chore: bump workspace dependencies

Cargo.toml

@@ -36,7 +36,7 @@ include_dir = "0.7.4"
 indoc = "2.0"
 lru = "0.16"
 once_cell = "1.20"
-rand = "0.8"
+rand = "0.10"
 regex = "1.12"
 reqwest = { version = "0.13", default-features = false, features = ["multipart", "form"] }
 schemars = { default-features = false, version = "1.0" }
@@ -45,7 +45,7 @@ serde_json = "1.0"
 serde_yaml = "0.9"
 shellexpand = "3.1"
 tempfile = "3"
-thiserror = "1.0"
+thiserror = "2.0"
 tokio = { version = "1.49", features = ["full"] }
 tokio-stream = "0.1"
 tokio-util = "0.7"
@@ -54,10 +54,11 @@ tracing = "0.1"
 tracing-appender = "0.2"
 tracing-subscriber = "0.3"
 urlencoding = "2.1"
-utoipa = "4.1"
+utoipa = "5"
 uuid = { version = "1.11", features = ["v4"] }
 webbrowser = "1.0"
 which = "8.0.0"
+zip = { version = "8", default-features = false }
 wiremock = "0.6"
 serial_test = "3.2.0"
 test-case = "3.3.1"

crates/goose-cli/Cargo.toml

@@ -50,7 +50,7 @@ base64 = { workspace = true }
 regex = { workspace = true }
 tar = "0.4"
 reqwest = { workspace = true, features = ["blocking", "rustls"], default-features = false }
-zip = { version = "^8.0", default-features = false, features = ["deflate"] }
+zip = { workspace = true, features = ["deflate"] }
 bzip2 = "0.5"
 # Web server dependencies
 axum = { workspace = true, features = ["ws", "macros"] }

crates/goose-cli/src/session/thinking.rs

@@ -1,4 +1,4 @@
-use rand::seq::SliceRandom;
+use rand::seq::IndexedRandom;
 
 /// Extended list of playful thinking messages including both goose and general AI actions
 const THINKING_MESSAGES: &[&str] = &[
@@ -215,6 +215,6 @@ const THINKING_MESSAGES: &[&str] = &[
 /// Returns a random thinking message from the extended list
 pub fn get_random_thinking_message() -> &'static str {
     THINKING_MESSAGES
-        .choose(&mut rand::thread_rng())
+        .choose(&mut rand::rng())
         .unwrap_or(&THINKING_MESSAGES[0])
 }

crates/goose-mcp/Cargo.toml

@@ -46,7 +46,7 @@ once_cell = { workspace = true }
 ignore = { workspace = true }
 lopdf = "0.36.0"
 docx-rs = "0.4.7"
-image = { version = "0.24.9", features = ["jpeg"] }
+image = { version = "0.25", default-features = false, features = ["jpeg"] }
 umya-spreadsheet = "2.2.3"
 which = {workspace = true}
 lru = { workspace = true }

crates/goose-server/Cargo.toml

@@ -44,7 +44,7 @@ tokio-util = { workspace = true }
 serde_path_to_error = "0.1.20"
 tokio-tungstenite = { version = "0.28.0", features = ["rustls-tls-native-roots"] }
 url = { workspace = true }
-rand = "0.9.2"
+rand = { workspace = true }
 hex = "0.4.3"
 socket2 = "0.6.1"
 fs2 = { workspace = true }

crates/goose-server/src/openapi.rs

@@ -30,25 +30,26 @@
 use crate::routes::reply::MessageEvent;
 use utoipa::openapi::schema::{
     AdditionalProperties, AnyOfBuilder, ArrayBuilder, ObjectBuilder, OneOfBuilder, Schema,
-    SchemaFormat, SchemaType,
+    SchemaFormat, SchemaType, Type,
 };
 use utoipa::openapi::{AllOfBuilder, Ref, RefOr};
 
 macro_rules! derive_utoipa {
     ($inner_type:ident as $schema_name:ident) => {
         struct $schema_name {}
 
