From eac2d586993572908f195249e1e56e30bbc8f5f4 Mon Sep 17 00:00:00 2001
From: Derek <derek@hyperi.io>
Date: Tue, 6 Oct 2026 14:02:26 +1100
Subject: [PATCH 1/2] fix: move to scalo 2.14.0 and turn PGO and BOLT on for GA

scalo 2.14.0 writes no vendor, licence, copyright or group prefix of its own, so the app names them. The OCI labels carry the HyperI vendor, the io.hyperi namespace, BUSL-1.1 and the copyright line, as before.

Derived consumer groups keep their dfe- prefix through KafkaSource::with_group_prefix. The integration tests pinning dfe-transform-vector-syslog and dfe-transform-vector-syslog-enriched fail on 2.14.0 without it and pass with it.

PGO and BOLT are back on: build.skip_optimize is gone.

config/defaults.yaml gives generate-artefacts the ArgoCD repo URL and the dfe namespace. The hand-fixed chart Deployment takes the generator's checksum/secret annotation and its projected service-account volume with token automount off. The Dockerfile header and config schema are regenerated.

ci.yml passes optimize-tier through on dispatch, as the other apps do. The osv-scanner reason names the real blocker and the live scalo-rs tracker.

RESEARCH.md goes, with its two links: it described an internal architecture this repo no longer has. DESIGN.md stops promising a dlq config the app never had, and the README secret-marker row says how the marker gets onto a field. The 25 markdownlint warnings left in DESIGN.md, MIGRATION.md, README.md and SECURITY.md are cleared.
---
 .github/workflows/ci.yml        |   6 +
 .hyperi-ci.yaml                 |  16 +-
 Cargo.lock                      |   4 +-
 Cargo.toml                      |   7 +-
 Dockerfile                      |   2 +-
 README.md                       |   5 +-
 RESEARCH.md                     | 564 --------------------------------
 SECURITY.md                     |   5 +-
 chart/templates/deployment.yaml |  18 +
 chart/values.yaml               |   9 +-
 config/defaults.yaml            |  13 +
 docs/DESIGN.md                  |  34 +-
 docs/MIGRATION.md               |   3 +
 docs/architecture.md            |   7 +-
 docs/config-schema.json         |   1 +
 docs/config-schema.yaml         |   1 +
 src/config/loader.rs            |   6 +-
 src/deployment.rs               |   5 +
 18 files changed, 99 insertions(+), 607 deletions(-)
 delete mode 100644 RESEARCH.md
 create mode 100644 config/defaults.yaml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a90b826..4690fda 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,6 +42,11 @@ on:
         required: false
         default: ""
         description: "'true' to consent, for this run only, to shipping a skipped-optimisation build under a release tag."
+      optimize-tier:
+        type: string
+        required: false
+        default: ""
+        description: "'release' to build the release optimisation tier on a run that publishes nothing (Rust: PGO + BOLT)."
 
 permissions:
   contents: write
@@ -59,4 +64,5 @@ jobs:
       bump: ${{ inputs.bump || 'auto' }}
       skip-optimize: ${{ inputs.skip-optimize || '' }}
       release-unoptimized: ${{ inputs.release-unoptimized || '' }}
+      optimize-tier: ${{ inputs.optimize-tier || '' }}
     secrets: inherit
diff --git a/.hyperi-ci.yaml b/.hyperi-ci.yaml
index 573eafa..042883b 100644
--- a/.hyperi-ci.yaml
+++ b/.hyperi-ci.yaml
@@ -15,12 +15,14 @@ quality:
   ignore:
     # GHSA-w9wp-h8wv-79jx / CVE-2026-48504: opentelemetry_sdk 0.31.0 reaches the
     # lock only through scalo. The flaw is in BaggagePropagator's header parsing,
-    # and neither this repo nor scalo installs a text map propagator, so it is
-    # never called. scalo holds 0.31 until metrics-exporter-opentelemetry
-    # supports 0.32 (dfe-infra docs/THREAT-MODEL.md).
+    # and neither this repo nor scalo registers a Baggage or other text map
+    # propagator, so it is never called. Recorded as not reachable in the DFE
+    # threat model (dfe-infra docs/THREAT-MODEL.md, accepted risks). scalo holds
+    # 0.31 because metrics-exporter-opentelemetry 0.2.1 requires opentelemetry
+    # ^0.31; tracked in hyperi-io/scalo-rs#281.
     - tool: osv-scanner
       id: GHSA-w9wp-h8wv-79jx
-      reason: "CVE-2026-48504, opentelemetry_sdk 0.31.0 via scalo: BaggagePropagator::extract_with_context is unreachable (no text map propagator, no baggage in dfe-transform-vector or scalo). Drop when scalo allows opentelemetry_sdk >= 0.32.1."
+      reason: "CVE-2026-48504, opentelemetry_sdk 0.31.0 via scalo: unreachable, no Baggage propagator registered in dfe-transform-vector or scalo. Not reachable per dfe-infra docs/THREAT-MODEL.md accepted risks. Blocked on metrics-exporter-opentelemetry 0.2.1 requiring opentelemetry ^0.31; tracked in hyperi-io/scalo-rs#281."
 
 # Testing
 test:
@@ -35,12 +37,6 @@ test:
 # Building
 build:
   enabled: true
-  # PGO and BOLT are off for the rc.14 workstream: each adds 30-60 min per arch
-  # and the workstream needs fast turnaround on everything else first. Tier 1
-  # (allocator + LTO) still applies. Turning this back off is the LAST rc.14
-  # task. A STABLE release meanwhile needs `release-unoptimized: true` at
-  # dispatch; a prerelease (rc) is never refused.
-  skip_optimize: true
   type: app
   strategies:
     - native
diff --git a/Cargo.lock b/Cargo.lock
index 45ef59d..25042d4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3106,9 +3106,9 @@ dependencies = [
 
 [[package]]
 name = "scalo"
-version = "2.13.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cce445668f2f9ca2d64ec96f3b16aa901ceba43560a6753b3babed02295aa1ba"
+checksum = "a91fbe77be949c3d85576653573a6bf8c0320afcbdc222c4167ff54a9a4f40e4"
 dependencies = [
  "backon",
  "bytes",
diff --git a/Cargo.toml b/Cargo.toml
index b78d7e2..c954cc1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -62,7 +62,10 @@ tokio-util = { version = ">=0.7.19, <0.8", features = ["rt"] }
 # `transport-kafka` carries `KafkaConfig`, the security floor `Config::validate`
 # holds the generated Kafka source and sink to. Only its config is used: the
 # image ships no librdkafka, so nothing here may build an rdkafka client.
-scalo = { version = ">=2.13.0, <3", features = [
+#
+# The floor is the first release whose contract carries no vendor defaults, so
+# the app names its own.
+scalo = { version = "2.14.0", features = [
     "cli-service",
     "config-reload",
     "config-schema",
@@ -139,7 +142,7 @@ tar = ">=0.4.46, <0.5"
 chrono = ">=0.4.45, <0.5"
 testcontainers = ">=0.27.3, <0.28"
 testcontainers-modules = { version = ">=0.15, <0.16", features = ["kafka"] }
-scalo = { version = ">=2.13.0, <3", features = [
+scalo = { version = "2.14.0", features = [
     "transport-kafka",
 ] }
 # A stand-in Vector source for the bridge tests; scalo already builds this tonic.
diff --git a/Dockerfile b/Dockerfile
index 79f2c2e..da3ec8c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -9,7 +9,7 @@
 # Generated by scalo::deployment::generate_dockerfile()
 # Schema version: 3
 # Source contract: dfe-transform-vector::deployment::contract()
-# Regenerate with: `dfe-transform-vector emit-dockerfile > Dockerfile`
+# Regenerate by calling scalo::deployment::generate_dockerfile() on that contract.
 
 FROM debian:trixie-slim@sha256:a99cfc517144bc59b1978475ec53b46ecabec7e43635402ee5b77cc54cd1b20a
 
diff --git a/README.md b/README.md
index 1fbe994..4468372 100644
--- a/README.md
+++ b/README.md
@@ -126,10 +126,12 @@ Key environment variable overrides (prefix `DFE_TRANSFORM_`):
 ### Hot-reload
 
 **Hot-reloaded (takes effect via SIGHUP to Vector):**
+
 - Transform YAML file contents (modified/added/removed in watched directory)
 - `transforms.dir` / `transforms.files` path changes
 
 **Requires pod restart:**
+
 - `source.*` -- the consumer or the Push listener is established at startup
 - `sink.*` -- the producer or the Push client is established at startup
 - `bridge.*` -- the two supervisor-to-Vector legs bind at startup
@@ -235,7 +237,6 @@ points at it.
 - [docs/DESIGN.md](https://github.com/hyperi-io/dfe-transform-vector/blob/main/docs/DESIGN.md) -- Full architecture and design
 - [docs/MIGRATION.md](https://github.com/hyperi-io/dfe-transform-vector/blob/main/docs/MIGRATION.md) -- Migration from official Vector chart
 - [docs/LIBRDKAFKA.md](https://github.com/hyperi-io/dfe-transform-vector/blob/main/docs/LIBRDKAFKA.md) -- Kafka tuning reference
-- [RESEARCH.md](https://github.com/hyperi-io/dfe-transform-vector/blob/main/RESEARCH.md) -- Research findings and option analysis
 
 ## License
 
@@ -320,7 +321,7 @@ What green does NOT mean:
 | Set `enable.auto.commit: false` here, as the shared DFE consumer baseline does | Leave auto-commit on | Vector's kafka source only stores offsets and leaves librdkafka's commit timer to flush them, and that timer is armed only when auto-commit is on. Consumer lag sat at 72 across a quiet 90-second window while the app's own metrics said it had processed those same 72 events |
 | Read `/readyz` as "carrying traffic" | Read it as "the child was alive 500ms after spawn" | It once answered an unconditional 200 because nothing published a readiness signal, so Vector could crash and restart hundreds of times with the pod still Ready and zero restarts |
 | Swap the reload poller for inotify | Keep polling | S3-backed mounts -- s3fs, goofys, Mountpoint for S3 -- generate no filesystem notification events, so inotify works on every laptop and silently stops reloading in production |
-| Rename a credential field, or add one whose leaf name is not `password`, `secret`, `token`, `api_key`, `private_key` or `passphrase` | Add the `x-dfe-secret` marker to the schema first | This repo ships no `x-dfe-secret` marker anywhere. The only thing redacting the SASL password over dfe-engine's API is its leaf-name fallback in `appmgmt/contract.py`, so a rename outside that set returns an operator's Kafka password in the clear. The sibling dfe-transform-vrl marked its Kafka passwords already |
+| Add or rename a credential field without a schema marker | Schema it as `scalo::SensitiveString` with `#[schemars(with = ...)]`, as `SaslConfig::password` is | That puts `x-scalo-secret` and `writeOnly` on the field in the emitted config-schema, which is what tells a console to mask it. Without it, only dfe-engine's leaf-name fallback (`password`, `secret`, `token`, `api_key`, `private_key`, `passphrase`) redacts it, so a name outside that set returns an operator's Kafka password in the clear |
 
