[dependabot]

Bumps the patch-and-minor group with 7 updates in the / directory:

Package	From	To
rmcp	3.1.4	3.5.1
serialport	4.10.0	4.10.1
tokio	1.53.1	1.53.2
thiserror	2.0.20	2.0.21
uuid	1.26.0	1.27.0
toml	1.1.4+spec-1.1.0	1.1.6+spec-1.1.0
arbitrary	1.4.2	1.5.0

Updates rmcp from 3.1.4 to 3.5.1

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.5.1

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.1

Fixed

• (server) keep discover lifecycle bootstrap-neutral (#1248)
• keep handler-generated invalid params errors in-band (#1322)
• (model) export object! macro without macros feature (#1318)
• (server) default missing cache hints for 2026-07-28 peers (#1308)

Other

• [rmcp] Notify credential stores when a refresh token is rejected (#1285)

rmcp-macros-v3.5.0

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.5.0

Added

• update LATEST and add LATEST_WITH_INITIALIZE (#1105)

Fixed

• (model) decode float fields through serde_json::Number (#1300)
• (rmcp) reject duplicate sep-2243 headers (#1274)
• (transport) match explicit default ports in Origin allowlist (#1270)
• (rmcp) tolerate empty cacheScope instead of silently dropping the whole result (#1281)
• (model) preserve explicit null structuredContent in CallToolResult (#1295)

Other

• cargo fmt fixes on validate_standard_headers changes (#1275)

rmcp-macros-v3.4.1

Fixed

• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

rmcp-v3.4.1

Fixed

• (transport) fall back after JSON discover rejections (#1288)
• (macros) accept const paths and concat! in tool/prompt descriptions (#1243)

... (truncated)

Commits

• 79437f2 chore: release v3.5.1 (#1307)
• 4a226c7 fix(server): keep discover lifecycle bootstrap-neutral (#1248)
• 931d471 chore(deps): bump the github-actions group with 6 updates (#1313)
• cf1e9aa fix: keep handler-generated invalid params errors in-band (#1322)
• deef9bb fix(model): export object! macro without macros feature (#1318)
• c0d667e fix(server): default missing cache hints for 2026-07-28 peers (#1308)
• 94c5c03 fix: use MSRV-aware dependency resolver (#1316)
• 8f9a28e fix(examples): fix complex auth server discovery (#1309)
• ae2f9c9 [rmcp] Notify credential stores when a refresh token is rejected (#1285)
• bdd93dc ci: reject multi-line codex auth secret (#1306)
• Additional commits viewable in compare view

Updates serialport from 4.10.0 to 4.10.1

Changelog

Sourced from serialport's changelog.

[4.10.1] - 2026-09-08

Fixed

• Fix builds for Linux/PowerPC which got broken with [4.10.0]. #375 #376

Commits

• 41496a9 Release 4.10.1
• eb51adc Bump CI checkout to v7
• 3607b1b Add changelog for fixing builds for Linux/PowerPC
• ac4aa90 Add CI builds for Linux/PowerPC 64 bit
• 3a924c8 Fix compilation on PPC
• 53ac54b Clean up spacing around Illumos MSRV CI check
• 036562b Enable semver checks for Illumos in CI
• 44d0809 Bump version after release
• See full diff in compare view

Updates tokio from 1.53.1 to 1.53.2

Release notes

Sourced from tokio's releases.

Tokio v1.53.2

1.53.2 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• process: unregister Windows wait before closing child handle (#8564)
• rt: drop blocking pool mutex before shutting down rejected task (#8562)
• sync: fix mpsc index wraparound in block reclamation (#8546)
• sync: forget mpsc Permit before sending value (#8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#8548)
• sync: wake broadcast Sender::closed outside mutex (#8558)
• task: drop replaced waker outside lock in JoinSet (#8554)
• time: drop timer lock before dropping waker in clear_entry (#8552)
• time: expire timers directly on shutdown without rotating wheel (#8570)

Fixed (unstable)

• fs: clamp io_uring read length to u32::MAX (#8572)
• rt: ignore current_thread task dumps from other runtimes (#8544)
• rt: preserve io_uring context if a completion waker panics (#8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#8542)
• taskdump: restore deferred leaf wakes during capture (#8445)
• time: drop stored waker when cancelling alt timer entry (#8550)

