deps(deps): bump the tokio-stack group across 1 directory with 6 updates

[dependabot]

Bumps the tokio-stack group with 6 updates in the / directory:

Package	From	To
axum	0.8.8	0.8.9
axum-extra	0.10.3	0.12.6
tokio	1.49.0	1.50.0
tower-http	0.6.8	0.7.0
tokio-stream	0.1.18	0.1.19
axum-test	16.4.1	19.1.0

Updates axum from 0.8.8 to 0.8.9

Release notes

Sourced from axum's releases.

axum-v0.8.9

• added: WebSocketUpgrade::{requested_protocols, set_selected_protocol} for more flexible subprotocol selection (#3597)
• changed: Update minimum rust version to 1.80 (#3620)
• fixed: Set connect endpoint on correct field in MethodRouter (#3656)
• fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3597: tokio-rs/axum#3597 #3620: tokio-rs/axum#3620 #3656: tokio-rs/axum#3656 #3611: tokio-rs/axum#3611

Commits

• c59208c revert axum-core changelog changes
• 99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
• 23d7098 Revert "axum-core 0.5.6"
• e8a39ad axum-macros 0.5.1
• 6e9a249 axum-extra 0.12.6
• 0ec9041 axum 0.8.9
• c3fcebb axum-core 0.5.6
• a8790fc update release notes
• 26ba7bb docs: consolidate state management docs in crate root (#3683)
• 9fc59ef Update to tokio-tungstenite 0.29 (#3689)
• Additional commits viewable in compare view

Updates axum-extra from 0.10.3 to 0.12.6

Release notes

Sourced from axum-extra's releases.

axum-extra-v0.12.6

• fixed: Escape backslashes and double quotes in Content-Disposition filenames to prevent header parameter injection in Attachment and FileStream (#3664)
• vpath! macro now stops the compilation if your path is using deprecated path variables in the old 107 format, such as :var and *var. the only allowed way now is {var}. (#3618)
• fixed: Return specific error message when multipart body limit is exceeded (#3611)

#3664: tokio-rs/axum#3664 #3618: tokio-rs/axum#3618 #3611: tokio-rs/axum#3611

axum-extra v0.12.3

• changed: Make the typed-routing feature enable the routing feature (#3514)
• changed: Add trailing newline to ErasedJson::pretty response bodies (#3526)
• fixed: Fix integer underflow in FileStream::try_range_response for empty files (#3566)

#3514: tokio-rs/axum#3514 #3526: tokio-rs/axum#3526 #3566: tokio-rs/axum#3566

axum-extra v0.12.2

• Make it easier to visually scan for default features (#3550)

#3550: tokio-rs/axum#3550

axum-extra v0.12.0

• breaking: Remove unused async-stream feature, which was accidentally introduced as an implicit feature through an optional dependency which was no longer being used (#3298)
• breaking: option_layer now maps the Response body type to axum::body::Body (#3469)
• breaking: Some new features are added which need to be opted in (#3485).
  • Cached extractor requires cached feature.
  • The handler utilities require handler feature.
  • The middleware utilities require middleware feature.
  • OptionalPath extractor requires optional-path feature.
  • The routing utilities require routing feature.
  • WithRejection extractor requires with-rejection feature.
• breaking: Upgraded prost dependency to v0.14. (#3517)

#3298: tokio-rs/axum#3298 #3469: tokio-rs/axum#3469 #3485: tokio-rs/axum#3485 #3517: tokio-rs/axum#3517

axum-extra v0.11.0

Yanked from crates.io due to unforeseen breaking change, see #3190 for details

---

• breaking: Remove unused async-stream feature, which was accidentally introduced as an implicit feature through an optional dependency which was no

... (truncated)

Commits

• c59208c revert axum-core changelog changes
• 99068f5 Revert "Fix IntoResponse for tuples overriding error response codes (#3603)"
• 23d7098 Revert "axum-core 0.5.6"
• e8a39ad axum-macros 0.5.1
• 6e9a249 axum-extra 0.12.6
• 0ec9041 axum 0.8.9
• c3fcebb axum-core 0.5.6
• a8790fc update release notes
• 26ba7bb docs: consolidate state management docs in crate root (#3683)
• 9fc59ef Update to tokio-tungstenite 0.29 (#3689)
• Additional commits viewable in compare view

Updates tokio from 1.49.0 to 1.50.0

Release notes

Sourced from tokio's releases.