 ### Where this sits
 
diff --git a/RESEARCH.md b/RESEARCH.md
deleted file mode 100644
index 1fa6856..0000000
--- a/RESEARCH.md
+++ /dev/null
@@ -1,564 +0,0 @@
-# DFE Transform Vector — Research & Architecture Discussion
-
-## Problem Statement
-
-We need to orchestrate **Kafka → Vector transforms → Kafka** pipelines deployed as K8s pods. Each deployment has:
-
-- A **pre-defined Kafka source** (labelled, YAML)
-- A **pre-defined Kafka sink** (labelled, YAML)
-- **N user-supplied Vector YAML files** in between (98% transforms, occasionally extra sources/sinks)
-
-The wiring, credentials, scaling, and lifecycle must be abstracted behind "big dials" — high-level configuration knobs that hide infrastructure complexity.
-
----
-
-## Current Architecture (dfe-core)
-
-### How it works today
-
-dfe-core uses a **GitOps + Helm + Artifactory** approach:
-
-1. **ArgoCD ApplicationSets** with matrix generators deploy N pipelines across M clusters from a single declarative config
-2. **Official Vector Helm chart** (timberio/vector v0.42.1) deployed as StatefulSet
-3. **Vector configs fetched dynamically** at pod init via init container from Artifactory (zip archive)
-4. **Secrets** (Kafka SASL, ClickHouse creds, Artifactory creds) managed through AWS Secrets Manager → ExternalSecrets → K8s Secrets → env vars, 15-minute refresh
-5. **KEDA autoscaling** based on Kafka consumer lag
-6. **Multi-source Helm values**: common values from dfe-core + tenant-specific values from pipelines repo + kustomize patches for secrets
-
-### Config fetching workflow (init container)
-```bash
-curl -u ${ARTIFACTORY_USERNAME}:${ARTIFACTORY_PASSWORD} \
-  -L -o /tmp/download.zip \
-  ${ARTIFACTORY_VECTOR_TEMPLATES}/vector-artifacts/artifacts-${VERSION}.zip
-unzip /tmp/download.zip -d /etc/vector_config
-```
-
-### Key infrastructure
-- Dedicated Karpenter node pools (ARM64 c8gn compute-optimized for pipelines, r7g memory-optimized for receiver)
-- Persistent storage (20Gi for pipelines, 128Gi for receiver)
-- Separate Vector Receiver (NLB-exposed, mTLS + token auth) from Vector Pipelines (internal transform layer)
-
-### Strengths
-- Battle-tested GitOps pattern, well-understood by infra team
-- ArgoCD handles multi-tenant, multi-cluster deployment
-- Secrets rotation is automatic
-- KEDA scaling works well with Kafka lag
-
-### Weaknesses
-- **No config validation before deployment** — bad YAML goes live and crashes the pod
-- **Opaque config assembly** — zip from Artifactory means no visibility into what Vector will actually run
-- **No composition guarantees** — nothing validates that the source label matches transform inputs or that the sink inputs are wired correctly
-- **Upgrade friction** — Vector version bumps (currently 0.48.0) can break VRL transforms silently
-- **No dry-run** — can't test a pipeline config without deploying it
-- **Init container dependency** — pod startup blocked on Artifactory availability
-
----
-
-## Reference: dfe-loader Architecture
-
-dfe-loader is the sibling Rust project (Kafka → ClickHouse) that established the "big dials" pattern:
-
-### Key big dials exposed
-| Category | Dials |
-|---|---|
-| **Buffer** | `flush_rows`, `flush_bytes`, `flush_age_secs` |
-| **Routing** | `db_fields`, `table_fields`, `default_db/table`, `routed_orgs`, `route_all_by_org` |
-| **Metadata** | `metadata.enabled`, `include_raw`, `tags_fields`, `drop_tags` |
-| **Timestamp DQ** | `enabled`, `max_future_seconds`, `invalid_action` |
-| **Scaling** | `memory.limit_bytes`, `pressure_threshold`, `max_concurrent_inserts` |
-| **Field mapping** | `builtin` (ecs/cim/beats), `default_action`, external mapping files |
-| **DLQ** | `enabled`, `mode` (per_table/common), `topic_suffix` |
-
-### What makes it work
-- **Config cascade**: CLI args → env vars → .env → YAML/TOML → defaults
-- **Hot-reload**: file polling + SIGHUP for safe components (routing, metadata, sanitization)
-- **Metrics**: Prometheus exposition with KEDA-compatible scaling pressure
-- **Health**: `/healthz` endpoint with readiness checks
-- **Circuit breaker**: per-destination failure isolation
-
----
-
-## Vector.dev Configuration Patterns
-
-### How Vector wires components
-Vector pipelines are **directed acyclic graphs (DAGs)**. Each component declares its upstream via the `inputs` field:
-
-```yaml
-sources:
-  kafka_in:
-    type: kafka
-    bootstrap_servers: "broker:9092"
-    topics: ["events"]
-    group_id: "vector"
-
-transforms:
-  parse:
-    type: remap
-    inputs: ["kafka_in"]
-    source: |
-      . = parse_json!(.message)
-
-  enrich:
-    type: remap
-    inputs: ["parse"]
-    source: |
-      .environment = "production"
-
-sinks:
-  kafka_out:
-    type: kafka
-    inputs: ["enrich"]
-    bootstrap_servers: "broker:9092"
-    topic: "processed"
-    encoding:
-      codec: json
-```
-
-### Multi-file config support
-Vector natively supports composable configs:
-```bash
-vector --config /etc/vector/source.yaml --config /etc/vector/transforms/*.yaml --config /etc/vector/sink.yaml
-# or
-vector --config-dir /etc/vector/config.d/
-```
-
-### Validation tools
-- `vector validate` — pre-flight config validation (checks topology, VRL syntax, type compatibility)
-- `vector graph` — outputs pipeline topology as DOT graph
-- `vector tap` — inspect inputs/outputs of components in real time
-- Unit tests built into Vector config format
-
----
-
-## Option 1: Pure Helm Values Approach (Enhanced dfe-core)
-
-### How it would work
-1. Keep the existing Helm + ArgoCD + Artifactory pattern
-2. Add a **validation CI step** that runs `vector validate` on assembled configs before publishing to Artifactory
-3. Add a **config assembler script** (bash/python) that:
-   - Takes the pre-defined source YAML, user transform YAMLs, and pre-defined sink YAML
-   - Validates `inputs` wiring (source label → first transform → ... → sink)
-   - Merges into a single config or directory
-   - Runs `vector validate`
-   - Packages and uploads to Artifactory
-4. Expose "big dials" as top-level Helm values that template into the source/sink YAML
-
-### Big dials via Helm values
-```yaml
-# values.yaml — the user-facing "big dials"
-pipeline:
-  name: "syslog-enrichment"
-  version: "1.2.0"
-
-source:
-  kafka:
-    topics: ["raw-syslog"]
-    group_id: "vector-syslog"
-    # consumer_group_prefix auto-derived from pipeline.name
-
-sink:
-  kafka:
-    topic: "enriched-syslog"
-    key_field: ".tenant_id"
-
-scaling:
-  minReplicas: 1
-  maxReplicas: 10
-  kafkaLagThreshold: 1000
-
-resources:
-  cpu: "2"
-  memory: "4Gi"
-```
-
-### Pros
-- **Minimal new code** — extends what already works
-- **Team familiarity** — Helm + ArgoCD is well-understood
-- **Vector upgrades are simple** — just bump chart version + image tag
-- **No new runtime dependency** — Vector is the only binary in the pod
-
-### Cons
-- **Validation is CI-time only** — runtime composition errors still possible
-- **No runtime DAG awareness** — can't detect broken wiring after deployment
-- **Helm templating is fragile** — complex `inputs` wiring via Go templates gets ugly fast
-- **No hot-reload coordination** — config changes require pod restart
-- **Limited programmatic control** — can't dynamically adjust pipeline topology
-
----
-
-## Option 2: Rust Integration Layer (this project)
-
-### How it would work
-A Rust binary (`dfe-transform-vector`) that:
-
-1. **Owns the Vector config lifecycle**: assembles, validates, and manages Vector configuration
-2. **Runs Vector as a managed subprocess** (or embeds it if feasible)
-3. **Exposes big dials** via its own config (matching dfe-loader's cascade pattern)
-4. **Provides health, metrics, and scaling signals** (like dfe-loader does)
-5. **Still uses Helm** for K8s deployment — this is the binary that runs in the pod instead of bare Vector
-
-### Architecture
-```
-┌─────────────────────────────────────────────────────┐
-│  K8s Pod                                             │
-│                                                      │
-│  ┌───────────────────────────────────────────────┐  │
-│  │  dfe-transform-vector (Rust)                  │  │
-│  │                                                │  │
-│  │  Config Engine:                                │  │
-│  │  - Reads big-dial config (YAML/env/CLI)       │  │
-│  │  - Generates source.yaml (Kafka source)       │  │
-│  │  - Loads user transform YAMLs                 │  │
-│  │  - Generates sink.yaml (Kafka sink)           │  │
-│  │  - Validates DAG wiring (inputs chain)        │  │
-│  │  - Runs `vector validate` on assembled config │  │
-│  │                                                │  │
-│  │  Process Manager:                              │  │
-│  │  - Spawns `vector` as child process            │  │
-│  │  - Monitors health (Vector API on :8686)      │  │
-│  │  - Handles graceful shutdown (SIGTERM chain)   │  │
-│  │  - Restarts on crash with backoff             │  │
-│  │                                                │  │
-│  │  Observability:                                │  │
-│  │  - /healthz (composite: self + vector)        │  │
-│  │  - /metrics (proxy vector + own metrics)      │  │
-│  │  - KEDA scaling pressure signals              │  │
-│  │                                                │  │
-│  │  Hot-reload:                                   │  │
-│  │  - Watches config files / SIGHUP              │  │
-│  │  - Re-validates before applying               │  │
-│  │  - Sends SIGHUP to Vector or restarts it      │  │
-│  │                                                │  │
-│  └───────────────────────────────────────────────┘  │
-│                                                      │
-│  ┌───────────────────────────────────────────────┐  │
-│  │  vector (child process)                        │  │
-│  │  - Runs with assembled config                  │  │
-│  │  - Kafka source → transforms → Kafka sink     │  │
-│  └───────────────────────────────────────────────┘  │
-└─────────────────────────────────────────────────────┘
-```
-
-### Big dials
-```yaml
-# dfe-transform-vector config
-pipeline:
-  name: "syslog-enrichment"
-
-source:
-  type: kafka
-  brokers: "${KAFKA_BROKERS}"    # env var interpolation
-  topics: ["raw-syslog"]
-  group_id: "vector-${pipeline.name}"
-  sasl:
-    mechanism: "SCRAM-SHA-512"
-    username: "${KAFKA_SASL_USERNAME}"
-    password: "${KAFKA_SASL_PASSWORD}"
-
-sink:
-  type: kafka
-  brokers: "${KAFKA_BROKERS}"
-  topic: "enriched-syslog"
-  key_field: ".tenant_id"
-  encoding: json
-
-transforms:
-  # paths to user-supplied Vector YAML files
-  files:
-    - /etc/vector_config/transforms/parse.yaml
-    - /etc/vector_config/transforms/enrich.yaml
-    - /etc/vector_config/transforms/filter.yaml
-  # OR inline dir
-  dir: /etc/vector_config/transforms/
-
-vector:
-  binary: /usr/bin/vector
-  data_dir: /var/lib/vector
-  api_port: 8686
-
-health:
-  port: 9000
-
-metrics:
-  port: 9090
-
-scaling:
-  pressure_threshold: 0.8
-```
-
-### Config assembly logic (Rust)
-1. Read big-dial config
-2. Generate source YAML with canonical label (e.g., `kafka_source`)
-3. Load user transform YAMLs, validate each has valid `inputs` references
-4. Auto-wire: if first transform has `inputs: ["source"]`, rewrite to `inputs: ["kafka_source"]`
-5. Generate sink YAML with `inputs` pointing to last transform's label
-6. Merge all into Vector config directory
-7. Run `vector validate --config-dir /tmp/assembled/`
-8. If valid, start Vector with `--config-dir`
-
-### Pros
-- **Runtime validation** — config is validated before Vector starts, bad configs never run
-- **DAG awareness** — Rust layer understands the pipeline topology, can detect broken wiring
-- **Unified observability** — single health/metrics endpoint that aggregates Vector + wrapper state
-- **Hot-reload with validation** — re-validates config before sending SIGHUP to Vector
-- **Auto-wiring** — users supply transforms, the system wires source/sink automatically
-- **Consistent with dfe-loader** — same config cascade, same big-dial pattern, team familiarity
-- **Crash resilience** — wrapper restarts Vector on crash, reports to metrics
-- **Future extensibility** — can add config templating, VRL validation, transform library management
-
-### Cons
-- **New binary to maintain** — more code, more builds, more testing
-- **Vector subprocess management** — signal forwarding, stdout/stderr capture, PID management
-- **Version coupling risk** — must track Vector releases for config schema compatibility
-- **Startup latency** — wrapper adds milliseconds (negligible in practice)
-- **Two processes in one pod** — slightly more complex resource management
-
----
-
-## External Ecosystem Research
-
-### Existing Kubernetes operators for Vector
-
-| Operator | Language | CRDs | Maturity |
-|---|---|---|---|
-| [kaasops/vector-operator](https://github.com/kaasops/vector-operator) | Go | `Vector`, `VectorPipeline`, `ClusterVectorPipeline` | Active, handles config merging + validation |
-| [zcentric/vector-operator](https://github.com/zcentric/vector-operator) | Go | `Vector`, `VectorAggregator`, `VectorPipeline` | Active, multi-version support |
-
-These operators are the closest existing "big dial" pattern — you declare high-level pipeline CRDs and the operator generates, validates, and deploys Vector configs. However:
-- Both are Go-based, not Rust
-- They add a cluster-level operator dependency
-- They may conflict with existing ArgoCD patterns
-- They don't provide the same config cascade / hot-reload model as dfe-loader
-
-### Programmatic config management tools
-
-| Tool | Approach |
-|---|---|
-| `vector validate` | Built-in pre-flight validation (topology, VRL syntax, types) |
-| `vector generate` | Scaffolding for linear chains |
