chore(deps)(deps): Bump the prod group across 1 directory with 6 updates

[dependabot]

Bumps the prod group with 6 updates in the / directory:

Package	From	To
clap	4.6.3	4.6.5
toml	1.1.3+spec-1.1.0	1.1.4+spec-1.1.0
http	1.4.2	1.5.0
schemars	1.2.1	1.2.2
rmcp	2.2.0	3.1.0
jsonschema	0.48.1	0.49.2

Updates clap from 4.6.3 to 4.6.5

Release notes

Sourced from clap's releases.

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Changelog

Sourced from clap's changelog.

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Commits

• c8c9355 chore: Release
• af74def docs: Update changelog
• c96f222 Merge pull request #6368 from truffle-dev/fix/fish-env-escaping
• 49a05cd fix(complete): Two-pass quote fish env-completer
• e791004 test(complete): Snapshot fish env quoting cases
• 87ec1ad chore: Release
• 78f2529 docs: Update changelog
• b61f270 Merge pull request #6369 from Metbcy/fix/zsh-completion-ordering
• 74c6666 fix(complete): Keep zsh candidate order
• d142d8f Merge pull request #6360 from epage/string
• Additional commits viewable in compare view

Updates toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0

Commits

• beee9fe chore: Release
• 16e2ac1 docs: Update changelog
• 89f5541 fix(toml): preserve datetimes when deserializing Value (#1194)
• 534039c fix(serde): Deserialize Value datetimes into typed targets
• 6e45cef test(serde): Reproduce Value datetime deserialization error
• 4ec099f chore: Release
• 5a47a51 docs: Update changelog
• da0911f perf(parser): Reduce over allocation by better tokens/byte ratio (#1193)
• 26eb157 perf(parser): Reduce over allocation by better tokens/byte ratio
• ca4c7bf chore(deps): Update Prek to v0.4.11 (#1191)
• Additional commits viewable in compare view

Updates http from 1.4.2 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

• feat(method): add QUERY method by @​seanmonstar in hyperium/http#798
• fix(uri): allow empty paths in uri::Builder by @​seanmonstar in hyperium/http#853
• perf(header,uri): faster value validation, URI parse/format, map inserts by @​geeknoid in hyperium/http#852
• fix(uri): enforce max length in PathAndQuery by @​seanmonstar in hyperium/http#856

New Contributors

• @​geeknoid made their first contribution in hyperium/http#852

Full Changelog: hyperium/http@v1.4.2...v1.5.0

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

Commits

• 16fc9a7 v1.5.0
• e559023 fix(uri): enforce max length in PathAndQuery (#856)
• 2178e17 perf(header,uri): faster value validation, URI parse/format, map inserts (#852)
• 03c8cd7 fix(uri): allow empty paths in uri::Builder (#853)
• bb8705b feat(method): add QUERY method (#798)
• See full diff in compare view

Updates schemars from 1.2.1 to 1.2.2

Release notes

Sourced from schemars's releases.

v1.2.2

• Update to syn 3 in schemars_derive

Changelog

Sourced from schemars's changelog.

[1.2.2] - 2026-07-27

• Update to syn 3 in schemars_derive

Commits

• ed61863 v1.2.2
• ae618c3 Update syn to v3 (#528)
• c072ea0 docs: add missing attributes to table of contents (#517)
• 015272f Clippy fix (#512)
• 944f727 Bump bytes from 1.10.1 to 1.11.1 (#507)
• See full diff in compare view

Updates rmcp from 2.2.0 to 3.1.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.1.0

Added

• add strict stateless protocol metadata validation (#1091)

Other

• document the ping utility with examples (#1106)
• complete Tier 1 feature docs and finalize roadmap (#1101)
• (conformance) meeting requirements for tier 1 (#1087)

rmcp-v3.1.0

Added

• classify authorization-required errors (#1056)
• add strict stateless protocol metadata validation (#1091)
• SEP-2260 stream-based enforcement of client receive-side request association (#1055)

Fixed

• (model) decode metadata-bearing input-required results affecting mrtr (#1097)
• require metadata for modern HTTP requests (#1089)
• honor supported_protocol_versions when negotiating initialize (#1093)

Other

• document the ping utility with examples (#1106)
• complete Tier 1 feature docs and finalize roadmap (#1101)
• (conformance) meeting requirements for tier 1 (#1087)

rmcp-macros-v3.0.1

Other

• release stable 3.0.0

rmcp-v3.0.1

Fixed

• (auth) use discovered resource for token refresh (#1084)
• return header mismatch for missing protocol header (#1083)
• negotiate stateless initialize versions (#1080)
• stamp server info on graceful subscription results (#1078)

rmcp-macros-v3.0.0

Other

• release stable 3.0.0

rmcp-v3.0.0

RMCP 3.0 adds support for MCP 2026-07-28. Review the protocol key changes and the RMCP 3.0 migration guide before upgrading from 2.x.

... (truncated)

Commits

• 1f9358e chore: release v3.1.0 (#1090)
• 1cf6deb docs: document the ping utility with examples (#1106)
• 00bcf13 fix(model): decode metadata-bearing input-required results affecting mrtr (#1...
• 65f05e9 feat: classify authorization-required errors (#1056)
• 3240b6e docs: complete Tier 1 feature docs and finalize roadmap (#1101)
• def31f0 chore(deps): bump github/codeql-action from 4 to 4.37.3 (#1100)
• 570c478 chore(deps): bump taiki-e/install-action from 2 to 2.85.2 (#1099)
• 983a137 feat: add strict stateless protocol metadata validation (#1091)
• 58b136f fix: require metadata for modern HTTP requests (#1089)
• d272389 fix: honor supported_protocol_versions when negotiating initialize (#1093)
• Additional commits viewable in compare view

Updates jsonschema from 0.48.1 to 0.49.2

Release notes

Sourced from jsonschema's releases.

