chore(deps): bump the tokio group across 1 directory with 2 updates

[dependabot]

Bumps the tokio group with 2 updates in the / directory: tokio and tokio-tungstenite.

Updates tokio from 1.52.2 to 1.52.3

Release notes

Sourced from tokio's releases.

Tokio v1.52.3

1.52.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• sync: require that an RwLock has max_readers != 0 (#8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#8074)

#8062: tokio-rs/tokio#8062 #8074: tokio-rs/tokio#8074 #8075: tokio-rs/tokio#8075 #8076: tokio-rs/tokio#8076

Commits

• d875691 chore: prepare Tokio v1.52.3 (#8130)
• e1aebb0 Merge 'tokio-1.51.3' into 'tokio-1.52.x' (#8129)
• fd63094 chore: prepare Tokio v1.51.3 (#8127)
• 8c600d0 Merge 'tokio-1.47.5' into 'tokio-1.51.x' (#8123)
• 11bfc13 chore: prepare Tokio v1.47.5 (#8122)
• f085b62 sync: notify receivers in mpsc OwnedPermit::release() method (#8075)
• 30d25cc sync: require that an RwLock has max_readers != 0 (#8076)
• 9fccf53 sync: return Empty from try_recv() when mpsc is closed with outstanding p...
• ebf61b4 sync: fix underflow in mpsc channel len() (#8062)
• See full diff in compare view

Updates tokio-tungstenite from 0.20.1 to 0.29.0

Changelog

Sourced from tokio-tungstenite's changelog.

0.29.0

• Update tungstenite to 0.29.0. See tungstenite release.

0.28.0

• Update tungstenite to 0.28.0. See tungstenite release.

0.27.0

• See performance updates in tungstenite-rs.

0.26.2

• Update tungstenite, see changes here.

0.26.1

• Update tungstenite to address an issue that might cause UB in certain cases.

0.26.0

• Update tungstenite to 0.26.0 (breaking changes).

0.25.0

• Update tungstenite to 0.25.0 (important updates!).

0.24.0

• Update dependencies (TLS, tungstenite).
• Return a runtime error when WSS URLs are used without a proper TLS feature enabled.

0.23.1

• Introduce a url feature (proxies to tungstenite/url).

0.23.0

• Update tungstenite to 0.23.0.
• Disable default features on TLS crates.

0.22.0

• Update TLS dependencies.
• Update tungstenite to match 0.22.0.

0.21.0

• Update TLS dependencies.

... (truncated)

Commits

• 7930ff2 Bump version
• 38d0465 Update Readme (#369)
• 35d110c Implement into_inner to get the underlying stream (#367)
• f3ae75d Update tungstenite version and fix bugs
• 25b544e Allow getting a reference to the shared inner stream (#363)
• e855f9e Fix errors in the examples caused by Utf8Error
• 21c5d19 Bump version
• fbd1471 Update performance notes in README
• a8d9f19 Bump version
• aafb2f9 Bump version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b0cc526c5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve websocket buffer sizing

With this bump, every Vector websocket connection that uses tungstenite defaults now gets the newer WebSocketConfig::read_buffer_size default of 128 KiB, and that buffer is eagerly allocated. The websocket client path currently calls WebSocketConfig::default() in src/common/websocket.rs, and the websocket server path uses accept_hdr_async without passing a config, so deployments with many websocket source/server connections can see a large RSS increase compared with the old 0.20.x defaults unless we explicitly configure the previous smaller read buffer.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Regenerate the license inventory

Because this bump removes tungstenite's transitive utf-8 dependency from Cargo.lock but leaves LICENSE-3rdparty.csv unchanged, make check-licenses/CI will still see an inventory entry for a crate no longer in the resolved dependency graph. Regenerate the license inventory (e.g. make build-licenses) as part of this dependency update so the packaged third-party license list matches the lockfile.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Migrate websocket handshakes to http 1

Upgrading to tokio-tungstenite 0.29 also moves tungstenite's handshake Request/Response types from http 0.2 to http 1, but the websocket paths still pass those values to helpers typed against this crate's http 0.2 API (auth.apply(&mut request) in the client connector, and auth.handle_auth(..., req.headers(), ...) plus StatusCode::UNAUTHORIZED in the server callback). Enabling sources-websocket or sinks-websocket-server will fail to build until these handshakes use http-1-compatible types or explicitly convert between versions.

Useful? React with 👍 / 👎.