-| [vector_jsonnet](https://github.com/xunleii/vector_jsonnet) | Jsonnet library for composable Vector configs |
-| CUE | Strong typing + validation over Vector YAML |
-| Datadog Observability Pipelines | Commercial "big dial" UI built on Vector (Terraform support) |
-
-### Key Vector capabilities we leverage
-
-- **Multi-file config**: `--config-dir` loads all YAML from a directory
-- **DAG topology**: `inputs` field wiring, validated by `vector validate`
-- **Environment variable interpolation**: `${VAR}` and `${VAR:-default}` in config
-- **Config reload**: `--watch-config` or SIGHUP
-- **GraphQL API**: observation and limited control at runtime (port 8686)
-- **Kafka source/sink**: librdkafka-backed, SASL/SCRAM, consumer groups, regex topics, acknowledgements
-
-### Rust Kubernetes operator ecosystem
-
-For future consideration if we want to go full operator:
-- **[kube-rs](https://github.com/kube-rs/kube)** — CNCF Sandbox, provides Controller builder, CRD derive macros, async reconcilers
-- One production case study: zero crashes, 68% less resource consumption vs Go operator
-- Not needed for Option 2 (subprocess model) but relevant if we later want CRD-based pipeline management
-
----
-
-## Decision Matrix
-
-| Criterion | Option 1 (Helm-only) | Option 2 (Rust wrapper) |
-|---|---|---|
-| **Robustness** | CI-time validation only | Runtime validation + auto-wiring + crash recovery |
-| **Config safety** | Bad YAML can reach production | Bad YAML caught before Vector starts |
-| **Big dials** | Helm values (Go templates) | Native config cascade (like dfe-loader) |
-| **Vector upgrades** | Bump chart + image tag | Bump image tag, validate config schema compat |
-| **Hot-reload** | Pod restart only | Validated reload via SIGHUP |
-| **Observability** | Vector's built-in metrics | Composite metrics (wrapper + Vector) |
-| **Team familiarity** | High (existing pattern) | Medium (new binary, but mirrors dfe-loader) |
-| **Maintenance cost** | Low | Medium (new Rust codebase) |
-| **Time to MVP** | Days | Weeks |
-| **Auto-wiring** | Manual `inputs` management | Automatic source/sink wiring |
-| **Extensibility** | Limited by Helm templating | Full programmatic control |
-| **External deps** | Helm, ArgoCD, Artifactory | Same + Rust binary |
-| **Scaling** | KEDA (existing) | KEDA + pressure signals (like dfe-loader) |
-| **Crash handling** | K8s restartPolicy | Wrapper restart with backoff + K8s fallback |
-
----
-
-## Vector Helm Chart: What It Actually Provides
-
-### The honest answer: not much magic
-
-The official Vector Helm chart generates standard K8s resources (StatefulSet/Deployment/DaemonSet, Service, ServiceAccount, ConfigMap, optional PodMonitor/HPA/PDB). Its **actual value-adds** are:
-
-| Feature | Value | Hard to replicate? |
-|---|---|---|
-| **ConfigMap checksum annotation** | Auto-restarts pods when config changes | No — one line, or use stakater/Reloader |
-| **Port auto-generation from config** | Parses Vector YAML to generate container/service ports | Medium — convenience, prevents port drift |
-| **Role-based workload switching** | Single chart deploys as Agent/Aggregator/Stateless | No — we always use StatefulSet (Aggregator) |
-| **HAProxy sub-chart** | TCP load balancer sidecar | Not needed for transform pipelines |
-| **`customConfig` with `tpl`** | Helm template expressions inside Vector config | Nice but we already use env var interpolation |
-| **PodMonitor generation** | Small Prometheus Operator manifest | Trivial to write ourselves |
-
-### What it does NOT provide
-- **No probes configured by default** — liveness/readiness are empty `{}`, you must opt in
-- **No preStop hook** — empty `{}` by default
-- **No init containers** — dfe-core adds its own (Artifactory fetch)
-- **No sidecars** — dfe-core adds nothing here either
-- **No config validation** — just renders YAML into a ConfigMap
-- **API binds to 127.0.0.1** — probes can't reach it without overriding to 0.0.0.0
-
-### What Vector itself handles (no chart needed)
-| Feature | Vector native | Notes |
-|---|---|---|
-| Graceful shutdown | SIGTERM → stop sources → flush buffers → exit | Default 60s timeout, configurable |
-| Config hot-reload | `--watch-config --watch-config-method poll` or SIGHUP | Works with K8s ConfigMap volume mounts |
-| Health endpoint | `/health` on API port (8686) | Returns `{"ok":true}` |
-| Internal metrics | `internal_metrics` source | Always available |
-| Prometheus exposition | `prometheus_exporter` sink | Config, not chart feature |
-| Disk buffer persistence | `data_dir` with WAL files | Just needs a volume mount |
-| Exit code 78 | Invalid configuration | Useful for init container validation |
-
-### Recommendation: Drop the Vector Helm chart
-
-For the Rust wrapper approach, the chart adds friction and almost no value:
-- We're always deploying as StatefulSet (one role)
-- We generate our own Vector config (the whole point of the wrapper)
-- We handle health/metrics through the wrapper
-- We already customize probes, init containers, volumes, IRSA, topology spread — all via dfe-core overrides
-
-**Replace with**: Our own Helm chart (or plain manifests + kustomize) in this repo that deploys the `dfe-transform-vector` container. The container image includes both the Rust wrapper binary and the Vector binary. Simpler, no upstream chart version to track, full control.
-
-The dfe-core ArgoCD ApplicationSet pattern stays — it just points to our chart instead of `helm.vector.dev`.
-
----
-
-## Subprocess vs Compiled Crate: How to Run Vector
-
-### Option A: Vector as subprocess (recommended)
-
-```
-dfe-transform-vector (PID 1) → spawns → vector (child process)
-```
-
-The Rust binary assembles config, validates it, then calls `vector --config-dir /tmp/assembled/` as a child process via `tokio::process::Command`.
-
-**Why this is the right call:**
-
-| Factor | Subprocess | Compiled crate |
-|---|---|---|
-| **Vector upgrades** | Swap binary, zero Rust changes | Rebuild entire crate against new Vector version |
-| **Build complexity** | Rust binary + Vector binary in Docker image | Must compile Vector from source as a Rust dependency — Vector is ~500k lines of Rust with 400+ deps |
-| **Version decoupling** | Wrapper and Vector version independently | Tight coupling, must coordinate releases |
-| **Fault isolation** | Vector crash doesn't kill wrapper; wrapper can restart it, report metrics, log the crash | Vector panic = whole process dies |
-| **Memory/resource visibility** | Two processes, separate memory tracking in K8s | Single process, simpler but less granular |
-| **Signal handling** | Forward SIGTERM to child, wait for graceful drain | Native — single process handles it |
-| **Development speed** | Don't need to understand Vector internals | Must understand Vector's internal APIs (unstable, undocumented) |
-| **Testing** | Mock the subprocess, test config assembly independently | Integration-heavy, hard to unit test |
-| **Maintenance burden** | Low — treat Vector as a black box | High — every Vector release may break internal API assumptions |
-
-**The "subprocess is brittle" concern:**
-
-This is the key question. But consider:
-- The current Helm deployment is *already* "Vector as a process managed by something else" — that something is kubelet + the container runtime
-- Our wrapper adds a layer *between* kubelet and Vector that can: validate before starting, restart with backoff on crash, report crash metrics, hold the health endpoint unhealthy during restart
-- This is strictly more robust than bare Vector in a pod
-- The pattern is well-established: nginx unit, envoy + pilot, istio sidecar, containerd + shims
-
-**Subprocess management is simple in Rust:**
-
-```rust
-// Simplified — the actual implementation would use tokio::process
-let mut child = Command::new("/usr/bin/vector")
-    .args([
-        "--config-dir", "/tmp/assembled/",
-        "--watch-config", "--watch-config-method", "poll",
-    ])
-    .stdout(Stdio::inherit())  // Vector logs go to pod stdout
-    .stderr(Stdio::inherit())
-    .spawn()?;
-
-// Forward SIGTERM
-tokio::signal::unix::signal(SignalKind::terminate())?.recv().await;
-child.signal(Signal::SIGTERM)?;
-
-// Wait for graceful shutdown (with timeout)
-tokio::time::timeout(Duration::from_secs(55), child.wait()).await?;
-```
-
-**Key design decisions for subprocess approach:**
-1. **stdout/stderr: inherit** — Vector logs go directly to pod stdout, no buffering/reparsing
-2. **PID 1: the wrapper** — receives SIGTERM from kubelet, forwards to Vector
-3. **Health: composite** — wrapper checks its own state + polls Vector's `/health` API
-4. **Restart policy**: exponential backoff (1s, 2s, 4s, 8s... capped at 60s), with metrics counter
-5. **Config reload**: wrapper re-assembles + re-validates, then either SIGHUP to Vector or restart it
-
-### Option B: Vector as compiled crate (not recommended)
-
-This would mean adding `vector` as a Rust dependency and calling its internal APIs to build and run a pipeline programmatically.
-
-**Why not:**
-- Vector is **not designed as a library**. There is no stable public API for embedding it. The `vector` crate's internals are undocumented and change between releases.
-- The build would pull in **~400 transitive dependencies** including `rdkafka` (C FFI), `lua`, `vrl` compiler, `aws-sdk-*`, and many more. Build times would be enormous.
-- **Every Vector release** would require recompilation and potentially code changes to accommodate internal API shifts.
-- You'd be taking on the **maintenance burden of Vector's internals** rather than treating it as a stable, well-tested binary.
-- The one advantage (single process, native signal handling) doesn't justify the cost. K8s already manages process lifecycle — adding a thin wrapper on top is negligible overhead.
-
-### Verdict: Subprocess, decisively
-
-The subprocess model gives us:
-- Clean version decoupling (upgrade Vector independently)
-- Fault isolation (crash → restart, not crash → pod death)
-- Simple development (config assembly + process management, not Vector internals)
-- Fast builds (small Rust binary, Vector is just a binary in the Docker image)
-
-The "brittleness" concern is a non-issue because:
-1. The alternative (bare Vector in a pod) is the *same thing* with less control
-2. Process supervision is a solved problem (systemd, supervisord, tini, etc.)
-3. Our wrapper is purpose-built and thin — it's not a generic process manager
-
----
-
-## Discussion Points
-
-### 1. Do we need runtime validation?
-The biggest differentiator. If bad configs reaching production is rare and acceptable (fix-forward with GitOps), Option 1 is fine. If it causes outages or data loss, Option 2 pays for itself.
-
-### 2. How complex are the transform chains?
-If most deployments are 2-3 simple VRL transforms, Helm templating handles it. If we have 10+ transforms with branching routes, auto-wiring becomes essential.
-
-### 3. Vector upgrade strategy
-Option 1 is simpler for upgrades (just bump versions). Option 2 adds a layer that must be tested against each Vector release. However, Option 2 can also **pin and validate** Vector versions more precisely.
-
-### 4. Should we embed Helm or not?
-**Recommendation: Keep Helm for K8s deployment, regardless of option.** The Rust binary (if chosen) is what runs *inside* the pod. Helm + ArgoCD still handles the K8s deployment lifecycle. The init container pattern can still fetch transform YAMLs from Artifactory.
-
-### 5. Hybrid approach?
-Start with Option 1 (enhanced validation in CI), build the Rust wrapper incrementally:
-- Phase 1: Config assembler CLI tool (validates + assembles, runs in CI and init container)
-- Phase 2: Runtime wrapper (subprocess management, health, metrics)
-- Phase 3: Hot-reload + scaling pressure signals
-
-This gives immediate value (validation) while building toward the full vision.
-
-### 6. Do we adopt an existing operator?
-The kaasops/vector-operator is interesting but:
-- Adds a cluster-wide dependency
-- Conflicts with ArgoCD ownership model
-- Doesn't match our config cascade pattern
-- Go-based, doesn't fit our Rust ecosystem
-
-**Recommendation: Don't adopt an external operator.** Our needs are specific enough that a purpose-built solution (either option) is better.
-
----
-
-## References
-
-- [Vector Transforms Reference](https://vector.dev/docs/reference/configuration/transforms/)
-- [Vector Managing Complex Configs](https://vector.dev/guides/level-up/managing-complex-configs/)
-- [Vector Kafka Source](https://vector.dev/docs/reference/configuration/sources/kafka/)
-- [Vector Kafka Sink](https://vector.dev/docs/reference/configuration/sinks/kafka/)
-- [Vector Helm Chart](https://github.com/vectordotdev/helm-charts)
-- [Vector K8s Deployment](https://vector.dev/docs/setup/installation/platforms/kubernetes/)
-- [Vector Environment Variables](https://vector.dev/docs/reference/environment_variables/)
-- [Vector Unit Testing](https://vector.dev/docs/reference/configuration/unit-tests/)
-- [kaasops/vector-operator](https://github.com/kaasops/vector-operator)
-- [zcentric/vector-operator](https://github.com/zcentric/vector-operator)
-- [vector_jsonnet](https://github.com/xunleii/vector_jsonnet)
-- [kube-rs](https://github.com/kube-rs/kube)
-- [Vector Config API Issue #24020](https://github.com/vectordotdev/vector/issues/24020)
-- [Vector CRD Issue #3018](https://github.com/timberio/vector/issues/3018)
diff --git a/SECURITY.md b/SECURITY.md
index 739be4b..8d4fe10 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -5,9 +5,10 @@
 If you discover a security vulnerability in this project, please report it
 responsibly. We take security seriously and will respond promptly.
 
