chore(deps): bump uuid from 1.24.0 to 1.25.0

[dependabot]

Bumps uuid from 1.24.0 to 1.25.0.

Release notes

Sourced from uuid's releases.

1.25.0

What's Changed

• Add a serde::bytes module that encodes a Uuid as a byte string by @​ChrisJr404 in uuid-rs/uuid#902
• Prepare for 1.25.0 release by @​KodrAus in uuid-rs/uuid#903

New Contributors

• @​ChrisJr404 made their first contribution in uuid-rs/uuid#902

Full Changelog: uuid-rs/uuid@v1.24.1...1.25.0

v1.24.1

What's Changed

• Fix non-ASCII character handling in parse diagnostics by @​questfever in uuid-rs/uuid#899
• Prepare for 1.24.1 release by @​KodrAus in uuid-rs/uuid#900

New Contributors

• @​questfever made their first contribution in uuid-rs/uuid#899

Full Changelog: uuid-rs/uuid@v1.24.0...v1.24.1

Commits

• 302e0bf Merge pull request #903 from uuid-rs/cargo/1.25.0
• b7ccde8 prepare for 1.25.0 release
• c62dffb Merge pull request #902 from ChrisJr404/serde-bytes-module
• 8c198b2 Add a serde::bytes module that encodes as a byte string
• 2ea38af Merge pull request #900 from uuid-rs/cargo/v1.24.1
• 9dbeb04 prepare for 1.24.1 release
• e113df8 Merge pull request #899 from questfever/main
• b017765 Fix non-ASCII character handling in parse diagnostics
• See full diff in compare view

[github-actions]

Thanks @dependabot[bot] for taking the time to contribute.

This repository is observing a maintainer-managed PR intake gate in dry-run mode, so this pull request is staying open. This note helps maintainers prepare the allowlist before any enforcement is considered.

Please read CONTRIBUTING.md for the expected contribution shape. A maintainer can grant recurring PR access by commenting /lgtm on a pull request.

[claude]

Claude finished @Hmbown's task in 1m 33s —— View job

---

Claude's Review: uuid 1.24.0 → 1.25.0 (dependabot)

• Gather context (diff, changed files)
• Review the uuid version bump
• Post findings

Scope: Cargo.lock only (+3/-3), no source changes.

Findings

1. PR description doesn't match the actual bump — it resolves to uuid 1.26.0, not 1.25.0.
   The diff in this branch sets:

   -version = "1.24.0"
   +version = "1.26.0"
   -checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
   +checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
   

   This is already true in the original dependabot commit (a2bf6c6), before the later merge from main. Since the workspace Cargo.toml pins uuid = { version = "1.11", ... } (a caret range), cargo update -p uuid resolved to the newest compatible release at lockfile-generation time (1.26.0) rather than the 1.25.0 pinned in the PR title/commit message/release notes. That means the release notes quoted in the PR body (1.25.0 / 1.24.1) don't cover whatever shipped in 1.26.0 — worth a quick check of upstream's changelog for 1.26.0 before merging, since it's an unreviewed delta beyond what's described here.

2. Incidental, unrelated-looking hunk: tempfile 3.27.0's getrandom selection moved from 0.4.3 → 0.3.4.
   This is a side effect of the resolver re-running for the uuid bump, not a manual edit. Both getrandom versions remain in the lock file (uuid itself still depends on getrandom 0.4.3), so this looks like a benign resolver artifact rather than a functional regression — flagging only for visibility since it's easy to mistake for an unrelated/accidental change when skimming the diff.

Not applicable here

• No provider/model/route logic touched (EPIC v0.8.65 EPIC: Separate provider facts, model facts, offerings, and route resolution #2608 invariant N/A — lockfile-only change).
• No tests needed for a dependency bump.
• No secret/exec/input-validation surface touched.

Verification note

I could not run cargo build/cargo metadata in this sandbox (cargo commands require interactive approval not available here), so I did not independently verify the lockfile resolves cleanly offline. Recommend letting CI's build/test job confirm compilation before merge.

Summary: Low-risk, mechanical lockfile bump. The one thing worth maintainer attention is that the actual resolved version is uuid 1.26.0, not the 1.25.0 described in the PR — confirm that's acceptable (or re-run dependabot / pin explicitly) before merging.

[Hmbown]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.