chore(deps): bump rmcp from 0.15.0 to 1.4.0 in /codex-rs

[dependabot]

Bumps rmcp from 0.15.0 to 1.4.0.

Release notes

Sourced from rmcp's releases.

rmcp-macros-v1.4.0

Added

• (macros) auto-generate get_info and default router (#785)

rmcp-v1.4.0

Added

• add Default and constructors to ServerSseMessage (#794)
• add meta to elicitation results (#792)
• (macros) auto-generate get_info and default router (#785)
• (transport) add which_command for cross-platform executable resolution (#774)
• (auth) add StoredCredentials::new() constructor (#778)

Fixed

• (server) remove initialized notification gate to support Streamable HTTP (#788)
• default session keep_alive to 5 minutes (#780)
• (http) add host check (#764)
• exclude local feature from docs.rs build (#782)

Other

• update Rust toolchain to 1.92 (#797)
• unify IntoCallToolResult Result impls (#787)

rmcp-macros-v1.3.0

Added

• add local feature for !Send tool handler support (#740)

Other

• fix all clippy warnings across workspace (#746)

rmcp-v1.3.0

Added

• (transport) add Unix domain socket client for streamable HTTP (#749)
• (auth) implement SEP-2207 OIDC-flavored refresh token guidance (#676)
• add configuration for transparent session re-init (#760)
• add local feature for !Send tool handler support (#740)

Fixed

• prevent CallToolResult and GetTaskPayloadResult from shadowing CustomResult in untagged enums (#771)
• drain in-flight responses on stdin EOF (#759)
• remove default type param from StreamableHttpService (#758)
• use cfg-gated Send+Sync supertraits to avoid semver break (#757)
• (rmcp) surface JSON-RPC error bodies on HTTP 4xx responses (#748)

... (truncated)

Commits

• 4628720 chore: release v1.4.0 (#779)
• 65d2b29 fix(server): remove initialized notification gate to support Streamable HTTP ...
• a7b5700 fix: pass GIT_TOKEN to release-plz CLI (#798)
• 8a8c036 chore: update Rust toolchain to 1.92 (#797)
• 34d0bc6 fix: upgrade rustc in actions (#796)
• 45a4cc5 feat: add Default and constructors to ServerSseMessage (#794)
• 5f43283 feat: add meta to elicitation results (#792)
• be321a4 feat(macros): auto-generate get_info and default router (#785)
• 5891b45 refactor: unify IntoCallToolResult Result impls (#787)
• d98248a ci: add --locked to release-plz install (#786)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This is a Dependabot PR that bumps the rmcp dependency from version 0.15.0 to 1.4.0 in the codex-rs crate.

Analysis

Changes in Scope:

• codex-rs/Cargo.toml: Updated rmcp version constraint from 0.15.0 to 1.4.0
• codex-rs/Cargo.lock: Updated locked dependencies reflecting the new version

Key Observations:

1. API Compatibility: The codebase uses rmcp types (rmcp::model::Content, RawContent, CallToolResult, InitializeRequestParams, etc.) that remain stable across the upgrade. No source code changes were required.

2. Transitive Dependencies: The upgrade brings in new dependencies:

   • chacha20 0.10.0 (new)
   • cpufeatures 0.3.0 (updated)
   • getrandom 0.4.2 (new)
   • wasip3 (new)
   • rand 0.10.1 (new, requested by rmcp)
   • Added WebAssembly component model dependencies (wit-bindgen, wasm-encoder, wasm-metadata, etc.)

3. Removed Dependencies: Some dependencies were dropped from rmcp:

   • axum (removed from rmcp dependencies)
   • tracing (removed from rmcp dependencies)
   • serde_urlencoded, form_urlencoded (removed from axum dependencies)

4. Release Notes Highlights: Version 1.4.0 includes:

   • Auto-generate get_info and default router (macros)
   • Added meta to elicitation results
   • Unix domain socket client for Streamable HTTP transport
   • OIDC refresh token support
   • Default session keep_alive to 5 minutes
   • Host check for HTTP transport

5. ElicitationResponse: The meta field in ElicitationResponse struct (line 428 in lib.rs) is correctly set to None in the From<CreateElicitationResult> impl. The new rmcp version populates meta fields, which aligns with the update.

Verification Needed

The CI should confirm:

• cargo check --workspace passes
• cargo test --workspace passes
• cargo clippy --workspace -- -D warnings passes

If all checks pass, this PR is ready to merge.

Files Reviewed (2 files)

• codex-rs/Cargo.toml - Dependency version update
• codex-rs/Cargo.lock - Lockfile update

---

_{Reviewed by laguna-m.1-20260312:free · 559,055 tokens}