build(deps): bump mdns-sd from 0.11.5 to 0.21.3

[dependabot]

Bumps mdns-sd from 0.11.5 to 0.21.3.

Release notes

Sourced from mdns-sd's releases.

v0.21.3

This is a bugfix release that improves RFC 6762 section 6.7 compliance for legacy unicast responses.

Bug fixes

• Echo the querier's message id in legacy unicast responses, per RFC 6762 section 6.7. (#498)
• Cap the resource record TTL to 10 seconds in legacy unicast responses, per RFC 6762 section 6.7. (#504)
• Replace assert with assert_eq in tests where possible for clearer failure output. (#456)

What's Changed

• fix: echo query id in legacy unicast responses (#496) by @​keepsimple1 in keepsimple1/mdns-sd#498
• feat: replace assert with assert_eq where possible by @​CosminPerRam in keepsimple1/mdns-sd#456
• fix: cap TTL to 10s in legacy unicast responses by @​keepsimple1 in keepsimple1/mdns-sd#504
• prepare for a new release 0.21.3 by @​keepsimple1 in keepsimple1/mdns-sd#505

Full Changelog: keepsimple1/mdns-sd@v0.21.2...v0.21.3

v0.21.2

This is a bugfix release.

Bug fixes / improvements

• Fix an out-of-bounds panic parsing a truncated HINFO record: read_char_string now checks that the length octet is present instead of indexing past the end of the packet. Found by fuzzing the packet parser. (#499)
• Remove the raw packet dump from parse-failure messages, which is no longer needed for triage and can be troublesome when the packet is large. (#501)
• Remove the duplicated TXT decoding in dns_parser: it now uses the canonical TxtProperty in service_info instead of its own copy. (#500)
• Add fuzzing support under fuzz/ with a parse_packet target covering DnsIncoming::new, plus a fuzz build in CI. Publishing is unaffected: cargo package still excludes fuzz/. (#502)

What's Changed

• fix: out-of-bounds panic parsing a truncated HINFO record by @​keepsimple1 in keepsimple1/mdns-sd#499
• refactoring: remove the duplicated TXT decoding in dns_parser by @​keepsimple1 in keepsimple1/mdns-sd#500
• fix: bound the raw packet dump in parse-failure messages by @​keepsimple1 in keepsimple1/mdns-sd#501
• tests: add fuzzing support with a packet parser target by @​keepsimple1 in keepsimple1/mdns-sd#502
• prepare for a new release 0.21.2 by @​keepsimple1 in keepsimple1/mdns-sd#503

Full Changelog: keepsimple1/mdns-sd@v0.21.1...v0.21.2

v0.21.1

This is a bugfix release.

Bug fixes / improvements

• Send goodbye (TTL=0) packets under conflict-resolved names. When probing renames a record due to a name conflict (RFC 6762 section 9), now the goodbye carries the updated names peers actually observed. (#495, commit fe525a6)
• Harden DNS name parsing (read_name) and name compression handling: skip only the malformed record instead of the whole packet. (#492, commit 5bf6b7c)

What's Changed

• fix: send goodbye packets under conflict-resolved names by @​dhavli in keepsimple1/mdns-sd#495
• refactoring: read_name and name compression by @​keepsimple1 in keepsimple1/mdns-sd#492
• prepare for a new release 0.21.1 by @​keepsimple1 in keepsimple1/mdns-sd#497

... (truncated)

Changelog

Sourced from mdns-sd's changelog.

Version 0.21.3 (2026-09-07)

This is a bugfix release that improves RFC 6762 section 6.7 compliance for legacy unicast responses.

Bug fixes / improvements

• Echo the querier's message id in legacy unicast responses, per RFC 6762 section 6.7. (#498)
• Cap the resource record TTL to 10 seconds in legacy unicast responses, per RFC 6762 section 6.7. (#504)
• Replace assert with assert_eq in tests where possible for clearer failure output. (#456)

All changes

• b61fee3 2026-09-07 fix: echo query id in legacy unicast responses (#498) (keepsimple1)
• 217ed5a 2026-09-07 test: replace assert with assert_eq where possible (#456) (CosminPerRam)
• d8ab875 2026-09-07 fix: cap TTL to 10s in legacy unicast responses (#504) (keepsimple1)
• 0ec8df3 2026-09-07 fix clippy (keepsimple1)

Version 0.21.2 (2026-09-05)

This is a bugfix release.

