Update salvo requirement from 0.93 to 0.94

[dependabot]

Updates the requirements on salvo to permit the latest version.

Release notes

Sourced from salvo's releases.

v0.94.0

Salvo 0.94.0 focuses on security hardening, OpenAPI 3.1 correctness, lower runtime overhead in core routing/dispatch paths, and API naming cleanup. This release also raises the Rust MSRV to 1.94.

Highlights

• Rust MSRV is now 1.94.
• Core routing and dispatch were reworked to reduce per-request allocations and improve path parameter rollback.
• Server lifecycle control is clearer, with Server::max_connections, ConnCtrl, improved graceful/forceful shutdown behavior, and safer default connection fuse protection.
• OpenAPI generation is closer to OpenAPI 3.1: jsonSchemaDialect, webhooks, reusable components, PathItem refs, parameter content/examples/allowEmptyValue, and stricter required path parameters.
• Security hardening landed across proxying, CORS, CSRF, static files, default error pages, JWT/OIDC, WebSocket upgrades, tus uploads, cookies, and ACME.
• Response rendering semantics are documented and tightened: text-like scribes append, while Json<T> now replaces previously buffered body bytes because JSON is a complete document.
• salvo-tus exposes storage/locking types, adds Tus::storage_root, and adds Tus::absolute_location for safe absolute Location URLs.

Migration Guide

Rust

Update your toolchain to Rust 1.94 or newer.

rustup update stable

Core API naming

Several old names remain as deprecated aliases, but new code should use the clearer names:

Old	New
Depot::inject(value)	Depot::insert_typed(value)
Depot::obtain::<T>()	Depot::get_typed::<T>()
Depot::obtain_mut::<T>()	Depot::get_typed_mut::<T>()
Depot::contains::<T>()	Depot::contains_typed::<T>()
Depot::scrape::<T>()	Depot::remove_typed::<T>()
Depot::delete(key)	Depot::remove(key).is_some()
Response::stuff(status, value)	Response::render_with_status(status, value)
Server::stop_forcible()	Server::stop_forceful()
ServerHandle::stop_forcible()	ServerHandle::stop_forceful()
SchemeFilter::lack(...)	SchemeFilter::fallback(...)
HostFilter::lack(...)	HostFilter::fallback(...)
PortFilter::lack(...)	PortFilter::fallback(...)
StatusError::request_header_fields_toolarge()	StatusError::request_header_fields_too_large()
StatusError::unavailable_for_legalreasons()	StatusError::unavailable_for_legal_reasons()
AcmeListener::get_directory(...)	AcmeListener::directory(...)

Depot now has separate named and type-keyed storage. Use insert/get/remove for string keys and insert_typed/get_typed/remove_typed for type keys. Capacity and inner() refer to named storage.

Response body rendering

... (truncated)

Commits

• 4d31061 cargo fmt
• 408e2d3 version 0.94.0
• ba417be cargo fmt
• 8623f64 Make sliding-window timing test robust against CI sleep overshoot (#1662)
• 314ec5b Qualify the form_data size-limit guarantee in FilePart docs (#1661)
• 03c15c1 build(deps): update criterion requirement from 0.7 to 0.8 (#1659)
• 137f024 Add deprecated core migration aliases (#1660)
• 5553d18 Rework connection protection, lifecycle control, and router matching to reduc...
• 2e6d181 Bump Rust MSRV to 1.94 (#1658)
• d1365f0 feat(oapi): add endpoint attribute aliases (#1652)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #45.