chore(deps): bump the cargo-minor-patch group across 1 directory with 5 updates

[dependabot]

Bumps the cargo-minor-patch group with 5 updates in the / directory:

Package	From	To
tokio-util	0.7.18	0.7.19
ort	2.0.0-rc.12	2.0.0-rc.13
http	1.4.2	1.5.0
rustls	0.23.42	0.23.43
clap	4.6.3	4.6.6

Updates tokio-util from 0.7.18 to 0.7.19

Commits

• f2189d3 chore: prepare tokio-util v0.7.19 (#8309)
• 52f2745 net: re-enable tcp_stream::try_read_buf test for WASI (#8305)
• ac6869a rt: remove unstable cfgs leftovers after local runtime stabilization (#8298)
• 75fef53 chore: prepare Tokio v1.53.1 (#8303)
• ae9d011 signal: restore MSRV by removing OnceLock::wait from the Windows handler (#8300)
• eb4988d time: fix the loom test of the race between cancellation/insertion (#8302)
• 91d3b4c time: fix alt timer cancellation and insertion race (#8252)
• a463384 runtime: remove dead link definition in Runtime::block_on (#8301)
• be689a3 chore: prepare Tokio v1.53.0 (#8294)
• 50f76c7 chore: prepare tokio-macros v2.7.1 (#8295)
• Additional commits viewable in compare view

Updates ort from 2.0.0-rc.12 to 2.0.0-rc.13

Release notes

Sourced from ort's releases.

v2.0.0-rc.13

2.0.0-rc.13

💖 If you find ort useful, please consider sponsoring us on Open Collective 💖

🤔 Need help upgrading? Ask questions in GitHub Discussions or in the pyke.io Discord server!

---

🎯 Execution provider clarity

EP structs like ep::CUDA are now compile-time gated behind their respective Cargo feature flags. The EP feature flags only modifying runtime behavior was a common pain point, and this change brings ort in line with, like, every other Rust crate in existence.

⚠️ ort will now throw an error at link time if download-binaries is enabled and no binaries contain all of the requested EPs. Previously, if you enabled a nonsensical combination like cuda + coreml, ort would silently fall back to a CPU-only build. This caused great confusion as the only indicator of what went wrong was in log messages that don't show by default. A new lax-feature-matching Cargo feature will fallback to the closest fit instead of erroring.

🍎 ONNX Runtime 1.28

rc.13 skips ahead 4 ONNX Runtime versions to v1.28, bringing new operator support, bug & security fixes, and performance improvements.

✖️ No CUDA 12

rc.13 only ships CUDA 13 binaries, as ONNX Runtime has deprecated CUDA 12.

🧩 Custom operator ergonomics

Custom operators have been reworked to have a more Rusty interface:

 struct MyOperator;
impl Operator for MyOperator {


type Kernel<'attr> = ort::operator::BoxedKernel<'attr>;
fn name(&self) -> &str {
"MyOperator"
}



fn inputs(&self) -> Vec<OperatorInput> {

  vec![OperatorInput::required(TensorElementType::Float32), OperatorInput::required(TensorElementType::Float32)]




fn inputs(&self) -> impl IntoIterator<Item = OperatorInput> {

  [OperatorInput::required(TensorElementType::Float32), OperatorInput::required(TensorElementType::Float32)]

}


fn outputs(&self) -> Vec<OperatorOutput> {

  vec![OperatorOutput::required(TensorElementType::Float32)]




fn outputs(&self) -> impl IntoIterator<Item = OperatorOutput> {

  [OperatorOutput::required(TensorElementType::Float32)]

}


fn create_kernel(&self, _: &KernelAttributes) -> ort::Result<Box<dyn Kernel>> {

  Ok(Box::new(|ctx: &amp;KernelContext| {



</tr></table>

... (truncated)

Commits

• 002f41a 2.0.0-rc.13
• d5dc28f chore(tract): update tract to v0.23
• 62ad710 chore(candle): update to candle v0.11.0
• 66ffef6 docs: update
• 58ebfd8 chore(tools): update api-coverage
• 71c1c84 refactor!: separate Device and HardwareDevice
• 85f4893 chore(sys): update ONNX Runtime to v1.28.0
• d7d924e refactor!: move environment::current to an associated function
• db48c03 feat: Tensor::size
• 2c6652b feat: per-run profiling
• Additional commits viewable in compare view

