chore(deps): bump the cargo-minor-patch group across 1 directory with 2 updates

[dependabot]

Bumps the cargo-minor-patch group with 2 updates in the /packages/eql directory: thiserror and rust_decimal.

Updates thiserror from 2.0.20 to 2.0.21

Release notes

Sourced from thiserror's releases.

2.0.21

• Fix parsing of generic unit variants in display expressions (#459)

Commits

• b1827ee Release 2.0.21
• 58037b5 Merge pull request #459 from dtolnay/turbofish
• f82a0cf Keep track of nested turbofish depth
• 72ea492 Raise required compiler to Rust 1.77
• 72eea0d Resolve io_other_error clippy lint in tests
• 07f09a2 Raise required compiler to Rust 1.74
• 2715388 Update ui test suite to nightly-2026-09-22
• 5a306c7 Update ui test suite to nightly-2026-09-05
• ef9383b Update ui test suite to nightly-2026-08-22
• 8336b84 Update ui tests for version 2.0.20
• See full diff in compare view

Updates rust_decimal from 1.42.1 to 1.43.0

Release notes

Sourced from rust_decimal's releases.

1.43.0

What's Changed

• Accumulated fixes backported from master by @​paupino in paupino/rust-decimal#808
• Various performance improvements by @​paupino in paupino/rust-decimal#809
• General clippy cleanup by @​paupino in paupino/rust-decimal#813
• Require rust_decimal_macros >=1.37 to avoid circular dependency by @​momomuchu in paupino/rust-decimal#814
• fix: add negative sign for array_string by @​flisky in paupino/rust-decimal#823
• Remove rkyv 0.7 from feature bridge and update rand 0.8 support by @​paupino in paupino/rust-decimal#819

New Contributors

• @​momomuchu made their first contribution in paupino/rust-decimal#814
• @​flisky made their first contribution in paupino/rust-decimal#823

Full Changelog: paupino/rust-decimal@1.42.1...1.43.0

Commits

• 8592462 version 1.43.0
• 9be5917 Remove rkyv 0.7 from feature bridge and update rand 0.8 support (#819)
• f017c8b Merge pull request #823 from flisky/v1
• 93bd26f fix: add negative sign for array_string
• 5c3bf3b Merge pull request #814 from momomuchu/fix/rust-decimal-macros-minimal-versio...
• fe55209 fix: require rust_decimal_macros >=1.37 to avoid circular dependency
• 551be15 General clippy cleanup (#813)
• f7272b5 Various performance improvements (#809)
• b363729 Accumulated fixes backported from master (#808)
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 79cc2ef

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[freshtonic]

The lockfile change is safe. Merge only after the SQLx shards pass again. The shard failures do not come from this change.

The change

Only packages/eql/Cargo.lock changes:

• thiserror 2.0.20 → 2.0.21. This is a fix to the derive parser only.
• rust_decimal 1.42.1 → 1.43.0. This release removes its rkyv 0.7 dependency, so the lock also drops rkyv, rend, bytecheck, ptr_meta, seahash, hashbrown 0.12, ahash 0.7 and syn 1.0. That is a good reduction in the dependency tree.
• Some Windows-only windows-sys edges move to versions that the lock already has. They do not change the Linux or macOS builds.

No Cargo.toml changes, so eql-bindings and the path dependency from packages/protect-ffi stay the same. A changeset is not necessary, because nothing that ships changes.

Why Shard PG17 1/4–4/4 fail (and so ci-required fails)

All 39 failures are in the tests that use the workspace-keyed SteVec selectors. Both drift guards fired:

• jsonb_entry_integer_selector_matches_fixture: v3_doc_integer $.field op-selector drifted from the pinned constant.
• v3_jsonb_sel_hello_op_matches_fixture: v3_ste_vec $.hello op-selector drifted from the pinned constant.

The other failures follow from these two, for example 17 rows have a NULL entry at SELECTOR and fetching fixtures.v3_doc_integer payload …. The numeric and decimal tests that use rust_decimal passed.

A Dependabot run gets the Dependabot secrets, not the Actions secrets. The CS_* Dependabot secrets were last set on 2026-05-04. The CS_* Actions secrets were rotated on 2026-07-11, and the selectors were re-pinned to that workspace on 2026-08-13 (9467cc5d, da141339). Thus this run encrypted the fixtures under a different workspace keyset. The AGENTS.md notes on EQL say the guards fire in this condition.

Other recent PRs skipped these shards, so no other run has shown this problem. Every Dependabot PR that touches packages/eql will fail this way until the secrets are fixed.

To fix: set the Dependabot secrets CS_WORKSPACE_CRN, CS_CLIENT_ID, CS_CLIENT_KEY and CS_CLIENT_ACCESS_KEY to the same values as the Actions secrets. Then re-run the failed jobs of this run. Do not re-pin the selector constants to make this PR pass.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.