-**Email**: security@hyperi.io
+**Email**: <security@hyperi.io>
 
 Please include:
+
 - A description of the vulnerability
 - The affected component or version
 - Steps to reproduce the issue
@@ -57,6 +58,6 @@ The following are generally out of scope:
 
 ## Contact
 
-**Security reports**: security@hyperi.io
+**Security reports**: <security@hyperi.io>
 
 For non-security issues, please use the project's issue tracker.
diff --git a/chart/templates/deployment.yaml b/chart/templates/deployment.yaml
index 38f3f01..a9cec77 100644
--- a/chart/templates/deployment.yaml
+++ b/chart/templates/deployment.yaml
@@ -15,6 +15,7 @@ spec:
     metadata:
       annotations:
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
         {{- with .Values.podAnnotations }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -29,6 +30,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "dfe-transform-vector.serviceAccountName" . }}
+      automountServiceAccountToken: false
       {{- with .Values.podSecurityContext }}
       securityContext:
         {{- toYaml . | nindent 8 }}
@@ -113,6 +115,9 @@ spec:
             - name: kafka-credentials
               mountPath: /var/run/secrets/dfe-kafka
               readOnly: true
+            - name: serviceaccount-files
+              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              readOnly: true
           {{- with .Values.resources }}
           resources:
             {{- toYaml . | nindent 12 }}
@@ -132,6 +137,19 @@ spec:
                 path: username
               - key: {{ .Values.kafka.secretKeys.password }}
                 path: password
+        - name: serviceaccount-files
+          projected:
+            sources:
+              - configMap:
+                  name: kube-root-ca.crt
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+              - downwardAPI:
+                  items:
+                    - path: namespace
+                      fieldRef:
+                        fieldPath: metadata.namespace
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/chart/values.yaml b/chart/values.yaml
index 8280080..f86af21 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -3,7 +3,8 @@
 # Generated by scalo deployment module.
 # Contract points validated by cargo test.
 
-# -- Number of replicas (ignored when KEDA is enabled)
+# -- Number of replicas, ignored while a KEDA ScaledObject or the HPA
+# fallback renders, because that then owns the replica count.
 replicaCount: 1
 
 image:
@@ -51,9 +52,9 @@ podSecurityContext:
     type: RuntimeDefault
 
 # -- Container-level security context. readOnlyRootFilesystem stays
-# false because the spool and DLQ write to disk and the only volume
-# mounted here is the read-only config map; set it true only for an
-# app that spools nowhere.
+# false because the spool and DLQ write to disk and every volume
+# mounted here is read-only; set it true only for an app that spools
+# nowhere.
 securityContext:
   allowPrivilegeEscalation: false
   privileged: false
diff --git a/config/defaults.yaml b/config/defaults.yaml
new file mode 100644
index 0000000..98a4c2d
--- /dev/null
+++ b/config/defaults.yaml
@@ -0,0 +1,13 @@
+# Project:   dfe-transform-vector
+# File:      config/defaults.yaml
+# Purpose:   Cascade defaults for `dfe-transform-vector generate-artefacts`
+#
+# License:   BUSL-1.1
+# Copyright: (c) 2026 HYPERI PTY LIMITED
+
+# generate-artefacts writes no ArgoCD Application without a repo URL, and
+# deploys into a namespace named after the app unless one is set here.
+deployment:
+  argocd:
+    repo_url: https://github.com/hyperi-io/dfe-transform-vector
+    dest_namespace: dfe
diff --git a/docs/DESIGN.md b/docs/DESIGN.md
index cd1eb80..059ca4f 100644
--- a/docs/DESIGN.md
+++ b/docs/DESIGN.md
@@ -119,12 +119,11 @@ class TransformVectorConfig(BaseServiceConfig):
 
     # Scaling
     scaling: ScalingConfig            # pressure_threshold
-
-    # DLQ
-    dlq: DlqConfig                   # enabled, topic
 ```
 
-Shared models (`MetricsConfig`, `LoggingConfig`, `SaslConfig`, `KafkaTlsConfig`, `DlqConfig`) are reused from `dfe_engine.services.models.common` — same as dfe-loader and dfe-receiver.
+Shared models (`MetricsConfig`, `LoggingConfig`, `SaslConfig`, `KafkaTlsConfig`) are reused from `dfe_engine.services.models.common` — same as dfe-loader and dfe-receiver.
+
+There is no DLQ and no `dlq` config. A record no retry would get through is dropped and counted in `pipeline_dead_letters_dropped_total`: `reason="too_large"` for one over the next stage's message-size ceiling, `reason="rejected"` for one the sink refused for good.
 
 ### 3.3 ServicePlugin
 
@@ -267,7 +266,7 @@ are derived from Vector's own component counters by the scrape below.
 loopback `metrics.vector_metrics_address`, registered on the same registry
 :9090 serves and scalo pushes over OTLP):
 
-```
+```text
 # Names and labels as Vector emits them
 vector_component_received_events_total{component_id="dfe_source",component_type="kafka"} 150000
 vector_component_sent_events_total{component_id="dfe_sink",component_kind="sink"} 149950
@@ -300,7 +299,7 @@ for a future release via the scalo `scaling` feature.
 
 The Rust binary loads its own config via the standard scalo 7-layer cascade:
 
-```
+```text
 1. CLI args                              (highest priority)
 2. Env vars (DFE_TRANSFORM_VECTOR_*)
 3. .env file
@@ -355,7 +354,7 @@ scaling:
 
 The config engine takes the big dials and produces a Vector config directory:
 
-```
+```text
 /var/run/vector/config/
   00_global.yaml          # data_dir, api switch, SASL secret backends
   00_source.yaml          # Generated from source big dials
@@ -367,6 +366,7 @@ The config engine takes the big dials and produces a Vector config directory:
 ```
 
 **Generated source (`00_source.yaml`):**
+
 ```yaml
 sources:
   dfe_source:
@@ -389,6 +389,7 @@ sources:
 ```
 
 **Generated sink (`90_sink.yaml`):**
+
 ```yaml
 transforms:
   dfe_size_cap:                         # drops a record over message.max.bytes
@@ -418,6 +419,7 @@ sinks:
 ```
 
 **Generated observability (`99_observability.yaml`):**
+
 ```yaml
 sources:
   internal_metrics:
@@ -443,6 +445,7 @@ The wrapper understands the pipeline topology and wires components automatically
 6. **Extra sources/sinks** (the 2% case): detected and passed through unchanged, references validated
 
 **Validation rules:**
+
 - All `inputs` references must resolve to a defined component
 - No orphaned components (every component must be reachable from a source)
 - No cycles in the DAG
@@ -451,7 +454,7 @@ The wrapper understands the pipeline topology and wires components automatically
 
 ### 5.4 Hot-Reload
 
-```
+```text
 Config change detected (file watcher or SIGHUP)
   │
   ├─ Transform file change (safe)
@@ -475,7 +478,7 @@ Config change detected (file watcher or SIGHUP)
 
 ### 6.1 Lifecycle States
 
-```
+```text
 Initialising ──► Validating ──► Starting ──► Running ──► ShuttingDown
                                                 │
                                                 ├──► Reloading ──► Running
@@ -488,7 +491,7 @@ Initialising ──► Validating ──► Starting ──► Running ──►
 
 ### 6.2 Signal Handling
 
-```
+```text
 Wrapper (PID 1)                     Vector (child)
      │                                    │
      │◄──── SIGTERM (from kubelet) ──────│
@@ -505,6 +508,7 @@ Wrapper (PID 1)                     Vector (child)
 ```
 
 **Timeouts:**
+
 - `terminationGracePeriodSeconds` in K8s: **65s**
 - Wrapper sends SIGTERM to Vector, waits: **55s**
 - If Vector doesn't exit in 55s: SIGKILL child, then exit(1)
@@ -578,7 +582,7 @@ is adopted.
 
