chore(deps): bump the dependencies group across 1 directory with 16 updates

Cargo.toml

@@ -73,10 +73,10 @@ anyhow = "1"
 # Serialization
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-toml = "0.8"
+toml = "1.1"
 # Networking
 bytes = "1"
-socket2 = { version = "0.5", features = ["all"] }
+socket2 = { version = "0.6", features = ["all"] }
 libc = "0.2"
 # Logging
 tracing = "0.1"
@@ -111,13 +111,13 @@ rustls-pemfile = "2"
 tokio-util = { version = "0.7", default-features = false, features = ["rt"] }
 # Item 2: WebSocket proxy path (PROMPT.md §14). 0.24 keeps us on the same
 # rustls 0.23 + tokio-rustls 0.26 stack already pinned above.
-tokio-tungstenite = { version = "0.24", default-features = false, features = ["handshake"] }
+tokio-tungstenite = { version = "0.29", default-features = false, features = ["handshake"] }
 # Item 2: `StreamExt` + `SinkExt` combinators over `tokio-tungstenite`'s
 # `WebSocketStream`. `std` is the only default we need; we keep the pull
 # light and skip the `compat` layer.
 futures-util = { version = "0.3", default-features = false, features = ["std", "sink"] }
 # Utilities
-rand = "0.8"
+rand = "0.10"
 # XDP / eBPF (Pillar 4a: aya userspace loader; Linux-only in consumers)
 aya = "0.13"
 # Pillar 4b-1: aya-obj gives us the kernel-free ELF parser (no CAP_BPF
@@ -133,7 +133,7 @@ libfuzzer-sys = "0.4"
 # listener. `default-features = false` drops the protobuf family so we
 # keep the text-format path only; `process` enables the
 # `process_collector` for OS-level RSS/CPU samples.
-prometheus = { version = "0.13", default-features = false, features = ["process"] }
+prometheus = { version = "0.14", default-features = false, features = ["process"] }
 # CODE-2-11: property-based testing for the H1 / H2 / H3 / QUIC parsers.
 # Dev-only; never enters release. The default-features include
 # `proptest-derive` machinery we do not need (regex-based generators)

crates/lb-l4-xdp/Cargo.toml

@@ -40,4 +40,4 @@ libc = { workspace = true }
 #
 # Wave-1 (EBPF-2-01) used it only for the ELF-section regression
 # tests; Wave-2 (SEC-2-12) extends that into a startup-time check.
-object = { version = "0.36", default-features = false, features = ["read", "std"] }
+object = { version = "0.37", default-features = false, features = ["read", "std"] }

crates/lb-l7/Cargo.toml

@@ -79,7 +79,7 @@ lb-observability = { path = "../lb-observability" }
 tokio-rustls = { workspace = true }
 rustls = { workspace = true }
 rustls-pki-types = { workspace = true }
-rcgen = { version = "0.13", features = ["pem"] }
+rcgen = { version = "0.14", features = ["pem"] }
 # ROUND8-OPS-06: the traceparent-propagation proof installs a custom
 # `tracing_subscriber` layer that snapshots emitted span fields so the
 # test can assert the request span carries the inbound `trace_id`.

crates/lb-quic/Cargo.toml

@@ -72,7 +72,7 @@ lb-h3-testcodec = { path = "../lb-h3-testcodec" }
 # leaf crate (bytes/http/thiserror, zero lb-* deps) so this dev-edge adds
 # no cycle, and the production `lb-quic` build links zero gRPC symbols.
 lb-grpc = { path = "../lb-grpc" }
-rcgen = { version = "0.13", features = ["pem"] }
+rcgen = { version = "0.14", features = ["pem"] }
 tokio = { workspace = true, features = ["full", "test-util"] }
 # CODE-2-11: proptest harness for the long/short header parse path.
 # Sanity budget; CI bumps via PROPTEST_CASES env.

crates/lb-security/Cargo.toml

@@ -46,5 +46,5 @@ ring = "0.17"
 subtle = "2"
 
 [dev-dependencies]
-rcgen = { version = "0.13", features = ["pem"] }
+rcgen = { version = "0.14", features = ["pem"] }
 tokio = { workspace = true, features = ["full", "test-util", "macros"] }

crates/lb-soak/Cargo.toml

@@ -42,7 +42,7 @@ quiche = { workspace = true }
 # ring + rcgen are declared directly (not workspace-inherited) to match the
 # lb-quic convention — they are not in [workspace.dependencies].
 ring = "0.17"
-rcgen = { version = "0.13", features = ["pem"] }
+rcgen = { version = "0.14", features = ["pem"] }
 # TLS client for the h1s/h2 (ALPN) front scenarios.
 tokio-rustls = { workspace = true }
 rustls = { workspace = true }

crates/lb/Cargo.toml

@@ -73,7 +73,7 @@ tokio-util = { workspace = true }
 # S15 A2 verify gate (i) quic_passthrough_e2e: real quiche client +
 # real quiche server backend, rcgen-issued cert. ring is pulled in
 # for SystemRandom (16-byte SCID material).
-rcgen = { version = "0.13", features = ["pem"] }
+rcgen = { version = "0.14", features = ["pem"] }
 ring = "0.17"
 # SESSION 28 / WS-over-H3 (RFC 9220) Stage C e2e: a real tokio-tungstenite
 # WS echo backend behind the spawned QUIC listener. The client side is raw