[dependabot]

Bumps the production-dependencies group with 3 updates: cc, rmcp and zip.

Updates cc from 1.11.0 to 1.11.1

Release notes

Sourced from cc's releases.

cc-v1.11.1

Fixed

• (target-parsing) wasm32-none-component (#2056)

Changelog

Sourced from cc's changelog.

1.11.1 - 2026-11-06

Fixed

• (target-parsing) wasm32-none-component (#2056)

Commits

• 401b5a6 chore(cc): release v1.11.1 (#2087)
• f8de725 ci(deps): bump tombi-toml/setup-tombi from 1.9.7 to 1.9.8 (#2085)
• 3844867 ci(deps): bump tombi-toml/setup-tombi from 1.9.6 to 1.9.7 (#2083)
• 3a0f2a3 ci(deps): bump release-plz/action from 0.5.146 to 0.5.147 (#2081)
• 568f5e1 chore(ci): Install cuda for ubuntu-26.04 (#2082)
• 499d43e fix(target-parsing): wasm32-none-component (#2056)
• 995643d ci(deps): bump tombi-toml/setup-tombi from 1.9.1 to 1.9.6 (#2077)
• 0e224ff ci(deps): bump release-plz/action from 0.5.145 to 0.5.146 (#2079)
• See full diff in compare view

Updates rmcp from 3.8.0 to 3.9.0

Release notes

Sourced from rmcp's releases.

rmcp-macros-v3.9.0

Other

• add Voltip to built with rmcp list (#1401)

rmcp-v3.9.0

Added

• (auth) structure protected resource discovery errors (#1305)
• (transport) log followed same-origin redirects at debug level (#1417)
• support the Skills extension (SEP-2640) (#1392)

Fixed

• (model) don't treat _meta alone as a CallToolResult (#1405)
• (client) keep ProgressDispatcher lock off the await path (#1310)
• (auth) refresh with only granted scopes (#1331)
• streamable-http server: stateful session workers ignore config.canc (#1427)
• (skills) enforce manifest boundaries and capability negotiation (#1412)
• (transport) send SIGTERM before killing a child process on graceful shutdown (#1379)
• (handler) generate a tool's outputSchema for the serialize contract (#1378)
• (server) reject server-to-client requests on discover sessions (#1397)
• (auth) accept ID-JAGs without a resource claim (#1406)
• (rmcp) reject Mcp-Param headers with invalid characters (#1414)
• (transport) match explicit HTTP media types and Accept quality values (#1382)
• (model) accept URL elicitation requests without elicitationId (#1383)
• (transport) preserve protocol error replies across cancellation (#1370)

Other

• (transport) fix spell-check failures in response-limit tests (#1432)
• Merge commit from fork
• (deps) update rstest requirement from 0.27.0 to 0.28.0 (#1422)
• (client) point on_*_list_changed callbacks to Peer::listen (#1402)
• add Voltip to built with rmcp list (#1401)

Commits

• 5596a8a chore: release v3.9.0 (#1403)
• 429524d fix(model): don't treat _meta alone as a CallToolResult (#1405)
• e7d201f test(transport): fix spell-check failures in response-limit tests (#1432)
• 3e0156c Merge commit from fork
• d66a74d fix(client): keep ProgressDispatcher lock off the await path (#1310)
• 09d29d9 fix(auth): refresh with only granted scopes (#1331)
• 8878a79 fix: streamable-http server: stateful session workers ignore config.canc (#1427)
• 3fc54d0 fix(skills): enforce manifest boundaries and capability negotiation (#1412)
• b166e81 fix(transport): send SIGTERM before killing a child process on graceful shutd...
• df2af23 fix(handler): generate a tool's outputSchema for the serialize contract (#1378)
• Additional commits viewable in compare view

Updates zip from 9.3.0 to 9.4.1

Release notes

Sourced from zip's releases.

v9.4.1

🐛 Bug Fixes

• Add a OwnedZipFileEntry for #177 (#1270)

🚜 Refactor

• Use boxed slices instead of Vec when growability isn't needed (#1271)

v9.4.0

🚀 Features

• Implement ZipIterable::files_with_reader (#1267)

Changelog

Sourced from zip's changelog.

9.4.1 - 2026-11-06

🐛 Bug Fixes

• Add a OwnedZipFileEntry for #177 (#1270)

🚜 Refactor

• Use boxed slices instead of Vec when growability isn't needed (#1271)

9.4.0 - 2026-11-05

🚀 Features

• Implement ZipIterable::files_with_reader (#1267)

Commits

• 96e8cce chore: release v9.4.1 (#1272)
• f1b82f2 docs(example): Fix bug in memory-tracking example where reallocations were co...
• 2308d6d refactor: Use boxed slices instead of Vec when growability isn't needed (#1271)
• b3ad5df fix: Add a OwnedZipFileEntry for #177 (#1270)
• 196b805 chore(deps): update lzma-rust2 from 0.24 to 0.25 (#1268)
• f347dd4 chore: release v9.4.0 (#1269)
• e9b7dcd feat: Implement ZipIterable::files_with_reader (#1267)
• 47765a9 docs(security): Clarify that some "vulnerabilities" are necessary for legitim...
• 53cfe46 ci(deps): bump useblacksmith/checkout from 1.8.1 to 1.8.2 (#1260)
• b66f6b1 ci(deps): bump step-security/harden-runner from 2.22.2 to 2.22.3 (#1262)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: doublegate/RustyNES
• Branch: main
• File: .coderabbit.yaml
• Commit: 5459dce
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 338b772c-481f-4699-a2a3-4872d69654df

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​rmcp@​3.8.0 ⏵ 3.9.0	+1
	cargo/​cc@​1.11.0 ⏵ 1.11.1
	cargo/​zip@​9.3.0 ⏵ 9.4.1

View full report

[github-actions]

Antigravity review (Gemini via Ultra)

Bumps three locked dependencies in Cargo.lock (cc 1.11.0 → 1.11.1, rmcp 3.8.0 → 3.9.0, and zip 9.3.0 → 9.4.1) with no manifest changes.

Blocking issues

None found.

Suggestions

• crates/rustynes-mcp/Cargo.toml:34: rmcp is declared with a three-component floor (version = "3.8.0"). If nothing requires holding the manifest floor at 3.8.0, consider either bumping the manifest requirement to "3.9.0" to match the lockfile or relaxing it to "3.9" / "3" for consistency with how zip (version = "9") and other crate dependencies are specified.

Nitpicks

• Cargo.lock:4370: rmcp 3.9.0 adds a dependency on sha2 0.11.1 (disambiguated in the lockfile because transitive sha2 0.10.x is also locked via optional ratatui-termwiz). It resolves to the same 0.11.1 package already selected by workspace Cargo.toml:139, so no new duplicate crate version is introduced; this is a trivial lockfile-only maintenance update.

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}