[wu-sheng]

Bump Rust dependencies in Cargo.lock to fix open security alerts. These crates ship in the PHP extension.

Dependencies (Cargo.lock)

Package	Old	New	Advisory
libz-sys	1.1.29	1.1.31	RUSTSEC-2026-0418 / GHSA-8p3x-q3q3-q3v5
rustls-webpki	0.103.15	0.103.16	RUSTSEC-2026-0382 / CVE-2026-111943
tokio	1.53.1	1.53.3	RUSTSEC-2026-0386

Each is the latest patch on the current minor and declares a rust-version at or below the 1.85 MSRV (tokio 1.53.3: 1.71, rustls-webpki 0.103.16: 1.71, libz-sys: none). Applied with cargo update -p <crate> --precise <version>. Only the three package entries change in Cargo.lock; the lock is accepted unchanged by cargo metadata --locked.

libz-sys is only built with the kafka-reporter feature (via rdkafka-sys).

License

dist-material/LICENSE regenerated with license-eye dependency resolve --summary ./dist-material/LICENSE.tpl -c .licenserc.yaml at the commit the License workflow pins (d299844e). The base branch had no drift. Only the three version lines change.

GitHub Actions

No changes. actions/checkout@v7, shivammathur/setup-php@v2 and Swatinem/rust-cache@... # v2.9.3 are already on the latest major/release and allowed by the ASF allowlist.

apache/skywalking-eyes is left at d299844e (2023). Moving to v0.9.0 makes license-eye dependency check fail: its Apache-2.0 compatibility matrix does not list Unicode-3.0, which covers 18 shipped crates (icu_*, zerovec, yoke, tinystr, litemap, writeable, zerofrom, zerotrie, potential_utf). Working around that in .licenserc.yaml would mean excluding or relabelling shipped crates, so it is out of scope here.

infra-e2e

Not used in this repo. Tests use docker compose (v2 plugin) on ubuntu-24.04.

Verified locally (macOS arm64, Rust 1.85.1, PHP 8.5.4 headers)

• cargo clippy --locked --release --workspace, with and without --features kafka-reporter
• cargo build --locked --release --workspace, with and without --features kafka-reporter

All four pass. Two local-only caveats: they ran without the workflow's RUSTFLAGS=-D warnings, because on macOS the Linux-only metrics code leaves an existing unused-import warning in src/worker.rs; and bindgen used libclang 21, which cannot handle PHP 8.5's preserve_none attribute, so HAVE_PRESERVE_NONE was turned off in a scratch copy of the PHP headers. CI builds on Linux with llvm-18 and needs neither.

• license-eye header check, license-eye dependency check, and the summary regeneration diff check from the License workflow

Not run: cargo test (needs the docker compose services), PECL packaging, container build. CI covers these.

Left out

• time 0.3.45 (RUSTSEC-2026-0009 / CVE-2026-25727): every fixed release needs Rust 1.88, above the 1.85 MSRV.
• bincode 2.0.1 (RUSTSEC-2025-0141) and rustls-pemfile 2.2.0 (RUSTSEC-2025-0134): unmaintained notices with no fixed release.