tinyhumansai · dependabot · Aug 18, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/api/Cargo.toml b/api/Cargo.toml
@@ -60,7 +60,7 @@ uuid = { version = "1", features = ["v4"] }
 [dev-dependencies]
 # The moved `host::` config sections are parsed from TOML in their own tests,
 # exactly as the host parses them from `config.toml`.
-toml = "0.9"
+toml = "1.1"
 # The mandatory-composition tests are async — they drive a `MemoryProvider`.
 # Dev-only, so it does not touch the forbidden-dependency rule this crate's
 # manifest enforces for its normal graph (#18 §D4).

diff --git a/sources/Cargo.toml b/sources/Cargo.toml
@@ -41,7 +41,7 @@ chrono = { version = "0.4", features = ["serde"], optional = true }
 # The GitHub reader shells out to `git` for clones.
 tokio = { version = "1", features = ["process", "io-util"], optional = true }
 # The registry is the host's `sources.toml`: it reads, mutates and rewrites it.
-toml = "0.9"
+toml = "1.1"
 # New sources get a generated id.
 uuid = { version = "1", features = ["v4"] }