 Vector upgrades are a **container image concern**, not a wrapper code concern. This is the key advantage of the subprocess model.
 
-```
+```text
                     Wrapper Image (Rust)           Vector Binary
                     ─────────────────────          ─────────────
 Release cadence:    When wrapper changes           When Vector releases
@@ -614,6 +618,7 @@ ENTRYPOINT ["dfe-transform-vector"]
 ```
 
 **To update Vector without touching wrapper code:**
+
 1. Change `VECTOR_VERSION` in `src/deployment.rs` — that const is the ONLY
    pin. Do NOT edit the Dockerfile: it is autogenerated, and
    `checked_in_dockerfile_matches_emit_dockerfile` fails if it drifts.
@@ -685,7 +690,7 @@ The two-layer restart model (wrapper restarts Vector, K8s restarts wrapper) prov
 
 ### 8.3 Startup Sequence
 
-```
+```text
 1. Load config (cascade)
 2. Validate config (Pydantic-equivalent in Rust)
 3. Check Vector binary exists at configured path
@@ -741,7 +746,7 @@ DFE remediation guide.
 
 ### 9.1 Chart Structure
 
-```
+```text
 chart/
   Chart.yaml
   values.yaml
@@ -845,13 +850,14 @@ affinity: {}
 
 Like dfe-loader, multiple instances of dfe-transform-vector can run simultaneously for different pipelines:
 
-```
+```text
 transform-vector-syslog      # Kafka(raw_syslog) → parse+enrich → Kafka(enriched_syslog)
 transform-vector-netflow      # Kafka(raw_netflow) → decode+geoip → Kafka(enriched_netflow)
 transform-vector-dns          # Kafka(raw_dns) → parse+filter  → Kafka(enriched_dns)
 ```
 
