[gilesknap]

This bumps rustls in bundler/Cargo.lock (cargo update -p rustls --precise 0.23.46), which closes 4 of the 5 open Dependabot alerts. It is lockfile-only: Cargo.toml is unchanged.

Changes

• rustls 0.23.40 → 0.23.46, rustls-webpki 0.103.13 → 0.103.16

Checked
cargo fetch --locked, cargo fmt --check, and every dependency compiles. The bundler crate itself and the tests need a database for the sqlx macros (no .sqlx cache is committed), so CI is the real check for those. They fail the same way on main here.

Not fixed

• opentelemetry_sdk (1): the fix is 0.32.1 against the declared 0.23, a breaking 0.x bump across the whole otel stack. The open Dependabot PRs chore(deps): bump tracing-opentelemetry from 0.24.0 to 0.33.0 in /bundler in the opentelemetry group across 1 directory #311, chore(deps): bump opentelemetry-semantic-conventions from 0.15.0 to 0.32.0 in /bundler #315, chore(deps): bump opentelemetry from 0.23.0 to 0.32.0 in /bundler #316, chore(deps): bump opentelemetry_sdk from 0.23.0 to 0.32.1 in /bundler #320 and chore(deps): bump opentelemetry-otlp from 0.16.0 to 0.32.0 in /bundler #321 probably need to land together.

Happy for you to close this if you'd rather handle it via Renovate/Dependabot.

Prepared with Claude Code for @gilesknap; reviewed before opening.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uybqz7SRaVuiGbQ8Kv6ZHL