Updates http from 1.4.2 to 1.5.0

Release notes

Sourced from http's releases.

v1.5.0

What's Changed

• feat(method): add QUERY method by @​seanmonstar in hyperium/http#798
• fix(uri): allow empty paths in uri::Builder by @​seanmonstar in hyperium/http#853
• perf(header,uri): faster value validation, URI parse/format, map inserts by @​geeknoid in hyperium/http#852
• fix(uri): enforce max length in PathAndQuery by @​seanmonstar in hyperium/http#856

New Contributors

• @​geeknoid made their first contribution in hyperium/http#852

Full Changelog: hyperium/http@v1.4.2...v1.5.0

Changelog

Sourced from http's changelog.

1.5.0 (July 29, 2026)

• Add Method::QUERY constant for the new QUERY method defined in RFC 10008.
• Fix uri::Builder::path_and_query() to allow empty strings to mean no path.
• Fix uri::PathAndQuery parsing to enforce URI max length.

Commits

• 16fc9a7 v1.5.0
• e559023 fix(uri): enforce max length in PathAndQuery (#856)
• 2178e17 perf(header,uri): faster value validation, URI parse/format, map inserts (#852)
• 03c8cd7 fix(uri): allow empty paths in uri::Builder (#853)
• bb8705b feat(method): add QUERY method (#798)
• See full diff in compare view

Updates rustls from 0.23.42 to 0.23.43

Commits

• fcf61cd Prepare 0.23.43
• f0dad4c Check server's proposed suite against actual offer
• b480cc6 Test for server choosing a non-QUIC TLS1.3 suite
• 883a44d Consider Protocol in ServerConfig::supports_version
• c2f1fd9 Check suitability of server version in QUIC client
• d98e1b9 Add test for server Tls13RequiredForQuic
• e63d9bf Bound ticket age calculation
• 79cd462 Defensiveness improvement for binder suffix arithmetic
• 4a9f025 use checked_sub for the mac tag offset in Rfc5077Ticketer::decrypt
• 3131e5c Accept that libcrux deps are vulnerable
• Additional commits viewable in compare view

Updates clap from 4.6.3 to 4.6.6

Release notes

Sourced from clap's releases.

v4.6.6

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

v4.6.5

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

v4.6.4

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Changelog

Sourced from clap's changelog.

[4.6.6] - 2026-08-06

Features

• Add Command::get_overridden_usage

[4.6.5] - 2026-07-31

Fixes

• (help) Correctly mark which value_names are optional with num_args

[4.6.4] - 2026-07-21

Internal

• Update to syn v3

Commits

• 348cff3 chore: Release
• d478377 docs: Update changelog
• 04b9fbb Merge pull request #6414 from koopatroopa787/fix-bash-completion-bracket-glob
• 7075239 Merge pull request #6422 from BaumiCoder/fix-fish-indentations
• f90a966 fix(complete): Use spaces for indentation in fish
• dd4997b fix(complete): Don't glob-expand bash positionals
• 8387c81 Merge pull request #6399 from clap-rs/renovate/crate-ci-typos-1.x
• 8141e11 chore(deps): Update compatible (dev) (#6398)
• 8a6bd4e chore(deps): Update pre-commit hook crate-ci/typos to v1.47.0
• 71a7213 chore(deps): Update Rust Stable to v1.96 (#6396)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sathish-mg]

Checked before merging. Lock-only, so the only bump with real teeth here is ort 2.0.0-rc.12 → rc.13, which is a breaking release: EP structs are now compile-time gated behind their Cargo features, Device/HardwareDevice were split, custom operators were reworked, and it jumps to ONNX Runtime 1.28.

None of that reaches us. SileroVad and SmartTurn only use Session::builder(), Tensor::from_array and session.run(inputs![...]) on CPU — no execution-provider selection, no custom operators, no Device. Verified with clippy -p flowcat-core --features vad-ort,filter-rnnoise --all-targets -D warnings and the feature-gated test suite, both clean.

http 1.5.0, rustls 0.23.43, tokio-util 0.7.19 and clap 4.6.6 are all additive.

Rebased onto current main and re-ran CI — the previous green was from Aug 10, three merges ago, so it was passing branch protection without ever having been tested against the current tree.