 Each instance has its own:
+
 - Config file in dfe-engine registry: `transform-vector-syslog.yaml`
 - Deployment config: `deployment_configs/transform-vector-syslog.yaml`
 - Kafka consumer group: `dfe-transform-vector-syslog`
diff --git a/docs/MIGRATION.md b/docs/MIGRATION.md
index e4c2366..8287ea8 100644
--- a/docs/MIGRATION.md
+++ b/docs/MIGRATION.md
@@ -89,6 +89,7 @@ keda:
 ```
 
 Key differences:
+
 - **No inline VRL** — transforms are fetched by the init container from Artifactory
 - **No persistence** — Deployment (not StatefulSet), data dir loss just re-reads from Kafka
 - **SASL/TLS** inherited from `common.yaml` — only override pipeline-specific values
@@ -146,6 +147,7 @@ independently without affecting the existing pipeline.
 ### Step 4: Switch Traffic
 
 Once validated:
+
 1. Scale down old pipeline replicas to 0
 2. Update downstream consumers to read from new output topic (if topic name changed)
 3. Monitor for 24-48 hours
@@ -154,6 +156,7 @@ Once validated:
 ### Step 5: Cleanup
 
 After all pipelines migrated:
+
 1. Remove old `vector.yaml` ApplicationSet from dfe-core
 2. Remove old `gitOps/addons/helm/vector/` directory
 3. Remove `vector_project.yaml` ArgoCD project (or update to cover new apps)
diff --git a/docs/architecture.md b/docs/architecture.md
index e72c633..ed69465 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -28,10 +28,9 @@ side this app is indistinguishable from dfe-loader or dfe-receiver.
 
 Vector is not designed as a library and has no stable public API for embedding,
 so the image downloads the upstream release binary at a pinned version and the
-supervisor spawns it with `--config-dir`. The subprocess-versus-compiled-crate
-comparison that settled this is in [../RESEARCH.md](../RESEARCH.md), and the
-deciding factor was upgrades: a subprocess swaps the binary, a crate rebuilds
-against every new Vector version.
+supervisor spawns it with `--config-dir`. Against compiling Vector in as a
+crate, the deciding factor was upgrades: a subprocess swaps the binary, a crate
+rebuilds against every new Vector version.
 
 That choice has one visible consequence. This is the only DFE Rust app whose
 runtime image carries two binaries -- its own, which scalo's deployment contract
diff --git a/docs/config-schema.json b/docs/config-schema.json
index 6078a83..1a2f3ad 100644
--- a/docs/config-schema.json
+++ b/docs/config-schema.json
@@ -348,6 +348,7 @@
         "password": {
           "description": "SASL password. Leave empty when `secret_dir` supplies it.\n\nTaken literally: Vector does not expand `${VAR}` placeholders, so a\nvalue holding one is refused.",
           "type": "string",
+          "x-scalo-secret": true,
           "x-dfe-secret": true,
           "writeOnly": true,
           "default": ""
diff --git a/docs/config-schema.yaml b/docs/config-schema.yaml
index b011569..9b00425 100644
--- a/docs/config-schema.yaml
+++ b/docs/config-schema.yaml
@@ -335,6 +335,7 @@ $defs:
           Taken literally: Vector does not expand `${VAR}` placeholders, so a
           value holding one is refused.
         type: string
+        x-scalo-secret: true
         x-dfe-secret: true
         writeOnly: true
         default: ''
diff --git a/src/config/loader.rs b/src/config/loader.rs
index f7269f9..eecd494 100644
--- a/src/config/loader.rs
+++ b/src/config/loader.rs
@@ -49,7 +49,7 @@ pub struct SaslConfig {
     /// Taken literally: Vector does not expand `${VAR}` placeholders, so a
     /// value holding one is refused.
     // Typed `String` for the round-trip above, but schema'd as scalo's
-    // `SensitiveString` so the emitted config-schema carries `x-dfe-secret` and
+    // `SensitiveString` so the emitted config-schema carries `x-scalo-secret` and
     // `writeOnly`, which is what tells the console to mask the field.
     #[schemars(with = "scalo::SensitiveString")]
     pub password: String,
@@ -906,7 +906,9 @@ impl Config {
             return Ok(());
         };
 
-        let dfe = KafkaSource::new(source_name);
+        // Every derived group leads with `dfe-`: a changed group strands its
+        // committed offsets and falls outside the broker's prefix grant.
+        let dfe = KafkaSource::new(source_name).with_group_prefix("dfe-");
         let defaults = SourceConfig::default();
         let sink_defaults = SinkConfig::default();
 
diff --git a/src/deployment.rs b/src/deployment.rs
index 6382b2c..30294b3 100644
--- a/src/deployment.rs
+++ b/src/deployment.rs
@@ -166,8 +166,13 @@ pub fn contract() -> DeploymentContract {
         native_deps: NativeDepsContract::default(),
         image_profile: ImageProfile::default(),
         schema_version: 3,
+        // scalo writes no vendor, licence or copyright of its own, so the labels
+        // and the generated Dockerfile header carry exactly these.
         oci_labels: scalo::deployment::OciLabels {
+            vendor: "HYPERI PTY LIMITED".into(),
+            label_namespace: "io.hyperi".into(),
             licenses: "BUSL-1.1".into(),
+            copyright: "(c) 2026 HYPERI PTY LIMITED".into(),
             ..Default::default()
         },
         // Reflectable config (scalo-rs#6): derived JSON Schema of the wrapper

From e7fd43e123e7f5d9d15fa6bbc4bacc129243b1af Mon Sep 17 00:00:00 2001
From: Derek <derek@hyperi.io>
Date: Tue, 6 Oct 2026 14:10:57 +1100
Subject: [PATCH 2/2] fix(deps): update dependencies for GA

scalo moves to 2.14.1, which brings cel 0.14.5, the one cel line the suite now shares. Its generated Dockerfile, chart, config schema and generate-artefacts output are byte-identical to 2.14.0's.

Cargo.lock takes the newest compatible release of every crate. The floors move to what the lock now holds for tokio 1.53.2, clap 4.6.7, thiserror 2.0.21 and tokio-test 0.4.6, and the thiserror 1.x copy leaves the graph.

testcontainers stays on 0.27: testcontainers-modules 0.15.0, the newest, requires it.

figment, dotenvy, serde_yaml_ng and prometheus-parse have had no release in over a year. scalo depends on the first three as well, and no maintained drop-in replaces prometheus-parse, so each stays.

The Kafka test broker is already apache/kafka 4.3.1 on the JVM image, pinned by digest.

No open Dependabot alert. Code scanning is not enabled on this repo.
---
 Cargo.lock | 1012 ++++++++++++++++++++++++++++------------------------
 Cargo.toml |   15 +-
 2 files changed, 544 insertions(+), 483 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 25042d4..bc08f9a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -23,9 +23,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
 dependencies = [
  "memchr",
 ]
@@ -38,9 +38,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "android_system_properties"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
 dependencies = [
  "libc",
 ]
@@ -120,15 +120,15 @@ checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "astral-tokio-tar"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08648fef353ab39a9d26f909ad53fc4f071be4c91853b78523f5cc3d9e5ebffd"
+checksum = "b18457efd137254e016bbde5e1d88df61c4e1a5ae2223746e56123bac6af2463"
 dependencies = [
  "futures-core",
  "libc",
  "portable-atomic",
  "rustc-hash",
- "rustix 0.38.44",
+ "rustix",
  "tokio",
  "tokio-stream",
  "xattr",
@@ -153,18 +153,18 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "async-trait"
-version = "0.1.89"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -271,6 +271,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "better_any"
 version = "0.2.1"
@@ -294,9 +300,15 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
 
 [[package]]
 name = "bollard"
@@ -305,8 +317,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee04c4c84f1f811b017f2fbb7dd8815c976e7ca98593de9c1e2afad0f636bff4"
 dependencies = [
  "async-stream",
- "base64",
- "bitflags",
+ "base64 0.22.1",
+ "bitflags 2.13.2",
  "bollard-buildkit-proto",
  "bollard-stubs",
  "bytes",
@@ -324,7 +336,7 @@ dependencies = [
  "log",
  "num",
  "pin-project-lite",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rustls",
  "rustls-native-certs",
  "rustls-pki-types",
@@ -332,7 +344,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "serde_urlencoded",
- "thiserror 2.0.20",
+ "thiserror",
  "time",
  "tokio",
  "tokio-stream",
@@ -362,7 +374,7 @@ version = "1.52.1-rc.29.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f0a8ca8799131c1837d1282c3f81f31e76ceb0ce426e04a7fe1ccee3287c066"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bollard-buildkit-proto",
  "bytes",
  "prost",
@@ -389,9 +401,9 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bytemuck"
-version = "1.25.0"
+version = "1.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
 
 [[package]]
 name = "byteorder"
@@ -407,9 +419,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "cc"
-version = "1.2.65"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
+checksum = "f74872d07caf508b30a21f6836e7d7016a2eaf7d9ff4f48deaa58cd8a0407630"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -419,12 +431,12 @@ dependencies = [
 
 [[package]]
 name = "cel"
-version = "0.13.0"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47a40f338a8c3505921000b609279775792c07cc21f97a3011578c0c5e1738ae"
+checksum = "2ae7daebcd4d032c9a5288790c2facde6fab3f9a9ff8d5028765e8b48a36eeb2"
 dependencies = [
  "antlr4rust",
- "base64",
+ "base64 0.22.1",
  "chrono",
  "lazy_static",
  "nom",
@@ -432,20 +444,20 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "thiserror 1.0.69",
+ "thiserror",
 ]
 
 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
 [[package]]
 name = "cfg_aliases"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 
 [[package]]
 name = "chacha20"
@@ -474,9 +486,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -484,9 +496,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.6.6"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
 dependencies = [
  "anstream",
  "anstyle",
@@ -496,21 +508,21 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.4"
+version = "4.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "clap_lex"
-version = "1.1.0"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
 
 [[package]]
 name = "cmake"
@@ -529,9 +541,9 @@ checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "combine"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
 dependencies = [
  "bytes",
  "memchr",
@@ -564,27 +576,27 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "cpufeatures"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
 dependencies = [
  "libc",
 ]
 
 [[package]]
 name = "crc32fast"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.6"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
 dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
@@ -592,24 +604,24 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.20"
+version = "0.9.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
 dependencies = [
  "crossbeam-utils",
 ]
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.21"
+version = "0.8.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+checksum = "a31eee39dddec8330830986fcd7625edb5a24ec90ea038215273bbc3adb08ac6"
 
 [[package]]
 name = "darling"
-version = "0.23.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+checksum = "ed17f5901b6630b993ca003def43f2f8ef4014fc13b047b57aad617ff32bc2ec"
 dependencies = [
  "darling_core",
  "darling_macro",
@@ -617,26 +629,26 @@ dependencies = [
 
 [[package]]
 name = "darling_core"
-version = "0.23.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+checksum = "6837e2cf7485aaae18f86181d2f0e9a7ed297a025e220aeabf63fdebd3a2ddff"
 dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "darling_macro"
-version = "0.23.0"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
  "darling_core",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -653,6 +665,37 @@ dependencies = [
  "parking_lot_core",
 ]
 
+[[package]]
+name = "defmt"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"
+dependencies = [
+ "bitflags 1.3.2",
+ "defmt-macros",
+]
+
+[[package]]
+name = "defmt-macros"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"
+dependencies = [
+ "defmt-parser",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "defmt-parser"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"
+dependencies = [
+ "thiserror",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -681,7 +724,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustc_version",
- "syn 2.0.118",
+ "syn 2.0.119",
  "unicode-xid",
 ]
 
@@ -709,7 +752,7 @@ dependencies = [
  "tempfile",
  "testcontainers",
  "testcontainers-modules",
- "thiserror 2.0.20",
+ "thiserror",
  "tikv-jemallocator",
  "tokio",
  "tokio-test",
@@ -721,9 +764,9 @@ dependencies = [
 
 [[package]]
 name = "dirs"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
 dependencies = [
  "dirs-sys",
 ]
@@ -746,19 +789,19 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "objc2",
 ]
 
 [[package]]
 name = "displaydoc"
-version = "0.2.6"
+version = "0.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -767,7 +810,7 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29547a1dc60885a552306986316bc9701ba120c1a8db6769fa68691529ad373d"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "serde",
  "serde_json",
 ]
@@ -792,9 +835,9 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "either"
-version = "1.16.0"
+version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
 [[package]]
 name = "endian-type"
@@ -841,9 +884,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.4.1"
+version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
 [[package]]
 name = "faststr"
@@ -864,7 +907,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee93edf3c501f0035bbeffeccfed0b79e14c311f12195ec0e661e114a0f60da4"
 dependencies = [
  "portable-atomic",
- "rand 0.10.1",
+ "rand 0.10.3",
  "web-time",
 ]
 
@@ -896,9 +939,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.9"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+checksum = "aedcfb3409746eddb02b9e19ebda1c3394f759a152e48ee875a0844d1b955484"
 
 [[package]]
 name = "fixedbitset"
@@ -952,9 +995,9 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
 [[package]]
 name = "futures"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -967,9 +1010,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -977,15 +1020,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf29c38818342a3b26b5b923639e7b1f4a61fc5e76102d4b1981c6dc7a7579d"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -994,32 +1037,32 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-timer"
@@ -1029,9 +1072,9 @@ checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
 
 [[package]]
 name = "futures-util"
-version = "0.3.32"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1046,9 +1089,9 @@ dependencies = [
 
 [[package]]
 name = "generator"
-version = "0.8.9"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b854b0e584ead1a33f18b2fcad7cf7be18b3875c78816b753639aa501513ae"
+checksum = "54ade96dc9003043bce7c035c85a9df5a858bfb2039c5a2e6fdf00f324f6c551"
 dependencies = [
  "cc",
  "cfg-if",
@@ -1093,9 +1136,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1127,7 +1172,7 @@ dependencies = [
  "parking_lot",
  "portable-atomic",
  "quanta",
- "rand 0.9.4",
+ "rand 0.9.5",
  "smallvec",
  "spinning_top",
  "web-time",
@@ -1135,9 +1180,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.18"
+version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228"
+checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1145,7 +1190,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "slab",
  "tokio",
  "tokio-util",
@@ -1219,9 +1264,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
  "bytes",
  "itoa",
@@ -1229,9 +1274,9 @@ dependencies = [
 
 [[package]]
 name = "http-body"
-version = "1.0.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
  "http",
@@ -1239,9 +1284,9 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.3"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
@@ -1264,9 +1309,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "hyper"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -1286,9 +1331,9 @@ dependencies = [
 
 [[package]]
 name = "hyper-named-pipe"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
+checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
 dependencies = [
  "hex",
  "hyper",
@@ -1296,14 +1341,13 @@ dependencies = [
  "pin-project-lite",
  "tokio",