[Python] Release 0.49.2

Fixed

• Canonical numeric bounds no float can hold are exposed as decimal.Decimal instead of a rounded, wider bound.

Performance

• Faster serialization of canonicalized schemas.
• Up to 70x faster canonicalize for multipleOf beside numeric bounds far from zero.

[Rust] Release 0.49.2

Performance

• Faster serialization of canonicalized schemas.
• Faster macro code generation for subschemas with many keywords.
• Up to 70x faster canonicalization of multipleOf beside numeric bounds far from zero.

[Python] Release 0.49.1

Fixed

• canonicalize rejecting pattern_options (it should take the same regex configuration as validators).

[Ruby] Release 0.49.1

Fixed

• JSONSchema.canonicalize rejecting pattern_options (it should take the same regex configuration as validators).
• InvalidPattern failures raising the base CanonicalizationError (they should raise JSONSchema::Canonical::InvalidPattern).

[Rust] Release 0.49.1

Fixed

• jsonschema-value: Ruby builds on x64-mingw-ucrt.

[Python] Release 0.49.0

Added

• Validation of recursive Python objects. #945
• EXPERIMENTAL: Schema canonicalization via jsonschema::canonicalize. It reduces a reasonable subset of JSON Schemas to their normal forms.

Fixed

• multipleOf incorrectly accepted integers past u64 that are not multiples of the divisor.
• list subclasses incorrectly rejected as unsupported types.
• Segmentation fault on enum members whose value resolves back to the member.

Performance

• Up to 5x faster validation by working on Python objects directly instead of converting them to serde_json. #239
• Up to 2x faster meta.is_valid / meta.validate by working on Python objects directly instead of converting them to serde_json.

... (truncated)

Changelog

Sourced from jsonschema's changelog.

[0.49.2] - 2026-07-28

Performance

• Faster serialization of canonicalized schemas.
• Faster macro code generation for subschemas with many keywords.
• Up to 70x faster canonicalization of multipleOf beside numeric bounds far from zero.

[0.49.1] - 2026-07-25

Fixed

• jsonschema-value: Ruby builds on x64-mingw-ucrt.

[0.49.0] - 2026-07-25

Added

• Generic JSON input: options_for builds a validator over any instance representation implementing json::Json, so instances validate without conversion to serde_json::Value. #239
• meta::validate_for and meta::is_valid_for for checking a schema document held in any representation implementing json::Json against its meta-schema.
• EXPERIMENTAL: Schema canonicalization via jsonschema::canonicalize. It reduces a reasonable subset of JSON Schemas to their normal forms.

Fixed

• multipleOf incorrectly accepted integers past u64 that are not multiples of the divisor.

[0.48.5] - 2026-07-22

Fixed

• Packaging issue again.

[0.48.4] - 2026-07-22

Fixed

• Packaging issue.

[0.48.3] - 2026-07-22

Changed

• INTERNAL. Extract common JSON Schema semantic into a separate jsonschema-value crate.

Performance

• Avoid map lookups in some properties validators.
• Faster validation of {"type": "array", "items": {...}} schemas.

[0.48.2] - 2026-07-21

... (truncated)

Commits

• 3fe5c3b chore(ruby): Release 0.49.2
• c9ef386 chore(python): Release 0.49.2
• d85e5f2 chore(rust): Release 0.49.2
• f9040ec perf: Up to 70x faster canonicalization of multipleOf beside numeric bounds...
• 21a3272 perf: Use arbitrary-precision for canonicalization benchmarks
• 9cdec99 perf: Faster macro code generation for subschemas with many keywords
• fad0015 perf: Tune codegen benchmarks
• 8d23dd2 perf: Faster serialization of canonicalized schemas
• bfe9ece perf: Extend benchmarks
• 80a0d91 perf: Tune canonicalization benchmarks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cursor]

PR Summary

Medium Risk
The rmcp major upgrade touches MCP client, OAuth, and HTTP transport paths used by trg mcp; regression risk is moderate without a broad code diff. jsonschema and minor CLI/HTTP bumps are lower risk.

Overview
Bumps production dependencies in crates/trg and refreshes Cargo.lock. There are no application source changes—only version pins and transitive resolution.

rmcp moves from 2.2.0 → 3.1.0 (major), including MCP 2026-07-28 support, stricter HTTP/metadata handling, and auth/protocol negotiation fixes. trg uses this for MCP proxy transports, OAuth (AuthorizationManager, credential storage), and JSON-RPC bridging—so behavior may shift even if the public CLI surface is unchanged.

jsonschema goes 0.48 → 0.49 for optional schema-validation and dev tests that validate embedded agent-skill JSON schemas.

Minor bumps: clap 4.6.3→4.6.5, toml 1.1.3→1.1.4, http 1.4.2→1.5.0, schemars 1.2.1→1.2.2. Lockfile also picks up related transitives (e.g. base64 0.23 for rmcp, syn 3 for some derive crates).

^{Reviewed by Cursor Bugbot for commit 48dd2b4. Bugbot is set up for automated code reviews on this repo. Configure here.}