build(deps): update bgpkit-broker requirement from 0.11 to 0.12

[dependabot]

Updates the requirements on bgpkit-broker to permit the latest version.

Release notes

Sourced from bgpkit-broker's releases.

v0.12.0

New features

• Added an opt-in PostgreSQL backend for self-hosted brokers
  • Selects PostgreSQL automatically when the database path or BGPKIT_BROKER_POSTGRES_URL begins with pg://, postgres://, or postgresql:// (case-insensitive); any other path is treated as a local SQLite file
  • Configurable connection pool via BGPKIT_BROKER_POSTGRES_MAX_CONNECTIONS
  • SQLite remains the default backend; the container image is backend-neutral unless explicitly configured
  • PostgreSQL bootstrap requires pre-seeding the schema; SQLite users are unaffected
• Added a unified DatabaseTarget configuration path so the backend can be selected from either the positional CLI argument or environment variables (BGPKIT_BROKER_POSTGRES_URL, BGPKIT_BROKER_SQLITE_PATH)

Updates

• Upgraded direct dependencies to current releases
  • reqwest 0.12 -> 0.13 (rustls-tls-native-roots feature replaced by rustls)
  • sha2 0.10 -> 0.11
  • sqlx 0.8 -> 0.9
  • bgpkit-commons 0.9 -> 0.10, oneio 0.20 -> 0.24.2, scraper 0.24 -> 0.27, tabled 0.20 -> 0.21, tower-http 0.6 -> 0.7, axum-prometheus 0.9 -> 0.10, itertools 0.14 -> 0.15
  • Resolved the rsa (RUSTSEC-2023-0071) advisory via the sqlx 0.9 upgrade; fxhash unmaintained warning removed via scraper 0.27
• Updated the Docker base image from rust:1.90 to rust:1.97
• CI now publishes multi-architecture (linux/amd64, linux/arm64) container images
• Updated route-views2 collector URL from https://archive.routeviews.org/bgpdata to https://archive.routeviews.org/route-views2/bgpdata to match RouteViews' directory rename (announcement)
  • The old /bgpdata path remains available via HTTP symlink, but rsync users must use the new path
  • Existing databases need a manual UPDATE collectors SET url = 'https://archive.routeviews.org/route-views2/bgpdata' WHERE name = 'route-views2'

Bug fixes

• Prevent storing entries with Unix epoch timestamp (1970-01-01) (fixes #97)
  • Added MIN_VALID_TIMESTAMP constant (1998-01-01) in crawler/common.rs
  • Crawlers filter out entries with timestamps before 1998-01-01 during parsing
• Fixed slow queries when no timestamp filters are provided
  • Added default 30-day time window when neither ts_start nor ts_end is specified
  • Prevents full table scans that caused timeouts on large databases
  • Returns recent data by default instead of starting from 1970
• Bounded SQLite connection-pool memory usage (fixes #101)
  • Reduced the default maximum from 10 to 2 connections per pool
  • Set SQLite's suggested per-connection page-cache maximum to 640 KiB
  • Added BGPKIT_BROKER_SQLITE_MAX_CONNECTIONS and BGPKIT_BROKER_SQLITE_CACHE_SIZE_KIB overrides
• Bounded memory used by broad SQLite searches
  • Added a covering collector/timestamp/type index for exact counts
  • Restored SQL-level LIMIT/OFFSET with the composite index so paginated queries stop early instead of streaming the full result set
  • Previous streaming approach held a pooled connection for the entire scan, exhausting the 2-connection pool under concurrent broad searches and hanging the service
• Added comma-separated collector_id filtering to the /latest endpoint
• Fixed S3 backup uploads on endpoints that require path-style object keys by updating oneio to 0.24.2

Changelog

Sourced from bgpkit-broker's changelog.

