From f94a3d2ffa647ceb8239f86a26e8185545a5d536 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 5 Jun 2026 09:17:11 +0000
Subject: [PATCH] chore(deps): bump the http-serialization-utils group

Bumps the http-serialization-utils group in /core with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [reqwest](https://github.com/seanmonstar/reqwest) | `0.13.3` | `0.13.4` |
| [http](https://github.com/hyperium/http) | `1.4.0` | `1.4.1` |
| [quick-xml](https://github.com/tafia/quick-xml) | `0.39.3` | `0.40.1` |
| [serde_json](https://github.com/serde-rs/json) | `1.0.149` | `1.0.150` |
| [uuid](https://github.com/uuid-rs/uuid) | `1.23.1` | `1.23.2` |
| [rustls-native-certs](https://github.com/rustls/rustls-native-certs) | `0.8.3` | `0.8.4` |


Updates `reqwest` from 0.13.3 to 0.13.4
- [Release notes](https://github.com/seanmonstar/reqwest/releases)
- [Changelog](https://github.com/seanmonstar/reqwest/blob/master/CHANGELOG.md)
- [Commits](https://github.com/seanmonstar/reqwest/compare/v0.13.3...v0.13.4)

Updates `http` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/hyperium/http/releases)
- [Changelog](https://github.com/hyperium/http/blob/master/CHANGELOG.md)
- [Commits](https://github.com/hyperium/http/compare/v1.4.0...v1.4.1)

Updates `quick-xml` from 0.39.3 to 0.40.1
- [Release notes](https://github.com/tafia/quick-xml/releases)
- [Changelog](https://github.com/tafia/quick-xml/blob/master/Changelog.md)
- [Commits](https://github.com/tafia/quick-xml/compare/v0.39.3...v0.40.1)

Updates `serde_json` from 1.0.149 to 1.0.150
- [Release notes](https://github.com/serde-rs/json/releases)
- [Commits](https://github.com/serde-rs/json/compare/v1.0.149...v1.0.150)

Updates `uuid` from 1.23.1 to 1.23.2
- [Release notes](https://github.com/uuid-rs/uuid/releases)
- [Commits](https://github.com/uuid-rs/uuid/compare/v1.23.1...v1.23.2)

Updates `rustls-native-certs` from 0.8.3 to 0.8.4
- [Release notes](https://github.com/rustls/rustls-native-certs/releases)
- [Commits](https://github.com/rustls/rustls-native-certs/compare/v/0.8.3...v/0.8.4)

---
updated-dependencies:
- dependency-name: reqwest
  dependency-version: 0.13.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: http-serialization-utils
- dependency-name: http
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: http-serialization-utils
- dependency-name: quick-xml
  dependency-version: 0.40.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: http-serialization-utils
- dependency-name: serde_json
  dependency-version: 1.0.150
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: http-serialization-utils
- dependency-name: uuid
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: http-serialization-utils
- dependency-name: rustls-native-certs
  dependency-version: 0.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: http-serialization-utils
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 core/Cargo.lock               | 250 ++++++++++++++++++----------------
 core/Cargo.toml               |   4 +-
 core/core/Cargo.toml          |   2 +-
 core/services/hf/Cargo.toml   |   2 +-
 core/services/http/Cargo.toml |   2 +-
 5 files changed, 135 insertions(+), 125 deletions(-)