  "tower-service",
- "winapi",
 ]
 
 [[package]]
 name = "hyper-rustls"
-version = "0.27.9"
+version = "0.27.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
  "http",
  "hyper",
@@ -1330,16 +1374,17 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-channel",
  "futures-util",
  "http",
  "http-body",
+ "httparse",
  "hyper",
  "ipnet",
  "libc",
@@ -1392,9 +1437,9 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+checksum = "fa68d21081c4a05d5a901a1c62add574c77048b6a1c67be3b50ce0b60d4ca513"
 dependencies = [
  "displaydoc",
  "potential_utf",
@@ -1406,9 +1451,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+checksum = "d56e28588da92eee5c3201a6eff33fabdd49b62269c8938d4ff050ce4d900deb"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -1419,9 +1464,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+checksum = "12f9cf5f235641ed274641dd81c3f28d870e276763d0797aeeab72317b1c646f"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -1433,16 +1478,17 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+checksum = "1563da1ed3e0b3bf3d74c9b85917ac9c56464d2f57242270c09c9e752f8021a0"
 
 [[package]]
 name = "icu_properties"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+checksum = "7e7ca276ad3145661a65914e6daf131ca5120cd3dcee8f8f3214b8875184a148"
 dependencies = [
+ "displaydoc",
  "icu_collections",
  "icu_locale_core",
  "icu_properties_data",
@@ -1453,15 +1499,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.2.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+checksum = "e590f038c1464a96894fd6d10127e90a8be4509f56ff7ecef851b15cee0b7caa"
 
 [[package]]
 name = "icu_provider"
-version = "2.2.0"
+version = "2.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+checksum = "d27bbb9d3abbefac45d55f647c9de1d44aafcd1186eb91879afef17c396c3e73"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -1512,9 +1558,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.14.0"
+version = "2.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
 dependencies = [
  "equivalent",
  "hashbrown 0.17.1",
@@ -1530,9 +1576,9 @@ checksum = "c8fae54786f62fb2918dcfae3d568594e50eb9b5c25bf04371af6fe7516452fb"
 
 [[package]]
 name = "ipnet"
-version = "2.12.0"
+version = "2.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "is_terminal_polyfill"
@@ -1564,6 +1610,60 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "jiff"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
+dependencies = [
+ "defmt",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c"
+dependencies = [
+ "defmt",
+ "log",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "142bd39932ad231f10513df9ab62661fead8719872150b7ad02a2df79f4e141e"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
 [[package]]
 name = "jni"
 version = "0.22.4"
@@ -1576,7 +1676,7 @@ dependencies = [
  "jni-sys",
  "log",
  "simd_cesu8",
- "thiserror 2.0.20",
+ "thiserror",
  "walkdir",
  "windows-link",
 ]
@@ -1591,7 +1691,7 @@ dependencies = [
  "quote",
  "rustc_version",
  "simd_cesu8",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1610,24 +1710,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
 dependencies = [
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "jobserver"
-version = "0.1.34"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "libc",
 ]
 
 [[package]]
 name = "js-sys"
-version = "0.3.103"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+checksum = "7883d941dae510fb2d978fc3fe018c71c9e2892fd38854de3e8b92c2e5ad9cc5"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1636,15 +1736,15 @@ dependencies = [
 
 [[package]]
 name = "lazy_static"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 
 [[package]]
 name = "left-right"
-version = "0.11.7"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0c21e4c8ff95f487fb34e6f9182875f42c84cef966d29216bf115d9bba835a"
+checksum = "8bc015ded5d9b3054dbbdb63332cdd6ee42352ccef19e911e25117490e2f48ee"
 dependencies = [
  "crossbeam-utils",
  "loom",
@@ -1653,15 +1753,15 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.186"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "libredox"
-version = "0.1.17"
+version = "0.1.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
 dependencies = [
  "libc",
 ]
@@ -1678,12 +1778,6 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "linux-raw-sys"
-version = "0.4.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -1692,9 +1786,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
 
 [[package]]
 name = "lock_api"
@@ -1707,9 +1801,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "loom"
@@ -1726,9 +1820,9 @@ dependencies = [
 
 [[package]]
 name = "lru-slab"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
 
 [[package]]
 name = "matchers"
@@ -1747,9 +1841,9 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
-version = "2.8.2"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "metrics"
@@ -1779,19 +1873,19 @@ version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1db0d8f1fc9e62caebd0319e11eaec5822b0186c171568f0480b46a0137f9108"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "evmap",
  "http-body-util",
  "hyper",
  "hyper-rustls",
  "hyper-util",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "ipnet",
  "metrics",
  "metrics-util",
  "quanta",
  "rustls",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tracing",
 ]
@@ -1806,12 +1900,12 @@ dependencies = [
  "crossbeam-epoch",
  "crossbeam-utils",
  "hashbrown 0.16.1",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "metrics",
  "ordered-float",
  "quanta",
  "radix_trie",
- "rand 0.9.4",
+ "rand 0.9.5",
  "rand_xoshiro",
  "rapidhash",
  "sketches-ddsketch",
@@ -1841,9 +1935,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.1"
+version = "1.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
 dependencies = [
  "libc",
  "wasi",
@@ -1873,7 +1967,7 @@ checksum = "4568f25ccbd45ab5d5603dc34318c1ec56b117531781260002151b8530a9f931"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1900,7 +1994,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -1956,9 +2050,9 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.6"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
 dependencies = [
  "num-integer",
  "num-traits",
@@ -1981,20 +2075,19 @@ checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-integer"
-version = "0.1.46"
+version = "0.1.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
 name = "num-iter"
-version = "0.1.45"
+version = "0.1.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
 dependencies = [
- "autocfg",
  "num-integer",
  "num-traits",
 ]
@@ -2038,14 +2131,14 @@ dependencies = [
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "objc2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
 dependencies = [
  "objc2-encode",
 ]
@@ -2056,7 +2149,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "dispatch2",
  "objc2",
 ]
@@ -2073,7 +2166,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "objc2",
 ]
 
@@ -2126,7 +2219,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.20",
+ "thiserror",
  "tracing",
 ]
 
@@ -2156,7 +2249,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prost",
  "reqwest 0.12.28",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tonic",
  "tracing",
@@ -2186,8 +2279,8 @@ dependencies = [
  "futures-util",
  "opentelemetry",
  "percent-encoding",
- "rand 0.9.4",
- "thiserror 2.0.20",
+ "rand 0.9.5",
+ "thiserror",
  "tokio",
  "tokio-stream",
 ]
@@ -2200,18 +2293,18 @@ checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
 
 [[package]]
 name = "ordered-float"
-version = "5.3.0"
+version = "5.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7d950ca161dc355eaf28f82b11345ed76c6e1f6eb1f4f4479e0323b9e2fbd0e"
+checksum = "8c7c9e0d9b23589f26070720bac724174bfec1083e82f7854cdd0267518343c0"
 dependencies = [
  "num-traits",
 ]
 
 [[package]]
 name = "owo-colors"
-version = "4.3.0"
+version = "4.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+checksum = "13c45bb4a6ae1280ec0803b1ef9d3455eb50f01efbbe1447ab020f1d54fba9d8"
 
 [[package]]
 name = "parking_lot"
@@ -2258,7 +2351,7 @@ dependencies = [
  "regex",
  "regex-syntax",
  "structmeta",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2287,7 +2380,7 @@ dependencies = [
  "proc-macro2",
  "proc-macro2-diagnostics",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2304,7 +2397,7 @@ checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
 dependencies = [
  "fixedbitset",
  "hashbrown 0.15.5",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
 ]
 
 [[package]]
@@ -2324,7 +2417,7 @@ checksum = "c96395f0a926bc13b1c17622aaddda1ecb55d49c8f1bf9777e4d877800a43f8b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2335,30 +2428,39 @@ checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.1"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
+dependencies = [
+ "portable-atomic",
+]
 
 [[package]]
 name = "potential_utf"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
 dependencies = [
  "zerovec",
 ]
 
 [[package]]
 name = "powerfmt"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+checksum = "4a6394b9e965e73d0a289ee54f589087e2c676aedf60885baf52c76b771e4958"
 
 [[package]]
 name = "ppv-lite86"
@@ -2376,7 +2478,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2385,14 +2487,14 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.12+spec-1.1.0",
+ "toml_edit 0.25.15+spec-1.1.0",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
@@ -2405,7 +2507,7 @@ checksum = "af066a9c399a26e020ada66a034357a868728e72cd426f3adcd35f80d88d88c8"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
  "version_check",
  "yansi",
 ]
@@ -2449,7 +2551,7 @@ dependencies = [
  "pulldown-cmark",
  "pulldown-cmark-to-cmark",
  "regex",
- "syn 2.0.118",
+ "syn 2.0.119",
  "tempfile",
 ]
 
@@ -2463,7 +2565,7 @@ dependencies = [
  "itertools 0.14.0",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2477,22 +2579,22 @@ dependencies = [
 
 [[package]]
 name = "ptr_meta"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b9a0cf95a1196af61d4f1cbdab967179516d9a4a4312af1f31948f8f6224a79"
+checksum = "743da816b98c921cdbe8628ef7381b76f25ecf4da599fc80aca90eae7ef70cc0"
 dependencies = [
  "ptr_meta_derive",
 ]
 
 [[package]]
 name = "ptr_meta_derive"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7347867d0a7e1208d93b46767be83e2b8f978c3dad35f775ac8d8847551d6fe1"
+checksum = "1c8d9ca532f185d5d4db7a7c9d51420b452168ea1c2b913953281bd6fe1fcbd0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2501,16 +2603,16 @@ version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "memchr",
  "unicase",
 ]
 
 [[package]]
 name = "pulldown-cmark-to-cmark"
-version = "22.0.1"
+version = "22.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab1ad36992cead65f02aa399a373a42730922f1525d988172634fdefdecb8a60"
+checksum = "84bbb29c624230c4bd1047bbdb2aa47e41c860e9665ce62ba9504eebe91bf867"
 dependencies = [
  "pulldown-cmark",
 ]
@@ -2532,9 +2634,9 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.11"
+version = "0.11.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
 dependencies = [
  "bytes",
  "cfg_aliases",
@@ -2544,7 +2646,7 @@ dependencies = [
  "rustc-hash",
  "rustls",
  "socket2",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tracing",
  "web-time",
@@ -2552,21 +2654,22 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.15"
+version = "0.11.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
 dependencies = [
  "aws-lc-rs",
  "bytes",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "lru-slab",
- "rand 0.9.4",
+ "rand 0.10.3",
+ "rand_pcg",
  "ring",
  "rustc-hash",
  "rustls",
  "rustls-pki-types",
  "slab",
- "thiserror 2.0.20",
+ "thiserror",
  "tinyvec",
  "tracing",
  "web-time",
@@ -2574,23 +2677,23 @@ dependencies = [
 
 [[package]]
 name = "quinn-udp"
-version = "0.5.14"
+version = "0.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
 dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.46"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -2619,18 +2722,18 @@ dependencies = [
 
 [[package]]
 name = "rancor"
-version = "0.1.1"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a063ea72381527c2a0561da9c80000ef822bdd7c3241b1cc1b12100e3df081ee"
+checksum = "9b534442d0fcdb55d66f373d9cac6d33b6293a2335bc2136dbd06ce0e87d2572"
 dependencies = [
  "ptr_meta",
 ]
 
 [[package]]
 name = "rand"
-version = "0.9.4"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha",
  "rand_core 0.9.5",
@@ -2638,9 +2741,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.10.1"
+version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+checksum = "65c9fb96cbc91e3478eaae79a69fcd3f1ae4ad052e471fe6732fff548984b4af"
 dependencies = [
  "chacha20",
  "getrandom 0.4.3",
@@ -2672,6 +2775,15 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_xoshiro"
 version = "0.7.0"
@@ -2683,9 +2795,9 @@ dependencies = [
 
 [[package]]
 name = "rapidhash"
-version = "4.4.1"
+version = "4.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
+checksum = "5da7e78a036ce858e8d55b7e7dc8ba3a88b78350fd2155d3591bbd966b58589e"
 dependencies = [
  "rustversion",
 ]
@@ -2696,7 +2808,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
 ]
 
 [[package]]
@@ -2755,45 +2867,44 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
 ]
 
 [[package]]
 name = "redox_users"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+checksum = "60dc65c0ff1a7ae1294b0c67b9f14baf70b644404010370171787bfac1038fc0"
 dependencies = [
- "getrandom 0.2.17",
  "libredox",
- "thiserror 2.0.20",
+ "thiserror",
 ]
 
 [[package]]
 name = "ref-cast"
-version = "1.0.25"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f354300ae66f76f1c85c5f84693f0ce81d747e2c3f21a45fef496d89c960bf7d"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
 dependencies = [
  "ref-cast-impl",
 ]
 
 [[package]]
 name = "ref-cast-impl"
-version = "1.0.25"
+version = "1.0.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7186006dcb21920990093f30e3dea63b7d6e977bf1256be20c3563a5db070da"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2803,9 +2914,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2820,9 +2931,9 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "rend"
-version = "0.5.3"
+version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cadadef317c2f20755a64d7fdc48f9e7178ee6b0e1f7fce33fa60f1d68a276e6"
+checksum = "663ba70707f96e871406fe10d68128412e619b06d1d47cb91c3a4c6501176240"
 
 [[package]]
 name = "reqwest"
@@ -2830,7 +2941,7 @@ version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-core",
@@ -2860,11 +2971,11 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.13.4"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+checksum = "16a1cfa75cc186dd73d5818e510e042e40927bccc9c236b061cea97e1eb08029"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bytes",
  "futures-core",
  "http",
@@ -2917,7 +3028,7 @@ checksum = "d9776093b7ca170454ab1406954f7b7d97a57c51dc6c0642957fb2ef25c2d399"
 dependencies = [
  "bytes",
  "hashbrown 0.17.1",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "munge",
  "ptr_meta",
  "rancor",
@@ -2935,7 +3046,7 @@ checksum = "1c25ef604ac7dd839d44d64648952ea23c97866f124ff671b0ed2cf3ad9bb06e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2958,9 +3069,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustc_version"
@@ -2973,27 +3084,14 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
-dependencies = [
- "bitflags",
- "errno",
- "libc",
- "linux-raw-sys 0.4.15",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "rustix"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "errno",
  "libc",
- "linux-raw-sys 0.12.1",
+ "linux-raw-sys",
  "windows-sys 0.61.2",
 ]
 
@@ -3027,9 +3125,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
 dependencies = [
  "web-time",
  "zeroize",
@@ -3037,9 +3135,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier"
-version = "0.7.0"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
 dependencies = [
  "core-foundation",
  "core-foundation-sys",
@@ -3058,9 +3156,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-platform-verifier-android"
-version = "0.1.1"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-webpki"
@@ -3076,9 +3174,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
 
 [[package]]
 name = "ryu"
@@ -3106,9 +3204,9 @@ dependencies = [
 
 [[package]]
 name = "scalo"
-version = "2.14.0"
+version = "2.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a91fbe77be949c3d85576653573a6bf8c0320afcbdc222c4167ff54a9a4f40e4"