v0.12.0 - 2026-07-27

New features

• Added an opt-in PostgreSQL backend for self-hosted brokers
  • Selects PostgreSQL automatically when the database path or BGPKIT_BROKER_POSTGRES_URL begins with pg://, postgres://, or postgresql:// (case-insensitive); any other path is treated as a local SQLite file
  • Configurable connection pool via BGPKIT_BROKER_POSTGRES_MAX_CONNECTIONS
  • SQLite remains the default backend; the container image is backend-neutral unless explicitly configured
  • PostgreSQL bootstrap requires pre-seeding the schema; SQLite users are unaffected
• Added a unified DatabaseTarget configuration path so the backend can be selected from either the positional CLI argument or environment variables (BGPKIT_BROKER_POSTGRES_URL, BGPKIT_BROKER_SQLITE_PATH)

Updates

• Upgraded direct dependencies to current releases
  • reqwest 0.12 -> 0.13 (rustls-tls-native-roots feature replaced by rustls)
  • sha2 0.10 -> 0.11
  • sqlx 0.8 -> 0.9
  • bgpkit-commons 0.9 -> 0.10, oneio 0.20 -> 0.24.2, scraper 0.24 -> 0.27, tabled 0.20 -> 0.21, tower-http 0.6 -> 0.7, axum-prometheus 0.9 -> 0.10, itertools 0.14 -> 0.15
  • Resolved the rsa (RUSTSEC-2023-0071) advisory via the sqlx 0.9 upgrade; fxhash unmaintained warning removed via scraper 0.27
• Updated the Docker base image from rust:1.90 to rust:1.97
• CI now publishes multi-architecture (linux/amd64, linux/arm64) container images
• Updated route-views2 collector URL from https://archive.routeviews.org/bgpdata to https://archive.routeviews.org/route-views2/bgpdata to match RouteViews' directory rename (announcement)
  • The old /bgpdata path remains available via HTTP symlink, but rsync users must use the new path
  • Existing databases need a manual UPDATE collectors SET url = 'https://archive.routeviews.org/route-views2/bgpdata' WHERE name = 'route-views2'

Bug fixes

• Prevent storing entries with Unix epoch timestamp (1970-01-01) (fixes #97)
  • Added MIN_VALID_TIMESTAMP constant (1998-01-01) in crawler/common.rs
  • Crawlers filter out entries with timestamps before 1998-01-01 during parsing
• Fixed slow queries when no timestamp filters are provided
  • Added default 30-day time window when neither ts_start nor ts_end is specified
  • Prevents full table scans that caused timeouts on large databases
  • Returns recent data by default instead of starting from 1970
• Bounded SQLite connection-pool memory usage (fixes #101)
  • Reduced the default maximum from 10 to 2 connections per pool
  • Set SQLite's suggested per-connection page-cache maximum to 640 KiB
  • Added BGPKIT_BROKER_SQLITE_MAX_CONNECTIONS and BGPKIT_BROKER_SQLITE_CACHE_SIZE_KIB overrides
• Bounded memory used by broad SQLite searches
  • Added a covering collector/timestamp/type index for exact counts
  • Restored SQL-level LIMIT/OFFSET with the composite index so paginated queries stop early instead of streaming the full result set
  • Previous streaming approach held a pooled connection for the entire scan, exhausting the 2-connection pool under concurrent broad searches and hanging the service
• Added comma-separated collector_id filtering to the /latest endpoint
• Fixed S3 backup uploads on endpoints that require path-style object keys by updating oneio to 0.24.2

v0.11.0 - 2025-03-23

New collector

• Added RouteViews locix.fra collector to the supported collectors list

... (truncated)

Commits

• dd9885a release: v0.12.0
• a3189c6 chore: bump oneio to 0.24.2
• 2f425cb fix: restore SQL LIMIT/OFFSET to prevent connection-pool exhaustion
• 75a04b5 fix: bound SQLite search memory and filter latest
• 2038bab fix: update oneio to 0.24.1 for path-style S3 object key handling
• def216a ci: publish multi-architecture Docker images
• 21157b0 fix: bound SQLite connection pool memory
• 864828a fix: gate PostgresDb module and re-export on 'backend' feature
• 17bbc11 address PR review: backend logging, insert safety, pool config, shared constants
• af63651 refactor: use database target instead of postgres flag
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)