Update all patch updates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
pyroscope (source)	workspace.dependencies	patch	2.0.1 → 2.0.4
reqwest	workspace.dependencies	patch	0.13.2 → 0.13.3
tokio (source)	workspace.dependencies	patch	1.52.1 → 1.52.3

---

Release Notes

grafana/pyroscope-rs (pyroscope)

v2.0.4

Bug Fixes

• do not recreate profiling guard, just reset the data (#​518) (b1fe114)
• remove kindasafe CI leftovers (#​521) (f8bc0f3)

Miscellaneous Chores

• deps: bump openssl from 0.10.79 to 0.10.80 (#​548) (f3ed911)
• deps: lock file maintenance (#​535) (9554564)
• deps: lock file maintenance (#​541) (3abc7b6)
• deps: lock file maintenance (#​547) (cd30ebf)
• deps: pin rust docker tag to a9cfb75 (#​544) (ea14091)
• deps: remove names crate dependency (#​527) (5893aac)
• deps: update rust crate libc to v0.2.186 (#​533) (a7468c1)
• deps: update rust crate reqwest to v0.13.3 (#​539) (b8c6fbb)
• deps: update rust:trixie docker digest to a9cfb75 (#​538) (bff1d5d)
• renovate: vulnerabilities-only with profiling deps allowlist (#​540) (4aa8e56)

Continuous Integration

• add ARM cross-compilation test job (#​536) (54bb03f)
• auto-publish to crates.io after release-please PR merge (#​529) (a4f76b6)
• Potential fix for code scanning alert no. 14: Workflow does not contain permissions (#​542) (51ac4b7)

v2.0.3

Bug Fixes

• epoll: use libc::c_long for itimerspec fields (#​532) (093406e)

Miscellaneous Chores

• deps: update googleapis/release-please-action action to v5 (#​530) (6c97b9d)

v2.0.2

Miscellaneous Chores

• deps: bump rustls-webpki from 0.103.12 to 0.103.13 (#​524) (935384d)
• deps: lock file maintenance (#​522) (4bd95bb)
• deps: update dependency ruby to v4.0.3 (#​523) (e126aa2)
• deps: update rust:trixie docker digest to e4f09e8 (#​515) (f450327)

seanmonstar/reqwest (reqwest)

v0.13.3

Compare Source

• Fix CertificateRevocationList parsing of PEM values.
• Fix logging in resolver to only show host, not full URL.
• Fix hickory-dns to fallback to a default if /etc/resolv.conf fails.
• Fix HTTP/3 to handle STOP_SENDING as not an error.
• Fix HTTP/3 pool to remove timed out QUIC connections.
• Fix HTTP/3 connection establishment picking IPv4 and IPv6.
• Upgrade rustls-platform-verifier.
• (wasm) Only use wasm-bindgen on unknown-* targets.

tokio-rs/tokio (tokio)

v1.52.3: Tokio v1.52.3

Compare Source

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#​8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#​8075)
• sync: require that an RwLock has max_readers != 0 (#​8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#​8074)

v1.52.2: Tokio v1.52.2

Compare Source

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#​7431), due to its performance impact. (#​8100)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.