-        impl<'__s> ToSchema<'__s> for $schema_name {
-            fn schema() -> (&'__s str, utoipa::openapi::RefOr<utoipa::openapi::Schema>) {
+        impl utoipa::PartialSchema for $schema_name {
+            fn schema() -> utoipa::openapi::RefOr<utoipa::openapi::Schema> {
                 let settings = rmcp::schemars::generate::SchemaSettings::openapi3();
                 let generator = settings.into_generator();
                 let schema = generator.into_root_schema_for::<$inner_type>();
-                let schema = convert_schemars_to_utoipa(schema);
-                (stringify!($inner_type), schema)
+                convert_schemars_to_utoipa(schema)
             }
+        }
 
-            fn aliases() -> Vec<(&'__s str, utoipa::openapi::schema::Schema)> {
-                Vec::new()
+        impl ToSchema for $schema_name {
+            fn name() -> std::borrow::Cow<'static, str> {
+                std::borrow::Cow::Borrowed(stringify!($inner_type))
             }
         }
     };
@@ -210,10 +211,10 @@
                 }
             }
 
             RefOr::T(Schema::Array(array_builder.build()))
         }
         "string" => {
-            let mut object_builder = ObjectBuilder::new().schema_type(SchemaType::String);
+            let mut object_builder = ObjectBuilder::new().schema_type(SchemaType::Type(Type::String));
 
             if let Some(Value::Number(min_length)) = obj.get("minLength") {
                 if let Some(min) = min_length.as_u64() {
@@ -232,10 +233,10 @@
                 object_builder = object_builder.format(Some(SchemaFormat::Custom(format.clone())));
             }
 
             RefOr::T(Schema::Object(object_builder.build()))
         }
         "number" => {
-            let mut object_builder = ObjectBuilder::new().schema_type(SchemaType::Number);
+            let mut object_builder = ObjectBuilder::new().schema_type(SchemaType::Type(Type::Number));
 
             if let Some(Value::Number(minimum)) = obj.get("minimum") {
                 if let Some(min) = minimum.as_f64() {
@@ -263,10 +264,10 @@
                 }
             }
 
             RefOr::T(Schema::Object(object_builder.build()))
         }
         "integer" => {
-            let mut object_builder = ObjectBuilder::new().schema_type(SchemaType::Integer);
+            let mut object_builder = ObjectBuilder::new().schema_type(SchemaType::Type(Type::Integer));
 
             if let Some(Value::Number(minimum)) = obj.get("minimum") {
                 if let Some(min) = minimum.as_f64() {
@@ -298,11 +299,11 @@
         }
         "boolean" => RefOr::T(Schema::Object(
             ObjectBuilder::new()
-                .schema_type(SchemaType::Boolean)
+                .schema_type(SchemaType::Type(Type::Boolean))
                 .build(),
         )),
         "null" => RefOr::T(Schema::Object(
-            ObjectBuilder::new().schema_type(SchemaType::String).build(),
+            ObjectBuilder::new().schema_type(SchemaType::Type(Type::String)).build(),
         )),
         _ => RefOr::T(Schema::Object(ObjectBuilder::new().build())),
     }

crates/goose-server/src/routes/agent.rs

@@ -36,6 +36,12 @@ use std::sync::Arc;
 use tokio_util::sync::CancellationToken;
 use tracing::{error, warn};
 
+fn content_schema() -> utoipa::openapi::schema::Array {
+    utoipa::openapi::schema::ArrayBuilder::new()
+        .items(utoipa::openapi::Ref::from_schema_name("Content"))
+        .build()
+}
+
 #[derive(Deserialize, utoipa::ToSchema)]
 pub struct UpdateFromSessionRequest {
     session_id: String,
@@ -136,6 +142,7 @@ pub struct CallToolRequest {
 
