chore(deps): bump the cargo group across 1 directory with 4 updates

[dependabot]

Bumps the cargo group with 4 updates in the /apps/ingest directory: opentelemetry_sdk, quinn-proto, rand and rustls-webpki.

Updates opentelemetry_sdk from 0.31.0 to 0.32.1

Changelog

Sourced from opentelemetry_sdk's changelog.

Release Notes 0.32

OpenTelemetry Rust 0.32 continues to drive the Logs, Metrics, and Distributed Tracing components forward. The Logs and Metrics API and SDK remain stable, with no breaking changes in this release. The OTLP Exporters and the Distributed Tracing API/SDK remain in pre-stable states (Release-Candidate and Beta respectively), and this release introduces a small number of intentional breaking changes in those areas to prepare them for stabilization.

For detailed changelogs of individual crates, please refer to their respective changelog files. This document serves as a summary of the main changes.

Key Changes

Metrics SDK

1. Bound instruments (experimental): Added Counter::bind() and Histogram::bind() returning pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups on the hot path. Benchmarks show ~28x speedup for counter operations and ~9x for histograms. Gated behind the experimental_metrics_bound_instruments feature flag.

2. Delta collection efficiency: Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted.

3. Stable Aggregation API: Aggregation and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.

Logs

1. Tracing-span attribute enrichment (experimental): The opentelemetry-appender-tracing crate can now copy attributes from active tracing spans onto each emitted log record. ("Span" here refers to tracing::span!, not an opentelemetry::trace::Span.) Enrichment is disabled by default with zero per-span overhead, and is gated behind the new experimental_span_attributes cargo feature.

2. spec_unstable_logs_enabled removed: The capability (and the backing specification) is now stable and is enabled by default. The feature flag has been removed.

Distributed Tracing (Beta)

The Distributed Tracing API and SDK remain in beta. This release contains intentional breaking changes to clean up the public surface ahead of

... (truncated)

Commits

• 74cb6f3 chore: Release opentelemetry-semantic-conventions 0.32.1 (#3562)
• 10dde18 chore(sdk): add missing changelog entry (#3550)
• ec2da12 refactor: leverage static str key when possible (#3529)
• 90a39a0 feat(api): accept quoted-key fields in otel logging macros (#3567)
• 8c922bc feat(appender-tracing): add builder support for custom instrumentation scope ...
• fb2af9d feat(metrics): add BoundUpDownCounter under experimental_metrics_bound_instru...
• 1b3846c feat(metrics): add BoundGauge under experimental_metrics_bound_instruments (#...
• ee359db fix: remove reqwest-rustls-webpki-roots (#3524)
• 4d4fd4d chore: Bump semantic-conventions to v1.42.0 (#3561)
• 69213f2 fix(prometheus-exporter): Concatenate metric attributes with Scope during col...
• Additional commits viewable in compare view

Updates quinn-proto from 0.11.13 to 0.11.17

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.17

This release fixes three remote memory exhaustion issues. See GHSA-qfwj-vfxf-92j2, GHSA-2hv7-gw8g-gpq5, and GHSA-hmxj-32vh-65vr for more details, and quinn-rs/quinn#2789 for the fixes.

What's Changed

• fix(ci): fix clippy lints by @​LesnyRumcajs in quinn-rs/quinn#2752
• congestion: saturate CUBIC window increment to avoid overflow by @​LesnyRumcajs in quinn-rs/quinn#2751
• 0.11.x: Backport memory use fixes and prepare release by @​Ralith in quinn-rs/quinn#2790

Full Changelog: quinn-rs/quinn@quinn-proto-0.11.16...quinn-proto-0.11.17

quinn-proto-0.11.16

What's Changed

• 0.11.x: upgrade dependencies by @​djc in quinn-rs/quinn#2707

quinn-proto 0.11.15, quinn 0.11.11

This release fixes a remote memory exhaustion issue in the quinn-proto Assembler. See GHSA-4w2j-m93h-cj5j for more details and #2694 for the fix.

Two sponsoring organizations participated in coordinated disclosure. If this is relevant to your organization, please contact us to keep support Quinn maintenance.

What's Changed

• Prepare 0.11.x branch for release by @​djc in quinn-rs/quinn#2645
• Backport of #2495 to 0.11.x by @​stablebits in quinn-rs/quinn#2674
• 0.11.x backport | quinn-proto: drop Initials silently when saturated by @​stablebits in quinn-rs/quinn#2688
• Backport #2677 to 0.11.x by @​syszery in quinn-rs/quinn#2690
• congestion: avoid double-reducing CUBIC fast convergence (0.11.x) by @​0xdeafbeef in quinn-rs/quinn#2641
• proto: yield error on too many gaps in assembler by @​djc in quinn-rs/quinn#2694

quinn-proto 0.11.14

@​jxs reported a denial of service issue in quinn-proto 5 days ago:

• GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

• Fix over-permissive proto dependency edge by @​Ralith in quinn-rs/quinn#2385
• 0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @​djc in quinn-rs/quinn#2559