Bug fixes / improvements

• Fix an out-of-bounds panic parsing a truncated HINFO record: read_char_string now checks that the length octet is present instead of indexing past the end of the packet. Found by fuzzing the packet parser. (#499, commit c65dd3c)
• Remove the raw packet dump from parse-failure messages, which is no longer needed for triage and can be troublesome when the packet is large. (#501, commit 30a22cf)
• Remove the duplicated TXT decoding in dns_parser: it now uses the canonical TxtProperty in service_info instead of its own copy. (#500, commit a6af4b5)
• Add fuzzing support under fuzz/ with a parse_packet target covering DnsIncoming::new, plus a fuzz build in CI. Publishing is unaffected: cargo package still excludes fuzz/. (#502, commit 3656343)

All changes

• c65dd3c 2026-09-03 fix: out-of-bounds panic parsing a truncated HINFO record (#499) (keepsimple1)
• a6af4b5 2026-09-03 refactoring: remove the duplicated TXT decoding in dns_parser (#500) (keepsimple1)
• 30a22cf 2026-09-04 fix: bound the raw packet dump in parse-failure messages (#501) (keepsimple1)
• 3656343 2026-09-04 tests: add fuzzing support with a packet parser target (#502) (keepsimple1)

Version 0.21.1 (2026-08-30)

This is a bugfix release.

Bug fixes / improvements

... (truncated)

Commits

• da41a9c prepare for a new release 0.21.3 (#505)
• d8ab875 fix: cap TTL to 10s in legacy unicast responses (#504)
• 217ed5a test: replace assert with assert_eq where possible (#456)
• b61fee3 fix: echo query id in legacy unicast responses (#498)
• 725eb85 prepare for a new release 0.21.2 (#503)
• 3656343 tests: add fuzzing support with a packet parser target (#502)
• 30a22cf fix: bound the raw packet dump in parse-failure messages (#501)
• a6af4b5 refactoring: remove the duplicated TXT decoding in dns_parser (#500)
• c65dd3c fix: out-of-bounds panic parsing a truncated HINFO record (#499)
• 8616315 prepare for a new release 0.21.1 (#497)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[greptile-apps]

Greptile Summary

Updating mdns-sd to 0.21.3 breaks the workspace mDNS integration. cortex-app-server cannot compile because cortex-engine still expects the older resolved-service payload and channel timeout-error types.

Confidence Score: 4/5

Not safe to merge until the mDNS callers are updated, because a dependent application package fails to compile.

The reproduced build failure prevents cortex-app-server from compiling after the dependency update.

Files Needing Attention: src/cortex-engine/src/mdns/browser.rs needs adaptation for the updated mdns-sd resolved-service API and its channel timeout-error type. src/cortex-app-server/src/mdns.rs also has resolved-service consumers to verify after the engine is fixed.

T-Rex Logs

What T-Rex did

• T-Rex produced a proof for a posted P1 finding and attached it to the corresponding review comment.
• T-Rex produced a second proof for a posted P1 finding and attached it to the related review comment.
• T-Rex performed a general contract validation, confirming a cargo check offline failure caused by mdns-sd and flume version conflicts, and documented the exact affected source locations.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   mdns-sd 0.21.3 breaks cortex-app-server through incompatible cortex-engine mDNS call sites

   • Bug
     • The narrow locked offline check for cortex-app-server exits 101 because cortex-engine has six E0308 type errors after the mdns-sd upgrade. ServiceResolved values are now Box<ResolvedService> rather than the ServiceInfo accepted by the existing converter, and the direct flume 0.11 error enum cannot match mdns-sd's flume 0.12 receiver error enum.
   • Cause
     • The dependency bump changes both the ServiceEvent::ServiceResolved payload API and the transitive flume version, but existing cortex-engine source retains the mdns-sd 0.11-era ServiceInfo and direct flume 0.11 assumptions.
   • Fix
     • Update the mDNS integration for mdns-sd 0.21.3: adapt from_mdns_info and both resolved-event call sites to the new resolved-service API, and match/re-export mdns-sd's receiver timeout error or otherwise align the flume dependency. Re-run the locked package check afterward.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "build(deps): bump mdns-sd from 0.11.5 to..." | Re-trigger Greptile}

[greptile-apps]

Restore mDNS compatibility

Updating mdns-sd to 0.21.3 leaves cortex-engine using the older mDNS API. Resolved events now contain Box<ResolvedService> rather than the ServiceInfo accepted by the existing converter, and the returned timeout error comes from flume 0.12 while the caller matches the direct flume 0.11 type. Consequently, cortex-app-server fails to compile with six type errors. Update the resolved-service handling and align the channel error type before merging.

Artifacts

Evidence from the check

• The read-only script creates a detached pre-upgrade worktree, runs the matching narrow Cargo checks, and captures the dependency diff and mDNS call sites; it is the complete executed source.

Command output from the check

• The matching Cargo check was run against HEAD^ and stopped during offline dependency resolution because the local cache lacks polling required by mdns-sd 0.11.5; the before build result cannot be established offline.

Command output from the check

• The locked offline Cargo check was run against the upgraded revision and reports six E0308 errors in cortex-engine for ServiceResolved and flume timeout-error incompatibilities; the upgrade breaks the build.

Command output from the check

• The captured command output shows mdns-sd changing from 0.11.5 to 0.21.3, flume 0.12.0 entering the lockfile, and the exact cortex-engine and cortex-app-server ServiceResolved call sites; the incompatibilities map directly to current source.

_{Ran code and verified through T-Rex}