Tokio v1.50.0

1.50.0 (Mar 3rd, 2026)

Added

• net: add TcpStream::set_zero_linger (#7837)
• rt: add is_rt_shutdown_err (#7771)

Changed

• io: add optimizer hint that memchr returns in-bounds pointer (#7792)
• io: implement vectored writes for write_buf (#7871)
• runtime: panic when event_interval is set to 0 (#7838)
• runtime: shorten default thread name to fit in Linux limit (#7880)
• signal: remember the result of SetConsoleCtrlHandler (#7833)
• signal: specialize windows Registry (#7885)

Fixed

• io: always cleanup AsyncFd registration list on deregister (#7773)
• macros: remove (most) local use declarations in tokio::select! (#7929)
• net: fix GET_BUF_SIZE constant for target_os = "android" (#7889)
• runtime: avoid redundant unpark in current_thread scheduler (#7834)
• runtime: don't park in current_thread if before_park defers waker (#7835)
• io: fix write readiness on ESP32 on short writes (#7872)
• runtime: wake deferred tasks before entering block_in_place (#7879)
• sync: drop rx waker when oneshot receiver is dropped (#7886)
• runtime: fix double increment of num_idle_threads on shutdown (#7910, #7918, #7922)

Unstable

• fs: check for io-uring opcode support (#7815)
• runtime: avoid lock acquisition after uring init (#7850)

Documented

• docs: update outdated unstable features section (#7839)
• io: clarify the behavior of AsyncWriteExt::shutdown() (#7908)
• io: explain how to flush stdout/stderr (#7904)
• io: fix incorrect and confusing AsyncWrite documentation (#7875)
• rt: clarify the documentation of Runtime::spawn (#7803)
• rt: fix missing quotation in docs (#7925)
• runtime: correct the default thread name in docs (#7896)
• runtime: fix event_interval doc (#7932)
• sync: clarify RwLock fairness documentation (#7919)
• sync: clarify that recv returns None once closed and no more messages (#7920)
• task: clarify when to use spawn_blocking vs dedicated threads (#7923)
• task: doc that task drops before JoinHandle completion (#7825)
• signal: guarantee that listeners never return None (#7869)
• task: fix task module feature flags in docs (#7891)

... (truncated)

Commits

• 0273e45 chore: prepare Tokio v1.50.0 (#7934)
• e3ee4e5 chore: prepare tokio-macros v2.6.1 (#7943)
• 8c980ea io: add write_all_vectored to tokio-util (#7768)
• e35fd6d ci: fix patch during clippy step (#7935)
• 03fe44c runtime: fix event_interval doc (#7932)
• d18e5df io: fix race in Mock::poll_write (#7882)
• f21f269 runtime: fix race condition during the blocking pool shutdown (#7922)
• d81e8f0 macros: remove (most) local use declarations in tokio::select! (#7929)
• 25e7f26 rt: fix missing quotation in docs (#7925)
• e1a91ef util: fix typo in docs (#7926)
• Additional commits viewable in compare view

Updates tower-http from 0.6.8 to 0.7.0

Release notes

Sourced from tower-http's releases.

tower-http-0.7.0

Changes since 0.6.11

Added

• csrf: add cross-site request forgery (CSRF) protection middleware, porting the cross-origin protection scheme introduced in Go 1.25 (#699)

  use tower::ServiceBuilder;
  use tower_http::csrf::CsrfLayer;
  // Rejects cross-origin state-changing requests using Sec-Fetch-Site,
  // an Origin allow-list, and an Origin/Host fallback. No per-request
  // token state required.
  let layer = CsrfLayer::new().add_trusted_origin("https://example.com")?;
  let service = ServiceBuilder::new().layer(layer).service_fn(handler);

• timeout: add DeadlineBody for non-resetting body timeouts, applied via the new RequestBodyDeadlineLayer and ResponseBodyDeadlineLayer (#688)