diff --git a/core/Cargo.lock b/core/Cargo.lock
index 2bb8456cd7f7..ac011bb9091a 100644
--- a/core/Cargo.lock
+++ b/core/Cargo.lock
@@ -521,7 +521,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "hex",
- "http 1.4.0",
+ "http 1.4.1",
  "ring",
  "time",
  "tokio",
@@ -614,7 +614,7 @@ dependencies = [
  "hex",
  "hmac 0.12.1",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 0.4.6",
  "lru",
  "percent-encoding",
@@ -708,7 +708,7 @@ dependencies = [
  "hex",
  "hmac 0.12.1",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "p256 0.11.1",
  "percent-encoding",
  "ring",
@@ -775,7 +775,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 0.4.6",
  "percent-encoding",
  "pin-project-lite",
@@ -795,7 +795,7 @@ dependencies = [
  "h2 0.3.27",
  "h2 0.4.14",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 0.4.6",
  "hyper 0.14.32",
  "hyper 1.9.0",
@@ -805,7 +805,7 @@ dependencies = [
  "pin-project-lite",
  "rustls 0.21.12",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls 0.26.4",
@@ -856,7 +856,7 @@ dependencies = [
  "bytes",
  "fastrand",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 0.4.6",
  "http-body 1.0.1",
  "pin-project-lite",
@@ -875,7 +875,7 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "pin-project-lite",
  "tokio",
  "tracing",
@@ -893,7 +893,7 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "http 0.2.12",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 0.4.6",
  "http-body 1.0.1",
  "http-body-util",
@@ -969,7 +969,7 @@ dependencies = [
  "axum-core 0.4.5",
  "bytes",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "itoa",
@@ -995,7 +995,7 @@ dependencies = [
  "axum-core 0.5.6",
  "bytes",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "itoa",
@@ -1037,7 +1037,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
@@ -1056,7 +1056,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "mime",
@@ -2955,7 +2955,7 @@ version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ed900ba953ca6bf1fadb75e0c6b73d8463b9e2bb6bdb7b4573e8e7295852fbe"
 dependencies = [
- "http 1.4.0",
+ "http 1.4.1",
  "prost 0.14.3",
  "tokio",
  "tokio-stream",
@@ -3992,7 +3992,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.4.0",
+ "http 1.4.1",
  "indexmap 2.14.0",
  "slab",
  "tokio",
@@ -4164,7 +4164,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "headers-core",
- "http 1.4.0",
+ "http 1.4.1",
  "httpdate",
  "mime",
  "sha1 0.10.6",
@@ -4176,7 +4176,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 1.4.0",
+ "http 1.4.1",
 ]
 
 [[package]]
@@ -4246,7 +4246,7 @@ checksum = "430b33fa84f92796d4d263070b6c0d3ca219df7b9a0e1853ee431029b1612bcd"
 dependencies = [
  "async-trait",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "more-asserts",
  "serde",
  "thiserror 2.0.18",
@@ -4392,9 +4392,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
 dependencies = [
  "bytes",
  "itoa",
@@ -4418,7 +4418,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
 ]
 
 [[package]]
@@ -4429,7 +4429,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "pin-project-lite",
 ]
@@ -4496,7 +4496,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "h2 0.4.14",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "httparse",
  "httpdate",
@@ -4529,11 +4529,11 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.0",
+ "http 1.4.1",
  "hyper 1.9.0",
  "hyper-util",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "tokio",
  "tokio-rustls 0.26.4",
  "tower-service",
@@ -4574,7 +4574,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "hyper 1.9.0",
  "ipnet",
@@ -6152,7 +6152,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "humantime",
  "itertools 0.14.0",
  "parking_lot 0.12.5",
@@ -6203,7 +6203,7 @@ dependencies = [
  "ctor 1.0.3",
  "divan",
  "futures",
- "http 1.4.0",
+ "http 1.4.1",
  "libtest-mimic",
  "log",
  "logforth",
@@ -6340,7 +6340,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "jiff",
  "log",
@@ -6350,7 +6350,7 @@ dependencies = [
  "moka",
  "percent-encoding",
  "pretty_assertions",
- "quick-xml",
+ "quick-xml 0.40.1",
  "rand 0.10.1",
  "reqsign-core",
  "reqwest",
@@ -6437,7 +6437,7 @@ name = "opendal-layer-concurrent-limit"
 version = "0.57.0"
 dependencies = [
  "futures",
- "http 1.4.0",
+ "http 1.4.1",
  "mea",
  "opendal-core",
  "tokio",
@@ -6495,7 +6495,7 @@ version = "0.57.0"
 dependencies = [
  "futures",
  "hotpath",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
  "tokio",
 ]
@@ -6543,7 +6543,7 @@ name = "opendal-layer-observe-metrics-common"
 version = "0.57.0"
 dependencies = [
  "futures",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
  "tokio",
 ]
@@ -6646,7 +6646,7 @@ dependencies = [
  "anyhow",
  "dotenvy",
  "futures",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
  "opentelemetry 0.32.0",
  "opentelemetry-otlp",
@@ -6662,7 +6662,7 @@ name = "opendal-service-aliyun-drive"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -6676,7 +6676,7 @@ name = "opendal-service-alluxio"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -6690,12 +6690,12 @@ version = "0.57.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "opendal-service-azure-common",
  "pretty_assertions",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-azure-storage",
  "reqsign-core",
  "reqsign-file-read-tokio",
@@ -6712,11 +6712,11 @@ version = "0.57.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "opendal-service-azure-common",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-azure-storage",
  "reqsign-core",
  "reqsign-file-read-tokio",
@@ -6730,11 +6730,11 @@ name = "opendal-service-azfile"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "opendal-service-azure-common",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-azure-storage",
  "reqsign-core",
  "reqsign-file-read-tokio",
@@ -6746,7 +6746,7 @@ dependencies = [
 name = "opendal-service-azure-common"
 version = "0.57.0"
 dependencies = [
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
 ]
 