#8445: tokio-rs/tokio#8445 #8572: tokio-rs/tokio#8572 #8540: tokio-rs/tokio#8540 #8542: tokio-rs/tokio#8542 #8544: tokio-rs/tokio#8544 #8546: tokio-rs/tokio#8546 #8548: tokio-rs/tokio#8548 #8550: tokio-rs/tokio#8550 #8552: tokio-rs/tokio#8552 #8554: tokio-rs/tokio#8554 #8558: tokio-rs/tokio#8558 #8560: tokio-rs/tokio#8560 #8562: tokio-rs/tokio#8562 #8564: tokio-rs/tokio#8564 #8566: tokio-rs/tokio#8566 #8570: tokio-rs/tokio#8570 #8574: tokio-rs/tokio#8574

Commits

• ff0c406 chore: prepare Tokio v1.53.2 (#8580)
• a762700 Merge 'tokio-1.51.5' into 'tokio-1.53.x' (#8577)
• ec31a9f chore: prepare Tokio v1.51.5 (#8579)
• 625c851 sync: assign semaphore permits before emitting tracing event (#8542)
• 832dd23 sync: avoid leaking semaphore permits on tracing panic (#8542)
• 826954a sync: unlink semaphore waiter before emitting tracing event (#8542)
• 9a47992 process: unregister Windows wait before closing child handle (#8564)
• 2fc5972 fs: handle integer overflow in buffered relative seek (#8574)
• 85a6d13 io: revert "always cleanup AsyncFd registration list on deregister" (#8540)
• 436faa2 rt: drop blocking pool mutex before shutting down rejected task (#8562)
• Additional commits viewable in compare view

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates uuid from 1.26.0 to 1.27.0

Release notes

Sourced from uuid's releases.

v1.27.0

What's Changed

• Accept case-insensitive urn:uuid: prefixes when parsing by @​jaideeppyne in uuid-rs/uuid#912
• Fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos by @​KodrAus in uuid-rs/uuid#915
• Prepare for 1.27.0 release by @​KodrAus in uuid-rs/uuid#917

New Contributors

• @​jaideeppyne made their first contribution in uuid-rs/uuid#912

Full Changelog: uuid-rs/uuid@v1.26.1...v1.27.0

v1.26.1

What's Changed

• Seat the v7 counter below the version nibble by @​lenamonj in uuid-rs/uuid#907
• Don't panic in overflowing Timestamp to SystemTime conversion by @​KodrAus in uuid-rs/uuid#909
• Prepare for 1.26.1 release by @​KodrAus in uuid-rs/uuid#910

New Contributors

• @​lenamonj made their first contribution in uuid-rs/uuid#907

Full Changelog: uuid-rs/uuid@v1.26.0...v1.26.1

Commits

• b62154e Merge pull request #917 from uuid-rs/cargo/v1.27.0
• ffd8ec5 prepare for 1.27.0 release
• 4b6c10f Merge pull request #915 from uuid-rs/fix/v7-ordering
• a1aa126 Merge pull request #912 from jaideeppyne/fix/urn-prefix-case-insensitive
• 4639d67 fix ordering of V7 UUIDs created by earlier seconds with later subsec nanos
• 2723703 bump MSRV to 1.89.0
• a3e64fa refactor: simplify URN prefix parsing
• 5055fd4 refactor: inline case-insensitive URN prefix checks
• cb8b1d5 refactor: simplify case-insensitive URN parsing
• 285967d Accept case-insensitive urn:uuid: prefixes when parsing
• Additional commits viewable in compare view

Updates toml from 1.1.4+spec-1.1.0 to 1.1.6+spec-1.1.0

Commits

• 572c005 chore: Release
• 66d0c53 docs: Update changelog
• 07af4e7 perf: Reduce allocations in toml_edit parsing and dumping (#1215)
• 0ff90db perf(display): Write encoded strings directly
• efb2536 perf(display): Move generated representation strings
• 075c444 refactor(display): Consolidate key-path encoding
• b48f338 perf(display): Borrow table keys during document output
• c6c1de3 perf(parser): Move completed table header keys
• ec90463 perf(parser): Borrow input when creating editable documents
• d76a48a test: Benchmark rendering generated keys and values
• Additional commits viewable in compare view

Updates arbitrary from 1.4.2 to 1.5.0

Changelog

Sourced from arbitrary's changelog.

1.5.0

Released 2026-10-05.

Added

• Added support for deriving Arbitrary for types with raw identifiers.