  Unlike TimeoutBody, which resets its deadline on every frame, DeadlineBody caps the total time of a body transfer. A slow client trickling one byte at a time never trips an idle timeout but will trip a deadline.

  use std::time::Duration;
  use tower::ServiceBuilder;
  use tower_http::timeout::RequestBodyDeadlineLayer;
  // Abort the request body transfer after 30s total, regardless of how
  // frequently data arrives.
  let service = ServiceBuilder::new()
  .layer(RequestBodyDeadlineLayer::new(Duration::from_secs(30)))
  .service_fn(handler);

• fs: add strong ETag support to ServeDir, including If-Match and If-None-Match precondition handling per RFC 9110. 304 Not Modified responses now carry the ETag and Last-Modified validators (#691)

• fs: add a Backend trait to make ServeDir work with non-filesystem sources (e.g. embedded assets or object storage). The default TokioBackend preserves existing behavior. Use ServeDir::with_backend() to plug in custom implementations (#684)

  use tower_http::services::fs::ServeDir;
  // MyBackend implements tower_http::services::fs::Backend.
  // The default ServeDir::new() continues to use TokioBackend (local FS).
  let service = ServeDir::with_backend("assets", MyBackend::new());

• fs: add html_as_default_extension option to ServeDir, appending .html when the request path has no extension (#519)

• fs: add redirect_path_prefix option to ServeDir, prepending a prefix on trailing-slash redirects so the service can be mounted under a sub-path (#486)

• validate-request: add ValidateRequestHeaderLayer::has_header_value() to reject requests when a header does not have an expected value (#360)

• body: UnsyncBoxBody::new() constructor and From<ServeFileSystemResponseBody> conversion to avoid double-boxing when combining ServeDir responses with other body types (#537)

• limit: implement Default for limit::ResponseBody when the wrapped body also implements Default (#679)

Changed

... (truncated)

Commits

• b194fcf v0.7.0
• af828a6 feat(follow_redirect)!: preserve request extensions across redirects (#706)
• 8cb8d99 feat(ValidateRequestHeaderLayer): add has_header("...").with_value("...") fun...
• 3b56d2d feat!: Add configurable Backend trait for ServeDir, bump MSRV 1.65 (#684)
• 8508716 Add redirect_path_prefix option (#486)
• 56327b2 Add Windows drive-prefix path regression test (#705)
• 54c6db8 feat(compression)!: upgrade SizeAbove threshold from u16 to u64 (#704)
• 68cd6d8 Add DeadlineBody for non-resetting body timeouts (#688)
• fa8a98c feat(fs): add strong ETag support to ServeDir (#691)
• 36d2205 fix: Make SetMultiple*Header Clone for !Clone http bodies (#703)
• Additional commits viewable in compare view

Updates tokio-stream from 0.1.18 to 0.1.19

Commits

• bc0933c chore: prepare tokio-stream v0.1.19 (#8310)
• e3786d0 readme: remove obsolete TokioConf notices (#8311)
• f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
• 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
• ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
• 75fef53 chore: prepare Tokio v1.53.1 (#8303)
• ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
• eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
• 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
• a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
• Additional commits viewable in compare view

Updates axum-test from 16.4.1 to 19.1.0

Release notes

Sourced from axum-test's releases.

19.1.0

• Remove TestServer::scheme, as it never actually worked with http requests only mocked requests.
• Remove TestRequest::scheme, as it never actually worked with http requests only mocked requests.
• Mocked transport no longer provides the scheme and authority to the service, which matches the behaviour with Tokio / Hyper based services.
• Mocked now provides the HOST header, which matches the behaviour with Hyper based HTTP services.

19.0.0

• Simplified constructors for TestServer, TestServerBuilder, and TestServerConfig.
  • new() constructor no longer returns a Result, and instead panics on failure.
  • Added try_new() to allow people to continue to catch the Result if needed.
• TestResponse assertion functions now return &self, allowing calls to be chained!
• Requests using Reqwest will now share cookies with regular Axum Test requests.
  • Cookies saved by one are saved to the other, and both adhere to TestServer::save_cookies() and TestServer::do_not_save_cookies() commands.
• Improved error messages across the API.
  • JSON and Yaml assertions now output the body of the request when they fail.
• Removed deprecated feature old-json-diff.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.