 #[derive(Serialize, utoipa::ToSchema)]
 pub struct CallToolResponse {
+    #[schema(schema_with = content_schema)]
     content: Vec<Content>,
     #[serde(skip_serializing_if = "Option::is_none")]
     structured_content: Option<Value>,

crates/goose-server/src/routes/tunnel.rs

@@ -1,4 +1,5 @@
 use crate::state::AppState;
+use crate::tunnel::TunnelInfo;
 use axum::{
     extract::State,
     http::StatusCode,

crates/goose-test-support/Cargo.toml

@@ -8,7 +8,7 @@ repository.workspace = true
 description.workspace = true
 
 [dependencies]
-axum = "0.7"
+axum = "0.8"
 rmcp = { workspace = true, features = ["server", "macros", "transport-streamable-http-server"] }
 serde_json.workspace = true
 tokio.workspace = true

crates/goose/Cargo.toml

@@ -111,7 +111,7 @@ tokenizers = { version = "0.21.0", default-features = false, features = ["onig"]
 hf-hub = { version = "0.4.3", default-features = false, features = ["tokio"] }
 symphonia = { version = "0.5", features = ["all"] }
 rubato = "0.16"
-zip = "0.6"
+zip = { workspace = true, features = ["deflate"] }
 sys-info = "0.9"
 
 schemars = { workspace = true, features = [

crates/goose/src/agents/extension.rs

@@ -13,6 +13,12 @@ use thiserror::Error;
 use tracing::warn;
 use utoipa::ToSchema;
 
+fn tool_vec_schema() -> utoipa::openapi::schema::Array {
+    utoipa::openapi::schema::ArrayBuilder::new()
+        .items(utoipa::openapi::Ref::from_schema_name("Tool"))
+        .build()
+}
+
 pub use crate::agents::platform_extensions::{
     PlatformExtensionContext, PlatformExtensionDef, PLATFORM_EXTENSIONS,
 };
@@ -247,6 +253,7 @@ pub enum ExtensionConfig {
         #[schema(required)]
         description: String,
         /// The tools provided by the frontend
+        #[schema(schema_with = tool_vec_schema)]
         tools: Vec<Tool>,
         /// Instructions for how to use these tools
         instructions: Option<String>,

crates/goose/src/config/signup_openrouter/mod.rs

@@ -5,7 +5,8 @@ mod tests;
 
 use anyhow::{anyhow, Result};
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
-use rand::{distributions::Alphanumeric, Rng};
+use rand::distr::Alphanumeric;
+use rand::RngExt;
 use reqwest::Client;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -42,7 +43,7 @@ struct TokenRequest {
 
 impl PkceAuthFlow {
     pub fn new() -> Result<Self> {
-        let code_verifier: String = rand::thread_rng()
+        let code_verifier: String = rand::rng()
             .sample_iter(&Alphanumeric)
             .take(128)
             .map(char::from)

crates/goose/src/config/signup_tetrate/mod.rs

@@ -5,7 +5,8 @@ mod tests;
 
 use anyhow::{anyhow, Result};
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
-use rand::{distributions::Alphanumeric, Rng};
+use rand::distr::Alphanumeric;
+use rand::RngExt;
 use reqwest::Client;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -42,7 +43,7 @@ struct TokenRequest {
 
 impl PkceAuthFlow {
     pub fn new() -> Result<Self> {
-        let code_verifier: String = rand::thread_rng()
+        let code_verifier: String = rand::rng()
             .sample_iter(&Alphanumeric)
             .take(128)
             .map(char::from)

crates/goose/src/conversation/message.rs

@@ -10,9 +10,40 @@ use rmcp::model::{
 use serde::{Deserialize, Deserializer, Serialize};
 use std::collections::HashSet;
 use std::fmt;
+use utoipa::openapi::RefOr;
 use utoipa::ToSchema;
 use uuid::Uuid;
 