@@ -6755,7 +6755,7 @@ name = "opendal-service-b2"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -6780,7 +6780,7 @@ name = "opendal-service-cloudflare-kv"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
  "serde",
  "serde_json",
@@ -6802,10 +6802,10 @@ name = "opendal-service-cos"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-core",
  "reqsign-file-read-tokio",
  "reqsign-tencent-cos",
@@ -6818,7 +6818,7 @@ name = "opendal-service-d1"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
  "serde",
  "serde_json",
@@ -6842,7 +6842,7 @@ version = "0.57.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -6855,7 +6855,7 @@ name = "opendal-service-dropbox"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "mea",
  "opendal-core",
  "serde",
@@ -6918,10 +6918,10 @@ dependencies = [
  "fastpool",
  "futures",
  "futures-rustls",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "serde",
  "suppaftp",
  "tokio",
@@ -6933,11 +6933,11 @@ version = "0.57.0"
 dependencies = [
  "async-trait",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "percent-encoding",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-core",
  "reqsign-file-read-tokio",
  "reqsign-google",
@@ -6951,7 +6951,7 @@ name = "opendal-service-gdrive"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -6966,7 +6966,7 @@ version = "0.57.0"
 dependencies = [
  "bytes",
  "ghac",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "opendal-service-azblob",
@@ -6985,7 +6985,7 @@ version = "0.57.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -7051,7 +7051,7 @@ dependencies = [
  "bytes",
  "futures",
  "hf-xet",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "percent-encoding",
@@ -7065,7 +7065,7 @@ dependencies = [
 name = "opendal-service-http"
 version = "0.57.0"
 dependencies = [
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -7077,7 +7077,7 @@ name = "opendal-service-ipfs"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "prost 0.14.3",
@@ -7090,7 +7090,7 @@ name = "opendal-service-ipmfs"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -7103,7 +7103,7 @@ name = "opendal-service-koofr"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -7117,7 +7117,7 @@ name = "opendal-service-lakefs"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -7198,10 +7198,10 @@ name = "opendal-service-obs"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-core",
  "reqsign-file-read-tokio",
  "reqsign-huaweicloud-obs",
@@ -7214,7 +7214,7 @@ name = "opendal-service-onedrive"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -7241,11 +7241,11 @@ name = "opendal-service-oss"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "pretty_assertions",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-aliyun-oss",
  "reqsign-core",
  "reqsign-file-read-tokio",
@@ -7258,7 +7258,7 @@ name = "opendal-service-pcloud"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -7303,7 +7303,7 @@ version = "0.57.0"
 dependencies = [
  "bytes",
  "fastpool",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
  "redis",
  "serde",
@@ -7327,12 +7327,12 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "crc-fast",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "md-5 0.11.0",
  "opendal-core",
  "pretty_assertions",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-aws-v4",
  "reqsign-core",
  "reqsign-file-read-tokio",
@@ -7347,7 +7347,7 @@ name = "opendal-service-seafile"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -7411,11 +7411,11 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "hmac 0.13.0",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "percent-encoding",
- "quick-xml",
+ "quick-xml 0.40.1",
  "serde",
  "serde_json",
  "sha1 0.11.0",
@@ -7440,9 +7440,9 @@ name = "opendal-service-tos"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "reqsign-core",
  "reqsign-file-read-tokio",
  "reqsign-volcengine-tos",
@@ -7457,11 +7457,11 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "hmac 0.13.0",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "md-5 0.11.0",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "serde",
