build(deps): bump the prod group with 3 updates

[dependabot]

Bumps the prod group with 3 updates: clap, inferno and hyper.

Updates clap from 4.4.8 to 4.4.9

Release notes

Sourced from clap's releases.

v4.4.9

[4.4.9] - 2023-11-27

Fixes

• (help) Show correct Command::about under flattened headings
• (help) Respect hide when flattening subcommands

Changelog

Sourced from clap's changelog.

[4.4.9] - 2023-11-27

Fixes

• (help) Show correct Command::about under flattened headings
• (help) Respect hide when flattening subcommands

Commits

• 21b671f chore: Release
• 93ba76d docs: Update changelog
• c1c55b3 Merge pull request #5228 from epage/flat
• b13f6d9 fix(help): Hide 'help' if only flattened subcommand
• a9322ca fix(help): Hide subcommands in flattened usage
• b656198 test(help): Show how hide and flatten mix
• 5c8f8d5 Merge pull request #5227 from epage/flat
• 22130e3 fix(help): Use right about when flattening
• e9194b5 test(help): Better show about bug
• 5c81df6 Merge pull request #5216 from kellytk/correct-wording
• Additional commits viewable in compare view

Updates inferno from 0.11.18 to 0.11.19

Changelog

Sourced from inferno's changelog.

[0.11.19] - 2023-11-25

Changed

• By default, make cargo install strip all binaries. #310

Commits

• 1b61f2e Release 0.11.19 with stripped binaries
• d877809 Strip symbols of inferno binaries to decrease size by 24x (#310)
• 86131d4 Fix future-incompat
• See full diff in compare view

Updates hyper from 0.14.27 to 1.0.1

Release notes

Sourced from hyper's releases.

v1.0.1

This release "fixes" or adds a few things that should have been in 1.0.0, but were forgotten. Thus, it includes additions that would normally be a semver-minor release, but because it is so close to 1.0.0, it is released as a patch version.

Bug Fixes

• rt: implement Read/Write for Pin (#3413) (dd6d81ca, closes #3412)

Features

• rt: Make ReadBuf::new public (7161f562)

Breaking Changes

• Pin is #[fundamental], so providing a Read/Write impl for it theoretically conflicts with existing user Read/Write for Pin impls. However, those impls probably don't exist yet. (dd6d81ca)

New Contributors

• @​coolreader18 made their first contribution in hyperium/hyper#3413

v1.0.0

Be sure to checkout the upgrading guide!

Features

• client: allow !Send IO with HTTP/1 client (#3371) (cf87eda8, closes #3363)
• error:
  • Error::source() is purposefully unspecified (#3318) (502a6450, closes #2843)
  • change Display for Error to only print top error (#3312) (50f123af, closes #2844)
• ext:
  • make ReasonPhrase::from_static a const fn (d4a61e3d)
  • remove ReasonPhrase::from_bytes_unchecked() method (4021c57b)
• lib:
  • update to http 1.0 (899e92a5)
  • missing Timer will warn or panic (f3308c04, closes #3393)
  • increase MSRV to 1.63 (#3293) (e68dc961)
• rt: rename to Http2ClientConnExec and Http2ServerConnExec (52b27faa)
• server: default http1 header_read_timeout to 30 seconds (8bf26d1e)
• upgrade: introduce tracing as an optional unstable feature (#3326) (da3fc76c, closes #3319)

Bug Fixes

• client:
  • avoid double-polling a Select future (#3290) (fece9f7f, closes #3289)
  • early server response shouldn't propagate NO_ERROR (#3275) (194e6f98, closes #2872)
  • remove Send bounds for request Body (#3266) (4ace340b, closes #3184)
• ffi: fix deadlock in hyper_executor::poll_next (#3370) (0c7d03ef, closes #3369)

... (truncated)

Changelog

Sourced from hyper's changelog.

v1.0.1 (2023-11-16)

This release "fixes" or adds a few things that should have been in 1.0.0, but were forgotten. Thus, it includes additions that would normally be a semver-minor release, but because it is so close to 1.0.0, it is released as a patch version.

Bug Fixes

• rt: implement Read/Write for Pin (#3413) (dd6d81ca, closes #3412)

Features

• rt: Make ReadBuf::new public (7161f562)

Breaking Changes

• Pin is #[fundamental], so providing a Read/Write impl for it theoretically conflicts with existing user Read/Write for Pin impls. However, those impls probably don't exist yet. (dd6d81ca)

v1.0.0 (2023-11-15)

Be sure to check out the upgrading guide.

Bug Fixes

• client:
  • avoid double-polling a Select future (#3290) (fece9f7f, closes #3289)
  • early server response shouldn't propagate NO_ERROR (#3275) (194e6f98, closes #2872)
  • remove Send bounds for request Body (#3266) (4ace340b, closes #3184)
• ffi: fix deadlock in hyper_executor::poll_next (#3370) (0c7d03ef, closes #3369)
• http2:
  • don't send keep-alive ping when idle (#3381) (429ad8a3)
  • change default server max concurrent streams to 200 (#3362) (dd638b5b, closes #3358)
• server: Respect Expect header only when http proto > 1.0 (#3294) (43d2f5c6)

Features

• client: allow !Send IO with HTTP/1 client (#3371) (cf87eda8, closes #3363)
• error:
  • Error::source() is purposefully unspecified (#3318) (502a6450, closes #2843)
  • change Display for Error to only print top error (#3312) (50f123af, closes #2844)
• ext:
  • make ReasonPhrase::from_static a const fn (d4a61e3d)
  • remove ReasonPhrase::from_bytes_unchecked() method (4021c57b)
• lib:
  • update to http 1.0 (899e92a5)

... (truncated)

Commits

• 2954280 v1.0.1
• 7161f56 feat(rt): Make ReadBuf::new public
• b855475 refactor(proto): use derive macro to implement Default for KA
• 823d2cb refactor(lib): remove redundant field name
• 33e1cbe refactor(lib): remove unneeded return
• b7e8f88 refactor(lib): remove unused cfg condition
• dd6d81c fix(rt): implement Read/Write for Pin<P> (#3413)
• a475ada docs(examples): update dependencies section
• f1bb2aa chore(ci): add minimal versions checking
• 931aee7 chore(dependencies): relax minimum tokio version to 1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[teor2345]

@dependabot ignore hyper major version

[dependabot]

OK, I won't notify you about version 1.x.x of hyper again, unless you unignore it.

[teor2345]

@dependabot ignore major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)

@arya2 I think this is exactly the behaviour we want, and it's automatic. (So it will stop ignoring when we do the manual upgrade.)

This doesn't seem to be what we want, so I'm going to revert that PR:

exclude-patterns | Use to exclude certain dependencies from the group. If a dependency is excluded from a group, Dependabot will continue to raise single pull requests to update the dependency to its latest version.

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups

This would be closer, but it requires another PR to undo, so let's avoid that:

By default all dependencies that are explicitly defined in a manifest are kept up to date by Dependabot version updates. In addition, Dependabot security updates also update vulnerable dependencies that are defined in lock files. You can use allow and ignore to customize which dependencies to maintain.

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#ignore

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.