSL_* and pkg-config (#1...
• a95c524 Prepare aws-lc-fips-sys v0.13.15 (#1158)
• 00e016a Bump actions/checkout from 6 to 7 (#1157)
• e7568de fix(system-lib): gate system AWS-LC on a declared minimum version (#1152)
• dfe4525 fix(builder): select flag dialect by compiler driver mode, not target ABI (#1...
• 26838da rsa: report specific key rejection for invalid sizes (#1153)
• Additional commits viewable in compare view

Updates bytes from 1.12.0 to 1.12.1

Release notes

Sourced from bytes's releases.

Bytes v1.12.1

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

Changelog

Sourced from bytes's changelog.

1.12.1 (July 8th, 2026)

Fixed

• Properly handle when Box::new panics (#837)

Commits

• 76c0fbb Release bytes v1.12.1 (#838)
• 924c82b Handle unwinding from Box::new (#837)
• See full diff in compare view

Updates clap from 4.6.1 to 4.6.2

Release notes

Sourced from clap's releases.

v4.6.2

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Changelog

Sourced from clap's changelog.

[4.6.2] - 2026-07-15

Fixes

• (help) Say alias when there is only one

Commits

• 0fe0be3 chore: Release
• 480af9d docs: Update changelog
• 2b3ddd0 Merge pull request #6340 from liskin/fix-completion-escape
• 7ffe739 fix(complete): Do not suggest options after "--"
• d47fc4f test(complete): Options suggested after escape (--)
• See full diff in compare view

Updates ryu-js from 1.0.2 to 1.0.3

Release notes

Sourced from ryu-js's releases.

v1.0.3

Breaking Changes

• Minimum rust version has been bumped from 1.64.0 to 1.71.0.

Bug Fixes

• [BUG #56](boa-dev/ryu-js#2): Fix panic in format64_to_fixed when rounding carries past all integer digits. (@​Ansh-699)

Internal Improvements

• [INTERNAL #57](boa-dev/ryu-js#57): Sync upstream/main. (@​jedel1043)
• [INTERNAL #63](boa-dev/ryu-js#63): Make Cursor store unsigned integer len and index. (@​HalidOdat)

New Contributors

• @​Ansh-699 made their first contribution in boa-dev/ryu-js#56

Full Changelog: boa-dev/ryu-js@v1.0.2...v1.0.3

Changelog

Sourced from ryu-js's changelog.

# 1.0.3 (2026-07-05)

Breaking Changes

• Minimum rust version has been bumped from 1.64.0 to 1.71.0.

Bug Fixes

• [BUG #56](boa-dev/ryu-js#2): Fix panic in format64_to_fixed when rounding carries past all integer digits. (@​Ansh-699)

Internal Improvements

• [INTERNAL #57](boa-dev/ryu-js#57): Sync upstream/main. (@​jedel1043)
• [INTERNAL #63](boa-dev/ryu-js#63): Make Cursor store unsigned integer len and index. (@​HalidOdat)

Commits

• f8d6626 Release v1.0.3 (#64)
• 9a936cb Make Cursor store unsigned integer len and index (#63)
• 97e8180 Bump actions/cache from 4 to 6 (#62)
• 4beec89 Fix panic in format64_to_fixed when rounding carries past all integer digits ...
• 03bf0f3 Sync upstream/main (#57)
• See full diff in compare view

Updates time from 0.3.51 to 0.3.53

Release notes

Sourced from time's releases.

v0.3.53

See the changelog for details.

v0.3.52

See the changelog for details.

Changelog

Sourced from time's changelog.

0.3.53 [2026-07-01]

There are no publicly-facing changes in this release. It solely works around the cookie crate relying on an implementation detail of time that was never part of the public API (and thus subject to semver guarantees). The internal API has been reverted to the extent necessary for cookie to compile. This measure is temporary; the internal change will be re-applied in an yet-to-be-determined future release.

0.3.52 [2026-06-30]

Fixed

• Subsecond values in the time! macro are parsed using the textual representation, ensuring accuracy. Previously, they were parsed using the floating point representation, which could result in a loss of precision and even invalid values.
• The date! macro could previously create an invalid value that would then panic at compile time. The macro now emits a proper error instead.
• When parsing an invalid format description, an edge case would inadvertently panic. This now returns an error as intended.

Added

• Support default values when parsing

Commits

• 0ae2f84 v0.3.53 release
• cea8c96 Avoid issue with cookie crate temporarily
• 55e1f2b Require private type to properly seal traits
• 7cf4780 v0.3.52 release
• 0e5b04f Fix trusted publishing workflow
• 6e4140a Support default values when parsing
• 10ac36a Add more doctests to Timestamp
• 6b0d468 Restore lexer depth on the unclosed-bracket error path
• 0abc06d Add trusted publishing
• 43cf0c0 Preferentially group shards by target
• Additional commits viewable in compare view

Updates tokio from 1.52.3 to 1.52.4

Release notes

Sourced from tokio's releases.

