deps: bump vgi-rpc from 0.16.0 to 0.20.0

[dependabot]

Bumps vgi-rpc from 0.16.0 to 0.20.0.

Release notes

Sourced from vgi-rpc's releases.

v0.20.0

Added

• Access log: trace correlation. Records carry trace_id / span_id as W3C hex when a valid span is current. request_id only joins records within one service, so without these a log line and the span describing the same call cannot be matched. The ids are read from whatever span is current, via a provider installed with access_log::set_trace_context_provider, so an application-opened span correlates as readily as a framework-opened one — and so the core keeps no OpenTelemetry dependency (the otel feature is tracing-only). Ids that are not 32 / 16 lowercase hex, or are all zeroes, are dropped rather than emitted, and the pair is always emitted together or not at all.
• Access log: sampling. AccessLogHook::with_sample_rate(rate). Errors are never sampled — a rate below 1 exists because successes repeat, which failures do not. The decision is deterministic and keyed on stream_id, then request_id, so every record of one stream shares its init's fate rather than being shredded into fragments indistinguishable from data loss. Every kept record carries sample_rate, because a consumer scaling counts has to divide by it. An out-of-range rate is an error at construction, not at the first request.
• Access log: egress accounting. request_bytes (on-wire, before decompression), response_bytes (on-wire, after compression) and externalized_bytes (uploaded to external storage). Distinct from input_bytes / output_bytes, which measure logical Arrow buffers and can differ by a factor of a thousand on a compressible body. response_bytes cannot be measured where the others are — compression runs after the handler — so emission is deferred through a hooks::AccessSink that the HTTP post-processing middleware drains once the final body exists. A transport that installs no sink keeps logging inline.
• Access log: claim redaction. claims are now emitted, redacted by key (credentials plus the standard OIDC personal-data claims). Values are replaced rather than dropped, so which claims a credential carried stays answerable. AccessLogHook::with_claim_redactor replaces the policy; access_log::no_redaction opts out for a service that owns its logs end to end. A redactor that panics fails closed — the claims are dropped, never emitted raw.
• Access log: dropped_records. The bounded async queue already dropped rather than blocked; the loss is now reported in-band on the next record through, so a consumer can tell a quiet period from a lossy one.
• Access log: per-record size cap. AccessLogHook::with_max_record_bytes (default 1 MiB) sheds request_data, then claims, then everything but the required envelope (truncated: "record_too_large"). error_message is never truncated.
• Conformance worker: --access-log-sample, --access-log-async, --access-log-queue-size, --access-log-max-record-bytes.
• Conformance worker: --access-log-debug (DEBUG-equivalent verbosity, i.e. AccessLogHook::with_verbose), and CI now runs vgi-rpc-test --access-log ... --require-request-data against it. Validated at INFO the log simply

... (truncated)

Changelog

Sourced from vgi-rpc's changelog.

[0.20.0] — 2026-08-05

Added

• Access log: trace correlation. Records carry trace_id / span_id as W3C hex when a valid span is current. request_id only joins records within one service, so without these a log line and the span describing the same call cannot be matched. The ids are read from whatever span is current, via a provider installed with access_log::set_trace_context_provider, so an application-opened span correlates as readily as a framework-opened one — and so the core keeps no OpenTelemetry dependency (the otel feature is tracing-only). Ids that are not 32 / 16 lowercase hex, or are all zeroes, are dropped rather than emitted, and the pair is always emitted together or not at all.
• Access log: sampling. AccessLogHook::with_sample_rate(rate). Errors are never sampled — a rate below 1 exists because successes repeat, which failures do not. The decision is deterministic and keyed on stream_id, then request_id, so every record of one stream shares its init's fate rather than being shredded into fragments indistinguishable from data loss. Every kept record carries sample_rate, because a consumer scaling counts has to divide by it. An out-of-range rate is an error at construction, not at the first request.
• Access log: egress accounting. request_bytes (on-wire, before decompression), response_bytes (on-wire, after compression) and externalized_bytes (uploaded to external storage). Distinct from input_bytes / output_bytes, which measure logical Arrow buffers and can differ by a factor of a thousand on a compressible body. response_bytes cannot be measured where the others are — compression runs after the handler — so emission is deferred through a hooks::AccessSink that the HTTP post-processing middleware drains once the final body exists. A transport that installs no sink keeps logging inline.
• Access log: claim redaction. claims are now emitted, redacted by key (credentials plus the standard OIDC personal-data claims). Values are replaced rather than dropped, so which claims a credential carried stays answerable. AccessLogHook::with_claim_redactor replaces the policy; access_log::no_redaction opts out for a service that owns its logs end to end. A redactor that panics fails closed — the claims are dropped, never emitted raw.
• Access log: dropped_records. The bounded async queue already dropped rather than blocked; the loss is now reported in-band on the next record through, so a consumer can tell a quiet period from a lossy one.
• Access log: per-record size cap. AccessLogHook::with_max_record_bytes (default 1 MiB) sheds request_data, then claims, then everything but the required envelope (truncated: "record_too_large"). error_message is never truncated.
• Conformance worker: --access-log-sample, --access-log-async, --access-log-queue-size, --access-log-max-record-bytes.
• Conformance worker: --access-log-debug (DEBUG-equivalent verbosity, i.e. AccessLogHook::with_verbose), and CI now runs vgi-rpc-test --access-log ... --require-request-data against it. Validated at INFO the log simply

... (truncated)

Commits

• fc97ccd release: 0.20.0 — payloads over 2 GiB survive the socket transports
• ed07b97 ci: give the large-payload group a step the access log cannot kill
• 02883d8 fix: bound every transport write, and stop capping legitimate bodies at 256 MiB
• 4d01aa2 release: 0.19.0
• 5f2bf8d feat(http): enforce the externalized-response cap, and externalize streams
• 2be4770 release: 0.18.1 — park the writer before asserting the queue overflowed
• 506180f release: 0.18.0
• b2e9e28 Merge pull request #1 from Query-farm/feat/protocol-0.36-parity
• 6285c64 build: fix three defects no CI configuration could see
• 78e549c fix(http): send X-VGI-RPC-Error, correlate request ids, drop dead stub
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #16.