chore(deps): weekly safe cargo updates · 4 packages

[mendral-app]

Packages bumped

Package	Old	New	Published
axum	0.8.8	0.8.9	2026-04-14
chrono	0.4.44	0.4.45	2026-06-04
rand	0.10.0	0.10.1	2026-04-11
reqwest	0.13.2	0.13.4	2026-05-25

Per-package changelog details

axum 0.8.8 → 0.8.9

• Added WebSocket subprotocol methods
• Fixed connect endpoint routing bug in MethodRouter
• Improved multipart body limit error message
• MSRV bumped to 1.80 (we use 1.93.1 — no impact)

chrono 0.4.44 → 0.4.45

• Fixed timezone offset hour validation (reject invalid hour 24)
• Fixed tzdata location resolution on Android
• Impact: We don't use FixedOffset or Android — no impact.

rand 0.10.0 → 0.10.1

• Fixed a soundness bug
• Added #[track_caller] to relevant functions
• Deprecated the log feature (we don't use it)
• Impact: We use rand::rng().random() only — no impact from deprecation. Soundness fix is beneficial.

reqwest 0.13.2 → 0.13.4

• Added tls_sslkeylogfile(), http2_keep_alive_* options
• Added TLS 1.3 support with native-tls backend
• Fixed redirect handling to strip sensitive headers on scheme changes (security improvement)
• Fixed CRL PEM parsing, HTTP/3 connection handling, resolver fallback
• Impact: We use reqwest with json feature for API calls — no breaking changes. Security fix is beneficial.

Files modified

• Cargo.toml
• Cargo.lock

Skipped this ecosystem

Package	Current	Latest	Reason
ammonia	4.1.2	4.1.3	Cooldown (published 2026-06-30, 6 days ago)
rand	0.10.1	0.10.2	Cooldown (published 2026-07-02, 4 days ago)
http	1.4.0	1.4.2	Open PR #29
jsonwebtoken	10.3.0	10.4.0	Open PR #29
serde_json	1.0.149	1.0.150	Open PR #29
tokio	1.49.0	1.52.3	Open PR #29
tracing-subscriber	0.3.22	0.3.23	Open PR #29
uuid	1.21.0	1.23.x	Open PR #29
octocrab	0.49.5	0.53.1	Open PR #28
askama_escape	0.15.4	0.16.0	Open PR #24
hmac	0.12.1	0.13.0	Breaking (0.x minor bump) — separate PR needed
sha2	0.10.9	0.11.0	Breaking (0.x minor bump) — separate PR needed
mockall	0.14.0	0.15.0	Cooldown (published 2026-06-28, 8 days) + Breaking — needs investigation
rustls	0.23.37	0.24.0-dev.0	Pre-release/dev version

---

Note

Created by Mendral. Tag @mendral-app with feedback or questions.

• View implementation session

[cloudflare-workers-and-pages]

Deploying pratrol with    Cloudflare Pages

Latest commit:	31c7a98
Status:	✅  Deploy successful!
Preview URL:	https://ad227abc.pratrol.pages.dev
Branch Preview URL:	https://mendral-deps-weekly-safe-car-uw57.pratrol.pages.dev

View logs