Update rust dependencies (dev) (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
axum-client-ip	dependencies	major	0.7 → 1.0
vergen-git2	build-dependencies	major	9.1 → 10.0

---

Release Notes

rustyhorde/vergen (vergen-git2)

v10.0.1: vergen 10.0.1

Compare Source

vergen 10.0.1

Patch release adding a new error-fallback knob, a builder-access API addition, dependency updates, and a security-audit refresh.

New features

• VERGEN_DEFAULT_ON_ERROR fallback (#​509) — When building outside a git worktree (or any time an instruction cannot be generated), the new VERGEN_DEFAULT_ON_ERROR env var and Emitter::default_on_error() builder method populate missing instructions with the idempotent default (VERGEN_IDEMPOTENT_OUTPUT) so env!("VERGEN_GIT_SHA") keeps compiling — while builds inside a real worktree still emit real values.
• all() builder accessor (#​513) — Exposes Build::all(), Cargo::all(), Rustc::all(), and Sysinfo::all() as public methods that return the builder with all instructions enabled, enabling subtractive modification (turn all on, then selectively disable).

Dependency updates

• bon 3.9.1 → 3.9.3
• gix 0.84.0 → 0.85.0
• regex 1.12.3 → 1.12.4
• time 0.3.47 → 0.3.51
• sysinfo 0.39.3 → 0.39.5
• memmap2 0.9.10 → 0.9.11 (resolves RUSTSEC-2026-0186)

Security audit refresh

• Added RUSTSEC-2026-0173 ignore (proc-macro-error2 unmaintained, informational only)
• Removed RUSTSEC-2025-0055 ignore (tracing-subscriber now resolved to ≥ 0.3.20)
• Removed RUSTSEC-2025-0141 ignore (bincode no longer in the dependency tree)
• cargo audit passes clean

Other

• Fixed inaccurate fail_on_error and idempotent docs (#​509)
• Added cargo:rerun-if-changed=VERGEN_DEFAULT_ON_ERROR rerun directive
• Bumped cargo-binstall in CI (#​503)
• Parse deprecation fixes (#​505)

Full Changelog: rustyhorde/vergen@v10.0.0...10.0.1

v10.0.0: vergen 10.0.0

vergen 10.0.0

Major release of the vergen suite (vergen, vergen-lib, vergen-git2, vergen-gitcl, vergen-gix, vergen-pretty).

Highlights

• MSRV raised to 1.95.0 (#​496, prior bumps via #​487, #​440).
• Raw Unix-seconds timestamps — emit build timestamps as raw Unix seconds (#​444).
• SOURCE_DATE_EPOCH decoupling plus a .cargo_vcs_info.json fallback for reproducible builds when building from a published crate without a git repo (#​452, #​448).
• Remote URL support for git functionality (#​459).
• GIT_DIRTY instruction documented and dirty-output fixes for vergen-gix (#​465, #​423).

Internal / maintenance

• Replaced getset with hand-written getters in vergen-lib (#​491).
• Removed bincode from vergen-pretty (#​481).
• Added a cargo-semver-checks CI job (#​478).
• Numerous dependency updates, including gix bumps to address RUSTSEC advisories (#​473, #​488, #​490).
• CI: skip coverage jobs for forked PRs (#​492), pinning + parallelization (#​496).
• Lint and doc fixes across the workspace.

Full Changelog: rustyhorde/vergen@vergen_9.0.6...v10.0.0

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.