Changed

• Updated derive_arbitrary to syn 3. This raises the MSRV from 1.63.0 to 1.71.0, which is the MSRV of syn 3.

Fixed

• Fixed soundness when generating arrays.
• Fixed nonzero integer generation to always produce a nonzero value.
• Updated derive_arbitrary to include fixes for fully qualified paths.

---

Commits

• 9807b59 Merge pull request #243 from fitzgen/bump-to-1.5.0
• 7a49e61 Bump to version 1.5.0
• aa2802b Merge pull request #242 from drakeo338/claude/241-fix
• a9f7ca5 Update derive_arbitrary to syn 3 and raise MSRV to 1.71
• cd35bd2 Merge pull request #239 from Manishearth/fix-soundness
• 53a651d agent-driven: Fix soundness in try_create_array
• df8afe9 Merge pull request #238 from baloo/baloo/push-lopsmyosqnpv
• 15f5c08 Bring fix for fully qualified path
• 341a8fd Merge pull request #237 from ngildenhuys/downgrading_msrv_deps
• 9b68ef4 ci: adding update commands to downgrade dependencies to fix MSRV test
• Additional commits viewable in compare view

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.

[qarnet]

Integrated latest main (5fe6492) in 4770656, resolving Cargo.lock conflicts by retaining the newer rmcp/rmcp-macros 3.5.1 and uuid 1.27.0 versions while preserving main security fixes. Follow-up 0b63e11 aligns the modern resource-error contract with rmcp 3.5.1.

The remaining failure after integrating main was the old expectation that a valid modern resources/read request for a missing URI returns HTTP 400/direct JSON. Upstream rust-sdk #1322 deliberately corrected that mapping to an in-band application error. Returning an unrecognized HTTP 400 can trigger false legacy fallback. The updated test still asserts exact -32602, request ID, requested URI, and configured SSE content type. Missing protocol metadata/header failures retain HTTP 400; removed RPC methods retain HTTP 404/-32601; legacy resource errors retain HTTP 200/-32002.

Added typed_2026_07_28_resource_error_keeps_client_modern_and_usable: after a missing-resource JSON-RPC error, the same client successfully lists tools, retains modern cache hints, and remains negotiated at 2026-07-28. The manifest now requires at least rmcp 3.5.1 to prevent resolving the old HTTP mapping.

Sources:

• fix: keep handler-generated invalid params errors in-band modelcontextprotocol/rust-sdk#1322
• https://modelcontextprotocol.io/specification/2026-07-28/server/resources#error-handling
• https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http

Local verification passed: format, locked all-target build, full Rust tests, Clippy with warnings denied, rustdoc with warnings denied, full MCP compatibility runner, 100-cycle public-boundary PTY gate, and Linux x86_64 nix flake check. Compatibility runner kept all four existing expected failures unchanged. Historical rmcp client, npm validation pins/security fixes, and production source are unchanged relative to main.

Dependabot closed and deleted this branch while the work was underway and opened #91. This branch has been restored and PR reopened; #91 remains untouched. Work used an isolated worktree, preserving unrelated local documentation edits.

Documentation hygiene

• Mode: incremental
• Default branch: main
• Audit base: 5fe64926
• Audited revision: 0b63e11e
• Files audited: 4
• Excluded: 2
• Clean: 4
• Rewritten: 0
• Moved: 0
• Deleted: 0
• Contributor docs changed: 2
• ADRs added/superseded: 0/0
• Lifecycle: no plans or evidence removed; contract and upstream sources retained in docs/reference/mcp-version-compatibility-policy.md; no preservation blockers.
• Behavior changes: rmcp dependency update intentionally corrects modern application-error HTTP mapping; protocol error payload, transport validation, and legacy behavior retained.
• Verification: all local gates above passed, including RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --locked; isolated worktree clean.

Important findings

• docs/reference/mcp-version-compatibility-policy.md: separates application errors from malformed protocol requests, citing upstream correction and published specification.
• tests/protocol_compatibility.rs: old blanket HTTP 400 expectation replaced with exact in-band contract and typed-client recovery proof.

[qarnet]

CI passed on 0b63e11: all four platform build/test/Clippy jobs, required Linux PTY checks, Nix flake check, and the full MCP conformance/Inspector gate. CodeQL also passed. Main is integrated, historical compatibility assets remain unchanged, and no PR merge was performed.