[daniel-mader]

Follow-ups from a dependency audit (cargo audit, cargo outdated, cargo deny).

Changes

• Declare required tokio features. tokio::spawn needs rt and #[tokio::test] needs macros. Until now both were enabled only transitively through mongodb and cqrs-es. The library now declares rt, and the dev-dependencies declare macros + rt.
• Bump GitHub Actions to their latest versions:
  • actions/checkout v4 → v7 (in all workflows)
  • codecov/codecov-action v3 → v7
  • supercharge/mongodb-github-action 1.12.0 → 1.12.1
• Audit workflow: install a prebuilt cargo-audit with taiki-e/install-action instead of compiling it with cargo install on every run.
• Clippy: remove redundant borrows in two debug! calls (clippy::useless_borrows_in_formatting, new in Rust 1.99). This lint also fails on main with the current stable toolchain.

Audit results

• cargo audit on a stale local lockfile reported 8 advisories (rustls, rustls-webpki, webpki-roots, crossbeam-epoch, h2). Every patched version is semver-compatible, and Cargo.lock is gitignored, so CI and downstream users already resolve to the fixed versions. No manifest change was needed.
• Licenses: all permissive. Bans and sources: clean. No unused dependencies.

Notes

• The codecov-action inputs in use (token, files, fail_ci_if_error) are unchanged in v7. Since v4, uploads require a token, which we already pass. Uploads from fork PRs may need tokenless uploads enabled in the Codecov organisation settings.
• Tested locally: cargo fmt --check, cargo clippy --all-targets --all-features -D warnings, and cargo test (16 tests) against a local MongoDB replica set all pass.

🤖 Generated with Claude Code