+checksum = "c91d0d04345fda3e6508b44d8478add090f8699946d13d16b31bd778cb1dc1e1"
 dependencies = [
  "backon",
  "bytes",
@@ -3137,7 +3235,7 @@ dependencies = [
  "rayon",
  "rdkafka",
  "regex",
- "reqwest 0.13.4",
+ "reqwest 0.13.5",
  "rmpv",
  "schemars 1.2.2",
  "serde",
@@ -3145,7 +3243,7 @@ dependencies = [
  "serde_yaml_ng",
  "sonic-rs",
  "sysinfo",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -3204,7 +3302,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde_derive_internals",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3225,7 +3323,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -3275,7 +3373,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3286,7 +3384,7 @@ checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3295,7 +3393,7 @@ version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "itoa",
  "memchr",
  "serde",
@@ -3305,13 +3403,13 @@ dependencies = [
 
 [[package]]
 name = "serde_repr"
-version = "0.1.20"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3337,16 +3435,17 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.21.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a5c54c7310e7b8b9577c286d7e399ddd876c3e12b3ed917a8aabc4b96e9e8c"
+checksum = "df9adc193c780ef8f159aee8b61e2d5801aaa555e6eb0947fe45530ec506296f"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "bs58",
  "chrono",
  "hex",
  "indexmap 1.9.3",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
+ "jiff",
  "schemars 0.9.0",
  "schemars 1.2.2",
  "serde_core",
@@ -3357,14 +3456,14 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.21.0"
+version = "3.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
+checksum = "3e17bbc68e28663bbbb90df47e058aa7eda4fb445b89fe70457bb94fbccf6e49"
 dependencies = [
  "darling",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -3373,7 +3472,7 @@ version = "0.9.34+deprecated"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "itoa",
  "ryu",
  "serde",
@@ -3386,7 +3485,7 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b4db627b98b36d4203a7b458cf3573730f2bb591b28871d916dfa9efabfd41f"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "itoa",
  "ryu",
  "serde",
@@ -3432,9 +3531,9 @@ checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
 [[package]]
 name = "simd_cesu8"
-version = "1.1.1"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
 dependencies = [
  "rustc_version",
  "simdutf8",
@@ -3460,15 +3559,15 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
-version = "1.15.2"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
 
 [[package]]
 name = "socket2"
-version = "0.6.4"
+version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
  "windows-sys 0.61.2",
@@ -3476,18 +3575,18 @@ dependencies = [
 
 [[package]]
 name = "sonic-number"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3775c3390edf958191f1ab1e8c5c188907feebd0f3ce1604cb621f72961dbf32"
+checksum = "d7c350a05f295f922fc153a3af8b443c10db70904a9291a624ddb6058c6110d0"
 dependencies = [
  "cfg-if",
 ]
 
 [[package]]
 name = "sonic-rs"
-version = "0.5.8"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d971cc77a245ccf1756dbd1a87c3e7f709c0191464096510d43eec056d0f2c4f"
+checksum = "756586caeeb21126a57c17d1ef2b9386e2613ba784aae0f27104f5e9982335ec"
 dependencies = [
  "ahash",
  "bumpalo",
@@ -3500,7 +3599,7 @@ dependencies = [
  "simdutf8",
  "sonic-number",
  "sonic-simd",
- "thiserror 2.0.20",
+ "thiserror",
  "zmij",
 ]
 
@@ -3543,7 +3642,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "structmeta-derive",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3554,7 +3653,7 @@ checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3565,9 +3664,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.118"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3576,9 +3675,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.4"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3596,20 +3695,20 @@ dependencies = [
 
 [[package]]
 name = "synstructure"
-version = "0.13.2"
+version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "sysinfo"
-version = "0.39.5"
+version = "0.39.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c8bd2130a9b60bee2581bf82cfe89ee836424d1f37dcfa4ce21509611684673"
+checksum = "d2071df9448915b71c4fe6d25deaf1c22f12bd234f01540b77312bb8e41361e6"
 dependencies = [
  "libc",
  "memchr",
@@ -3640,7 +3739,7 @@ dependencies = [
  "fastrand",
  "getrandom 0.4.3",
  "once_cell",
- "rustix 1.1.4",
+ "rustix",
  "windows-sys 0.61.2",
 ]
 
@@ -3668,7 +3767,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with",
- "thiserror 2.0.20",
+ "thiserror",
  "tokio",
  "tokio-stream",
  "tokio-util",
@@ -3686,49 +3785,29 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
-[[package]]
-name = "thiserror"
-version = "2.0.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
-dependencies = [
- "thiserror-impl 2.0.20",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.118",
+ "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.20"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.4",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "thread_local"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
 dependencies = [
  "cfg-if",
 ]
@@ -3755,9 +3834,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.51"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
  "num-conv",
@@ -3775,9 +3854,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.30"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
 dependencies = [
  "num-conv",
  "time-core",
@@ -3785,9 +3864,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+checksum = "b1e27c91459209c2986af3dcf603a5a74a4368754ce37414f59acc971167f643"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -3795,24 +3874,15 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
 
 [[package]]
 name = "tokio"
-version = "1.53.1"
+version = "1.53.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+checksum = "e95f91fcc7a621e8b030f6aa23c71fe9838ae2fb4d8118b75602a328f5144044"
 dependencies = [
  "bytes",
  "libc",
@@ -3827,20 +3897,20 @@ dependencies = [
 
 [[package]]
 name = "tokio-macros"
-version = "2.7.0"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "tokio-rustls"
-version = "0.26.4"
+version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
  "rustls",
  "tokio",
@@ -3848,9 +3918,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -3859,9 +3929,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-test"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f6d24790a10a7af737693a3e8f1d03faef7e6ca0cc99aae5066f533766de545"
+checksum = "12bc5db7778a8e08ee255090861e0e7aac55e784300077e7ed293c7be36168b2"
 dependencies = [
  "futures-core",
  "tokio",
@@ -3919,7 +3989,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "serde",
  "serde_spanned",
  "toml_datetime 0.6.11",
@@ -3929,23 +3999,23 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.25.12+spec-1.1.0"
+version = "0.25.15+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2153edc6955a6c354fad8f5efd38b6a8769bdccf9fe50f8e1329f81b0baa5d7"
+checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
 dependencies = [
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow 1.0.3",
+ "winnow 1.0.4",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.1.2+spec-1.1.0"
+version = "1.1.3+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
+checksum = "1d38ac1cf9b95face32296c0a3ede1fdc270627c9d9c02a7274dd6d960dc4d56"
 dependencies = [
- "winnow 1.0.3",
+ "winnow 1.0.4",
 ]
 
 [[package]]
@@ -3962,7 +4032,7 @@ checksum = "ac2a5518c70fa84342385732db33fb3f44bc4cc748936eb5833d2df34d6445ef"
 dependencies = [
  "async-trait",
  "axum",
- "base64",
+ "base64 0.22.1",
  "bytes",
  "flate2",
  "h2",
@@ -3995,7 +4065,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4020,7 +4090,7 @@ dependencies = [
  "prost-build",
  "prost-types",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
  "tempfile",
  "tonic-build",
 ]
@@ -4033,7 +4103,7 @@ checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
 dependencies = [
  "futures-core",
  "futures-util",
- "indexmap 2.14.0",
+ "indexmap 2.14.2",
  "pin-project-lite",
  "slab",
  "sync_wrapper",
@@ -4050,7 +4120,7 @@ version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "bytes",
  "futures-util",
  "http",
@@ -4093,7 +4163,7 @@ checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4167,9 +4237,9 @@ dependencies = [
 
 [[package]]
 name = "tracing-throttle"
-version = "0.4.2"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e4e430251f5ca8f86ea941286923dc2e91be7ca95fec777d75ee8ae1c493f64"
+checksum = "e793598d143e1f9443db49e2a39d97579b35d877415d50c4d95b4d3aead9248e"
 dependencies = [
  "ahash",
  "dashmap",
@@ -4200,15 +4270,15 @@ dependencies = [
 
 [[package]]
 name = "unicase"
-version = "2.9.0"
+version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+checksum = "357cc3acc6a036009fd6c973ed009037c732d60d0b4f6c673e9041497482a28f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.24"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
 [[package]]
 name = "unicode-segmentation"
@@ -4236,11 +4306,11 @@ checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
 [[package]]
 name = "ureq"
-version = "3.3.0"
+version = "3.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea7109cdcd5864d4eeb1b58a1648dc9bf520360d7af16ec26d0a9354bafcfc0"
+checksum = "9a7ac20be9b7726e0bbdbf974c059676d9acb1cd414961f570a4e8231cacd7fc"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "log",
  "percent-encoding",
  "rustls",
@@ -4251,11 +4321,11 @@ dependencies = [
 
 [[package]]
 name = "ureq-proto"
-version = "0.6.0"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e994ba84b0bd1b1b0cf92878b7ef898a5c1760108fe7b6010327e274917a808c"
+checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "http",
  "httparse",
  "log",
@@ -4294,9 +4364,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.4"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -4334,9 +4404,9 @@ dependencies = [
 
 [[package]]
 name = "want"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+checksum = "ec4cdd0dd910afe868b7ef477227d8d538b46b3075031afee8a9f2acb0a2ed0b"
 dependencies = [
  "try-lock",
 ]
@@ -4358,9 +4428,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+checksum = "9bb54f33acc68fd454578d9820b0bde1a1a3d17aa17bb7b6595806d02886d409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -4371,19 +4441,20 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.76"
+version = "0.4.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
+checksum = "3cbab34de2d982e9b48e18d216d04c4a6f641066ff19ffb699980f591ee3610e"
 dependencies = [
  "js-sys",
+ "tokio",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+checksum = "2e29d0c35b16e224a7eeb5cd2d25e3e1968fbd65604117b44d3b789d00ee8535"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -4391,31 +4462,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+checksum = "6f501a8bc3719dba86ef8ae4728879c08001bea749eb1333ac5b91e040e2a6b7"
 dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.126"
+version = "0.2.129"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+checksum = "23f0c9c52aa7cd7d77769a4cfe2a9adb1b331f489a41d912ce14513d5ab995c6"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "web-sys"
-version = "0.3.103"
+version = "0.3.106"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
+checksum = "88261b9deccee56594c11a3460c462c41f58d148598fe70ad77070126a68aba4"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -4433,9 +4504,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.8"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -4534,7 +4605,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4545,7 +4616,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4591,15 +4662,6 @@ dependencies = [
  "windows-targets",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
-dependencies = [
- "windows-targets",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -4693,9 +4755,9 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "1.0.3"
+version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
 dependencies = [
  "memchr",
 ]
@@ -4708,9 +4770,9 @@ checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
 
 [[package]]
 name = "writeable"
-version = "0.6.3"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
 [[package]]
 name = "xattr"
@@ -4719,7 +4781,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix 1.1.4",
+ "rustix",
 ]
 
 [[package]]
@@ -4741,34 +4803,34 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.2"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
  "synstructure",
 ]
 
 [[package]]
 name = "zerocopy"
-version = "0.8.52"
+version = "0.8.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+checksum = "6400fc4bb7426f6faac3fb07566122bb18622e3022bd2c36426a92ed489b1dbe"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.52"
+version = "0.8.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+checksum = "99c27cc7525bad4df59a45e073c45b2c2aa820efb588234cc23a547ec69a34db"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4782,13 +4844,13 @@ dependencies = [
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
  "synstructure",
 ]
 
@@ -4800,9 +4862,9 @@ checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 
 [[package]]
 name = "zerotrie"
-version = "0.2.4"
+version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -4811,9 +4873,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.6"
+version = "0.11.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+checksum = "bb0464e17806c1d976d5cba29399c7f08e516e279e2ba493f63123b5fca67dd8"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -4822,23 +4884,23 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.3"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.118",
+ "syn 3.0.6",
 ]
 
 [[package]]
 name = "zlib-rs"
-version = "0.6.7"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
 
 [[package]]
 name = "zmij"
-version = "1.0.21"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/Cargo.toml b/Cargo.toml
index c954cc1..aca91d3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ required-features = ["pgo-driver"]
 
 [dependencies]
 # Async runtime
-tokio = { version = ">=1.53.1, <2", features = ["full"] }
+tokio = { version = ">=1.53.2, <2", features = ["full"] }
 tokio-util = { version = ">=0.7.19, <0.8", features = ["rt"] }
 
 # Shared library (CLI framework, deployment artefact generation, logging)
@@ -63,9 +63,8 @@ tokio-util = { version = ">=0.7.19, <0.8", features = ["rt"] }
 # holds the generated Kafka source and sink to. Only its config is used: the
 # image ships no librdkafka, so nothing here may build an rdkafka client.
 #
-# The floor is the first release whose contract carries no vendor defaults, so
-# the app names its own.
-scalo = { version = "2.14.0", features = [
+# The floor's contract carries no vendor defaults, so the app names its own.
+scalo = { version = "2.14.1", features = [
     "cli-service",
     "config-reload",
     "config-schema",
@@ -85,7 +84,7 @@ scalo = { version = "2.14.0", features = [
 
 # Configuration
 figment = { version = ">=0.10.19, <0.11", features = ["env"] }
-clap = { version = ">=4.6.6, <5", features = ["derive", "env"] }
+clap = { version = ">=4.6.7, <5", features = ["derive", "env"] }
 dotenvy = ">=0.15.7, <0.16"
 
 # Record payloads across the direct-transport bridge, which moves bytes rather
@@ -102,7 +101,7 @@ serde_yaml_ng = ">=0.10, <0.11"
 schemars = { version = ">=1.2.2, <2", default-features = false, features = ["std", "derive", "preserve_order"] }
 
 # Error handling
-thiserror = ">=2.0.20, <3"
+thiserror = ">=2.0.21, <3"
 anyhow = ">=1.0.104, <2"
 
 # Logging and tracing
@@ -133,7 +132,7 @@ pgo-driver = []
 
 [dev-dependencies]
 tempfile = ">=3.27.0, <4"
-tokio-test = ">=0.4.5, <0.5"
+tokio-test = ">=0.4.6, <0.5"
 # The WS21 filebeat corpus (tests/common/filebeat.rs) is read in memory from
 # dfe-transform-vrl's committed tar.gz; chrono compares transformed timestamps
 # against the elastic golden outputs.
@@ -142,7 +141,7 @@ tar = ">=0.4.46, <0.5"
 chrono = ">=0.4.45, <0.5"
 testcontainers = ">=0.27.3, <0.28"
 testcontainers-modules = { version = ">=0.15, <0.16", features = ["kafka"] }
-scalo = { version = "2.14.0", features = [
+scalo = { version = "2.14.1", features = [
     "transport-kafka",
 ] }
 # A stand-in Vector source for the bridge tests; scalo already builds this tonic.