[loonghao]

What this fixes

Two independent dependency blockers, each gating a queued renovate bump. They share no code path, but both must clear before the renovate queue can drain.

1. async-trait 0.1.89 -> 0.1.92 — unblocks chore(deps): update rust to v1.99.0

clippy 1.99.0 adds the double_must_use lint. async-trait 0.1.89 emits a redundant #[must_use] on the boxed future returned by every #[async_trait] method, so under -D warnings the Code Quality (via vx) job fails:

error: this function has a `#[must_use]` attribute with no message,
       but returns a type already considered as `#[must_use]`
  --> crates/vx-ecosystem-pm/src/traits.rs:17:15
  --> crates/vx-versions/src/fetch_context.rs:12:28

Reproduced locally with cargo +1.99.0 clippy -p vx-ecosystem-pm -p vx-versions --all-targets -- -D warnings -Aasync-fn-in-trait: 1 error in vx-ecosystem-pm and 2 in vx-versions, matching CI exactly.

async-trait 0.1.92 drops the redundant attribute, so the lint no longer fires. No #[allow] is needed, which keeps the lint working where it is a real signal.

2. renovate: cap tracing-opentelemetry below 0.34.0

tracing-opentelemetry 0.34.0 builds against opentelemetry 0.33.0, while this repo already pins the opentelemetry monorepo below 0.33.0 (added in #1127). Taking the tracing-opentelemetry bump on its own splits the dependency graph:

error[E0277]: the trait bound `SdkTracer: opentelemetry::trace::tracer::Tracer` is not satisfied
  = note: there are multiple different versions of crate `opentelemetry` in the dependency graph
      opentelemetry-0.33.0  <- expected trait
      opentelemetry-0.32.0  <- found trait
error[E0599]: the method `with_filter` exists for struct `OpenTelemetryLayer<_, SdkTracer>`,
              but its trait bounds were not satisfied
error: could not compile `vx-metrics` (lib) due to 3 previous errors

That breaks Build vx on every platform, plus Build vx binary, Benchmark, Analyze (CodeQL via vx) and Docker Success.

This adds a tracing-opentelemetry cap next to the existing monorepo cap and refreshes the stale rationale on the monorepo rule, which still described 0.33.0 as the newest tracing-opentelemetry release. Both caps should be lifted together when the monorepo is ready to move to 0.33.

With the cap in place renovate stops proposing the bump, so PR #1158 can be closed rather than fixed.

Verification

• cargo +1.99.0 clippy -p vx-ecosystem-pm -p vx-versions --all-targets -- -D warnings -Aasync-fn-in-trait — exit 0 (was exit 101 with 3 errors)
• cargo check --workspace --all-targets — exit 0
• renovate.json parses as valid JSON
• No new packages enter the lockfile: 0.1.92 moves from syn 2.0.119 to syn 3.0.6, both already present

Notes

• This supersedes the pending async-trait lockfile bump in chore(deps): update rust crate async-trait to v0.1.92 #1043, which makes the same change.
• Four renovate PRs also fail Test (Linux-x86_64) - Full on the node / cross_tool e2e groups. That is a separate, environmental cause already fixed on main by fix: harden 7z path-traversal test and preinstall Node on Linux CI #1216 (preinstall Node on Linux CI) and the e2e process-capture fix; those branches need a rebase, not a code change. A plain CI re-run will not help them, because the fix lives in .github/workflows/ci.yml rather than in the product code.

Security follow-up (2026-10-16)

• Updated the inherited rustls lock entry from 0.23.45 to 0.23.46; this follow-up changes only its version and registry checksum, with the dependency graph unchanged. Current head: 40eee51c4e96f4467c95e62d7975abcb642d91e7.
• Current-head CI completed: 38 successful checks and 18 intentionally skipped checks, with no failures or pending checks. Full native suites passed on Linux (4,289), macOS (4,292), and Windows (4,313), with no retry-absorbed failures. Independent review found no blocking issue in this bounded dependency change. The audit job's green status is not used as security validation.
• The existing audit recipe suppresses command failures. Its current-head job log reports three vulnerabilities and seven denied warnings even though the job is green. This PR does not claim a clean audit or add advisory ignores.
• The remaining dependency findings and audit error propagation are separate work. The unsafe optional public archive 7z extraction path is addressed by fix(archive): validate 7z entry paths before extraction #1226; the current CLI does not use that crate.