chore(deps): update cargo dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
bytes	dependencies	patch	1.11 → 1.11.1
chrono	dev-dependencies	patch	0.4.42 → 0.4.45
criterion (source)	dev-dependencies	patch	=0.8.1 → =0.8.2
futures (source)	dependencies	patch	0.3 → 0.3.32
http	dependencies	patch	1.4 → 1.4.2
httparse	dependencies	patch	1.10 → 1.10.1
interprocess	dependencies	patch	2.4 → 2.4.2
libc	dependencies	patch	0.2 → 0.2.186
parking_lot	dependencies	patch	0.12 → 0.12.5
path-tree	dependencies	patch	0.8 → 0.8.3
pin-project-lite	dependencies	patch	0.2 → 0.2.17
rand (source)	dependencies	patch	0.10 → 0.10.1
serde (source)	dependencies	patch	1.0 → 1.0.228
serde_json	dependencies	patch	1.0 → 1.0.150
thiserror	dependencies	patch	2.0 → 2.0.18
tokio (source)	dependencies	patch	1.49.0 → 1.52.3
tokio-stream (source)	dependencies	patch	0.1 → 0.1.18
tokio-util (source)	dependencies	patch	0.7 → 0.7.18
toml	dependencies	patch	0.9 → 0.9.12
tracing (source)	dependencies	patch	0.1 → 0.1.44
tracing-subscriber (source)	dev-dependencies	patch	0.3.22 → 0.3.23
url	dependencies	patch	2.5 → 2.5.8
widestring	dependencies	patch	1.2 → 1.2.1

---

Release Notes

chronotope/chrono (chrono)

v0.4.45: 0.4.45

Compare Source

What's Changed

• fix(tz): reject TZ offset hour of 24 to avoid FixedOffset overflow by @​SAY-5 in #​1787
• tz_data: fix tzdata locations on Android by @​caruschalalamove in #​1789

criterion-rs/criterion.rs (criterion)

v0.8.2

Compare Source

Fixed

• don't build alloca on unsupported targets

Other

• (deps) bump crate-ci/typos from 1.40.0 to 1.43.0
• Fix panic with uniform iteration durations in benchmarks
• Update Readme
• Exclude development scripts from published package

hyperium/http (http)

v1.4.2

Compare Source

• Fix uri::Builder to allow "*" as the path when scheme and authority are also set, used in HTTP/2 requests.
• Fix Uri to properly reject DEL characters.

v1.4.1

Compare Source

• Fix PathAndQuery::from_static() and from_shared() to reject inputs that do not start with /.
• Fix Extend for HeaderMap to clamp max size hint and not overflow.
• Fix header::IntoIter that could use-after-free if the generic value type could panic on drop.
• Fix header::{IterMut, ValuesIterMut} to not violate stacked borrows.

rust-lang/libc (libc)

v0.2.186

Compare Source

Added

• Apple: Add KEVENT_FLAG_* constants (#​5070)
• Linux: Add PR_SET_MEMORY_MERGE and PR_GET_MEMORY_MERGE (#​5060)

Changed

• CI: Migrate FreeBSD CI from Cirrus CI to GitHub Actions (#​5058)

serde-rs/json (serde_json)

v1.0.150

Compare Source

• Reject non-string enum object keys (#​1324, thanks @​puneetdixit200)

tokio-rs/tokio (tokio)

v1.52.3: Tokio v1.52.3

Compare Source

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#​8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#​8075)
• sync: require that an RwLock has max_readers != 0 (#​8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#​8074)

v1.52.2: Tokio v1.52.2

Compare Source

1.52.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#​7431), due to its performance impact. (#​8100)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.