  "serde_json",
  "sha1 0.11.0",
@@ -7474,7 +7474,7 @@ version = "0.57.0"
 dependencies = [
  "anyhow",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
  "serde",
@@ -7487,10 +7487,10 @@ name = "opendal-service-vercel-blob"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "serde",
  "serde_json",
  "tokio",
@@ -7502,11 +7502,11 @@ version = "0.57.0"
 dependencies = [
  "anyhow",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "serde",
  "tokio",
 ]
@@ -7517,7 +7517,7 @@ version = "0.57.0"
 dependencies = [
  "anyhow",
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "mea",
  "opendal-core",
@@ -7532,10 +7532,10 @@ name = "opendal-service-yandex-disk"
 version = "0.57.0"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "opendal-core",
- "quick-xml",
+ "quick-xml 0.40.1",
  "serde",
  "serde_json",
  "tokio",
@@ -7731,7 +7731,7 @@ version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9966929966d17620d7c316c643ba62631826e10021409357772d5eea84f62c35"
 dependencies = [
- "http 1.4.0",
+ "http 1.4.1",
  "opentelemetry 0.32.0",
  "opentelemetry-proto",
  "opentelemetry_sdk",
@@ -8686,9 +8686,19 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.39.3"
+version = "0.39.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdcc8dd4e2f670d309a5f0e83fe36dfdc05af317008fea29144da1a2ac858e5e"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.40.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "721da970c312655cde9b4ffe0547f20a8494866a4af5ff51f18b7c633d0c870b"
+checksum = "2474bd2e5029e7ccb6abb2ba48cf2383a333851dedf495901544281590c7da7f"
 dependencies = [
  "memchr",
  "serde",
@@ -9009,7 +9019,7 @@ dependencies = [
  "pin-project-lite",
  "rand 0.9.4",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "ryu",
  "sha1_smol",
  "socket2 0.6.3",
@@ -9129,7 +9139,7 @@ checksum = "57ac2757f3140aa2e213b554148ae0b52733e624fc6723f0cc6bb3d440176c95"
 dependencies = [
  "anyhow",
  "form_urlencoded",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "percent-encoding",
  "reqsign-core",
@@ -9147,10 +9157,10 @@ dependencies = [
  "anyhow",
  "bytes",
  "form_urlencoded",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "percent-encoding",
- "quick-xml",
+ "quick-xml 0.39.4",
  "reqsign-core",
  "rust-ini",
  "serde",
@@ -9169,7 +9179,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "form_urlencoded",
- "http 1.4.0",
+ "http 1.4.1",
  "jsonwebtoken",
  "log",
  "pem",
@@ -9194,7 +9204,7 @@ dependencies = [
  "futures",
  "hex",
  "hmac 0.12.1",
- "http 1.4.0",
+ "http 1.4.1",
  "jiff",
  "log",
  "percent-encoding",
@@ -9221,7 +9231,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35cc609b49c69e76ecaceb775a03f792d1ed3e7755ab3548d4534fd801e3242e"
 dependencies = [
  "form_urlencoded",
- "http 1.4.0",
+ "http 1.4.1",
  "jsonwebtoken",
  "log",
  "percent-encoding",
@@ -9241,7 +9251,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8df54ec7de5d7a5b917695a67baba53ec6fa5d75ce4c4f4550db68618779a6d7"
 dependencies = [
  "anyhow",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "percent-encoding",
  "reqsign-core",
@@ -9254,7 +9264,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e128f19525861dbded59e1e7c17653a8ed63d573ca04aed708d552dbef5bb32a"
 dependencies = [
  "anyhow",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "percent-encoding",
  "reqsign-core",
@@ -9269,7 +9279,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9d757602a7ef2b6025c0da77e6d2e23fbdef35930fa466b15ffbf0a3f13acf7"
 dependencies = [
  "anyhow",
- "http 1.4.0",
+ "http 1.4.1",
  "log",
  "percent-encoding",
  "reqsign-core",
@@ -9277,9 +9287,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -9287,7 +9297,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2 0.4.14",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.9.0",
@@ -9327,7 +9337,7 @@ checksum = "199dda04a536b532d0cc04d7979e39b1c763ea749bf91507017069c00b96056f"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 1.4.0",
+ "http 1.4.1",
  "reqwest",
  "thiserror 2.0.18",
  "tower-service",
@@ -9719,9 +9729,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
