[dependabot]

Bumps pingora-runtime from 0.9.0 to 0.9.1.

Release notes

Sourced from pingora-runtime's releases.

Pingora 0.9.1

0.9.1 - 2026-11-02

🐛 Bug Fixes

• Fix a panic on every accepted and outgoing connection with tokio 1.54 and later, which rejects zero-capacity buffered readers (#1059).
• Fix the docs.rs build of the pingora crate, which failed for 0.9.0 (#1018).
• Fix a panic in pingora-limits Estimator::incr when a counter overflows in builds with overflow checks enabled (#1041).

🔒 Security

• Require zstd 0.14.3, and through it zstd-safe 8.2.0 and zstd-sys 2.1.2, so dependency resolution cannot select zstd crates affected by RUSTSEC-2026-0391, RUSTSEC-2026-0395 through RUSTSEC-2026-0406, or RUSTSEC-2026-0410.

⚙️ Miscellaneous Tasks

• Ignore RustSec advisories for rustls 0.21, webpki-roots 0.26, rustls-webpki 0.101 and crypto-bigint 0.5.5, which reach the lockfile only through optional transitive dependencies and have no compatible fixed release.
• Update HTTP/2 rejection tests for h2 releases that reject conflicting Content-Length headers in the codec.

Changelog

Sourced from pingora-runtime's changelog.

0.9.1 - 2026-11-02

🔒 Security

• Require zstd 0.14.3, and through it zstd-safe 8.2.0 and zstd-sys 2.1.2, so dependency resolution cannot select zstd crates affected by RUSTSEC-2026-0391, RUSTSEC-2026-0395 through RUSTSEC-2026-0406, or RUSTSEC-2026-0410.

🐛 Bug Fixes

• Fix a panic on every accepted and outgoing connection with tokio 1.54 and later, which rejects zero-capacity buffered readers (#1059).
• Fix the docs.rs build of the pingora crate, which failed for 0.9.0 (#1018).
• Fix a panic in pingora-limits Estimator::incr when a counter overflows in builds with overflow checks enabled (#1041).

⚙️ Miscellaneous Tasks

• Ignore RustSec advisories for rustls 0.21, webpki-roots 0.26, rustls-webpki 0.101 and crypto-bigint 0.5.5, which reach the lockfile only through optional transitive dependencies and have no compatible fixed release.
• Update HTTP/2 rejection tests for h2 releases that reject conflicting Content-Length headers in the codec.

Commits

• f86ffda Release 0.9.1
• 96e9abd Enable Tokio unstable APIs for docs.rs
• daaabc1 Bump zstd to 0.14.3 for RUSTSEC-2026-0403
• db5f927 Ignore the transitive crypto-bigint 0.5.5 advisory
• c910121 Ignore transitive webpki-roots 0.26 and rustls-webpki 0.101 advisories
• 572e044 Keep zero-capacity L4 read buffers working on tokio 1.54
• 1ba3ad8 test: cover HTTP/2 rejection across codec versions
• 705d3ed Ignore rustls 0.21 advisories from the legacy aws-sdk-s3 chain
• 698c645 fix(limits): use wrapping addition for estimator increments
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)