Tokio v1.52.4

1.52.4 (July 16th, 2026)

Fixed

• runtime: don't skip the driver when before_park schedules work (#8222)

Fixed (unstable)

• taskdump: remove crate disambiguators from output (#8264)

#8264: tokio-rs/tokio#8264 #8222: tokio-rs/tokio#8222

Commits

• efdba5f chore: prepare Tokio v1.52.4 (#8289)
• b0ba02e Merge 'tokio-1.51.4' into 'tokio-1.52.x' (#8288)
• 7bcd2d3 taskdump: remove crate disambiguators from output (#8288)
• f84b209 chore: prepare Tokio v1.51.4 (#8286)
• eacb98e runtime: don't skip the driver when before_park schedules work (#8222)
• See full diff in compare view

Updates toml from 1.1.2+spec-1.1.0 to 1.1.3+spec-1.1.0

Commits

• eb25160 chore: Release
• f36fb52 docs: Update changelog
• 3adbbb7 fix(writer): Don't overflow (#1189)
• fb0c1b3 fix(writer): Don't overflow
• 5e70a70 test(writer): Add overflow test
• 771a975 chore: Upgrade toml-test (#1186)
• 28f6c9c chore: Upgrade toml-test
• 30d75ca chore(deps): Update Prek to v0.4.9 (#1185)
• 17efe57 chore(deps): Update Rust Stable to v1.97 (#1184)
• c9d0d54 style: Make clippy happy
• Additional commits viewable in compare view

Updates uuid from 1.23.4 to 1.24.0

Release notes

Sourced from uuid's releases.

v1.24.0

What's Changed

• feat(fmt): support encoding into MaybeUninit buffers by @​weifanglab in uuid-rs/uuid#892
• Prepare for 1.24.0 release by @​KodrAus in uuid-rs/uuid#896

New Contributors

• @​weifanglab made their first contribution in uuid-rs/uuid#892

Full Changelog: uuid-rs/uuid@v1.23.5...v1.24.0

v1.23.5

What's Changed

• doc: Fix broken link by @​frostyplanet in uuid-rs/uuid#891
• perf: Optimize UUID hex parsing and formatting by @​geeknoid in uuid-rs/uuid#894
• Prepare for 1.23.5 release by @​KodrAus in uuid-rs/uuid#895

New Contributors

• @​geeknoid made their first contribution in uuid-rs/uuid#894

Full Changelog: uuid-rs/uuid@v1.23.4...v1.23.5

Commits

• 6a8aeab Merge pull request #896 from uuid-rs/cargo/v1.24.0
• e6db8ec prepare for 1.24.0 release
• 606f236 Merge pull request #892 from weifanglab/main
• ab848db feat(fmt): support encoding into MaybeUninit buffers
• 5dc6b3d Merge pull request #895 from uuid-rs/cargo/v1.23.5
• 5a7dfe5 prepare for 1.23.5 release
• 9b4bfc8 Merge pull request #894 from geeknoid/main
• 5acc5a5 perf: Optimize UUID hex parsing and formatting
• 6fa1a1e feat(fmt): support encoding into MaybeUninit buffers
• 1e5d867 Merge pull request #891 from frostyplanet/doc
• Additional commits viewable in compare view

Updates regex from 1.12.4 to 1.13.1

Changelog

Sourced from regex's changelog.

1.13.1 (2026-07-15)

This is a release that fixes a bug where incorrect regex match offsets could be reported. Note that this doesn't impact whether a match occurs or not, just where it occurs. The match offsets are still valid for slicing, they just may not refer to the correct leftmost-first match. See #1364 for (many) more details.

Bug fixes:

• #1354: Fixes previously unsound reverse suffix and inner optimizations.

1.13.0 (2026-07-09)

This release includes a new API, a regex! macro, for lazy compilation of a regex from a string literal. If you use regexes a lot, it's likely you've already written one exactly like it. The new macro can be used like this:

use regex::regex;
fn is_match(line: &str) -> bool {
// The regex will be compiled approximately once and reused automatically.
// This avoids the footgun of using Regex::new here, which would
// guarantee that it would be compiled every time this routine is called.
// This would likely make this routine much slower than it needs to be.
regex!(r"bar|baz").is_match(line)
}
let hay = "
path/to/foo:54:Blue Harvest
path/to/bar:90:Something, Something, Something, Dark Side
path/to/baz:3:It's a Trap!
";
let matches = hay.lines().filter(|line| is_match(line)).count();
assert_eq!(matches, 2);

Improvements:

• #709: Add a new regex! macro for efficient and automatic reuse of a compiled regex.

Commits

• 2b52759 1.13.1, redux
• 40e9823 1.13.1
• 75fcb96 changelog: 1.13.1
• 64ad0b6 automata: fix bug in reverse suffix/inner optimization
• fa91c31 automata: fix a bug caught by Codex review
• 30390ec automata: formatting tweaks
• 821a8eb automata: refactor reverse suffix/inner search slightly
• 10afd70 automata: expose the extracted literals for inner literal extraction
• 8c34f41 automata: avoid reverse suffix optimization for non-leftmost-first
• 5524f02 test: add regression tests for failed reverse suffix/inner optimizations
• Additional commits viewable in compare view

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fe5fae7429

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Add the required DCO sign-off

The root /workspace/registry-stack/AGENTS.md says “Every commit needs a DCO sign-off: git commit -s,” but git log -1 --format=full 27079afe8d79a89f56af87f0cb43d36bf11e0205 has no Signed-off-by: trailer. In repositories that enforce DCO, this commit cannot merge as-is even though the lockfile change is mechanical, so please recreate or amend it with -s.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add security notes for the AWS-LC bump

The root /workspace/registry-stack/AGENTS.md requires explicit review notes for changes to signing or credential issuance; this lockfile line updates aws-lc-rs, which crates/registry-platform-crypto/src/lib.rs uses for RSA signing and crates/registry-notary-server/src/state_plane/sensitive.rs uses for AEAD/HMAC state protection. The commit body only carries Dependabot release notes, so reviewers lack the required repo-specific security note/validation for the affected crypto paths; please add that note before merging.

Useful? React with 👍 / 👎.