+fn json_object_schema() -> RefOr<utoipa::openapi::Schema> {
+    RefOr::Ref(utoipa::openapi::Ref::from_schema_name("JsonObject"))
+}
+
+/// Schema-only proxy for rmcp's TextContent (which lacks ToSchema in utoipa 5).
+struct TextContentSchemaRef;
+impl utoipa::PartialSchema for TextContentSchemaRef {
+    fn schema() -> RefOr<utoipa::openapi::Schema> {
+        RefOr::Ref(utoipa::openapi::Ref::from_schema_name("TextContent"))
+    }
+}
+impl utoipa::ToSchema for TextContentSchemaRef {
+    fn name() -> std::borrow::Cow<'static, str> {
+        std::borrow::Cow::Borrowed("TextContent")
+    }
+}
+
+/// Schema-only proxy for rmcp's ImageContent (which lacks ToSchema in utoipa 5).
+struct ImageContentSchemaRef;
+impl utoipa::PartialSchema for ImageContentSchemaRef {
+    fn schema() -> RefOr<utoipa::openapi::Schema> {
+        RefOr::Ref(utoipa::openapi::Ref::from_schema_name("ImageContent"))
+    }
+}
+impl utoipa::ToSchema for ImageContentSchemaRef {
+    fn name() -> std::borrow::Cow<'static, str> {
+        std::borrow::Cow::Borrowed("ImageContent")
+    }
+}
+
 #[derive(ToSchema)]
 pub enum ToolCallResult<T> {
     Success { value: T },
@@ -108,6 +139,7 @@ pub struct ToolResponse {
 pub struct ToolConfirmationRequest {
     pub id: String,
     pub tool_name: String,
+    #[schema(schema_with = json_object_schema)]
     pub arguments: JsonObject,
     pub prompt: Option<String>,
 }
@@ -119,6 +151,7 @@ pub enum ActionRequiredData {
     ToolConfirmation {
         id: String,
         tool_name: String,
+        #[schema(schema_with = json_object_schema)]
         arguments: JsonObject,
         prompt: Option<String>,
     },
@@ -185,7 +218,9 @@ pub struct ReasoningContent {
 /// Content passed inside a message, which can be both simple content and tool content
 #[serde(tag = "type", rename_all = "camelCase")]
 pub enum MessageContent {
+    #[schema(value_type = TextContentSchemaRef)]
     Text(TextContent),
+    #[schema(value_type = ImageContentSchemaRef)]
     Image(ImageContent),
     ToolRequest(ToolRequest),
     ToolResponse(ToolResponse),
@@ -662,6 +697,7 @@ impl MessageMetadata {
 #[serde(rename_all = "camelCase")]
 pub struct Message {
     pub id: Option<String>,
+    #[schema(value_type = String)]
     pub role: Role,
     pub created: i64,
     #[serde(deserialize_with = "deserialize_sanitized_content")]

crates/goose/src/gateway/pairing.rs

@@ -136,11 +136,11 @@ impl PairingStore {
     }
 
     pub fn generate_code() -> String {
-        use rand::Rng;
+        use rand::RngExt;
         let chars: &[u8] = b"ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
         (0..6)
-            .map(|_| chars[rng.gen_range(0..chars.len())] as char)
+            .map(|_| chars[rng.random_range(0..chars.len())] as char)
             .collect()
     }
 

crates/goose/src/session/diagnostics.rs

@@ -9,7 +9,7 @@
 use std::io::Cursor;
 use std::io::Write;
 use utoipa::ToSchema;
-use zip::write::FileOptions;
+use zip::write::SimpleFileOptions;
 use zip::ZipWriter;
 
 #[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
@@ -81,10 +81,10 @@
 
     let system_info = SystemInfo::collect();
 
     let mut buffer = Vec::new();
     {
         let mut zip = ZipWriter::new(Cursor::new(&mut buffer));
-        let options = FileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+        let options = SimpleFileOptions::default().compression_method(zip::CompressionMethod::Deflated);
 
         let mut log_files: Vec<_> = fs::read_dir(&logs_dir)?
             .filter_map(|e| e.ok())