build(deps): update bgpkit-broker requirement from 0.12 to 0.13

[dependabot]

Updates the requirements on bgpkit-broker to permit the latest version.

Release notes

Sourced from bgpkit-broker's releases.

v0.13.1

Bug fixes

• The broker base URL from BGPKIT_BROKER_URL is normalized before use: surrounding whitespace and trailing slashes are trimmed, and an unset or blank value falls back to the public endpoint instead of producing an empty base URL (#111)
  • The resolution is covered by unit tests, including a check that BgpkitBroker::default() picks up and normalizes the environment variable (#111)

Changelog

Sourced from bgpkit-broker's changelog.

v0.13.1 - 2026-10-07

Bug fixes

• The broker base URL from BGPKIT_BROKER_URL is normalized before use: surrounding whitespace and trailing slashes are trimmed, and an unset or blank value falls back to the public endpoint instead of producing an empty base URL (#111)
  • The resolution is covered by unit tests, including a check that BgpkitBroker::default() picks up and normalizes the environment variable (#111)

v0.13.0 - 2026-10-06

New features

• Consolidated the PostgreSQL Broker catalog into a single broker schema (#106)
  • The catalog that previously split across the mrt and api schemas now lives under broker, and the read views are exposed as broker.file_search_view and broker.file_latest_view
  • migration/postgres_bootstrap/migrate_mrt_api_to_broker.sql migrates an existing mrt + api database in place without rewriting rows and preserves the composite foreign key from spectrum.processing to the canonical Broker file identity; stop the Broker and Spectrum writers and take a verified PostgreSQL backup before running it
  • The bootstrap script now refuses an unsafe --reset when another schema has a foreign key into broker instead of cascading through it; SQLite-backed deployments are unaffected

Bug fixes

• Periodic S3 backup no longer retries in a full-file loop on failure (#108, fixes #107)
  • The backup gate now advances on the last attempt (not the last success), so a failed backup waits for a full BGPKIT_BROKER_BACKUP_INTERVAL_HOURS window before the next attempt instead of re-running on every update tick
  • The S3 upload step retries up to 3 times with exponential backoff (2s initial, doubling) before giving up for the interval window

Dependencies

• Updated oneio 0.24.2 -> 0.26 and bgpkit-commons 0.10 -> 0.13 (#109), clearing the quick-xml advisories (RUSTSEC-2026-0194, RUSTSEC-2026-0195) and the suppaftp advisory (RUSTSEC-2026-0271) carried by the previous dependency chain; the lockfile also moves rustls to 0.23.45, clearing RUSTSEC-2026-0285
  • cargo audit reports no vulnerabilities on this lockfile; the remaining proc-macro-error2 unmaintained warning does not fail the audit

v0.12.1 - 2026-08-16

Bug fixes

• Broker server now survives transient database outages (fixes the crash loop on restart) (#105)
  • Startup retries the database connection with exponential backoff instead of exiting on the first failure; a PostgreSQL restart no longer crash-loops the container until Docker's restart backoff happens to align with the database returning
  • Retries are configurable via BGPKIT_BROKER_DB_CONNECT_RETRIES (default 10) and BGPKIT_BROKER_DB_CONNECT_BACKOFF_MS (default 3000; doubles after each failure)
  • A failed latest-files read during an update round now skips that round instead of being treated as an empty database, which previously triggered a full bootstrap re-crawl of every collector on every update interval for the duration of the outage
  • /latest and /missing-collectors return 503 with the standard error body when the database read fails, instead of a misleading empty 200 response
  • LocalBrokerDb::new returns an error instead of panicking when SQLite cannot create the database file
• Fixed duplicate rows in PostgreSQL latest-file upserts (#104)
  • update_latest_files deduplicates the incoming batch by (collector, data_type) in memory before upserting, keeping the newest item per key; previously multiple same-type items from one collector in a single batch inserted duplicate rows, since the ON CONFLICT (collector_id, data_type) clause cannot deduplicate rows within a single INSERT statement

v0.12.0 - 2026-07-27

New features

• Added an opt-in PostgreSQL backend for self-hosted brokers
  • Selects PostgreSQL automatically when the database path or BGPKIT_BROKER_POSTGRES_URL begins with pg://, postgres://, or postgresql:// (case-insensitive); any other path is treated as a local SQLite file
  • Configurable connection pool via BGPKIT_BROKER_POSTGRES_MAX_CONNECTIONS
  • SQLite remains the default backend; the container image is backend-neutral unless explicitly configured
  • PostgreSQL bootstrap requires pre-seeding the schema; SQLite users are unaffected
• Added a unified DatabaseTarget configuration path so the backend can be selected from either the positional CLI argument or environment variables (BGPKIT_BROKER_POSTGRES_URL, BGPKIT_BROKER_SQLITE_PATH)

... (truncated)

Commits

• f8f62b5 chore: bump version to 0.13.1 and update changelog
• dee462b fix: normalize and test BGPKIT_BROKER_URL resolution (#111)
• cdd37ff chore: bump version to 0.13.0 and update changelog
• 6846f5e chore(deps): re-resolve Cargo.lock (oneio 0.26, bgpkit-commons 0.13, rustls 0...
• 61b524b chore(deps): update oneio to 0.26 and bgpkit-commons to 0.13
• 59fd0d1 fix(backup): gate retries on last attempt, add bounded upload backoff
• f80b9a4 feat: consolidate PostgreSQL catalog under broker schema
• 16ac53f chore: bump version to 0.12.1 and update changelog
• 5377697 fix: address review on backoff growth and test portability
• 952dcca fix: survive transient database outages in serve
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)