Commits

• 0343120 proto: bump version to 0.11.17
• d7bf3d0 Limit total memory used to buffer outgoing datagrams
• 31ca5d2 Limit total memory used to buffer incoming datagrams
• 3a78b60 Factor out DatagramBuffer for queues in either direction
• b37ced3 proto: check limits when processing already retired CIDs
• 6a984b8 proto: extract method for checking CID retirements
• 499dba8 proto: bound assembler chunk count regardless of over-allocation
• 33ce0c2 congestion: saturate CUBIC window increment to avoid overflow
• c8ad7e6 fix(ci): fix clippy lints
• a96949f Take semver-compatible update for anyhow
• Additional commits viewable in compare view

Updates rand from 0.9.2 to 0.9.5

Changelog

Sourced from rand's changelog.

[0.9.5] — 2026-07-02

Fixes

• Fix possible memory safety violation due to deserialization of UniformChar from bad source (#1803)

#1803: rust-random/rand#1803

[0.9.4] — 2026-04-13

Fixes

• Fix doc build (#1766)

#1766: rust-random/rand#1766

[0.9.3] — 2026-04-11

This release back-ports a fix from v0.10. See also #1763.

Changes

• Deprecate feature log (#1764)
• Replace usages of doc_auto_cfg (#1764)

#1763: rust-random/rand#1763

Commits

• 3474ec0 rand v0.9.5: backport #1790 (#1803)
• ba4c4c6 Prepare v0.9.4: fix doc build (#1766)
• 4b8b686 Document new error-handling behaviour for ReseedingRng
• 6c25c6d Prepare v0.9.4: fix doc build
• 1aeee9f Prepare v0.9.3: deprecate feature log (#1764)
• 98473ee Prepare rand 0.9.2 (#1648)
• 031a1f5 examples/print-next.rs (#1647)
• 6cb75ee Make UniformUsize serializable (#1646)
• 0c955c5 Add some tests for BlockRng, BlockRng64 and Xoshiro RNGs (#1639)
• 204084a Fix: Remove accidental editor swap file (#1636)
• Additional commits viewable in compare view

Updates rustls-webpki from 0.103.9 to 0.103.15

Release notes

Sourced from rustls-webpki's releases.

v/0.103.15

Fixes docs.rs build errors.

What's Changed

• Cargo: avoid all-features in docs.rs by @​cpu in rustls/webpki#530

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.14..v/0.103.15

v/0.103.14

What's Changed

• [0.103] Support stable ML-DSA by @​djc in rustls/webpki#523
• [0.103] Mark ML-DSA algorithms as FIPS submitted by @​djc in rustls/webpki#525

Full Changelog: rustls/webpki@v/0.103.13...v/0.103.14

0.103.13

• Fix reachable panic in parsing a CRL. This was reported to us as GHSA-82j2-j2ch-gfr8. Users who don't use CRLs are not affected.
• For name constraints on URI names, we incorrectly processed excluded subtrees in a way which inverted the desired meaning. See rustls/webpki#471. This was a case missing in the fix for GHSA-965h-392x-2mh5.

What's Changed

• Actually fail closed for URI matching against excluded subtrees by @​djc in rustls/webpki#473
• Prepare 0.103.13 by @​ctz in rustls/webpki#474

Full Changelog: rustls/webpki@v/0.103.12...v/0.103.13

0.103.12

This release fixes two bugs in name constraint enforcement:

• GHSA-965h-392x-2mh5: name constraints for URI names were ignored and therefore accepted. URI name constraints are now rejected unconditionally. Note this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.
• GHSA-xgp8-3hg3-c2mh: permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name. This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint. This is very similar to CVE-2025-61727.

Since name constraints are restrictions on otherwise properly-issued certificates, these bugs are reachable only after signature verification and require misissuance to exploit.

What's Changed

• Prepare 0.103.12 by @​djc in rustls/webpki#470

Full Changelog: rustls/webpki@v/0.103.11...v/0.103.12

0.103.11

In response to #464, we've slightly relaxed requirements for anchor_from_trust_cert() to ignore unknown extensions even if they're marked as critical. This only affects parsing a TrustAnchor from DER, for which most extensions are ignored anyway.

What's Changed

• Backport parsing trust anchors with unknown critical extensions to 0.103 by @​djc in rustls/webpki#466

0.103.10

... (truncated)

Commits

• c14836d Cargo: version 0.103.14 -> 0.103.15
• 5c92308 Cargo: avoid all-features in docs.rs
• 10a1514 Mark ML-DSA algorithms as FIPS submitted
• 14cbaa1 Bump version to 0.103.14
• cbb868a Support stable ML-DSA with aws-lc-rs
• c782fd1 Update to aws-lc-rs 1.18
• b250e31 Upgrade to base64 0.23
• 99115b2 ci: sync cargo-check-external-types nightly
• a82bfae crl: fix clippy::question_mark finding
• 2879b2c Prepare 0.103.13
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: c0f6288a-2054-459a-b897-737fb4520679

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}