deps: bump vgi-rpc from 0.14.2 to 0.16.0

[dependabot]

Bumps vgi-rpc from 0.14.2 to 0.16.0.

Release notes

Sourced from vgi-rpc's releases.

v0.16.0

• Fixed (http) max_body_size is now actually enforced. axum installs a 2 MiB DefaultBodyLimit on every route and checks it before our RequestBodyLimitLayer, so the configured ceiling — including the documented 64 MiB default — was silently inert above 2 MiB and every larger request body got a 413. Measured against a stock worker: 4 MiB was rejected before, accepted now; 80 MiB is still rejected against the 64 MiB ceiling. Found by a benchmark with realistic (incompressible) Arrow payloads, which produce ~4.4 MiB compressed exchange bodies; the previous benchmark payload compressed ~1242x, so bodies never approached the limit.
• Changed (MSRV) minimum supported Rust version raised 1.90 → 1.97.

v0.15.0

• Changed (http, default) zstd response compression is now on by default at level 1 (DEFAULT_RESPONSE_COMPRESSION_LEVEL), matching the Python SDK's compression_level=1. Level 1 measured 4.7x faster than level 3 and produced a smaller body on an 8.41 MB Arrow payload, so this is not a size/speed trade. A stock server therefore advertises VGI-Supported-Encodings: zstd and actually compresses.
• Added (http) HttpStateBuilder::disable_response_compression() — the explicit opt-out now that the default is on. response_compression_level(n) only changes the level.
• Fixed (http) capability (VGI-*) headers are now attached to compressed responses. The compressed early-return path skipped attach_capability_headers, so every compressed Arrow body arrived without a single capability header.
• Fixed (http, CORS) Access-Control-Expose-Headers now lists every VGI-* capability header the server emits (plus X-VGI-Content-Encoding, X-VGI-RPC-Error, and the sticky-session headers). Previously it named only Content-Encoding / WWW-Authenticate, so a browser fetch() client could not read a single server capability.
• Fixed (client) VGI-Supported-Encodings absent and present-but-empty are no longer conflated. Absent means a legacy server (assume zstd); present-but-empty means the server speaks no compression, and the client now stops sending compressed request bodies instead of eating a 415.

Changelog

Sourced from vgi-rpc's changelog.

[0.16.0] — 2026-07-21

• Fixed (http) max_body_size is now actually enforced. axum installs a 2 MiB DefaultBodyLimit on every route and checks it before our RequestBodyLimitLayer, so the configured ceiling — including the documented 64 MiB default — was silently inert above 2 MiB and every larger request body got a 413. Measured against a stock worker: 4 MiB was rejected before, accepted now; 80 MiB is still rejected against the 64 MiB ceiling. Found by a benchmark with realistic (incompressible) Arrow payloads, which produce ~4.4 MiB compressed exchange bodies; the previous benchmark payload compressed ~1242x, so bodies never approached the limit.
• Changed (MSRV) minimum supported Rust version raised 1.90 → 1.97.

[0.15.0] — 2026-07-21

• Changed (http, default) zstd response compression is now on by default at level 1 (DEFAULT_RESPONSE_COMPRESSION_LEVEL), matching the Python SDK's compression_level=1. Level 1 measured 4.7x faster than level 3 and produced a smaller body on an 8.41 MB Arrow payload, so this is not a size/speed trade. A stock server therefore advertises VGI-Supported-Encodings: zstd and actually compresses.
• Added (http) HttpStateBuilder::disable_response_compression() — the explicit opt-out now that the default is on. response_compression_level(n) only changes the level.
• Fixed (http) capability (VGI-*) headers are now attached to compressed responses. The compressed early-return path skipped attach_capability_headers, so every compressed Arrow body arrived without a single capability header.
• Fixed (http, CORS) Access-Control-Expose-Headers now lists every VGI-* capability header the server emits (plus X-VGI-Content-Encoding, X-VGI-RPC-Error, and the sticky-session headers). Previously it named only Content-Encoding / WWW-Authenticate, so a browser fetch() client could not read a single server capability.
• Fixed (client) VGI-Supported-Encodings absent and present-but-empty are no longer conflated. Absent means a legacy server (assume zstd); present-but-empty means the server speaks no compression, and the client now stops sending compressed request bodies instead of eating a 415.

Commits

• 7828399 Release 0.16.0
• 783ce2e Merge remote-tracking branch 'origin/msrv-1.97'
• 532cce3 fix(http): disable axum's DefaultBodyLimit so max_body_size is real
• 58ef291 chore: raise MSRV from 1.90 to 1.97
• 802842c ci(release): cut a GitHub Release when crates are published
• c9d0d0a Release 0.15.0
• 9bec888 test(conformance): add a compression-disabled worker for the shared suite
• dda7c66 feat(http): client-authoritative codec negotiation; compression on by default
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)