  "openssl-probe 0.2.1",
  "rustls-pki-types",
@@ -9769,7 +9779,7 @@ dependencies = [
  "log",
  "once_cell",
  "rustls 0.23.40",
- "rustls-native-certs 0.8.3",
+ "rustls-native-certs 0.8.4",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
  "security-framework 3.7.0",
@@ -10041,9 +10051,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "indexmap 2.14.0",
  "itoa",
@@ -10839,7 +10849,7 @@ dependencies = [
  "getrandom 0.3.4",
  "headers",
  "hex",
- "http 1.4.0",
+ "http 1.4.1",
  "humantime",
  "ipnet",
  "jsonwebtoken",
@@ -10929,7 +10939,7 @@ dependencies = [
  "flatbuffers",
  "geo 0.32.0",
  "hex",
- "http 1.4.0",
+ "http 1.4.1",
  "papaya",
  "rand 0.8.6",
  "regex",
@@ -11515,7 +11525,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "httparse",
  "js-sys",
  "thiserror 2.0.18",
@@ -11612,7 +11622,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "h2 0.4.14",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.9.0",
@@ -11643,7 +11653,7 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "h2 0.4.14",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.9.0",
@@ -11774,7 +11784,7 @@ dependencies = [
  "bitflags 2.11.1",
  "bytes",
  "futures-util",
- "http 1.4.0",
+ "http 1.4.1",
  "http-body 1.0.1",
  "pin-project-lite",
  "tower 0.5.3",
@@ -11960,7 +11970,7 @@ checksum = "8628dcc84e5a09eb3d8423d6cb682965dea9133204e8fb3efee74c2a0c259442"
 dependencies = [
  "bytes",
  "data-encoding",
- "http 1.4.0",
+ "http 1.4.1",
  "httparse",
  "log",
  "rand 0.9.4",
@@ -12137,9 +12147,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
@@ -13178,7 +13188,7 @@ dependencies = [
  "clap",
  "crc32fast",
  "futures",
- "http 1.4.0",
+ "http 1.4.1",
  "hyper 1.9.0",
  "lazy_static",
  "more-asserts",
@@ -13252,7 +13262,7 @@ dependencies = [
  "chrono",
  "clap",
  "gearhash",
- "http 1.4.0",
+ "http 1.4.1",
  "itertools 0.14.0",
  "lazy_static",
  "more-asserts",
diff --git a/core/Cargo.toml b/core/Cargo.toml
index 1f8b158a65b9..445ff9bb0eb0 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -45,11 +45,11 @@ base64 = "0.22"
 bytes = "1.10"
 ctor = "1.0.1"
 futures = { version = "0.3", default-features = false }
-http = "1.1"
+http = "1.4"
 log = { version = "0.4.29" }
 logforth = { version = "0.29.1", features = ["starter-log"] }
 mea = "0.6"
-quick-xml = { version = "0.39.3", default-features = false }
+quick-xml = { version = "0.40.1", default-features = false }
 rand = "0.10.1"
 serde = { version = "1", default-features = false }
 serde_json = "1"
diff --git a/core/core/Cargo.toml b/core/core/Cargo.toml
index 881bfcba99ba..adaef54b0bd9 100644
--- a/core/core/Cargo.toml
+++ b/core/core/Cargo.toml
@@ -81,7 +81,7 @@ mea = { workspace = true }
 percent-encoding = "2"
 quick-xml = { workspace = true, features = ["serialize", "overlapped-lists"] }
 reqsign-core = { version = "3.0.0", default-features = false }
-reqwest = { version = "0.13.2", features = [
+reqwest = { version = "0.13.4", features = [
   "stream",
 ], default-features = false }
 serde = { workspace = true, features = ["derive"] }
diff --git a/core/services/hf/Cargo.toml b/core/services/hf/Cargo.toml
index af9af7e27eb7..b0d45cf12364 100644
--- a/core/services/hf/Cargo.toml
+++ b/core/services/hf/Cargo.toml
@@ -37,7 +37,7 @@ http = { workspace = true }
 log = { workspace = true }
 opendal-core = { path = "../../core", version = "0.57.0", default-features = false }
 percent-encoding = "2"
-reqwest = { version = "0.13.2", default-features = false, features = [
+reqwest = { version = "0.13.4", default-features = false, features = [
   "rustls",
 ] }
 serde = { workspace = true, features = ["derive"] }
diff --git a/core/services/http/Cargo.toml b/core/services/http/Cargo.toml
index c6730968c39e..28a1607582ab 100644
--- a/core/services/http/Cargo.toml
+++ b/core/services/http/Cargo.toml
@@ -27,7 +27,7 @@ version = "0.57.0"
 all-features = true
 
 [dependencies]
-http = "1.1"
+http = "1.4"
 log = "0.4"
 opendal-core = { path = "../../core", version = "0.57.0", default-features = false }
 serde = { version = "1", features = ["derive"] }