deps: bump the rust-dependencies group with 4 updates

[dependabot]

Bumps the rust-dependencies group with 4 updates: aws-sdk-s3, deadpool, native-tls and rmcp.

Updates aws-sdk-s3 from 1.123.0 to 1.124.0

Commits

• See full diff in compare view

Updates deadpool from 0.12.3 to 0.13.0

Commits

• b134227 Release deadpool 0.13.0 and deadpool-sync 0.2.0
• 688234b Update lapin to version 4
• 362391f Release deadpool-runtime 0.3.1
• 70f1b93 Fix feature specific dependencies in READMEs
• 860570c Add rustdoc-args = ["--cfg", "docsrs"] to all Cargo.toml files
• 7a00e9c Fix deadpool CHANGELOG and improve yank explanation
• f9bd480 Update CHANGELOG why deadpool-sync 0.1.5 was yanked
• 4f6bd49 Update deadpool-runtime to version 0.3
• eef23c7 Fix small typo in README
• ffcf81e Released deadpool-runtime 0.3.0
• Additional commits viewable in compare view

Updates native-tls from 0.2.16 to 0.2.18

Release notes

Sourced from native-tls's releases.

v0.2.17

What's Changed

• Added ALPN support to TlsAcceptor by @​matszpk in rust-native-tls/rust-native-tls#229 and @​JohnGu9 in rust-native-tls/rust-native-tls#363

Full Changelog: rust-native-tls/rust-native-tls@v0.2.16...v0.2.17

Changelog

Sourced from native-tls's changelog.

[v0.2.18]

• Fixed min/max protocol selection fallback for very old OpenSSL versions.

[v0.2.17]

• Added support for ALPN on the server side on non-Apple platforms.
• Fixed iOS + ALPN feature flag.

Commits

• 3cf1877 TLS 1.3 min/max fallback for old OpenSSL versions
• a352cb3 Exclude unused files from the package
• be13f94 Release 0.2.17
• 8213e1d fmt
• c250fa7 Test features
• bd165e9 Work around set_alpn_select_callback lifetime issues
• 64439ad Use separate feature flag for server-side ALPN
• aa71c45 Common helper for alpn
• 1be1ac9 add ALPN server side test
• f640501 Add ALPN implement for schannel
• Additional commits viewable in compare view

Updates rmcp from 0.15.0 to 0.16.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v0.16.0

Fixed

• align task response types with MCP spec (#658)

Other

• include LICENSE in final crate tarball (#657)
• add rudof-mcp to MCP servers list (#645)

rmcp-v0.16.0

Added

• add support for custom HTTP headers in StreamableHttpClient (#655)
• (auth) add token_endpoint_auth_method to OAuthClientConfig (#648)

Fixed

• remove unnecessary doc-cfg (#661)
• duplicate meta serialization (#662)
• sort list_all() output in ToolRouter and PromptRouter for deterministic ordering (#665)
• align task response types with MCP spec (#658)

Other

• upgrade reqwest to 0.13.2 (#669)
• include LICENSE in final crate tarball (#657)
• (deps) update rand requirement from 0.9 to 0.10 (#650)
• remove unused axum dependency from server-side-http feature (#642)
• 11-25-2025 compliant Auth (#651)
• add rudof-mcp to MCP servers list (#645)

Commits

• 3df4c5b chore: release v0.16.0 (#652)
• 021a431 chore: upgrade reqwest to 0.13.2 (#669)
• 0b53bfd fix: remove unnecessary doc-cfg (#661)
• 5a6ff1f fix: duplicate meta serialization (#662)
• 61ffba8 fix: sort list_all() output in ToolRouter and PromptRouter for deterministic ...
• 53cd5ed chore(deps): update toml requirement from 0.9 to 1.0 (#668)
• 08a5b05 fix: align task response types with MCP spec (#658)
• 453032f chore: include LICENSE in final crate tarball (#657)
• 016b7d3 feat: add support for custom HTTP headers in StreamableHttpClient (#655)
• 70f6380 chore(deps): update rand requirement from 0.9 to 0.10 (#650)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
Dependency-only change, but it touches networking/storage and DB pooling stacks and introduces a second reqwest major version, which can cause subtle runtime/feature or build issues.

Overview
Upgrades Rust dependencies across the workspace: aws-sdk-s3 to 1.124 (used by api/services), deadpool to 0.13 (used by database), native-tls to 0.2.18, and rmcp to 0.16.

Refreshes Cargo.lock accordingly, including new/updated AWS Smithy crates and pulling in reqwest 0.13.2 (alongside existing reqwest 0.12.28) via the rmcp update.

^{Written by Cursor Bugbot for commit 1014e96. This will update automatically on new commits. Configure here.}