[dependabot]

Bumps the patch-and-minor group with 5 updates:

Package	From	To
rmcp	3.1.4	3.5.0
serialport	4.10.0	4.10.1
thiserror	2.0.20	2.0.21
uuid	1.26.0	1.26.1
toml	1.1.4+spec-1.1.0	1.1.6+spec-1.1.0

Updates rmcp from 3.1.4 to 3.5.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.5.0

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.0

Added

• update LATEST and add LATEST_WITH_INITIALIZE (#1105)

Fixed

• (model) decode float fields through serde_json::Number (#1300)
• (rmcp) reject duplicate sep-2243 headers (#1274)
• (transport) match explicit default ports in Origin allowlist (#1270)
• (rmcp) tolerate empty cacheScope instead of silently dropping the whole result (#1281)
• (model) preserve explicit null structuredContent in CallToolResult (#1295)

Other

• cargo fmt fixes on validate_standard_headers changes (#1275)

rmcp-macros-v3.4.1

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.4.1

Fixed

• (transport) fall back after JSON discover rejections (#1288)
• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

Other

• (deps) update rstest requirement from 0.26.1 to 0.27.0 (#1276)

rmcp-macros-v3.4.0

Added

• (model) add ServerConfig and ClientConfig (#1266)

Fixed

• (model) deprecate ServerInfo and ClientInfo aliases (#1156)

rmcp-v3.4.0

Added

• (model) add ServerConfig and ClientConfig (#1266)

... (truncated)

Commits

• 0cde3c5 chore: release v3.5.0 (#1296)
• e02efbf fix(model): decode float fields through serde_json::Number (#1300)
• 972af86 feat: update LATEST and add LATEST_WITH_INITIALIZE (#1105)
• 6e47ca3 chore(deps): bump the github-actions group with 2 updates (#1297)
• 6255c37 chore: reduce dependency update noise (#1293)
• 22ef52a fix(rmcp): reject duplicate sep-2243 headers (#1274)
• 26f3b2e fix(transport): match explicit default ports in Origin allowlist (#1270)
• 6677eee style: cargo fmt fixes on validate_standard_headers changes (#1275)
• fbed447 fix(rmcp): tolerate empty cacheScope instead of silently dropping the whole r...
• 90516bf fix(model): preserve explicit null structuredContent in CallToolResult (#1295)
• Additional commits viewable in compare view

Updates serialport from 4.10.0 to 4.10.1

Changelog

Sourced from serialport's changelog.

[4.10.1] - 2026-09-08

Fixed

• Fix builds for Linux/PowerPC which got broken with [4.10.0]. #375 #376

Commits

• 41496a9 Release 4.10.1
• eb51adc Bump CI checkout to v7
• 3607b1b Add changelog for fixing builds for Linux/PowerPC
• ac4aa90 Add CI builds for Linux/PowerPC 64 bit
• 3a924c8 Fix compilation on PPC
• 53ac54b Clean up spacing around Illumos MSRV CI check
• 036562b Enable semver checks for Illumos in CI
• 44d0809 Bump version after release
• See full diff in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates uuid from 1.26.0 to 1.26.1

Release notes

Sourced from uuid's releases.

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

Commits

• 9f92712 Merge pull request #910 from uuid-rs/cargo/v1.26.1
• d4df8f0 prepare for 1.26.1 release
• 5613f23 Merge pull request #909 from uuid-rs/fix/ts-conversion-overflow
• fda00eb don't panic in overflowing Timestamp to SystemTime conversion
• c82e88c Merge pull request #907 from lenamonj/v7-counter-placement
• ac065a6 Align the counter diagram
• 34ec102 Seat the v7 counter below the version nibble
• See full diff in compare view

Updates toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits

• 572c005 chore: Release
• 66d0c53 docs: Update changelog
• 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
• 0ff90db perf(display): Write encoded strings directly
• efb2536 perf(display): Move generated representation strings
• 075c444 refactor(display): Consolidate key-path encoding
• b48f338 perf(display): Borrow table keys during document output
• c6c1de3 perf(parser): Move completed table header keys
• ec90463 perf(parser): Borrow input when creating editable documents
• d76a48a test: Benchmark rendering generated keys and values
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[qarnet]

Fixes pushed in 8b72936, with latest main integrated in 3ad273a. This includes the merged dirs 7, jsonschema 0.58.6, and action updates.

The rmcp 3.5 migration now uses ServerConfig/ClientConfig, explicitly selects 2025-11-25 for initialized test clients, and preserves modern initialize rejection as HTTP 404 / JSON-RPC -32601 without allocating a session. The HTTP regression also verifies that legacy initialize/ping still works on the same server.

Security patches update active npm validation-tool transitives and root-lockfile rustls to 0.23.45. The direct Inspector/conformance pins and the entire historical rmcp-1-client fixture remain unchanged. npm audit reports zero vulnerabilities. Old alert dismissals now have path/feature evidence comments; vulnerable active dependencies remain open until fixes reach main.

Local verification after integrating main passed: format, locked all-target build, full Rust tests, Clippy with warnings denied, rustdoc with warnings denied, the full shared MCP compatibility gate, the 100-cycle public-boundary PTY gate, and nix flake check on Linux x86_64. The four existing fixture-dependent conformance expected failures remain unchanged. GitHub CI is running on 3ad273a.

Dependabot closed this PR and deleted its branch while the fix was underway. The branch has been restored and this PR reopened as requested. Replacement #90 remains untouched and includes additional updates, so it is not completely superseded by this fix.

Documentation hygiene

• Mode: incremental
• Default branch: main
• Audit base: c5e785cc
• Audited revision: 3ad273ae
• Files audited: 16
• Excluded: 3
• Clean: 14
• Rewritten: 2
• Moved: 0
• Deleted: 0
• Contributor docs changed: 2
• ADRs added/superseded: 1/0
• Lifecycle: no scaffolding removed; compatibility evidence retained in compat/README.md and routing decision retained as a Proposed ADR; no preservation blockers.
• Behavior changes: none from documentation hygiene; runtime compatibility and security fixes are the separately requested work.
• Verification: local gates listed above passed, including RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --locked; working tree clean.

Important findings

• compat/README.md: added a security-alert triage rule distinguishing vulnerable-path evidence from blanket compatibility-directory exemptions.
• docs/adr/preserve-policy-owned-http-lifecycle-routing.md: retains rationale for preserving stateless routing without duplicating SDK parsing; approval remains pending PR review.

[qarnet]

CI passed on 3ad273a: all four platform build/test/Clippy jobs, required Linux PTY checks, Nix flake check, and MCP conformance/Inspector smoke. CodeQL checks also passed. No PR merge performed.