build(deps): bump the rust group across 1 directory with 5 updates

[dependabot]

Bumps the rust group with 5 updates in the / directory:

Package	From	To
clevis-pin-trustee-lib	a605f02	abb618a
k8s-openapi	0.26.1	0.27.0
serde_json	1.0.148	1.0.149
thiserror	2.0.17	2.0.18
tower	0.5.2	0.5.3

Updates clevis-pin-trustee-lib from a605f02 to abb618a

Commits

• abb618a Merge pull request #19 from latchset/dependabot/github_actions/actions-76468c...
• b5a52aa Merge pull request #23 from alicefr/config-num-retries
• 5e834a0 Merge pull request #29 from travier/main-use-run
• 3b7df29 github/workflows: Bump lint toolchain to 1.90.0
• 0c7a35a Add configurable retries for the pin
• 87ff83f cli: Use /run instead of /var/run
• a83fbdb Merge pull request #22 from sarroutbi/202511271711-downgrade-josekit
• 60dccab build(deps): bump actions/checkout from 5 to 6 in the actions group
• fc78a34 Downgrade josekit version (0.10.3->0.7.4)
• See full diff in compare view

Updates k8s-openapi from 0.26.1 to 0.27.0

Release notes

Sourced from k8s-openapi's releases.

v0.27.0

k8s-openapi

• BREAKING CHANGE: Added support for Kubernetes 1.35 under the v1_35 feature.

• BREAKING CHANGE: Dropped support for Kubernetes 1.30.

• BREAKING CHANGE: chrono::DateTime has been replaced by jiff::Timestamp in the implementations of apimachinery::pkg::apis::meta::v1::{MicroTime, Time}.

• FEATURE: All newtypes now implement From for their inner type, eg Time impls From<jiff::Timestamp>.

Corresponding Kubernetes API server versions:

• v1.31.14
• v1.32.11
• v1.33.7
• v1.34.3
• v1.35.0

k8s-openapi-codegen-common

• No changes.

k8s-openapi-derive

• No changes except to bump the k8s-openapi-codegen-common dependency to the new version.

Changelog

Sourced from k8s-openapi's changelog.

v0.27.0 (2026-01-11)

k8s-openapi

• BREAKING CHANGE: Added support for Kubernetes 1.35 under the v1_35 feature.

• BREAKING CHANGE: Dropped support for Kubernetes 1.30.

• BREAKING CHANGE: chrono::DateTime has been replaced by jiff::Timestamp in the implementations of apimachinery::pkg::apis::meta::v1::{MicroTime, Time}.

• FEATURE: All newtypes now implement From for their inner type, eg Time impls From<jiff::Timestamp>.

Corresponding Kubernetes API server versions:

• v1.31.14
• v1.32.11
• v1.33.7
• v1.34.3
• v1.35.0

k8s-openapi-codegen-common

• No changes.

k8s-openapi-derive

• No changes except to bump the k8s-openapi-codegen-common dependency to the new version.

---

Commits

• ba38bf2 v0.27.0
• 8e34deb Update reqwest to v0.13
• 1eb93db Impl From for newtypes.
• f21871c Add v1.35.0 and drop v1.30
• f70fa6c Update to v1.32.11
• 8c1b6fc Replace chrono with jiff
• See full diff in compare view

Updates serde_json from 1.0.148 to 1.0.149

Release notes

Sourced from serde_json's releases.

v1.0.149

• Align arbitrary_precision number strings with zmij's formatting (#1306, thanks @​b41sh)

Commits

• 4f6dbfa Release 1.0.149
• f3df680 Touch up PR 1306
• e16730f Merge pull request #1306 from b41sh/fix-float-number-display
• eeb2bcd Align arbitrary_precision number strings with zmij’s formatting
• See full diff in compare view

Updates thiserror from 2.0.17 to 2.0.18

Release notes

Sourced from thiserror's releases.

2.0.18

• Make compatible with project-level needless_lifetimes = "forbid" (#443, thanks @​LucaCappelletti94)

Commits

• dc0f6a2 Release 2.0.18
• 0275292 Touch up PR 443
• 3c33bc6 Merge pull request #443 from LucaCappelletti94/master
• 995939c Reproduce issue 442
• 21653d1 Made clippy lifetime allows conditional
• 45e5388 Update actions/upload-artifact@v5 -> v6
• 386aac1 Update actions/upload-artifact@v4 -> v5
• ec50561 Update actions/checkout@v5 -> v6
• 247eab5 Update name of empty_enum clippy lint
• 91b181f Raise required compiler to Rust 1.68
• Additional commits viewable in compare view

Updates tower from 0.5.2 to 0.5.3

Release notes

Sourced from tower's releases.

tower 0.5.3

Added

• builder: Add ServiceBuilder::boxed_clone_sync() helper (#804)

Fixed

• retry: Check that supplied jitter is not NaN (#843)

#804: tower-rs/tower#804 #843: tower-rs/tower#843

Commits

• 4b0a6b0 tower v0.5.3
• 2c8524a tower v0.5.3
• 50fa4b6 ci: upgrade deny check to v2 (#847)
• 73febcd fix: Check that jitter is not NaN instead of finiteness (#843)
• 719ec03 chore: Disable unused futures feature (#838)
• 1992ebd chore(util): remove redundant ready! wrapping in poll implementations (#844)
• 21e01e9 docs: Resolve document warning (#841)
• d1b55be docs: Remove doc_auto_cfg config (#840)
• 9d876c0 ci: Update to actions/checkout v5 (#839)
• a1c277b docs: correct rng pre-requisite comment (#835)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @dependabot[bot]. Thanks for your PR.

I'm waiting for a trusted-execution-clusters member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Jakob-Naucke]

cf. #153