chore(deps): fuse the actionable dependabot updates

[LKSNDRTMLKV]

Fuses the actionable open dependabot updates into one branch, and records why the remaining two are not actionable.

Supersedes #180, #182, #184 and #185. #181 (aws-sdk-s3) closed itself when main took 1.144.0 as part of the lru advisory fix.

What is in

update	from → to	source
rust (docker images)	1.97-slim-bookworm → 1.98	#180
redis	1.5.0 → 1.6.0	#182
uuid	1.24.0 → 1.26.0	#184
Swatinem/rust-cache, taiki-e/install-action, docker/setup-buildx-action	pinned SHAs	#185

uuid lands on 1.26.0 rather than the 1.25.0 that PR proposed — same requirement, current latest.

The docker and actions updates are cherry-picked from their own branches so authorship is preserved. The two Cargo updates are applied as a single cargo update -p redis -p uuid rather than cherry-picked, because each of those PRs carries a whole Cargo.lock written against a main that has since moved through the 0.19.0 repin — picking them would have been three lockfile conflict resolutions to arrive at a lock cargo can regenerate exactly.

What is deliberately out, and why it stays out

#183 (x509-cert 0.2 → 0.3) and #186 (const-oid 0.9 → 0.10) cannot be taken, individually or together.

They are one release train with der and spki. Applying x509-cert 0.3 puts der 0.8 in the graph beside the der 0.7 that cms 0.2 pins, and the two do not interoperate — dpp-seal fails with 24 errors, of the shape AlgorithmIdentifier<x509_cert::der::Any> no longer satisfying der::DerOrd, plus tbs_certificate becoming private. Tried on its own, const-oid 0.10 fails 7 ways for the same reason.

The only cms built on that train is 0.3.0-pre.2, which requires der ^0.8.0-rc.10, x509-cert ^0.3.0-rc.4 and rsa ^0.10.0-rc.14. Three release candidates under dpp-seal — the eIDAS qualified seal adapter, the code path that produces signatures carrying legal weight. There is also no pressure to move: cargo audit is clean on the current versions and cargo-deny passes bans, licenses and sources.

And it would quietly reopen a settled decision. cms is pinned default-features = false specifically to keep rsa and RUSTSEC-2023-0071 out of the tree; cms 0.3-pre wants an rsa RC, so that avoidance would have to be re-derived rather than inherited.

So this branch adds an ignore block to .github/dependabot.yml for those two crates, carrying that reasoning and an explicit trigger: return when cms 0.3.0 is published — not a pre-release — and bump the whole formats stack in one PR, re-verifying the rsa feature check rather than assuming it.

The reasoning lives in the config rather than in a closed PR comment, so the next person to meet these updates finds it where they are looking.

Verification

just check — green: 871 tests, clippy, fmt, doc, the debug/subject/mod-rs gates, and cargo-deny (bans, licenses, sources ok).

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}